fix(tasks): address review-bot nits on task properties schema

- Shorten get_properties docstring to a single line under the 88-char
  limit (was awkwardly wrapped mid-sentence).
- Update properties_description to reflect that exception_type and
  stack_trace are only present when SHOW_STACKTRACE is enabled.
- Explicitly set SHOW_STACKTRACE=False in the "hides debug fields by
  default" test instead of relying on the ambient config default.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/CODEOWNERS

@@ -1,6 +1,6 @@
 # Notify all committers of DB migration changes, per SIP-59
 
-/superset/migrations/ @mistercrunch @michael-s-molina @betodealmeida @eschutho @sadpandajoe @rusackas
+/superset/migrations/ @mistercrunch @michael-s-molina @betodealmeida @eschutho @sadpandajoe
 
 # Notify some committers of changes in the components
 

.github/dependabot.yml

@@ -70,10 +70,6 @@ updates:
           - "@storybook/*"
           - "storybook"
           - "eslint-plugin-storybook"
-      ag-grid:
-        patterns:
-          - "ag-grid-react"
-          - "ag-grid-community"
     open-pull-requests-limit: 30
     versioning-strategy: increase
     cooldown:

.github/workflows/bump-python-package.yml

@@ -31,7 +31,7 @@ jobs:
       checks: write
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: true
           ref: master
@@ -40,7 +40,7 @@ jobs:
         uses: ./.github/actions/setup-supersetbot/
 
       - name: Set up Python ${{ inputs.python-version }}
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.11"
 

.github/workflows/check-python-deps.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-26.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
@@ -46,7 +46,7 @@ jobs:
       - name: Login to Docker Hub
         if: steps.check.outputs.python
         continue-on-error: true
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKERHUB_USER }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}

.github/workflows/check_db_migration_confict.yml

@@ -25,7 +25,7 @@ jobs:
       pull-requests: write
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Check and notify

.github/workflows/codeql-analysis.yml

@@ -26,7 +26,7 @@ jobs:
       frontend: ${{ steps.check.outputs.frontend }}
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Check for file changes
@@ -58,13 +58,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -75,6 +75,6 @@ jobs:
           # queries: security-extended,security-and-quality
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/dependabot-auto-approve.yml

@@ -1,63 +0,0 @@
-name: Auto-approve Dependabot patch bumps
-
-# Posts an approving review on Dependabot PRs that only bump a patch
-# version, using the same trigger/guard convention already proven to work
-# for Dependabot PRs in sync-requirements-for-python-dep-upgrade-pr.yml
-# (plain `pull_request` gets a working, write-capable GITHUB_TOKEN here
-# because Dependabot pushes branches directly to this repo, not a fork).
-#
-# This does NOT auto-merge anything - repo-wide auto-merge is disabled
-# (Settings > General > Pull Requests > "Allow auto-merge" is off), and
-# flipping that is a separate, repo-wide decision this workflow doesn't
-# make on its own. Branch protection also still requires 1 approving
-# review; this just means that review can already exist by the time a
-# human looks at the PR, for the (large majority of) ecosystems whose
-# files aren't matched by any CODEOWNERS pattern. One ecosystem - the npm
-# bump under .github/actions - matches the /.github/ CODEOWNERS entry, so
-# those PRs will still need a human owner's approval regardless of this
-# workflow; it posts a review there too, but that alone won't satisfy the
-# code-owner requirement.
-on:
-  pull_request:
-    types: [opened, synchronize]
-
-# Cancel a superseded run if Dependabot pushes to the same PR again before
-# the previous run finished (matches the pattern used elsewhere in
-# superset-docs-verify.yml).
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  approve-patch-bump:
-    name: Approve patch-level bump
-    # Mirrors the guard in sync-requirements-for-python-dep-upgrade-pr.yml:
-    # limited to (1) PRs authored by Dependabot and (2) the upstream repo,
-    # since forked PRs don't get a write-capable token here anyway.
-    if: >
-      github.repository == 'apache/superset' &&
-      github.event.pull_request.user.login == 'dependabot[bot]' &&
-      github.event.pull_request.head.repo.fork == false
-    runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write # to post the approving review via `gh pr review`
-    steps:
-      - name: Fetch Dependabot metadata
-        id: metadata
-        # This exact SHA is on ASF Infra's action allowlist
-        # (apache/infrastructure-actions approved_patterns.yml) as of this
-        # writing. Do not bump without opening an Infra ticket to allow
-        # the new SHA first!
-        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
-
-      - name: Approve patch-level bump
-        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_URL: ${{ github.event.pull_request.html_url }}
-          DEPENDENCY_NAMES: ${{ steps.metadata.outputs.dependency-names }}
-        run: |
-          gh pr review --approve "$PR_URL" \
-            --body "Auto-approved: patch-level bump only ($DEPENDENCY_NAMES)."

.github/workflows/dependency-review.yml

@@ -27,11 +27,12 @@ jobs:
     runs-on: ubuntu-26.04
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: "Dependency Review"
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        continue-on-error: true
         with:
           fail-on-severity: critical
           # compatible/incompatible licenses addressed here: https://www.apache.org/legal/resolved.html
@@ -50,7 +51,7 @@ jobs:
     runs-on: ubuntu-26.04
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 

.github/workflows/docker.yml

@@ -30,7 +30,7 @@ jobs:
       docker: ${{ steps.check.outputs.docker }}
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Check for file changes
@@ -71,7 +71,7 @@ jobs:
 
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -184,7 +184,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Free up disk space

.github/workflows/embedded-sdk-release.yml

@@ -23,7 +23,7 @@ jobs:
       run:
         working-directory: superset-embedded-sdk
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       # Note: registry-url is intentionally omitted. When set, actions/setup-node

.github/workflows/embedded-sdk-test.yml

@@ -21,7 +21,7 @@ jobs:
       run:
         working-directory: superset-embedded-sdk
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

.github/workflows/generate-FOSSA-report.yml

@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-26.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive

.github/workflows/github-action-validator.yml

@@ -27,7 +27,7 @@ jobs:
       security-events: write
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -46,4 +46,4 @@ jobs:
         run: bash .github/workflows/github-action-validator.sh
 
       - name: Check for security issues on GHA workflows
-        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7

.github/workflows/issue_creation.yml

@@ -2,10 +2,10 @@ name: supersetbot orglabel based on author
 
 on:
   issues:
-    types: [opened, edited]
+    types: [created, edited]
 
   pull_request:
-    types: [opened, edited]
+    types: [created, edited]
 
 jobs:
   superbot-orglabel:
@@ -16,7 +16,7 @@ jobs:
       issues: write
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -30,4 +30,4 @@ jobs:
           # Label the issue with the appropriate org using supersetbot
           # - this requires for the author to be publicly associated with their org
           # - and for the org to be listed in `supersetbot/src/metadata.js`
-          supersetbot orglabel --issue ${{ github.event.number || github.event.issue.number }} --repo ${{ github.repository }} || true
+          supersetbot orglabel --issue ${{ github.event.number }} --repo ${{ github.repository }} || true

.github/workflows/labeler.yml

@@ -14,7 +14,7 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-26.04
     steps:
-    - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
+    - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
       with:
         sync-labels: true
 

.github/workflows/latest-release-tag.yml

@@ -12,7 +12,7 @@ jobs:
 
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive

.github/workflows/license-check.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-26.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive

.github/workflows/mirror-service-images.yml

@@ -1,113 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-#
-# Mirror the Docker Hub service-container images that CI relies on into the
-# repository's GitHub Container Registry (GHCR) namespace.
-#
-# WHY: CI jobs declare Postgres/MySQL/Redis/Presto as `services:` containers
-# pulled anonymously from Docker Hub. Anonymous pulls share the runner's IP
-# rate limit, which causes intermittent timeouts / 429s / 502s on `master`
-# and same-repo PRs. The obvious fix — adding `credentials:` to the service
-# blocks — breaks fork PRs hard: forks can't read secrets, so the templated
-# username/password resolve to '' and GitHub rejects the workflow at parse
-# time ("Unexpected value ''"), failing every fork job at "Set up job".
-#
-# Mirroring to GHCR sidesteps both problems: public GHCR images are pulled
-# without Docker Hub's anonymous rate limit AND without any credentials, so
-# the consuming workflows need no `credentials:` block and forks work
-# unchanged.
-#
-# ONE-TIME BOOTSTRAP (maintainer, after this lands on the default branch):
-#   1. Run this workflow once (Actions tab → "Mirror service images to GHCR"
-#      → Run workflow), or wait for the weekly schedule.
-#   2. In the org's Packages settings, set each mirrored package's visibility
-#      to **public** (apache/superset → ci/postgres, ci/mysql, ci/redis,
-#      ci/presto). Public visibility is what lets fork CI pull without auth.
-#   3. Only then merge the follow-up that repoints the `services.*.image`
-#      refs at these GHCR copies and drops the `credentials:` blocks.
-#
-# NOTE: this mirrors only the images declared as `services:` containers (the
-# ones that broke forks). The `bde2020` hive-metastore image pulled via
-# `docker compose` in the Presto/Hive job is a separate path and is left for
-# a follow-up.
-
-name: Mirror service images to GHCR
-
-on:
-  schedule:
-    # Weekly, Monday 06:00 UTC — keeps the mirror fresh as upstream tags move.
-    - cron: "0 6 * * 1"
-  workflow_dispatch: {}
-
-concurrency:
-  group: mirror-service-images
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-  packages: write
-
-jobs:
-  mirror:
-    # Never run on forks: they lack both the secrets and write access to the
-    # apache GHCR namespace, so a scheduled run there would only ever fail.
-    if: github.repository == 'apache/superset'
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        # Keep this list in sync with the `services.*.image` refs in
-        # superset-e2e.yml, superset-python-integrationtest.yml, and
-        # superset-python-presto-hive.yml.
-        image:
-          - postgres:17-alpine
-          - redis:7-alpine
-          - mysql:8.0
-          - starburstdata/presto:350-e.6
-    steps:
-      - name: Log in to Docker Hub (authenticated source pulls)
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
-        with:
-          username: ${{ secrets.DOCKERHUB_USER }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Log in to GHCR (push target)
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-
-      - name: Copy image to GHCR
-        env:
-          # Pass the matrix value through the environment rather than
-          # interpolating it into the shell, to avoid template injection.
-          SRC_IMAGE: ${{ matrix.image }}
-        run: |
-          set -euo pipefail
-          # Destination keeps the image's short name (drop any namespace),
-          # under a `ci/` prefix in this repo's GHCR namespace.
-          name="${SRC_IMAGE##*/}"
-          dst="ghcr.io/${GITHUB_REPOSITORY}/ci/${name}"
-          echo "Mirroring docker.io/${SRC_IMAGE} -> ${dst}"
-          # imagetools copies the full (multi-arch) manifest registry-to-
-          # registry without a local pull/retag/push round trip.
-          docker buildx imagetools create --tag "${dst}" "docker.io/${SRC_IMAGE}"
-          echo "- \`docker.io/${SRC_IMAGE}\` → \`${dst}\`" >> "${GITHUB_STEP_SUMMARY}"

.github/workflows/pr-lint.yml

@@ -27,7 +27,7 @@ jobs:
       pull-requests: write
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive

.github/workflows/pre-commit.yml

@@ -33,7 +33,7 @@ jobs:
         python-version: ${{ github.event_name == 'pull_request' && fromJSON('["current"]') || fromJSON('["current", "next"]') }}
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
@@ -47,7 +47,7 @@ jobs:
           python-version: ${{ matrix.python-version }}
 
       - name: Setup Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
 
       - name: Install helm-docs
         run: go install github.com/norwoodj/helm-docs/cmd/helm-docs@v1.14.2
@@ -81,6 +81,7 @@ jobs:
         id: changed_files
         env:
           EVENT_NAME: ${{ github.event_name }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
           BEFORE_SHA: ${{ github.event.before }}
         run: |
           set -euo pipefail
@@ -94,15 +95,7 @@ jobs:
           # Resolve the commit to diff against.
           base=""
           if [ "${EVENT_NAME}" = "pull_request" ]; then
-            # HEAD is the PR merge commit, so its first parent is the current
-            # tip of the base branch. github.event.pull_request.base.sha is
-            # NOT that: GitHub freezes it at PR creation, so on a long-lived
-            # PR it points at the original branch point and the diff picks up
-            # all of the base branch's churn since then — thousands of paths,
-            # enough for the CHANGED_FILES env var below to exceed the
-            # kernel's per-variable size limit and kill the step with
-            # "Argument list too long" before bash even starts.
-            base="$(git rev-parse HEAD^1 2>/dev/null || true)"
+            base="${BASE_SHA}"
           elif [ -n "${BEFORE_SHA:-}" ] && \
                [ "${BEFORE_SHA}" != "0000000000000000000000000000000000000000" ]; then
             base="${BEFORE_SHA}"
@@ -121,15 +114,6 @@ jobs:
           # Files present in HEAD that changed since the base (drop deletions).
           files="$(git diff --name-only --diff-filter=ACMRT "${base}...HEAD")"
 
-          # Env vars have a hard per-variable size limit (E2BIG at step
-          # start). A PR that legitimately touches thousands of files is
-          # better served by --all-files anyway.
-          if [ "$(printf '%s' "${files}" | wc -c)" -gt 100000 ]; then
-            echo "::notice::Changed-file list too large to pass via env; falling back to --all-files."
-            echo "mode=all" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
           if [ -z "${files}" ]; then
             echo "mode=none" >> "$GITHUB_OUTPUT"
           else

.github/workflows/release.yml

@@ -33,7 +33,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           # pulls all commits (needed for lerna / semantic release to correctly version)

.github/workflows/scheduled-docker-image-refresh.yml

@@ -102,7 +102,7 @@ jobs:
       fail-fast: false
     steps:
       - name: "Checkout release tag: ${{ needs.config.outputs.latest-release }}"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ needs.config.outputs.latest-release }}
           fetch-depth: 0

.github/workflows/showtime-trigger.yml

@@ -153,7 +153,7 @@ jobs:
 
       - name: Checkout PR code (only if build needed)
         if: steps.auth.outputs.authorized == 'true' && steps.check.outputs.build_needed == 'true'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ steps.check.outputs.target_sha }}
           persist-credentials: false

.github/workflows/superset-app-cli.yml

@@ -41,7 +41,7 @@ jobs:
           - 16379:6379
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive

.github/workflows/superset-docs-deploy.yml

@@ -60,7 +60,7 @@ jobs:
     runs-on: ubuntu-26.04
     steps:
       - name: "Checkout ${{ github.event.workflow_run.head_sha || github.sha }}"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.workflow_run.head_sha || github.sha }}
           persist-credentials: false

.github/workflows/superset-docs-verify.yml

@@ -21,62 +21,47 @@ permissions:
   contents: read
 
 jobs:
-  lychee:
-    # See docs here: https://github.com/lycheeverse/lychee-action
+  linkinator:
+    # See docs here: https://github.com/marketplace/actions/linkinator
     # Only run on pull_request, not workflow_run
     if: github.event_name == 'pull_request'
     name: Link Checking
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      # Restores the on-disk request cache (.lycheecache) lychee writes when
-      # `--cache` is set, so re-runs don't re-check every external link from
-      # scratch. Key never matches exactly (github.run_id is unique per run),
-      # so actions/cache always saves a fresh copy afterwards; restore-keys
-      # falls back to the most recent prior cache on lookup.
-      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: .lycheecache
-          key: lychee-cache-${{ github.run_id }}
-          restore-keys: lychee-cache-
-      # v2.8.0 and v2.9.0 are both on ASF Infra's action allowlist
-      # (apache/infrastructure-actions approved_patterns.yml) as of this
-      # writing. Do not bump past v2.9.0 without opening an Infra ticket
-      # to allow the new SHA first!
-      - uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0
+      # Do not bump this linkinator-action version without opening
+      # an ASF Infra ticket to allow the new version first!
+      - uses: JustinBeckwith/linkinator-action@af984b9f30f63e796ae2ea5be5e07cb587f1bbd9 # v2.3
         continue-on-error: true # This will make the job advisory (non-blocking, no red X)
         with:
-          fail: false
-          args: >-
-            --verbose --no-progress
-            --cache --max-cache-age 7d
-            --exclude '^https://github.com/apache/(superset|incubator-superset)/(pull|issues)/\d+'
-            --exclude '^https://github.com/apache/(superset|incubator-superset)/commit/[a-f0-9]+'
-            --exclude 'superset-frontend/.*CHANGELOG\.md'
-            --exclude 'http://localhost:8088/'
-            --exclude 'http://127.0.0.1:3000/'
-            --exclude 'http://localhost:9001/'
-            --exclude 'https://charts.bitnami.com/bitnami'
-            --exclude 'https://www.li.me/'
-            --exclude 'https://www.fanatics.com/'
-            --exclude 'https://tails.com/gb/'
-            --exclude 'https://www.techaudit.info/'
-            --exclude 'https://avetilearning.com/'
-            --exclude 'https://www.udemy.com/'
-            --exclude 'https://trustmedis.com/'
-            --exclude 'http://theiconic.com.au/'
-            --exclude 'https://dev.mysql.com/doc/refman/5.7/en/innodb-limits.html'
-            --exclude '^https://img\.shields\.io/.*'
-            --exclude 'https://vkusvill.ru/'
-            --exclude 'https://www.linkedin.com/in/mark-thomas-b16751158/'
-            --exclude 'https://theiconic.com.au/'
-            --exclude 'https://wattbewerb.de/'
-            --exclude 'https://timbr.ai/'
-            --exclude 'https://opensource.org/license/apache-2-0'
-            --exclude 'https://www.plaidcloud.com/'
-            './**/*.md' './**/*.mdx'
+          paths: "**/*.md, **/*.mdx"
+          linksToSkip: >-
+            ^https://github.com/apache/(superset|incubator-superset)/(pull|issues)/\d+,
+            ^https://github.com/apache/(superset|incubator-superset)/commit/[a-f0-9]+,
+            superset-frontend/.*CHANGELOG\.md,
+            http://localhost:8088/,
+            http://127.0.0.1:3000/,
+            http://localhost:9001/,
+            https://charts.bitnami.com/bitnami,
+            https://www.li.me/,
+            https://www.fanatics.com/,
+            https://tails.com/gb/,
+            https://www.techaudit.info/,
+            https://avetilearning.com/,
+            https://www.udemy.com/,
+            https://trustmedis.com/,
+            http://theiconic.com.au/,
+            https://dev.mysql.com/doc/refman/5.7/en/innodb-limits.html,
+            ^https://img\.shields\.io/.*,
+            https://vkusvill.ru/,
+            https://www.linkedin.com/in/mark-thomas-b16751158/,
+            https://theiconic.com.au/,
+            https://wattbewerb.de/,
+            https://timbr.ai/,
+            https://opensource.org/license/apache-2-0,
+            https://www.plaidcloud.com/
 
   build-on-pr:
     # Build docs when PR changes docs/** (uses committed databases.json)
@@ -88,7 +73,7 @@ jobs:
         working-directory: docs
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
@@ -127,7 +112,7 @@ jobs:
         working-directory: docs
     steps:
       - name: "Checkout PR head: ${{ github.event.workflow_run.head_sha }}"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.workflow_run.head_sha }}
           persist-credentials: false

.github/workflows/superset-e2e.yml

@@ -38,7 +38,7 @@ jobs:
       frontend: ${{ steps.check.outputs.frontend }}
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Check for file changes
@@ -96,21 +96,21 @@ jobs:
       # Conditional checkout based on context
       - name: Checkout for push or pull_request event
         if: github.event_name == 'push' || github.event_name == 'pull_request'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
       - name: Checkout using ref (workflow_dispatch)
         if: github.event_name == 'workflow_dispatch' && github.event.inputs.ref != ''
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           ref: ${{ github.event.inputs.ref }}
           submodules: recursive
       - name: Checkout using PR ID (workflow_dispatch)
         if: github.event_name == 'workflow_dispatch' && github.event.inputs.pr_id != ''
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           ref: refs/pull/${{ github.event.inputs.pr_id }}/merge
@@ -206,21 +206,21 @@ jobs:
       # Conditional checkout based on context (same as Cypress workflow)
       - name: Checkout for push or pull_request event
         if: github.event_name == 'push' || github.event_name == 'pull_request'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
       - name: Checkout using ref (workflow_dispatch)
         if: github.event_name == 'workflow_dispatch' && github.event.inputs.ref != ''
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           ref: ${{ github.event.inputs.ref }}
           submodules: recursive
       - name: Checkout using PR ID (workflow_dispatch)
         if: github.event_name == 'workflow_dispatch' && github.event.inputs.pr_id != ''
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           ref: refs/pull/${{ github.event.inputs.pr_id }}/merge

.github/workflows/superset-extensions-cli.yml

@@ -31,7 +31,7 @@ jobs:
         working-directory: superset-extensions-cli
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive

.github/workflows/superset-frontend.yml

@@ -23,17 +23,11 @@ jobs:
   frontend-build:
     runs-on: ubuntu-26.04
     timeout-minutes: 30
-    # The change detector reads the PR's file list, which needs
-    # `pull-requests: read`. Public repos serve that endpoint without it;
-    # private forks return 403.
-    permissions:
-      contents: read
-      pull-requests: read
     outputs:
       should-run: ${{ steps.check.outputs.frontend }}
     steps:
       - name: Checkout Code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -116,7 +110,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout Code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -128,13 +122,25 @@ jobs:
           pattern: coverage-artifacts-*
           path: coverage/
 
+      - name: Reorganize test result reports
+        run: |
+          find coverage/
+          for i in {1..8}; do
+            mv coverage/coverage-artifacts-${i}/coverage-final.json coverage/coverage-shard-${i}.json
+          done
+        shell: bash
+
+      - name: Merge Code Coverage
+        run: npx nyc merge coverage/ merged-output/coverage-summary.json
+
       - name: Upload Code Coverage
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           flags: javascript
           use_oidc: true
           verbose: true
-          directory: coverage
+          disable_search: true
+          files: merged-output/coverage-summary.json
           slug: apache/superset
 
   lint-frontend:

.github/workflows/superset-helm-lint-test.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-26.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
@@ -38,11 +38,6 @@ jobs:
         with:
           install-superset: "false"
 
-      # Still vendored (not de-vendored like chart-releaser-action below): the
-      # allowlisted helm/chart-testing-action@v2.8.0 depends internally on
-      # astral-sh/setup-uv@v7.0.0, which isn't itself on the ASF Actions
-      # allowlist (only v8.1.0+ are, at apache/infrastructure-actions'
-      # actions.yml). Needs an INFRA request before this can de-vendor too.
       - name: Set up chart-testing
         uses: ./.github/actions/chart-testing-action
 

.github/workflows/superset-helm-release.yml

@@ -1,9 +1,6 @@
 # This workflow automates the release process for Helm charts.
-# Each run force-recreates a single 'helm-publish' branch from the tip of 'gh-pages' and
-# opens (or reuses) one pull request against 'gh-pages', allowing the changes to be
-# reviewed and merged manually. Because chart-releaser rebuilds index.yaml from all
-# published GitHub releases, the branch always contains every chart released since the
-# last merge, and the PR can never go stale or conflict with gh-pages.
+# The workflow creates a new branch for the release and opens a pull request against the 'gh-pages' branch,
+# allowing the changes to be reviewed and merged manually.
 
 name: "Helm: release charts"
 
@@ -21,12 +18,6 @@ on:
         required: false
         default: "master"
 
-# Serialize runs: concurrent runs would race on force-pushing the shared
-# helm-publish branch while chart-releaser is mid-release.
-concurrency:
-  group: helm-release
-  cancel-in-progress: false
-
 jobs:
   release:
     runs-on: ubuntu-26.04
@@ -38,7 +29,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ inputs.ref || github.ref_name }}
           persist-credentials: true
@@ -66,9 +57,9 @@ jobs:
           echo "DEBUG TAGS"
           git show-ref --tags
 
-      - name: Set pages branch name
+      - name: Create unique pages branch name
         id: vars
-        run: echo "branch_name=helm-publish" >> $GITHUB_ENV
+        run: echo "branch_name=helm-publish-${GITHUB_SHA:0:7}" >> $GITHUB_ENV
 
       - name: Force recreate branch from gh-pages
         env:
@@ -95,23 +86,23 @@ jobs:
           # Return to the original branch
           git checkout local_gha_temp
 
+      - name: Fetch/list all tags
+        run: |
+          git submodule update
+          cat .github/actions/chart-releaser-action/action.yml
+
       - name: Run chart-releaser
-        uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
+        uses: ./.github/actions/chart-releaser-action
         with:
           version: v1.6.0
           charts_dir: helm
           mark_as_latest: false
-          # A helm/** change without a Chart.yaml version bump repackages the
-          # already-released version; without this, cr aborts on the existing
-          # release tag (422 already_exists) instead of proceeding to rebuild
-          # the index, and the whole run fails.
-          skip_existing: true
           pages_branch: ${{ env.branch_name }}
         env:
           CR_TOKEN: "${{ github.token }}"
           CR_RELEASE_NAME_TEMPLATE: "superset-helm-chart-{{ .Version }}"
 
-      - name: Open or reuse Pull Request
+      - name: Open Pull Request
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
@@ -122,72 +113,15 @@ jobs:
               throw new Error("Branch name is not defined.");
             }
 
-            // The branch is force-recreated from gh-pages on every run, so an
-            // already-open PR for it now reflects this run's charts; opening
-            // another would both fail (422) and recreate the stale-PR pileup
-            // this fixed branch exists to avoid.
-            const { data: existing } = await github.rest.pulls.list({
+            const pr = await github.rest.pulls.create({
               owner,
               repo,
-              state: "open",
-              head: `${owner}:${branchName}`,
-              base: "gh-pages",
+              title: `Helm chart release for ${branchName}`,
+              head: branchName,
+              base: "gh-pages", // Adjust if the target branch is different
+              body: `This PR releases Helm charts to the gh-pages branch.`,
             });
 
-            let current;
-            if (existing.length > 0) {
-              current = existing[0];
-              core.info(`Reusing existing pull request: ${current.html_url}`);
-            } else {
-              const { data: pr } = await github.rest.pulls.create({
-                owner,
-                repo,
-                title: "Helm chart release",
-                head: branchName,
-                base: "gh-pages", // Adjust if the target branch is different
-                body: [
-                  "This PR releases Helm charts to the gh-pages branch.",
-                  "",
-                  "It is force-updated from the tip of `gh-pages` by every release run,",
-                  "so it always contains every chart released since the last merge and",
-                  "never needs to be closed as superseded.",
-                ].join("\n"),
-              });
-              current = pr;
-              core.info(`Pull request created: ${current.html_url}`);
-            }
-
-            // Sweep release PRs left open by older runs (per-SHA helm-publish-*
-            // branches from the previous scheme). Their content is a subset of
-            // the evergreen PR, so close them with a pointer to it.
-            const { data: openPrs } = await github.rest.pulls.list({
-              owner,
-              repo,
-              state: "open",
-              base: "gh-pages",
-              per_page: 100,
-            });
-
-            for (const stale of openPrs) {
-              if (
-                stale.number !== current.number &&
-                stale.head.repo?.full_name === process.env.GITHUB_REPOSITORY &&
-                stale.head.ref.startsWith("helm-publish")
-              ) {
-                await github.rest.issues.createComment({
-                  owner,
-                  repo,
-                  issue_number: stale.number,
-                  body: `Superseded by #${current.number}, which now carries all unreleased charts. Closing.`,
-                });
-                await github.rest.pulls.update({
-                  owner,
-                  repo,
-                  pull_number: stale.number,
-                  state: "closed",
-                });
-                core.info(`Closed superseded release PR #${stale.number}`);
-              }
-            }
+            core.info(`Pull request created: ${pr.data.html_url}`);
         env:
           BRANCH_NAME: ${{ env.branch_name }}

.github/workflows/superset-playwright.yml

@@ -34,7 +34,7 @@ jobs:
       frontend: ${{ steps.check.outputs.frontend }}
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Check for file changes
@@ -83,21 +83,21 @@ jobs:
       # Conditional checkout based on context (same as Cypress workflow)
       - name: Checkout for push or pull_request event
         if: github.event_name == 'push' || github.event_name == 'pull_request'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
       - name: Checkout using ref (workflow_dispatch)
         if: github.event_name == 'workflow_dispatch' && github.event.inputs.ref != ''
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           ref: ${{ github.event.inputs.ref }}
           submodules: recursive
       - name: Checkout using PR ID (workflow_dispatch)
         if: github.event_name == 'workflow_dispatch' && github.event.inputs.pr_id != ''
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           ref: refs/pull/${{ github.event.inputs.pr_id }}/merge

.github/workflows/superset-python-integrationtest.yml

@@ -29,7 +29,7 @@ jobs:
       python: ${{ steps.check.outputs.python }}
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Check for file changes
@@ -72,7 +72,7 @@ jobs:
           - 16379:6379
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
@@ -157,7 +157,7 @@ jobs:
           - 16379:6379
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
@@ -207,7 +207,7 @@ jobs:
           - 16379:6379
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive

.github/workflows/superset-python-presto-hive.yml

@@ -25,7 +25,7 @@ jobs:
       python: ${{ steps.check.outputs.python }}
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Check for file changes
@@ -72,7 +72,7 @@ jobs:
           - 16379:6379
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
@@ -127,7 +127,7 @@ jobs:
           - 16379:6379
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive

.github/workflows/superset-python-unittest.yml

@@ -30,7 +30,7 @@ jobs:
       python: ${{ steps.check.outputs.python }}
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Check for file changes
@@ -61,7 +61,7 @@ jobs:
       SQLALCHEMY_WARN_20: "1"
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive

.github/workflows/superset-translations.yml

@@ -25,7 +25,7 @@ jobs:
       pull-requests: read
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
@@ -61,7 +61,7 @@ jobs:
       pull-requests: read
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive

.github/workflows/superset-websocket.yml

@@ -25,7 +25,7 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Setup Node.js

.github/workflows/supersetbot.yml

@@ -38,7 +38,7 @@ jobs:
             });
 
       - name: "Checkout ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 

.github/workflows/sync-requirements-for-python-dep-upgrade-pr.yml

@@ -27,7 +27,7 @@ jobs:
       # zizmor: ignore[artipacked] - required persisted credentials to push synced requirement changes back to remote
       - name: Checkout source code
         if: ${{ steps.dependabot-metadata.outputs.package-ecosystem == 'pip' }}
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           persist-credentials: true
@@ -38,7 +38,7 @@ jobs:
       - name: Login to Docker Hub
         if: ${{ steps.dependabot-metadata.outputs.package-ecosystem == 'pip' }}
         continue-on-error: true
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKERHUB_USER }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}

.github/workflows/tag-release.yml

@@ -60,7 +60,7 @@ jobs:
       fail-fast: false
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -126,7 +126,7 @@ jobs:
       pull-requests: write
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           fetch-depth: 0

.github/workflows/tech-debt.yml

@@ -32,7 +32,7 @@ jobs:
     name: Generate Reports
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 

.gitignore

@@ -57,7 +57,6 @@ local_config.py
 /superset_text.yml
 superset.egg-info/
 superset/bin/supersetc
-superset/extensions/.reload_trigger
 tmp
 rat-results.txt
 superset/app/

.gitmodules

@@ -30,6 +30,9 @@
 [submodule ".github/actions/chart-testing-action"]
 	path = .github/actions/chart-testing-action
 	url = https://github.com/helm/chart-testing-action
+[submodule ".github/actions/chart-releaser-action"]
+	path = .github/actions/chart-releaser-action
+	url = https://github.com/helm/chart-releaser-action
 [submodule ".github/actions/github-action-push-to-another-repository"]
 	path = .github/actions/github-action-push-to-another-repository
 	url = https://github.com/cpina/github-action-push-to-another-repository

.pre-commit-config.yaml

@@ -144,7 +144,7 @@ repos:
               git fetch --no-recurse-submodules origin "$TARGET_BRANCH" 2>/dev/null || true
             fi
             BASE=$(git merge-base origin/"$TARGET_BRANCH" HEAD 2>/dev/null) || BASE="HEAD"
-            files=$(git diff --name-only --diff-filter=ACM "$BASE"..HEAD 2>/dev/null | grep '^superset/.*\.py$' | grep -v '^superset/migrations/' || true)
+            files=$(git diff --name-only --diff-filter=ACM "$BASE"..HEAD 2>/dev/null | grep '^superset/.*\.py$' || true)
             if [ -n "$files" ]; then
               pylint --rcfile=.pylintrc --load-plugins=superset.extensions.pylint --reports=no $files
             else

README.md

@@ -29,7 +29,7 @@ under the License.
 [![Last Commit](https://img.shields.io/github/last-commit/apache/superset)](https://github.com/apache/superset/commits/master)
 [![Open Issues](https://img.shields.io/github/issues/apache/superset)](https://github.com/apache/superset/issues)
 [![Open PRs](https://img.shields.io/github/issues-pr/apache/superset)](https://github.com/apache/superset/pulls)
-[![Get on Slack](https://img.shields.io/badge/slack-join-orange.svg)](https://bit.ly/join-superset-slack)
+[![Get on Slack](https://img.shields.io/badge/slack-join-orange.svg)](http://bit.ly/join-superset-slack)
 [![Documentation](https://img.shields.io/badge/docs-apache.org-blue.svg)](https://superset.apache.org)
 
 <picture width="500">
@@ -186,7 +186,7 @@ Try out Superset's [quickstart](https://superset.apache.org/docs/quickstart/) gu
 ## Get Involved
 
 - Ask and answer questions on [StackOverflow](https://stackoverflow.com/questions/tagged/apache-superset) using the **apache-superset** tag
-- [Join our community's Slack](https://bit.ly/join-superset-slack)
+- [Join our community's Slack](http://bit.ly/join-superset-slack)
   and please read our [Slack Community Guidelines](https://github.com/apache/superset/blob/master/CODE_OF_CONDUCT.md#slack-community-guidelines)
 - [Join our dev@superset.apache.org Mailing list](https://lists.apache.org/list.html?dev@superset.apache.org). To join, simply send an email to [dev-subscribe@superset.apache.org](mailto:dev-subscribe@superset.apache.org)
 - Follow us on social media:

RELEASING/README.md

@@ -423,7 +423,7 @@ git push origin ${SUPERSET_VERSION}
 
 ### Publishing a Convenience Release to PyPI
 
-Extract the release to the `/tmp` folder to build the PyPI release. Files in the `/tmp` folder will be automatically deleted by the OS.
+Extract the release to the `/tmp` folder to build the PiPY release. Files in the `/tmp` folder will be automatically deleted by the OS.
 
 ```bash
 mkdir -p /tmp/superset && cd /tmp/superset

RESOURCES/INTHEWILD.yaml

@@ -168,11 +168,6 @@ categories:
       url: https://www.now.vn/
       contributors: ["@davidkohcw"]
 
-    - name: Pattern
-      url: https://www.pattern.com
-      contributors: ["@alephys26", "@hladush", "@sanketjadhavSF"]
-      logo: pattern_logo.png
-
     - name: Qunar
       url: https://www.qunar.com/
       contributors: ["@flametest"]

UPDATING.md

@@ -24,71 +24,6 @@ assists people when migrating to a new version.
 
 ## Next
 
-### Principal listing APIs now honour related-field filters
-
-Two authorization-related listing behaviors changed for API clients. Neither
-affects the Superset UI — `include_ids` and `security/subject` have no frontend
-callers — but external clients will notice:
-
-- `GET /api/v1/<resource>/related/<column>?include_ids=...` now applies the
-  endpoint's `base_related_field_filters`. Previously the forced IDs were fetched
-  with no filtering, so a caller could resolve principals the related-field
-  filters deliberately hide; those IDs are now omitted from the response.
-- `GET /api/v1/security/subject/` now honours `EXCLUDE_USERS_FROM_LISTS` and
-  `EXTRA_RELATED_QUERY_FILTERS`, matching every other principal-listing endpoint.
-  List counts may drop, and fetching an excluded principal via
-  `GET /api/v1/security/subject/<id>` now returns `404`.
-
-### v1 chart import no longer re-adds the importer as editor on overwrite
-
-Re-importing over an existing chart (an overwrite or a soft-delete restore) no
-longer appends the importing user to the chart's `editors`, matching the
-dashboard importer's behavior. This changes anything only for a user who was not
-already an editor of that chart — typically an admin overwriting a chart they do
-not own, who was previously added as an editor as a side effect of the import.
-Newly-created charts are unaffected.
-### ClickHouse: system sampling queries retry with a bounded read
-
-System-generated sampling queries — filter-value dropdowns, the Samples
-tab/dataset preview, and datetime format detection — that ClickHouse rejects
-with a `max_rows_to_read` error (`TOO_MANY_ROWS`, code 158) are now retried
-once with `SETTINGS read_overflow_mode='break'` appended, so they return a
-partial result bounded by the operator's row cap instead of failing. The retry
-applies only to statements Superset generates for physical-table datasets;
-virtual datasets and user-authored SQL remain fully governed by configured
-read limits, and queries that already succeed are never altered. Operators who
-rely on `max_rows_to_read` as a hard failure gate for these system queries can
-restore the previous behavior per database with
-`"disable_sampling_read_limit_override": true` in the database's Extra JSON.
-Note that a retried query returns partial data with no truncation indicator
-(e.g. a filter dropdown may list only a subset of values on tables above the
-row cap).
-
-### Dashboard "Export Data to Excel" requires a Celery worker and S3 bucket
-
-A new dashboard action exports every chart's data to a single multi-sheet
-`.xlsx` asynchronously. It is disabled by default and turns on only when
-`EXCEL_EXPORT_S3_BUCKET` is set (the endpoint returns `501` otherwise). It also
-requires a running Celery worker and a configured SMTP transport, since the task
-emails the requesting user a pre-signed download link. New config keys:
-`EXCEL_EXPORT_S3_BUCKET`, `EXCEL_EXPORT_S3_KEY_PREFIX`,
-`EXCEL_EXPORT_LINK_TTL_SECONDS`, `EXCEL_EXPORT_S3_CLIENT_KWARGS`, and
-`EXCEL_EXPORT_TABLE_VIZ_TYPES`.
-
-The feature depends on `boto3`, which is **not** installed by default; install it
-with `pip install apache-superset[excel-export]`.
-
-A second mode, **Export Images to Excel**, embeds non-table charts as rendered
-images (which viz types stay tabular is controlled by
-`EXCEL_EXPORT_TABLE_VIZ_TYPES`). It renders through the headless webdriver, so the
-menu option only appears when the webdriver screenshot feature flags
-(`ENABLE_DASHBOARD_SCREENSHOT_ENDPOINTS`,
-`ENABLE_DASHBOARD_DOWNLOAD_WEBDRIVER_SCREENSHOT`) are enabled.
-
-Deployments that override `CELERY_CONFIG` must add
-`"superset.tasks.export_dashboard_excel"` to their `imports` tuple, or the task
-will not register and exports will silently never run.
-
 ### SQL_QUERY_MUTATOR now honors MUTATE_AFTER_SPLIT in SQL Lab
 
 SQL Lab now applies `SQL_QUERY_MUTATOR` according to `MUTATE_AFTER_SPLIT`, matching the documented semantics and the chart/query path. This only affects deployments that define `SQL_QUERY_MUTATOR` in `superset_config.py`:
@@ -104,48 +39,6 @@ Update your environment (virtualenv, Docker base image, CI configuration, etc.)
 Python 3.11+ before upgrading. The `apache/superset-cache:3.10-slim-trixie` and
 `py310` Docker image variants are no longer published.
 
-### `from_dttm` and `to_dttm` Jinja template variables removed
-
-The `{{ from_dttm }}` and `{{ to_dttm }}` Jinja template variables, deprecated since
-v5.0, have been removed from the Jinja context and are no longer available in virtual
-dataset SQL or custom SQL expressions.
-
-Replace usages with the `get_time_filter()` function. For example:
-
-```sql
--- Before
-SELECT * FROM tbl
-WHERE dttm_col > '{{ from_dttm }}' AND dttm_col < '{{ to_dttm }}'
-
--- After
-{% set tf = get_time_filter("dttm_col") %}
-SELECT * FROM tbl
-WHERE dttm_col > {{ tf.from_expr }} AND dttm_col <= {{ tf.to_expr }}
-```
-
-Note that `from_expr` and `to_expr` are already fully-formatted SQL expressions (e.g.
-`TO_TIMESTAMP('2024-01-01', ...)`) — do not wrap them in single quotes.
-
-### Removed deck.gl JavaScript tooltip/data-mutator controls and ENABLE_JAVASCRIPT_CONTROLS
-
-The `ENABLE_JAVASCRIPT_CONTROLS` feature flag and the deck.gl chart controls it gated
-(`js_tooltip`, `js_onclick_href`, `js_data_mutator`, and the GeoJSON layer's label/icon
-JavaScript-mode generators) have been removed. These controls let users write arbitrary
-JavaScript, sandboxed via Node's `vm` module, to customize deck.gl tooltips, click
-behavior, and data transforms; the flag defaulted off and the feature saw negligible use.
-
-The deck.gl "Extra data for JS" control (`js_columns`) has also been removed. It only
-ever existed to feed extra columns into the JavaScript controls above; deck.gl's
-built-in field-based tooltips and cross-filtering already pull in any columns they need
-via `tooltip_contents`/`cross_filter_column`, so this control had no remaining purpose.
-Any chart layer whose "Advanced" control panel section only contained this control no
-longer has an "Advanced" section.
-
-Any saved charts with these fields set will simply ignore them going forward and fall back
-to deck.gl's built-in field-based tooltips (`tooltip_contents`/`tooltip_template`) and
-native click/cross-filter behavior. No migration is required; the fields are dropped
-silently on next save.
-
 ### Owners, dashboard roles, and RLS roles replaced by Subjects
 
 Superset now uses subject-based access assignments for dashboards, charts, datasets,
@@ -328,22 +221,6 @@ The pivot table chart's `First` and `Last` aggregations now return the first and
 
 The `error` and `response` parameters of the `retryDelay` and `retryOn` callbacks in `FetchRetryOptions` (exported from `@superset-ui/core`) are now typed `Error | null` and `Response | null` to match the actual call-site signature provided by `fetch-retry`. Because these parameter types are contravariant, consumers who typed their callbacks with the non-nullable `(attempt: number, error: Error, response: Response) => number` will get a TypeScript compile error. Widen your callback signatures to accept `Error | null` / `Response | null`.
 
-### Pivot Table totals are now computed by the database (per-metric "Aggregation function" control removed)
-
-Pivot Table subtotals and grand totals are now computed by the database at each
-rollup level instead of re-aggregating the already-aggregated cell values on the
-client. This fixes long-standing incorrect totals for non-additive metrics
-(ratios such as `SUM(a)/SUM(b)`, `COUNT_DISTINCT`, `AVG`, percentiles, etc.),
-which previously summed the displayed cell values.
-
-As a result the per-table **"Aggregation function"** control (which let you pick
-how totals were aggregated client-side, e.g. Sum/Average/Count) has been
-removed: totals now always reflect the metric's own definition evaluated at the
-total's granularity. For additive metrics (`SUM`/`COUNT`/`MIN`/`MAX`) the result
-is unchanged. Saved charts that set `aggregateFunction` will ignore it; no
-migration is required. If you previously relied on a plain sum-of-cells total
-for a non-additive metric, that specific behavior is no longer available.
-
 ### `thumbnail_url` removed from dashboard list API response
 
 The `thumbnail_url` field has been removed from `GET /api/v1/dashboard/` list responses. External consumers relying on this field must now construct the thumbnail URL client-side using `id` and `changed_on_utc`:
@@ -398,26 +275,6 @@ A read-only companion to the version-history endpoints: each entity type gains a
 
 Authorization reuses the resource's `can_read` permission and per-object `raise_for_access`; related-entity rows are visibility-filtered to what the caller may see. The stream is empty unless version capture is on (`ENABLE_VERSIONING_CAPTURE`).
 
-### Version-history retention (pruning)
-
-Entity version history (the `version_transaction` / `*_version` shadow tables that back version capture) is aged out by a nightly Celery beat task, `version_history.prune_old_versions` (`superset.tasks.version_history_retention`).
-
-| Key | Default | Purpose |
-|---|---|---|
-| `SUPERSET_VERSION_HISTORY_RETENTION_DAYS` | `30` | Version rows whose owning `version_transaction.issued_at` is older than this many days are pruned. Each entity's live row (`end_transaction_id IS NULL`) is always preserved, as are the live rows of its children and associations; closed historical rows (including the baseline) age out. Set to `0` or a negative value to disable pruning. |
-
-The task ships in the default `CeleryConfig.beat_schedule`; a deployment that overrides `CELERY_CONFIG` without inheriting the default will log a startup warning that the prune task is absent (so it never silently stops running). Retention only prunes whatever history exists — capture itself is gated separately by `ENABLE_VERSIONING_CAPTURE` (ships off).
-
-### Deletion retention (soft-deleted entities are eventually purged)
-
-Soft-deleted dashboards, charts, and datasets are now permanently removed after a retention window (default 30 days; `SOFT_DELETE_RETENTION_DAYS`, `0` disables; settable per workspace at runtime via the `deletion-retention set-window` CLI, which takes precedence). The `deletion_retention.purge_soft_deleted` Celery beat task runs daily and removes each aged-out entity together with its M:N join rows, owned children, datasource permission, and version-history shadow rows. After purge an entity is **unrecoverable** — its detail and `/restore` endpoints return 404 and its version history is gone.
-
-The introducing release **defaults to dry-run** (`SOFT_DELETE_PURGE_DRY_RUN=True`): the task logs `would_purge` counts but deletes nothing, so operators can validate against production before activating real purging by setting it to `False`. Note `would_purge` is an **upper bound** — it counts every entity past the retention window without evaluating deletion blockers, so a real run may purge fewer (entities referenced by report schedules or set as a user's welcome dashboard are blocked and reported separately). The task only acts while the temporary `SOFT_DELETE` rollout flag is on.
-
-Deployments that replace the default `CELERY_CONFIG` must add `superset.tasks.deletion_retention` to the Celery `imports` and schedule the `deletion_retention.purge_soft_deleted` task themselves. The shipped Docker development config includes both entries.
-
-Operators can immediately erase a specific entity for compliance (GDPR) via `superset deletion-retention force-purge --uuid <uuid>`; this applies legacy hard-delete semantics — a live chart referencing a force-purged dataset is left without a datasource until re-pointed (the chart is not modified), and it purges the named entity even when it was never soft-deleted. Every purge writes an immutable, content-free audit record to the new `purge_audit_log` table that survives the entity it names: the **scheduled** purge fails closed (an entity whose audit row cannot be written is skipped and retried next run), while **force-purge** proceeds even if the audit write fails — the operator is present and deletion outranks audit for a compliance erasure.
-
 ### Webhook alerts/reports block private/internal hosts by default
 
 Webhook alert/report dispatch (`WebhookNotification.send`) now validates the target URL's host against the same private/internal-IP block applied to dataset import URLs. If the resolved host is in a loopback, link-local, private (RFC-1918), shared-CGNAT, or multicast range, the webhook is rejected with `NotificationParamException`.
@@ -670,12 +527,6 @@ The partial-index replacement is dialect-dependent: PostgreSQL uses a native `WH
 
 **Importer behavior:** importing a dashboard YAML whose UUID matches an existing **soft-deleted** dashboard is treated as an implicit restore-with-update — **and this happens even when `overwrite` is not set**. This is a deliberate asymmetry with active rows: an active dashboard imported without `overwrite=true` is returned unchanged (the import never mutates it), but a soft-deleted UUID match is restored *and* has the upload's contents applied regardless of the `overwrite` argument, on the reasoning that re-importing a deleted dashboard's exact UUID is an explicit request to bring it back. The restore preserves the original PK and all pre-deletion relationship rows (`dashboard_slices` junctions, editor/viewer subjects, tags). Callers whose imports must never mutate existing state should treat bundles that may contain previously deleted UUIDs accordingly. The operation is permission-gated: it requires `can_write` and editorship of the deleted row (or admin) — non-editors get `ImportFailedError`, and callers without `can_write` get `ImportFailedError` instead of silently receiving the soft-deleted row.
 
-### Engine spec capability flag: `supports_offset`
-
-A new `BaseEngineSpec.supports_offset` attribute (default `True`) indicates whether a database engine supports the SQL `OFFSET` clause. Engines that do not support `OFFSET` — such as Elasticsearch SQL and OpenDistro — opt out by setting it to `False`, and Superset uses each engine's cursor API to paginate drill-to-detail samples instead of emitting `OFFSET`. Downstream forks maintaining custom engine specs may set the flag to `False` (and implement `fetch_data_with_cursor`) to avoid crashes when paginated drill-to-detail queries are run against engines without `OFFSET` support.
-
-**Note on deep-pagination cost:** Cursor-based engines (including Elasticsearch and OpenDistro) are forward-only, so reaching page `N` of a drill-to-detail view issues `N` round trips to the cluster. Deep pagination is therefore linear in page number; users paginating into the hundreds or thousands will notice added latency compared to `OFFSET`-capable engines.
-
 ### Granular Export Controls
 
 A new feature flag `GRANULAR_EXPORT_CONTROLS` introduces three fine-grained permissions that replace the legacy `can_csv` permission:
@@ -706,22 +557,12 @@ Added a new combined datasource list endpoint at `GET /api/v1/datasource/` to se
 - Semantic views are included only when the `SEMANTIC_LAYERS` feature flag is enabled.
 - The endpoint enforces strict `order_column` validation and returns `400` for invalid sort columns.
 
-### Custom time range "Now"/"Today" anchors resolve in local time
-
-Custom time ranges that use the "Now" or "Today" anchor (for the Start, End, or the relative anchor itself) previously resolved that anchor in UTC before formatting it into a naive datetime string, which was then re-parsed elsewhere as local time. For users outside UTC, this made the resolved anchor drift by their browser's UTC offset. "Now"/"Today" now resolve directly in local time, matching the later local re-parse.
-
-Charts and dashboards using these anchors will compute a different (correct) timestamp after upgrading; if a chart's filters or drill-downs were tuned to compensate for the old offset, review them after upgrading.
-
 ## 6.1.0
 
 ### ClickHouse minimum driver version bump
 
 The minimum required version of `clickhouse-connect` has been raised to `>=0.13.0`. If you are using the ClickHouse connector, please upgrade your `clickhouse-connect` package. The `_mutate_label` workaround that appended hash suffixes to column aliases has also been removed, as it is no longer needed with modern versions of the driver.
 
-### Kenya Country Map: Updated Administrative Divisions
-
-The Kenya country map has been updated to reflect the 47 counties established under Kenya's 2010 constitution, replacing the outdated 8-province boundaries from the Natural Earth dataset. County keys now use ISO 3166-2:KE codes (`KE-01` through `KE-47`), replacing the former province codes (`KE-110`, `KE-200`, ..., `KE-800`). Dashboards that join on the old province codes will need to re-key their datasets to use the new county codes.
-
 ### MCP Tool Observability
 
 MCP (Model Context Protocol) tools now include enhanced observability instrumentation for monitoring and debugging:

docker-compose-image-tag.yml

@@ -28,10 +28,8 @@ x-superset-image: &superset-image apachesuperset.docker.scarf.sh/apache/superset
 x-superset-volumes:
   &superset-volumes # /app/pythonpath_docker will be appended to the PYTHONPATH in the final container
   - ./docker:/app/docker
+  - ./superset-core:/app/superset-core
   - superset_home:/app/superset_home
-x-superset-environment: &superset-environment
-  # Tagged images must use their bundled packages rather than host bind mounts.
-  DEV_MODE: "false"
 
 services:
   redis:
@@ -60,7 +58,6 @@ services:
         required: true
       - path: docker/.env-local # optional override
         required: false
-    environment: *superset-environment
     image: *superset-image
     container_name: superset_app
     command: ["/app/docker/docker-bootstrap.sh", "app-gunicorn"]
@@ -82,7 +79,6 @@ services:
         required: true
       - path: docker/.env-local # optional override
         required: false
-    environment: *superset-environment
     depends_on:
       db:
         condition: service_started
@@ -102,7 +98,6 @@ services:
         required: true
       - path: docker/.env-local # optional override
         required: false
-    environment: *superset-environment
     restart: unless-stopped
     depends_on:
       superset-init:
@@ -125,7 +120,6 @@ services:
         required: true
       - path: docker/.env-local # optional override
         required: false
-    environment: *superset-environment
     restart: unless-stopped
     depends_on:
       superset-init:

docker-compose.yml

@@ -34,7 +34,6 @@ x-superset-volumes: &superset-volumes
   - superset_home:/app/superset_home
   - ./tests:/app/tests
   - superset_data:/app/data
-  - ./local_extensions:/app/local_extensions
 x-common-build: &common-build
   context: .
   target: ${SUPERSET_BUILD_TARGET:-dev} # can use `dev` (default) or `lean`

docker/docker-bootstrap.sh

@@ -98,9 +98,7 @@ case "${1}" in
         echo "  🔒 Werkzeug debugger disabled (set SUPERSET_DEBUG_ENABLED=true to enable)"
     fi
 
-    flask run -p $PORT --reload $DEBUGGER_FLAG --host=0.0.0.0 \
-      --extra-files "/app/superset/extensions/.reload_trigger" \
-      --exclude-patterns "*/node_modules/*:*/.venv/*:*/build/*:*/__pycache__/*:*/superset-frontend/*:*/superset/__init__.py"
+    flask run -p $PORT --reload $DEBUGGER_FLAG --host=0.0.0.0 --exclude-patterns "*/node_modules/*:*/.venv/*:*/build/*:*/__pycache__/*:*/superset-frontend/*"
     ;;
   app-gunicorn)
     echo "Starting web app..."

docker/pythonpath_dev/superset_config.py

@@ -84,11 +84,9 @@ class CeleryConfig:
     broker_url = f"redis://{REDIS_HOST}:{REDIS_PORT}/{REDIS_CELERY_DB}"
     imports = (
         "superset.sql_lab",
-        "superset.tasks.deletion_retention",
         "superset.tasks.scheduler",
         "superset.tasks.thumbnails",
         "superset.tasks.cache",
-        "superset.tasks.export_dashboard_excel",
     )
     result_backend = f"redis://{REDIS_HOST}:{REDIS_PORT}/{REDIS_RESULTS_DB}"
     worker_prefetch_multiplier = 1
@@ -102,13 +100,6 @@ class CeleryConfig:
             "task": "reports.prune_log",
             "schedule": crontab(minute=10, hour=0),
         },
-        # Gated on the SOFT_DELETE feature flag, which is off by default: the
-        # task is scheduled either way, but purges nothing while the flag is
-        # unset. Enable it in FEATURE_FLAGS below to exercise retention locally.
-        "deletion_retention.purge_soft_deleted": {
-            "task": "deletion_retention.purge_soft_deleted",
-            "schedule": crontab(minute=0, hour=0),
-        },
     }
 
 

docs/admin_docs/configuration/cache.mdx

@@ -76,21 +76,6 @@ value defined in `DATA_CACHE_CONFIG`.
 Note, that by setting the cache timeout to `-1`, caching for charting data can be disabled, either
 per chart, dataset or database, or by default if set in `DATA_CACHE_CONFIG`.
 
-## Limiting Cached Result Size
-
-Very large chart or SQL query results can flood the cache backend (Redis/Memcached), evicting many
-smaller useful entries or exhausting memory. To cap the size of any single value written to the data
-cache, set `DATA_CACHE_MAX_VALUE_SIZE` (in bytes) in `superset_config.py`:
-
-```python
-DATA_CACHE_MAX_VALUE_SIZE = 10 * 1024 * 1024  # 10 MB
-```
-
-When a result's serialized size exceeds this threshold it is not written to the data cache — the
-chart still renders, but the next load re-queries the datasource instead of getting a cache hit. The
-`skip_cache_value_too_large` statsd metric is incremented each time this happens. Set to `None` (the
-default) to disable the check.
-
 ## SQL Lab Query Results
 
 Caching for SQL Lab query results is used when async queries are enabled and is configured using

docs/admin_docs/configuration/configuring-superset.mdx

@@ -149,10 +149,10 @@ database engine on a separate host or container.
 
 Superset supports the following database engines/versions:
 
-| Database Engine                           | Supported Versions                             |
-| ----------------------------------------- | ---------------------------------------------- |
-| [PostgreSQL](https://www.postgresql.org/) | 10.X, 11.X, 12.X, 13.X, 14.X, 15.X, 16.X, 17.X |
-| [MySQL](https://www.mysql.com/)           | 5.7, 8.X                                       |
+| Database Engine                           | Supported Versions                       |
+| ----------------------------------------- | ---------------------------------------- |
+| [PostgreSQL](https://www.postgresql.org/) | 10.X, 11.X, 12.X, 13.X, 14.X, 15.X, 16.X |
+| [MySQL](https://www.mysql.com/)           | 5.7, 8.X                                 |
 
 Use the following database drivers and connection strings:
 

docs/admin_docs/configuration/map-tiles.mdx

@@ -25,33 +25,6 @@ DECKGL_BASE_MAP = [
 ]
 ```
 
-[Yandex Tiles API](https://yandex.ru/maps-api/docs/tiles-api/request.html) can be used as a custom tile provider. The URL must include the `apikey` from the [Yandex Developer Dashboard](https://developer.tech.yandex.ru/services), tile coordinates (`x`, `y`, and `z`), and the required map layer parameters.
-
-```python
-DECKGL_BASE_MAP = [
-    [
-        "tile://https://tiles.api-maps.yandex.ru/v1/tiles/"
-        "?apikey=YOUR_YANDEX_API_KEY"
-        "&lang=ru_RU"
-        "&x={x}&y={y}&z={z}"
-        "&l=map"
-        "&projection=web_mercator"
-        "&maptype=map",
-        "Yandex Maps - Web Mercator",
-    ],
-    [
-        "tile://https://tiles.api-maps.yandex.ru/v1/tiles/"
-        "?apikey=YOUR_YANDEX_API_KEY"
-        "&lang=ru_RU"
-        "&x={x}&y={y}&z={z}"
-        "&l=map"
-        "&projection=wgs84_mercator"
-        "&maptype=map",
-        "Yandex Maps - WGS84 Mercator",
-    ],
-]
-```
-
 Default values are:
 ```python
 DECKGL_BASE_MAP = [
@@ -83,7 +56,6 @@ CORS_OPTIONS: dict[Any, Any] = {
         "https://tile.openstreetmap.org",
         "https://tile.osm.ch",
         "https://your_personal_url/{z}/{x}/{y}.png",
-        "https://tiles.api-maps.yandex.ru",
     ]
 }
 
@@ -100,7 +72,6 @@ TALISMAN_CONFIG = {
             "https://tile.openstreetmap.org",
             "https://tile.osm.ch",
             "https://your_personal_url/{z}/{x}/{y}.png",
-            "https://tiles.api-maps.yandex.ru",
         ],
         ...
 }

docs/admin_docs/configuration/sql-templating.mdx

@@ -39,6 +39,8 @@ made available in the Jinja context:
 
 - `columns`: columns which to group by in the query
 - `filter`: filters applied in the query
+- `from_dttm`: start `datetime` value from the selected time range (`None` if undefined). **Note:** Only available in virtual datasets when a time range filter is applied in Explore/Chart views—not available in standalone SQL Lab queries. (deprecated beginning in version 5.0, use `get_time_filter` instead)
+- `to_dttm`: end `datetime` value from the selected time range (`None` if undefined). **Note:** Only available in virtual datasets when a time range filter is applied in Explore/Chart views—not available in standalone SQL Lab queries. (deprecated beginning in version 5.0, use `get_time_filter` instead)
 - `groupby`: columns which to group by in the query (deprecated)
 - `metrics`: aggregate expressions in the query
 - `row_limit`: row limit of the query
@@ -47,26 +49,85 @@ made available in the Jinja context:
 - `time_column`: temporal column of the query (`None` if undefined)
 - `time_grain`: selected time grain (`None` if undefined)
 
-For example, to add a time range to a virtual dataset, use the `get_time_filter` macro:
+For example, to add a time range to a virtual dataset, you can write the following:
 
 ```sql
-{% set tf = get_time_filter("dttm_col") %}
 SELECT *
 FROM tbl
-WHERE dttm_col > {{ tf.from_expr }} AND dttm_col <= {{ tf.to_expr }}
+WHERE dttm_col > '{{ from_dttm }}' and dttm_col < '{{ to_dttm }}'
 ```
 
+You can also use [Jinja's logic](https://jinja.palletsprojects.com/en/2.11.x/templates/#tests)
+to make your query robust to clearing the timerange filter:
+
+```sql
+SELECT *
+FROM tbl
+WHERE (
+    {% if from_dttm is not none %}
+        dttm_col > '{{ from_dttm }}' AND
+    {% endif %}
+    {% if to_dttm is not none %}
+        dttm_col < '{{ to_dttm }}' AND
+    {% endif %}
+    1 = 1
+)
+```
+
+The `1 = 1` at the end ensures a value is present for the `WHERE` clause even when
+the time filter is not set. For many database engines, this could be replaced with `true`.
+
 Note that the Jinja parameters are called within _double_ brackets in the query and with
 _single_ brackets in the logic blocks.
 
 ### Understanding Context Availability
 
-Some Jinja variables like `filter` are **only available when a chart or dashboard provides them**. They are populated from:
+Some Jinja variables like `from_dttm`, `to_dttm`, and `filter` are **only available when a chart or dashboard provides them**. They are populated from:
 
 - Time range filters applied in Explore/Chart views
 - Dashboard native filters
 - Filter components
 
+**These variables are NOT available in standalone SQL Lab queries** because there's no filter context. If you try to use `{{ from_dttm }}` directly in SQL Lab, you'll get an "undefined parameter" error.
+
+#### Testing Time-Filtered Queries in SQL Lab
+
+To test queries that use time variables in SQL Lab, you have several options:
+
+**Option 1: Use Jinja defaults (recommended)**
+
+```sql
+SELECT *
+FROM tbl
+WHERE dttm_col > '{{ from_dttm | default("2024-01-01", true) }}'
+  AND dttm_col < '{{ to_dttm | default("2024-12-31", true) }}'
+```
+
+**Option 2: Use SQL Lab Parameters**
+
+Set parameters in the SQL Lab UI (Parameters menu):
+```json
+{
+  "from_dttm": "2024-01-01",
+  "to_dttm": "2024-12-31"
+}
+```
+
+**Option 3: Use `{% set %}` for testing**
+
+```sql
+{% set from_dttm = "2024-01-01" %}
+{% set to_dttm = "2024-12-31" %}
+SELECT *
+FROM tbl
+WHERE dttm_col > '{{ from_dttm }}' AND dttm_col < '{{ to_dttm }}'
+```
+
+:::tip
+When you save a SQL Lab query as a virtual dataset and use it in a chart with time filters,
+the actual filter values will override any defaults or test values you set.
+:::
+
 To add custom functionality to the Jinja context, you need to overload the default Jinja
 context in your environment by defining the `JINJA_CONTEXT_ADDONS` in your superset configuration
 (`superset_config.py`). Objects referenced in this dictionary are made available for users to use
@@ -418,13 +479,10 @@ Here's a concrete example:
 
 ### Time Filter
 
-The `{{ get_time_filter() }}` macro is the standard way to reference the selected time range
-in a virtual dataset. It returns a `TimeFilter` object whose `from_expr` and `to_expr`
-properties are fully-formatted SQL expressions for the start and end of the range — use them
-directly in your `WHERE` clause without quoting.
-
-Placing the filter inside the virtual dataset (rather than relying on it being applied to
-the outer query) also gives many database engines the opportunity to optimize the query better.
+The `{{ get_time_filter() }}` macro returns the time filter applied to a specific column. This is useful if you want
+to handle time filters inside the virtual dataset, as by default the time filter is placed on the outer query. This can
+considerably improve performance, as many databases and query engines are able to optimize the query better
+if the temporal filter is placed on the inner query, as opposed to the outer query.
 
 The macro takes the following parameters:
 

docs/admin_docs/installation/docker-builds.mdx

@@ -112,61 +112,12 @@ USER superset
 CMD ["/app/docker/entrypoints/run-server.sh"]
 ```
 
-### Adding translations to a custom image
-
-The pattern above, a small Dockerfile that just extends `FROM apache/superset:...`, can't add
-translations after the fact. By the time an official tag is published, its frontend and backend
-layers have already had non-English translation files stripped out unless `BUILD_TRANSLATIONS`
-was set at build time (see below), and there's no `superset/translations` source tree left in the
-final image to compile from.
-
-To get translations into your own image, you need to build from the full Superset source (a
-clone or fork of this repo) rather than extend a published tag. The most efficient way to do this
-is to append your customizations as one more stage at the end of the repo's own `Dockerfile`, so
-Docker can reuse the cached upstream layers and only rebuild what your stage adds:
-
-```Dockerfile
-# Append this to the end of the repo's Dockerfile
-# Keep this tag in sync with the branch/tag of the repo you cloned, so the
-# translation files built from source match the keys the runtime expects:
-FROM apache/superset:5.0.0 AS my-custom-image
-USER root
-
-# Pull the translation files out of the earlier build stages (frontend
-# .json in `superset-node`, backend .mo in `python-translation-compiler`).
-# Those stages' own cleanup only matches single-character extensions, so
-# the source `.po` files can still be present here; strip them explicitly
-# so this stage only keeps the compiled translations.
-COPY --from=superset-node /app/superset/translations superset/translations
-COPY --from=python-translation-compiler /app/translations_mo superset/translations
-RUN find superset/translations -name '*.po' -delete
-
-USER superset
-```
-
-Then build with:
-
-```bash
-docker build --target=my-custom-image --build-arg=BUILD_TRANSLATIONS=true -t mysuperset:5.0.0 .
-```
-
-You can combine this with the database-driver/dependency pattern above by adding your own
-`RUN uv pip install ...` step before switching back to `USER superset`. See
-[issue #35959](https://github.com/apache/superset/issues/35959) for the discussion this pattern
-came out of, credit to the community for working it out.
-
 ## Key ARGs in Dockerfile
 
-- `BUILD_TRANSLATIONS`: whether to compile non-English translations into the image.
-  When `true`, the frontend build converts the `*.po` files to locale JSON and the
-  backend runs `pybabel compile` to produce `*.mo` files; both source `*.po` files
-  are stripped afterward either way. When `false` (the default), those compile
-  steps are skipped and only `en` ships. This only takes effect when building the image from source
-  (`docker build` against this repo's own `Dockerfile`); it has no effect on a downstream
-  Dockerfile that just extends an already-published tag, see
-  "Adding translations to a custom image" above. Note that the backend `pybabel compile`
-  step ignores its exit code, so a `.po` file with a compile error won't fail the build;
-  check the build logs for `pybabel` warnings if a locale's backend strings aren't showing up.
+- `BUILD_TRANSLATIONS`: whether to build the translations into the image. For the
+  frontend build this tells webpack to strip out all locales other than `en` from
+  the `moment-timezone` library. For the backendthis skips compiling the
+  `*.po` translation files
 - `DEV_MODE`: whether to skip the frontend build, this is used by our `docker-compose` dev setup
   where we mount the local volume and build using `webpack` in `--watch` mode, meaning as you
   alter the code in the local file system, webpack, from within a docker image used for this

docs/admin_docs/security/security.mdx

@@ -247,51 +247,6 @@ This feature is particularly useful for:
 - Granting access to dashboards without exposing the underlying datasets for other uses
 - Creating dashboard-specific access patterns that don't align with dataset permissions
 
-#### Assigning the creator's groups automatically
-
-```python
-FEATURE_FLAGS = {
-    "ENABLE_VIEWERS": True,
-    "ASSIGN_CREATOR_GROUPS_AS_VIEWERS": True,
-}
-```
-
-This requires `ENABLE_VIEWERS` — it has no effect on its own, since it works by populating the
-`viewers` relationship that `ENABLE_VIEWERS` governs.
-
-With this enabled, a newly created dashboard or chart is shared read-only with every group its
-creator belongs to, unless the create payload names viewers explicitly. It applies to every path
-that creates an asset: the REST API, `/dashboard/new/`, save-as from Explore, dashboard copy,
-the import commands, and the MCP tools. Datasets are unaffected, as they have editors but no
-viewers.
-
-For dashboards, viewer access additionally requires the dashboard to be **published** — the same
-rule that governs every dashboard viewer. Until a new dashboard is published its creator's groups
-see nothing, and because it now has viewers the dataset-based fallback no longer applies to it
-either; group members gain access only once it is published. Charts have no such publish gate, so a
-new chart's viewer grant takes effect immediately. Note, though, that the viewer relationship
-governs access to the chart itself; rendering its **data** still runs the normal datasource
-permission check unless `VIEWER_PROMISCUOUS_MODE` is enabled — a group member without access to the
-underlying dataset can open the chart but won't load its data.
-
-Note that this **narrows** access rather than widening it. Because an asset with no viewers falls
-back to dataset-based access, giving new assets a viewer makes that fallback unreachable for them:
-a colleague who could previously open a new dashboard by virtue of dataset access can no longer do
-so unless they share one of the creator's groups. Existing assets are untouched — only assets
-created after the feature flag is enabled are affected.
-
-The same narrowing affects background execution as a fixed identity. Alerts, reports, and
-thumbnails that run as a `FixedExecutor` service account (via `ALERT_REPORTS_EXECUTE_AS` or
-`THUMBNAIL_EXECUTE_AS`) reach a chart or dashboard through the dataset fallback when that account
-is neither an editor nor a viewer. Once a new asset is scoped to the creator's groups that
-fallback is gone, so rendering fails `raise_for_access` unless the executor account is an admin,
-an editor, or shares one of those groups. If a fixed executor must render assets it does not own,
-grant it the needed access (make it an admin or add it to the relevant groups) — or leave the
-feature flag off.
-
-The setting assigns groups as *viewers*, not editors, so group members get read-only access and
-cannot modify or delete the asset.
-
 ### SQL Execution Security Considerations
 
 Apache Superset includes features designed to provide safeguards when interacting with connected databases, such as the `DISALLOWED_SQL_FUNCTIONS` configuration setting. This aims to prevent the execution of potentially harmful database functions or system variables directly from Superset interfaces like SQL Lab.

docs/developer_docs/extensions/architecture.md

@@ -163,6 +163,10 @@ The architecture leverages Webpack's Module Federation to enable dynamic loading
 Extensions configure Webpack to expose their entry points:
 
 ```javascript
+externalsType: 'window',
+externals: {
+  '@apache-superset/core': 'superset',
+},
 plugins: [
   new ModuleFederationPlugin({
     name: 'my_extension',
@@ -174,7 +178,6 @@ plugins: [
       react: { singleton: true, import: false },
       'react-dom': { singleton: true, import: false },
       antd: { singleton: true, import: false },
-      '@apache-superset/core': { singleton: true, import: false },
     },
   }),
 ]
@@ -184,7 +187,9 @@ This configuration does several important things:
 
 **`exposes`** - Declares which modules are available to the host application. Superset always loads extensions by requesting the `./index` module from the remote container — this is a fixed convention, not a configurable value. Extensions must expose exactly `'./index': './src/index.tsx'` and place all API registrations (views, commands, menus, editors, event listeners) in that file. The module is executed as a side effect when the extension loads, so any call to `views.registerView`, `commands.registerCommand`, etc. made at the top level of `index.tsx` will run automatically.
 
-**`shared`** - Prevents duplication of common libraries like React and Ant Design, and, for `@apache-superset/core`, is the mechanism that gives each extension an isolated context (see below). The `singleton: true` setting ensures only one *logical* instance of each library exists — for `react`/`react-dom`/`antd` that means the host's actual instance is reused; for `@apache-superset/core` it means the extension's container defers to whatever module the host's loader supplies for it at init time, which is not the same object for every extension (see [Runtime Resolution](#runtime-resolution)).
+**`externals` and `externalsType`** - Tell Webpack that when the extension imports `@apache-superset/core`, it should use `window.superset` at runtime instead of bundling its own copy. This ensures extensions use the host's implementation of shared packages.
+
+**`shared`** - Prevents duplication of common libraries like React and Ant Design. The `singleton: true` setting ensures only one instance of each library exists, avoiding version conflicts and reducing bundle size.
 
 ### Runtime Resolution
 
@@ -195,30 +200,25 @@ The following diagram illustrates the module loading process:
 Here's what happens at runtime:
 
 1. **Extension Registration**: When an extension is registered, Superset stores its remote entry URL
-2. **Dynamic Loading**: When the extension is activated, the host fetches the remote entry file, then initializes Module Federation sharing (`__webpack_init_sharing__`) and looks up the extension's container on `window`
-3. **Per-Extension Scope Injection**: Before calling `container.init()`, the loader builds a **per-container copy** of the webpack share scope in which the `@apache-superset/core` entry is replaced with a synthetic module — a copy of the host's own `window.superset` implementations with `extensions.getContext` bound to that one extension's isolated context object. Because Module Federation caches the resolved module per container, every import of `@apache-superset/core` inside that extension resolves to this pre-bound copy for the lifetime of the container, and because each container gets its own independent scope object, extensions loading in parallel cannot see each other's context.
-4. **Execution**: The extension code runs with access to the host's APIs (via its per-extension `@apache-superset/core` instance) and shared dependencies (`react`, `react-dom`, `antd`)
+2. **Dynamic Loading**: When the extension is activated, the host fetches the remote entry file
+3. **Module Resolution**: The extension imports `@apache-superset/core`, which resolves to `window.superset`
+4. **Execution**: The extension code runs with access to the host's APIs and shared dependencies
 
 ### Host API Setup
 
-On the Superset side, the real implementations backing `@apache-superset/core` (`commands`, `views`, `menus`, `extensions`, etc.) are assigned onto `window.superset` during application bootstrap, once the current user is known:
+On the Superset side, the APIs are mapped to `window.superset` during application bootstrap:
 
 ```typescript
-// eslint-disable-next-line no-restricted-syntax
 import * as supersetCore from '@apache-superset/core';
-import { commands, views, menus, extensions /* ... */ } from 'src/core';
 
-window.superset = {
-  ...supersetCore,
-  commands,
-  views,
-  menus,
-  extensions,
-  // ...
-};
+export default function setupExtensionsAPI() {
+  window.superset = {
+    ...supersetCore,
+  };
+}
 ```
 
-This runs before any extensions are loaded. `window.superset` is not itself what an extension's `@apache-superset/core` import resolves to — it is the source object the loader reads from when building each extension's per-container scoped instance (see [Runtime Resolution](#runtime-resolution)), so every extension ends up sharing the same underlying `commands`/`views`/`menus` singletons but with its own `extensions.getContext()`.
+This function runs before any extensions are loaded, ensuring the APIs are available when extensions import from `@apache-superset/core`.
 
 ### Benefits
 

docs/developer_docs/extensions/overview.md

@@ -47,14 +47,13 @@ Extension developers have access to pre-built UI components via `@apache-superse
 
 ## Next Steps
 
-- **[Quick Start](./quick-start)** - Build your first extension with a complete walkthrough
-- **[Architecture](./architecture)** - Design principles and system overview
-- **[Dependencies](./dependencies)** - Managing dependencies and understanding API stability
-- **[Contribution Types](./contribution-types)** - Available extension points
-- **[Development](./development)** - Project structure, APIs, and development workflow
-- **[Deployment](./deployment)** - Packaging and deploying extensions
-- **[MCP Integration](./mcp)** - Adding AI agent capabilities using extensions
-- **[Security](./security)** - Security considerations and best practices
-- **[Storage](./storage)** - Managed storage API for persisting extension data
-- **[Tasks](./tasks)** - Framework for creating and managing long running tasks
-- **[Community Extensions](./registry)** - Browse extensions shared by the community
+- **[Quick Start](./quick-start.md)** - Build your first extension with a complete walkthrough
+- **[Architecture](./architecture.md)** - Design principles and system overview
+- **[Dependencies](./dependencies.md)** - Managing dependencies and understanding API stability
+- **[Contribution Types](./contribution-types.md)** - Available extension points
+- **[Development](./development.md)** - Project structure, APIs, and development workflow
+- **[Deployment](./deployment.md)** - Packaging and deploying extensions
+- **[MCP Integration](./mcp.md)** - Adding AI agent capabilities using extensions
+- **[Security](./security.md)** - Security considerations and best practices
+- **[Tasks](./tasks.md)** - Framework for creating and managing long running tasks
+- **[Community Extensions](./registry.md)** - Browse extensions shared by the community

docs/developer_docs/extensions/quick-start.md

@@ -223,7 +223,7 @@ The `@apache-superset/core` package must be listed in both `peerDependencies` (t
 
 **`frontend/webpack.config.js`**
 
-The webpack configuration requires specific settings for Module Federation. `@apache-superset/core` is declared as a `shared` singleton alongside `react`/`react-dom`/`antd` — Superset injects a per-extension instance of the package into the container's share scope at load time, so the extension's own webpack config only needs to mark it `shared` with `singleton: true`, not resolve it itself. `import: false` on each shared entry means the extension doesn't bundle its own copy and instead uses the instance the host (or, for `@apache-superset/core`, the loader) provides. `remoteEntry.[contenthash].js` gives the built remote entry file a content hash for cache busting.
+The webpack configuration requires specific settings for Module Federation. Key settings include `externalsType: "window"` and `externals` to map `@apache-superset/core` to `window.superset` at runtime, `import: false` for shared modules to use the host's React instead of bundling a separate copy, and `remoteEntry.[contenthash].js` for cache busting.
 
 **Convention**: Superset always loads extensions by requesting the `./index` module from the Module Federation container. The `exposes` entry must be exactly `'./index': './src/index.tsx'` — do not rename or add additional entries. All API registrations must be reachable from that file. See [Architecture](./architecture.md#module-federation) for a full explanation.
 
@@ -255,6 +255,11 @@ module.exports = (env, argv) => {
     resolve: {
       extensions: ['.ts', '.tsx', '.js', '.jsx'],
     },
+    // Map @apache-superset/core imports to window.superset at runtime
+    externalsType: 'window',
+    externals: {
+      '@apache-superset/core': 'superset',
+    },
     module: {
       rules: [
         {
@@ -287,10 +292,6 @@ module.exports = (env, argv) => {
             requiredVersion: packageConfig.peerDependencies['antd'],
             import: false,
           },
-          '@apache-superset/core': {
-            singleton: true,
-            import: false, // Resolved to a per-extension instance by the loader
-          },
         },
       }),
     ],
@@ -497,7 +498,7 @@ Here's what happens when your extension loads:
 1. **Superset starts**: Reads `manifest.json` from the `.supx` bundle and loads the backend entrypoint
 2. **Backend registration**: `entrypoint.py` imports your API class, triggering the [`@api`](https://github.com/apache/superset/blob/master/superset-core/src/superset_core/rest_api/decorators.py) decorator to register it automatically
 3. **Frontend loads**: When SQL Lab opens, Superset fetches the remote entry file
-4. **Module Federation**: Webpack loads your extension module; the extension's `@apache-superset/core` import resolves to a per-extension instance injected into its container's share scope by the loader
+4. **Module Federation**: Webpack loads your extension module and resolves `@apache-superset/core` to `window.superset`
 5. **Registration**: The module executes at load time, calling `views.registerView` to register your panel
 6. **Rendering**: When the user opens your panel, React renders `<HelloWorldPanel />`
 7. **API call**: The component fetches data from `/extensions/my-org/hello-world/message`

docs/developer_docs/extensions/storage.md

@@ -1,465 +0,0 @@
----
-title: Storage
-sidebar_position: 8
----
-
-<!--
-Licensed to the Apache Software Foundation (ASF) under one
-or more contributor license agreements.  See the NOTICE file
-distributed with this work for additional information
-regarding copyright ownership.  The ASF licenses this file
-to you under the Apache License, Version 2.0 (the
-"License"); you may not use this file except in compliance
-with the License.  You may obtain a copy of the License at
-
-  http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing,
-software distributed under the License is distributed on an
-"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-KIND, either express or implied.  See the License for the
-specific language governing permissions and limitations
-under the License.
--->
-
-# Storage
-
-Superset Extensions have access to a managed storage API for persisting data. The storage system provides multiple tiers with different persistence characteristics, allowing extensions to choose the right storage for their needs.
-
-Each extension receives its own isolated storage namespace. When Superset loads your extension, it binds storage to your extension's unique identifier, ensuring data privacy—two extensions using the same key will never collide, and extensions cannot access each other's data.
-
-Storage is always accessed through the extension context via `getContext()`. This binding to the context is what ties every operation to the current extension's namespace.
-
-## Storage Tiers
-
-| Tier | Storage Type      | Context Property                           | Use Case                               |
-| ---- | ----------------- | ------------------------------------------ | -------------------------------------- |
-| 1    | Browser storage   | `ctx.storage.local`, `ctx.storage.session` | UI state, wizard progress, draft forms |
-| 2    | Server-side cache | `ctx.storage.ephemeral`                    | Job progress, temporary results        |
-| 3    | Database          | `ctx.storage.persistent`                   | Saved artifacts, durable config        |
-
-## Tier 1: Local State
-
-Browser-based storage that persists on the user's device. Use this for UI state and settings that don't need to sync across devices.
-
-### Why Use the API Instead of localStorage Directly?
-
-You might wonder why extensions should use `ctx.storage.local` instead of directly accessing `window.localStorage`. The managed API provides several benefits:
-
-- **Automatic namespacing**: Each extension's data is isolated. Two extensions using the same key name won't collide.
-- **User isolation**: By default, data is scoped to the current user, preventing data leakage between users on shared devices.
-- **Clean uninstall**: When an extension is uninstalled, all its data can be cleanly removed using prefix-based deletion.
-- **Future sandboxing**: The async API is designed for a future sandboxed execution model where extensions run in isolated contexts without direct DOM access.
-- **Consistent patterns**: The same API shape works across all storage tiers, making it easy to switch between them.
-
-### localState
-
-Data persists across browser sessions until explicitly deleted or the user clears browser storage.
-
-```typescript
-import { extensions } from '@apache-superset/core';
-
-const ctx = extensions.getContext();
-
-// Save sidebar state
-await ctx.storage.local.set('sidebar_collapsed', true);
-
-// Retrieve it later
-const isCollapsed = await ctx.storage.local.get('sidebar_collapsed');
-
-// Remove it
-await ctx.storage.local.remove('sidebar_collapsed');
-```
-
-### sessionState
-
-Data is cleared when the browser tab is closed. Use for transient state within a single session.
-
-```typescript
-import { extensions } from '@apache-superset/core';
-
-const ctx = extensions.getContext();
-
-// Save wizard progress (lost when tab closes)
-await ctx.storage.session.set('wizard_step', 3);
-await ctx.storage.session.set('unsaved_form', { name: 'Draft' });
-
-// Retrieve on page reload within same tab
-const step = await ctx.storage.session.get('wizard_step');
-```
-
-Tier 1 has no `shared` accessor. Browser storage is per-device, so a "shared" value would only be visible to other users of that same browser, not to other users of the extension generally — see `.shared` on [Tier 2](#tier-2-ephemeral-state) or [Tier 3](#tier-3-persistent-state) for storage that's actually shared across users.
-
-### When to Use Tier 1
-
-- UI state (sidebar collapsed, panel sizes)
-- Recently used items
-- Draft form values
-- Any data acceptable to lose if user clears browser
-
-### Limitations
-
-- Per-browser, per-device (not shared across devices)
-- Subject to browser storage quotas (~5-10 MB)
-- Not accessible from backend code
-
-## Tier 2: Ephemeral State
-
-Server-side cache storage with automatic TTL expiration. Use for temporary data that needs to be shared between frontend and backend, or persist across page reloads.
-
-TTL is required for every `set` call. The maximum allowed TTL is controlled by `MAX_TTL` in the server configuration.
-
-### Frontend Usage
-
-```typescript
-import { extensions } from '@apache-superset/core';
-
-const ctx = extensions.getContext();
-
-// Store with a 5-minute TTL
-await ctx.storage.ephemeral.set('job_progress', { pct: 42, status: 'running' }, { ttl: 300 });
-
-// Retrieve
-const progress = await ctx.storage.ephemeral.get('job_progress');
-
-// Remove
-await ctx.storage.ephemeral.remove('job_progress');
-```
-
-### Backend Usage
-
-```python
-from superset_core.extensions.context import get_context
-from superset_core.extensions.storage.ephemeral import EphemeralSetOptions
-
-ctx = get_context()
-
-# Store job progress with a 5-minute TTL
-ctx.storage.ephemeral.set(
-    'job_progress', {'pct': 42, 'status': 'running'}, EphemeralSetOptions(ttl=300)
-)
-
-# Retrieve
-progress = ctx.storage.ephemeral.get('job_progress')
-
-# Remove
-ctx.storage.ephemeral.remove('job_progress')
-```
-
-### Shared State
-
-For data that needs to be visible to all users:
-
-```typescript
-import { extensions } from '@apache-superset/core';
-
-const ctx = extensions.getContext();
-
-await ctx.storage.ephemeral.shared.set('shared_result', { data: [1, 2, 3] }, { ttl: 3600 });
-const result = await ctx.storage.ephemeral.shared.get('shared_result');
-```
-
-```python
-from superset_core.extensions.context import get_context
-from superset_core.extensions.storage.ephemeral import EphemeralSetOptions
-
-ctx = get_context()
-
-ctx.storage.ephemeral.shared.set(
-    'shared_result', {'data': [1, 2, 3]}, EphemeralSetOptions(ttl=3600)
-)
-result = ctx.storage.ephemeral.shared.get('shared_result')
-```
-
-### When to Use Tier 2
-
-- Background job progress indicators
-- Cross-request intermediate state
-- Query result previews
-- Temporary computation results
-- Any data that can be recomputed if lost
-
-### Limitations
-
-- Not guaranteed to survive server restarts
-- Subject to cache eviction under memory pressure
-- TTL-based expiration (data disappears after timeout)
-- TTL is required on every `set` call
-
-## Tier 3: Persistent State
-
-Database-backed storage that survives server restarts, cache evictions, and browser clears. Use for any data that must not be lost.
-
-### Frontend Usage
-
-```typescript
-import { extensions } from '@apache-superset/core';
-
-const ctx = extensions.getContext();
-
-// Store a saved SQL snippet
-await ctx.storage.persistent.set('snippet:top_customers', { sql: 'SELECT ...' });
-
-// Retrieve
-const snippet = await ctx.storage.persistent.get('snippet:top_customers');
-
-// Remove
-await ctx.storage.persistent.remove('snippet:top_customers');
-```
-
-### Backend Usage
-
-```python
-from superset_core.extensions.context import get_context
-
-ctx = get_context()
-
-# Store a saved SQL snippet
-ctx.storage.persistent.set('snippet:top_customers', {'sql': 'SELECT ...'})
-
-# Retrieve
-snippet = ctx.storage.persistent.get('snippet:top_customers')
-
-# Remove
-ctx.storage.persistent.remove('snippet:top_customers')
-```
-
-### Shared State
-
-For data that should be visible to all users of the extension:
-
-```typescript
-import { extensions } from '@apache-superset/core';
-
-const ctx = extensions.getContext();
-
-await ctx.storage.persistent.shared.set('global_config', { version: 2 });
-const config = await ctx.storage.persistent.shared.get('global_config');
-```
-
-```python
-from superset_core.extensions.context import get_context
-
-ctx = get_context()
-
-ctx.storage.persistent.shared.set('global_config', {'version': 2})
-config = ctx.storage.persistent.shared.get('global_config')
-```
-
-### Listing Entries
-
-Both the frontend and backend accessors support listing entries in the caller's scope, without needing to know every key in advance. `page` and `pageSize`/`page_size` are required on every call — `list()` always returns one page of results, never the whole result set, so there's no default that could make that fact easy to miss. Check the returned `count` (total entries matching the scope/filters, across all pages) against `pageSize`/`page_size` to know whether more pages exist.
-
-```typescript
-import { extensions } from '@apache-superset/core';
-
-const ctx = extensions.getContext();
-
-// Filter by resource
-const result = await ctx.storage.persistent.list({
-  resourceType: 'dashboard',
-  resourceUuid: '1234-uuid',
-  page: 0,
-  pageSize: 25,
-});
-result.entries.forEach(entry => {
-  console.log(entry.key, entry.value, entry.codec);
-});
-console.log(result.count); // total matching entries across all pages
-
-// Shared (global) scope
-const shared = await ctx.storage.persistent.shared.list({ page: 0, pageSize: 10 });
-```
-
-```python
-from superset_core.extensions.context import get_context
-from superset_core.extensions.storage.persistent import PersistentListOptions
-
-ctx = get_context()
-
-# Filter by resource
-result = ctx.storage.persistent.list(
-    PersistentListOptions(
-        resource_type="dashboard",
-        resource_uuid="1234-uuid",
-        page=0,
-        page_size=25,
-    )
-)
-for entry in result.entries:
-    print(entry.key, entry.value, entry.codec)
-print(result.count)  # total matching entries across all pages
-
-# Shared (global) scope
-shared = ctx.storage.persistent.shared.list(PersistentListOptions(page=0, page_size=10))
-```
-
-`resource_type`/`resource_uuid` filter to entries linked to one resource — since a single resource can have several keyed entries (e.g. `"layout"`, `"notes"`), this is how an extension enumerates all of them without tracking key names itself.
-
-There is no fixed limit on `page_size`, but the combined size of a requested page's values is checked against `MAX_LIST_PAYLOAD_SIZE` (see [Quotas](#quotas)) before any row's value is read from the database — a page that would exceed it is rejected rather than silently truncated, so reduce `page_size` and retry if that happens.
-
-Backend `list()` decodes every entry's value unconditionally. The REST API backing the frontend's `list()` call is more restrictive: an entry written with a codec that isn't safe to decode over the wire (e.g. `pickle`) comes back with `value: null` (its `codec` is still reported) rather than being decoded.
-
-### Enumerating and Managing Storage from the Backend
-
-`ctx.storage.persistent.list()` covers the common case of listing an extension's own entries. Backend extension code that needs lower-level bulk operations — for example, a cleanup routine that removes storage linked to resources that no longer exist, using filters `list()` doesn't expose — can use `superset_core.extensions.storage.dao.ExtensionStorageDAO` instead:
-
-```python
-from superset_core.extensions.storage.dao import ExtensionStorageDAO
-
-# All entries this extension has linked to a given resource type
-entries = ExtensionStorageDAO.filter_by(resource_type="my-resource-type")
-
-# Bulk-delete rows for resources that no longer exist
-orphaned = [e for e in entries if e.resource_uuid not in my_extension_live_resource_ids()]
-ExtensionStorageDAO.delete(orphaned)
-```
-
-`ExtensionStorageDAO` is automatically scoped to the calling extension's own rows — `extension_id` is never a parameter you pass, so there is no way to reach another extension's storage through this API. It supports the standard DAO operations `find_all`, `find_one_or_none`, `filter_by`, `query`, `update`, and `delete`. `create()` is not supported — it's a raw insert with no upsert dedup, quota check, or locking against the key `.set()` writes to, so use `ctx.storage.persistent.set()` to write a value instead.
-
-### When to Use Tier 3
-
-- Extension configuration that must survive restarts
-- User-specific saved artifacts that need to roam across devices and browsers (e.g. saved SQL snippets, annotations)
-- Any data where loss is unacceptable
-
-### Limitations
-
-- Higher latency than Tiers 1–2 (database round-trip per operation)
-- Subject to the per-value size limit configured via `EXTENSIONS_PERSISTENT_STORAGE.MAX_VALUE_SIZE` (see [Quotas](#quotas))
-- Subject to the per-extension quota configured via `EXTENSIONS_PERSISTENT_STORAGE.QUOTA_PER_EXTENSION` (see [Quotas](#quotas))
-- Requires a database migration when first deployed
-
-## Working with Binary Data
-
-Tiers 2 and 3 accept a `codec` option describing how `value` is encoded — `"json"` (the default) for JSON-native values, or `"binary"` for raw bytes. `list()` and `get()` report which codec an entry was written with via `entry.codec`.
-
-### Backend
-
-Backend code talks to the storage DAO directly and works with real Python `bytes` — no extra flag is needed:
-
-```python
-from superset_core.extensions.context import get_context
-from superset_core.extensions.storage.persistent import PersistentSetOptions
-
-ctx = get_context()
-
-with open('logo.png', 'rb') as f:
-    png_bytes = f.read()
-
-ctx.storage.persistent.set('logo', png_bytes, PersistentSetOptions(codec='binary'))
-
-stored = ctx.storage.persistent.get('logo')  # raw bytes back, unchanged
-```
-
-### Frontend
-
-The frontend SDK talks to the backend over a JSON REST API, which has no byte type — a binary value must be base64-encoded to travel in a JSON request body. There is no way for the SDK to infer this from a JS value's type, so it is never detected automatically: set `isBinary: true` explicitly whenever `value` is binary.
-
-```typescript
-import { extensions } from '@apache-superset/core';
-
-const ctx = extensions.getContext();
-
-const pngBytes = new Uint8Array([0x89, 0x50, 0x4e, 0x47 /* ... */]);
-await ctx.storage.persistent.set('logo', pngBytes, { isBinary: true });
-```
-
-`get()` returns a binary entry's value exactly as stored on the wire — a base64 string, not a `Uint8Array` — so decode it yourself:
-
-```typescript
-const base64 = await ctx.storage.persistent.get<string>('logo');
-const bytes = Uint8Array.from(atob(base64), c => c.charCodeAt(0));
-```
-
-`list()` entries report `isBinary` alongside `codec`, so you know which entries need decoding before you read `value`:
-
-```typescript
-const result = await ctx.storage.persistent.list({ page: 0, pageSize: 10 });
-result.entries.forEach(entry => {
-  const value = entry.isBinary
-    ? Uint8Array.from(atob(entry.value as string), c => c.charCodeAt(0))
-    : entry.value;
-});
-```
-
-## Key Patterns
-
-All storage keys are automatically namespaced:
-
-| Scope                  | Key Pattern                                        |
-| ---------------------- | -------------------------------------------------- |
-| User-scoped            | `superset-ext:{extension_id}:user:{user_id}:{key}` |
-| Shared (Tiers 2 and 3) | `superset-ext:{extension_id}:shared:{key}`         |
-
-This ensures:
-
-- Extensions cannot accidentally access each other's data
-- Users cannot see other users' data (by default)
-- Clean prefix-based deletion on uninstall
-
-## Configuration
-
-### Tier 2: Ephemeral Storage
-
-Administrators can configure the server-side cache backend in `superset_config.py`:
-
-```python
-EXTENSIONS_EPHEMERAL_STORAGE = {
-    # Use Redis for better performance in production
-    "CACHE_TYPE": "RedisCache",
-    "CACHE_REDIS_URL": "redis://localhost:6379/2",
-    "MAX_TTL": 604800,  # 7 days maximum TTL
-    "MAX_VALUE_SIZE": 100 * 1024,  # 100 KB maximum per stored value
-}
-```
-
-For development, the default `SupersetMetastoreCache` stores data in the metadata database.
-
-### Tier 3: Persistent Storage
-
-Tier 3 values are stored in the `extension_storage` database table. Values are stored unencrypted by default; encryption is opt-in per write, available via a `PersistentSetOptions`-shaped `encrypt` option:
-
-```typescript
-import { extensions } from '@apache-superset/core';
-
-const ctx = extensions.getContext();
-
-await ctx.storage.persistent.set('api_token', 'sk-...', { encrypt: true });
-const token = await ctx.storage.persistent.get('api_token');
-```
-
-```python
-from superset_core.extensions.context import get_context
-from superset_core.extensions.storage.persistent import PersistentSetOptions
-
-ctx = get_context()
-
-ctx.storage.persistent.set('api_token', 'sk-...', PersistentSetOptions(encrypt=True))
-token = ctx.storage.persistent.get('api_token')
-```
-
-Encryption reuses Superset's existing `EncryptedType` (from `sqlalchemy-utils`) rather than a separate mechanism — the same infrastructure used for database connection credentials. The key is not configured directly: user-scoped values are encrypted with a key derived per-user via HMAC-SHA256 from the deployment's `SECRET_KEY`, so ciphertext for one user cannot be decrypted as another's; shared/global values (written via `.shared`) use `SECRET_KEY` directly. The encryption engine (AES-CBC by default) can be changed for the whole deployment via the existing `SQLALCHEMY_ENCRYPTED_FIELD_ENGINE` config, the same setting that controls encryption for database credentials elsewhere in Superset — there is no separate key list or rotation mechanism specific to extension storage. When `SECRET_KEY` is rotated, extension storage rows are re-encrypted by the existing `SecretsMigrator` tooling alongside database credentials, with no extension-specific steps required.
-
-### Quotas
-
-Persistent storage is subject to per-value, per-list-page, and per-extension size limits, configured in `superset_config.py`:
-
-```python
-EXTENSIONS_PERSISTENT_STORAGE = {
-    # Maximum total bytes an extension may store across all of its rows
-    # (global, every user's, and shared). Defaults to 100 MB.
-    "QUOTA_PER_EXTENSION": 100 * 1024 * 1024,
-    # Maximum size (in bytes) of a single stored value. Defaults to 1 MB.
-    "MAX_VALUE_SIZE": 1024 * 1024,
-    # Maximum combined value size (in bytes) that a single list() page may
-    # return. Defaults to 10 MB.
-    "MAX_LIST_PAYLOAD_SIZE": 10 * 1024 * 1024,
-}
-```
-
-A write that would push the extension's total stored size over `QUOTA_PER_EXTENSION` is rejected — the frontend SDK's `set()` call rejects with an HTTP 413 response, and backend code calling `ctx.storage.persistent.set()` sees the corresponding exception raised. Overwriting an existing key nets out that key's own current size against usage first, so replacing a value with one of the same or smaller size never spuriously fails even when the extension is already near its quota.
-
-A write whose encoded value exceeds `MAX_VALUE_SIZE` is rejected outright, independently of the total quota.
-
-A `list()` call whose requested page would return more than `MAX_LIST_PAYLOAD_SIZE` combined bytes of value data is rejected — reduce `page`/`pageSize` and retry. This check runs against the page's stored sizes before any value is read from the database, so an oversized request fails fast. Because `list()`'s response is consumed as JSON in the browser, raising `MAX_LIST_PAYLOAD_SIZE` substantially above the default risks client-side memory and parse-time issues — treat the default as already generous rather than a floor to build up from.

docs/developer_docs/guidelines/design-guidelines.md

@@ -85,7 +85,7 @@ Often a product page will have the same title as the objects it contains. In thi
    Examples: Query A, Query B
 
 6. **Database names.** Always capitalize names of database engines and connectors.
-   Examples: Presto, Trino, Drill, Hive, Databricks, Google Sheets
+   Examples: Presto, Trino, Drill, Hive, Google Sheets
 
 ## Button Design Guidelines
 

docs/docs/using-superset/exporting-dashboard-data.mdx

@@ -1,99 +0,0 @@
----
-title: Exporting Dashboard Data to Excel
-hide_title: true
-sidebar_position: 7
-version: 1
----
-
-# Exporting Dashboard Data to Excel
-
-Superset can export every chart on a dashboard to a single Excel workbook, with
-each chart's underlying data rendered as its own worksheet. The export reflects
-the dashboard's currently applied filters and runs asynchronously: when it
-finishes, the requesting user receives an email with a time-limited download
-link.
-
-## Using the export
-
-From a dashboard, open the **... (actions) → Download** submenu and choose
-**Export Data to Excel**. The action appears for users who have the dashboard
-`can_export` permission. You'll see a confirmation that the export is being
-prepared; the workbook arrives by email when it's ready.
-
-A second option, **Export Images to Excel**, embeds each non-table chart as a
-rendered image (tables stay tabular) instead of exporting raw data. Because it
-renders charts through the headless webdriver, this option only appears when the
-webdriver screenshot feature flags are enabled (see the prerequisites below);
-which viz types stay tabular is controlled by `EXCEL_EXPORT_TABLE_VIZ_TYPES`.
-
-Notes on the generated workbook:
-
-- One worksheet per chart, named `{chart_id} - {chart title}` (truncated to
-  Excel's 31-character limit; the chart id keeps names unique).
-- Charts nested in tabs are included.
-- Data reflects the dashboard's active filter state at the time of export.
-- A chart with no saved query context is skipped and listed in the email; open
-  the chart in Explore and re-save it to include it next time.
-- Row counts per sheet are capped the same way as the chart-level CSV/Excel
-  export (`ROW_LIMIT`, bounded by `SQL_MAX_ROW`), and never exceed Excel's
-  per-sheet maximum.
-
-## Prerequisites
-
-This feature is **disabled by default**. It requires:
-
-1. **The `boto3` dependency.** It is not installed by default; install it with
-   `pip install apache-superset[excel-export]`. Without it, exports fail and the
-   user receives a failure email.
-2. **An S3 bucket.** Set `EXCEL_EXPORT_S3_BUCKET`. Until it is set, the export
-   endpoint returns `501` and the menu action surfaces a "not configured"
-   message.
-3. **A running Celery worker.** The export runs as a Celery task. If no worker
-   is running, the request is accepted but nothing is produced.
-4. **A configured SMTP transport.** The download link is delivered by email
-   using the same settings as alerts & reports (`SMTP_*`,
-   `EMAIL_REPORTS_SUBJECT_PREFIX`).
-
-**Export Images to Excel** additionally requires a working headless webdriver —
-the same infrastructure scheduled reports and thumbnails use (`WEBDRIVER_*`,
-plus the `ENABLE_DASHBOARD_SCREENSHOT_ENDPOINTS` and
-`ENABLE_DASHBOARD_DOWNLOAD_WEBDRIVER_SCREENSHOT` feature flags). The menu option
-is hidden when those flags are off; if the webdriver is unreachable, image
-charts come back empty even though the data export path still works.
-
-Deployments that override `CELERY_CONFIG` must add
-`"superset.tasks.export_dashboard_excel"` to the `imports` tuple, or the task
-will not register.
-
-## Configuration keys
-
-| Key | Default | Description |
-| --- | --- | --- |
-| `EXCEL_EXPORT_S3_BUCKET` | `None` | Destination bucket. Required; `501` if unset. |
-| `EXCEL_EXPORT_S3_KEY_PREFIX` | `"dashboard-exports/"` | Key prefix: `{prefix}{dashboard_id}/{job_id}.xlsx`. |
-| `EXCEL_EXPORT_LINK_TTL_SECONDS` | `86400` | Lifetime of the pre-signed download URL (24h). |
-| `EXCEL_EXPORT_S3_CLIENT_KWARGS` | `{}` | Extra kwargs for `boto3.client("s3", ...)` — e.g. `region_name`, or `endpoint_url` for MinIO/LocalStack. |
-| `EXCEL_EXPORT_TABLE_VIZ_TYPES` | `None` | Viz types kept tabular in **Export Images to Excel** mode; every other type is embedded as an image. `None` uses the built-in default (`table`, `pivot_table`, `pivot_table_v2`). |
-
-Credentials and region resolve through the standard boto3 chain (environment
-variables, shared config, or instance role) unless overridden via
-`EXCEL_EXPORT_S3_CLIENT_KWARGS`. The worker needs `s3:PutObject` on the bucket.
-
-## Security considerations
-
-- The emailed link is a **pre-signed S3 URL**: anyone who holds it can download
-  the workbook until it expires. Keep the bucket **private**, enable
-  encryption, and consider a lifecycle rule to delete objects after a few days.
-  Lower `EXCEL_EXPORT_LINK_TTL_SECONDS` if 24 hours is too long for your data.
-- The export runs with the requesting user's permissions; each chart's query is
-  access-checked, so users only ever receive data they are entitled to.
-
-## Limitations
-
-- **Embedded dashboards / guest tokens are not supported** in this version,
-  because guest users have no email address to deliver the link to. Logged-in
-  users viewing an embedded dashboard can still use the export.
-- The default **Export Data to Excel** mode exports data only (no visual
-  styling). Use **Export Images to Excel** to embed rendered chart images, which
-  requires the webdriver infrastructure described in the prerequisites.
-- Scheduled/automated exports are not part of this feature.

docs/docs/using-superset/sql-templating.mdx

@@ -146,9 +146,7 @@ The `where_in` filter converts the list to SQL format: `('value1', 'value2', 'va
 
 ### Time Filters
 
-`get_time_filter()` is the standard way to reference the selected time range in a virtual dataset.
-It returns a `TimeFilter` object with `from_expr` and `to_expr` — fully-formatted SQL expressions
-that should be used directly in `WHERE` clauses without quoting.
+For charts with time range filters:
 
 | Macro | Description |
 |-------|-------------|
@@ -200,9 +198,17 @@ GROUP BY category
 
 ## Testing Templates in SQL Lab
 
-Some variables like `filter_values()` only work when filters are applied from dashboards or charts. To test in SQL Lab:
+Some variables like `from_dttm` and `filter_values()` only work when filters are applied from dashboards or charts. To test in SQL Lab:
 
-**Option 1: Set test parameters**
+**Option 1: Use defaults**
+
+```sql
+SELECT *
+FROM orders
+WHERE date >= '{{ from_dttm | default("2024-01-01", true) }}'
+```
+
+**Option 2: Set test parameters**
 
 Add to the Parameters menu:
 
@@ -214,7 +220,7 @@ Add to the Parameters menu:
 }
 ```
 
-**Option 2: Use `{% set %}`**
+**Option 3: Use `{% set %}`**
 
 ```sql
 {% set start_date = "2024-01-01" %}

docs/package.json

@@ -53,20 +53,20 @@
     "@emotion/core": "^11.0.0",
     "@emotion/react": "^11.13.3",
     "@emotion/styled": "^11.14.1",
-    "@fontsource/fira-code": "^5.3.0",
-    "@fontsource/ibm-plex-mono": "^5.3.0",
-    "@fontsource/inter": "^5.3.0",
+    "@fontsource/fira-code": "^5.2.7",
+    "@fontsource/ibm-plex-mono": "^5.2.7",
+    "@fontsource/inter": "^5.2.8",
     "@mdx-js/react": "^3.1.1",
     "@saucelabs/theme-github-codeblock": "^0.3.0",
-    "@storybook/addon-docs": "^10.5.3",
+    "@storybook/addon-docs": "^10.5.0",
     "@superset-ui/core": "^0.20.4",
-    "@swc/core": "^1.15.46",
-    "antd": "^6.5.2",
-    "baseline-browser-mapping": "^2.11.1",
-    "caniuse-lite": "^1.0.30001806",
+    "@swc/core": "^1.15.43",
+    "antd": "^6.5.1",
+    "baseline-browser-mapping": "^2.10.43",
+    "caniuse-lite": "^1.0.30001805",
     "docusaurus-plugin-openapi-docs": "^5.1.2",
     "docusaurus-theme-openapi-docs": "^5.1.2",
-    "js-yaml": "^5.2.2",
+    "js-yaml": "^5.2.0",
     "json-bigint": "^1.0.0",
     "prism-react-renderer": "^2.4.1",
     "react": "^18.3.1",
@@ -77,8 +77,8 @@
     "react-table": "^7.8.0",
     "remark-import-partial": "^0.0.2",
     "reselect": "^5.2.0",
-    "storybook": "^10.5.3",
-    "swagger-ui-react": "^5.32.11",
+    "storybook": "^10.5.0",
+    "swagger-ui-react": "^5.32.8",
     "swc-loader": "^0.2.7",
     "tinycolor2": "^1.4.2",
     "unist-util-visit": "^5.1.0"
@@ -89,17 +89,17 @@
     "@eslint/js": "^9.39.2",
     "@types/js-yaml": "^4.0.9",
     "@types/react": "^19.1.8",
-    "@typescript-eslint/eslint-plugin": "^8.65.0",
-    "@typescript-eslint/parser": "^8.65.0",
+    "@typescript-eslint/eslint-plugin": "^8.64.0",
+    "@typescript-eslint/parser": "^8.64.0",
     "eslint": "^9.39.2",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-prettier": "^5.5.6",
     "eslint-plugin-react": "^7.37.5",
     "globals": "^17.7.0",
-    "prettier": "^3.9.6",
+    "prettier": "^3.9.5",
     "typescript": "~6.0.3",
-    "typescript-eslint": "^8.65.0",
-    "webpack": "^5.109.0"
+    "typescript-eslint": "^8.64.0",
+    "webpack": "^5.108.2"
   },
   "browserslist": {
     "production": [

docs/sidebarTutorials.js

@@ -82,14 +82,12 @@ const sidebars = {
           items: [
             'extensions/extension-points/sqllab',
             'extensions/extension-points/editors',
-            'extensions/extension-points/chat',
           ],
         },
         'extensions/development',
         'extensions/deployment',
         'extensions/mcp',
         'extensions/security',
-        'extensions/storage',
         'extensions/tasks',
         'extensions/registry',
       ],

docs/src/data/databases.json

@@ -1,16 +1,16 @@
 {
   "generated": "2026-04-17T17:08:35.132Z",
   "statistics": {
-    "totalDatabases": 81,
-    "withDocumentation": 81,
-    "withConnectionString": 81,
-    "withDrivers": 29,
+    "totalDatabases": 80,
+    "withDocumentation": 80,
+    "withConnectionString": 80,
+    "withDrivers": 28,
     "withAuthMethods": 5,
-    "supportsJoins": 75,
-    "supportsSubqueries": 78,
+    "supportsJoins": 74,
+    "supportsSubqueries": 77,
     "supportsDynamicSchema": 29,
     "supportsCatalog": 20,
-    "averageScore": 53,
+    "averageScore": 54,
     "maxScore": 201,
     "byCategory": {
       "Cloud - AWS": [
@@ -20,7 +20,6 @@
       ],
       "Query Engines": [
         "Amazon Athena",
-        "Apache DataFusion",
         "Apache Drill",
         "Apache Hive",
         "Apache Impala",
@@ -95,7 +94,6 @@
         "Vertica"
       ],
       "Apache Projects": [
-        "Apache DataFusion",
         "Apache Doris",
         "Apache Drill",
         "Apache Druid",
@@ -110,7 +108,6 @@
         "Databricks Interactive Cluster"
       ],
       "Open Source": [
-        "Apache DataFusion",
         "Apache Doris",
         "Apache Drill",
         "Apache Druid",
@@ -9701,97 +9698,6 @@
       "supports_dynamic_schema": true,
       "supports_catalog": true,
       "supports_dynamic_catalog": true
-    },
-    "Apache DataFusion": {
-      "time_grains": {
-        "SECOND": true,
-        "FIVE_SECONDS": true,
-        "THIRTY_SECONDS": true,
-        "MINUTE": true,
-        "FIVE_MINUTES": true,
-        "TEN_MINUTES": true,
-        "FIFTEEN_MINUTES": true,
-        "THIRTY_MINUTES": true,
-        "HALF_HOUR": false,
-        "HOUR": true,
-        "SIX_HOURS": false,
-        "DAY": true,
-        "WEEK": true,
-        "WEEK_STARTING_SUNDAY": false,
-        "WEEK_STARTING_MONDAY": false,
-        "WEEK_ENDING_SATURDAY": false,
-        "WEEK_ENDING_SUNDAY": false,
-        "MONTH": true,
-        "QUARTER": true,
-        "QUARTER_YEAR": false,
-        "YEAR": true
-      },
-      "module": "superset.db_engine_specs.datafusion",
-      "limit_method": 1,
-      "limit_clause": true,
-      "joins": true,
-      "subqueries": true,
-      "alias_in_select": true,
-      "alias_in_orderby": true,
-      "time_groupby_inline": false,
-      "alias_to_source_column": false,
-      "order_by_not_in_select": true,
-      "expressions_in_orderby": false,
-      "cte_in_subquery": true,
-      "max_column_name": null,
-      "sql_comments": true,
-      "escaped_colons": true,
-      "masked_encrypted_extra": false,
-      "column_type_mapping": false,
-      "function_names": false,
-      "user_impersonation": false,
-      "file_upload": false,
-      "get_extra_table_metadata": false,
-      "dbapi_exception_mapping": false,
-      "custom_errors": false,
-      "dynamic_schema": false,
-      "catalog": false,
-      "dynamic_catalog": false,
-      "ssh_tunneling": true,
-      "query_cancelation": false,
-      "get_metrics": false,
-      "where_latest_partition": false,
-      "expand_data": false,
-      "query_cost_estimation": false,
-      "sql_validation": false,
-      "score": 24,
-      "max_score": 201,
-      "documentation": {
-        "description": "DataFusion is a highly performant query engine",
-        "logo": "datafusion.png",
-        "homepage_url": "https://datafusion.apache.org/",
-        "categories": [
-          "Query Engines",
-          "Open Source",
-          "Apache Projects"
-        ],
-        "pypi_packages": [
-          "flightsql-dbapi"
-        ],
-        "connection_string": "datafusion://host:port",
-        "drivers": [
-          {
-            "name": "Arrow Flight SQL (Recommended)",
-            "pypi_package": "flightsql-dbapi",
-            "connection_string": "datafusion://host:port",
-            "is_recommended": true
-          }
-        ],
-        "category": "Apache Projects"
-      },
-      "engine": "datafusion",
-      "engine_name": "Apache DataFusion",
-      "engine_aliases": [],
-      "default_driver": "flightsql",
-      "supports_file_upload": false,
-      "supports_dynamic_schema": false,
-      "supports_catalog": false,
-      "supports_dynamic_catalog": false
     }
   }
 }

docs/static/.htaccess

@@ -28,9 +28,8 @@ RewriteRule ^(.*)$ https://superset.apache.org/$1 [R=301,L]
 # - *.googleapis.com, *.google.com, *.gstatic.com: Google Calendar embed, kapa.ai reCAPTCHA - all of these loaded with user consent, following policy laid out in https://privacy.apache.org/faq/committers.html
 # - github.com, *.github.com, *.githubusercontent.com: GitHub user-attachment images in docs (apex github.com serves user-attachments/* assets). Discussed/resolved in this thread: https://issues.apache.org/jira/browse/INFRA-25701?filter=-2 (DPA in place with GitHub)
 # - *.algolia.net, *.algolianet.com: Algolia DocSearch. Approved here: https://privacy.apache.org/faq/committers.html
-# - *.run.app: Google-owned domain (Google Cloud Run) used by the kapa.ai widget backend - only reached after explicit user acceptance when opening the widget, allowable per the policy laid out in https://privacy.apache.org/faq/committers.html
 # See: https://infra.apache.org/tools/csp.html
-SetEnv CSP_PROJECT_DOMAINS "widget.kapa.ai https://*.googleapis.com/ https://*.google.com/ https://*.gstatic.com/ https://github.com/ https://*.github.com/ https://*.githubusercontent.com/ https://*.algolia.net/ https://*.algolianet.com/ https://*.run.app/"
+SetEnv CSP_PROJECT_DOMAINS "widget.kapa.ai https://*.googleapis.com/ https://*.google.com/ https://*.gstatic.com/ https://github.com/ https://*.github.com/ https://*.githubusercontent.com/ https://*.algolia.net/ https://*.algolianet.com/"
 
 # REDIRECTS
 

docs/static/feature-flags.json

@@ -138,13 +138,6 @@
         "lifecycle": "testing",
         "description": "Allow users to export full CSV of table viz type. Warning: Could cause server memory/compute issues with large datasets."
       },
-      {
-        "name": "ASSIGN_CREATOR_GROUPS_AS_VIEWERS",
-        "default": false,
-        "lifecycle": "testing",
-        "description": "Share a newly created dashboard or chart read-only with every group its creator belongs to, unless the create payload names viewers explicitly. Requires ENABLE_VIEWERS. Narrows access: an asset with no viewers falls back to datasource permissions; one with viewers is limited to its editors and viewers, and dashboards must also be published before those viewers gain access.",
-        "category": "security"
-      },
       {
         "name": "AWS_DATABASE_IAM_AUTH",
         "default": false,
@@ -412,6 +405,12 @@
         "default": true,
         "lifecycle": "deprecated",
         "description": "Enable drill-to-detail functionality in charts"
+      },
+      {
+        "name": "ENABLE_JAVASCRIPT_CONTROLS",
+        "default": false,
+        "lifecycle": "deprecated",
+        "description": "Allow JavaScript in chart controls. WARNING: XSS security vulnerability!"
       }
     ]
   }

docs/yarn.lock

@@ -2529,20 +2529,20 @@
   resolved "https://registry.yarnpkg.com/@faker-js/faker/-/faker-5.5.3.tgz#18e3af6b8eae7984072bbeb0c0858474d7c4cefe"
   integrity sha512-R11tGE6yIFwqpaIqcfkcg7AICXzFg14+5h5v0TfF/9+RMDL6jhzCy/pxHVOfbALGdtVYdt6JdR21tuxEgl34dw==
 
-"@fontsource/fira-code@^5.3.0":
-  version "5.3.0"
-  resolved "https://registry.yarnpkg.com/@fontsource/fira-code/-/fira-code-5.3.0.tgz#487475cedfa1f7ba7650810ddce00b6c7b1b7a25"
-  integrity sha512-EJL968RJRkakubAj/coU8pSUaeTE5UNoRjtzAr6kGiSZ3jWuN8/AKWHwym/PFUaQL1q7IL/H+EXs4358YhrTBQ==
+"@fontsource/fira-code@^5.2.7":
+  version "5.2.7"
+  resolved "https://registry.yarnpkg.com/@fontsource/fira-code/-/fira-code-5.2.7.tgz#9ecbd909d53e7196a5d895b601747fe34491fc6a"
+  integrity sha512-tnB9NNund9TwIym8/7DMJe573nlPEQb+fKUV5GL8TBYXjIhDvL0D7mgmNVNQUPhXp+R7RylQeiBdkA4EbOHPGQ==
 
-"@fontsource/ibm-plex-mono@^5.3.0":
-  version "5.3.0"
-  resolved "https://registry.yarnpkg.com/@fontsource/ibm-plex-mono/-/ibm-plex-mono-5.3.0.tgz#1879699d104602d5331e28e103f33c3b1b766b17"
-  integrity sha512-eTgnZjZEGk1QtD3ZstF+Vclo2HLAni8YMy34/DxllwZvyz1lR/1RF/xTiAquOBO7MvqBx8D2Ig2WCPMVfdZu7Q==
+"@fontsource/ibm-plex-mono@^5.2.7":
+  version "5.2.7"
+  resolved "https://registry.yarnpkg.com/@fontsource/ibm-plex-mono/-/ibm-plex-mono-5.2.7.tgz#ef5b6f052115fdf6666208a5f8a0f13fcd7ba1fd"
+  integrity sha512-MKAb8qV+CaiMQn2B0dIi1OV3565NYzp3WN5b4oT6LTkk+F0jR6j0ZN+5BKJiIhffDC3rtBULsYZE65+0018z9w==
 
-"@fontsource/inter@^5.3.0":
-  version "5.3.0"
-  resolved "https://registry.yarnpkg.com/@fontsource/inter/-/inter-5.3.0.tgz#866278dc2357659f8be1755c8b67f29d3697b440"
-  integrity sha512-RofMylZmjlJEfELXeNHFWBRcSs75rGU/6bV2S2jfnvv/3rPXPGe0LgUJTklcHZ9lM4OZmAVFhcJPnACfb91A3g==
+"@fontsource/inter@^5.2.8":
+  version "5.2.8"
+  resolved "https://registry.yarnpkg.com/@fontsource/inter/-/inter-5.2.8.tgz#10c95d877d972c7de5bd4592309d42fb6a5e1a5b"
+  integrity sha512-P6r5WnJoKiNVV+zvW2xM13gNdFhAEpQ9dQJHt3naLvfg+LkF2ldgSLiF4T41lf1SQCM9QmkqPTn4TH568IRagg==
 
 "@hapi/hoek@^9.0.0", "@hapi/hoek@^9.3.0":
   version "9.3.0"
@@ -3779,7 +3779,7 @@
     "@rc-component/virtual-list" "^1.2.0"
     clsx "^2.1.1"
 
-"@rc-component/trigger@^3.0.0", "@rc-component/trigger@^3.10.1", "@rc-component/trigger@^3.6.15", "@rc-component/trigger@^3.7.1":
+"@rc-component/trigger@^3.0.0", "@rc-component/trigger@^3.10.0", "@rc-component/trigger@^3.6.15", "@rc-component/trigger@^3.7.1":
   version "3.10.1"
   resolved "https://registry.yarnpkg.com/@rc-component/trigger/-/trigger-3.10.1.tgz#cb28e1bc0745a2af6897dd7ec774f9b56dc88f86"
   integrity sha512-mXlDN0IXdtV8Yqqm8195ECCyrbmfvvfKvwVvSlH0+qvKD6BUF8gRhEjSy0FOcD1+CcDRHgTiX99LoxfQrmh3Cw==
@@ -3798,13 +3798,13 @@
     "@rc-component/util" "^1.11.1"
     clsx "^2.1.1"
 
-"@rc-component/util@^1.10.1", "@rc-component/util@^1.11.0", "@rc-component/util@^1.11.1", "@rc-component/util@^1.12.0", "@rc-component/util@^1.2.0", "@rc-component/util@^1.2.1", "@rc-component/util@^1.3.0", "@rc-component/util@^1.4.0", "@rc-component/util@^1.7.0", "@rc-component/util@^1.9.0":
-  version "1.12.0"
-  resolved "https://registry.yarnpkg.com/@rc-component/util/-/util-1.12.0.tgz#58e453585810bcb8a35ff1aafd5e01187457b86f"
-  integrity sha512-AEjPL8JVdohIITaiXokyjL9WQ6tKWWjAYK9QU16tGNE9JaQABBQy+hA4H2Lup5MgXy9yY3iLrbZJheuU13hTdQ==
+"@rc-component/util@^1.10.1", "@rc-component/util@^1.11.0", "@rc-component/util@^1.11.1", "@rc-component/util@^1.2.0", "@rc-component/util@^1.2.1", "@rc-component/util@^1.3.0", "@rc-component/util@^1.4.0", "@rc-component/util@^1.7.0", "@rc-component/util@^1.9.0":
+  version "1.11.1"
+  resolved "https://registry.yarnpkg.com/@rc-component/util/-/util-1.11.1.tgz#07d698908339c55648e4f974afa739345e65b483"
+  integrity sha512-awVlI3ub2vqfqkYxOBc/uQ0efm3jw0wcrhtO/YWLyZfxiKXczKwNbVuhlnyxytDt7H9pbbVQiqr+O6MLATtRYg==
   dependencies:
     is-mobile "^5.0.0"
-    react-is "^19.2.7"
+    react-is "^18.2.0"
 
 "@rc-component/virtual-list@^1.0.1", "@rc-component/virtual-list@^1.2.0":
   version "1.2.0"
@@ -4005,23 +4005,23 @@
   resolved "https://registry.yarnpkg.com/@standard-schema/utils/-/utils-0.3.0.tgz#3d5e608f16c2390c10528e98e59aef6bf73cae7b"
   integrity sha512-e7Mew686owMaPJVNNLs55PUvgz371nKgwsc4vxE49zsODpJEnxgxRo2y/OKrqueavXgZNMDVj3DdHFlaSAeU8g==
 
-"@storybook/addon-docs@^10.5.3":
-  version "10.5.3"
-  resolved "https://registry.yarnpkg.com/@storybook/addon-docs/-/addon-docs-10.5.3.tgz#b5666cf20361d85c98cc836b2bfcdbbb72af3e97"
-  integrity sha512-MI1VDMSMQk78YxjIdt7WlrVOiA3TzTP00lRed1LeXh0fCvA9jxz9YXJI2+XigsLaxCSuOAEf/l35/GTLDMHD8A==
+"@storybook/addon-docs@^10.5.0":
+  version "10.5.2"
+  resolved "https://registry.yarnpkg.com/@storybook/addon-docs/-/addon-docs-10.5.2.tgz#e8023d1a68f637de9188be093f719895a8252d19"
+  integrity sha512-MoBANDsh5qEA14U+JaBoQcYsKbayJDDMopigFN0NdVAsZTdBfVIsL7cnjTFBL6ubB3ifb5M0tCXbScpml1KqiQ==
   dependencies:
     "@mdx-js/react" "^3.0.0"
-    "@storybook/csf-plugin" "10.5.3"
+    "@storybook/csf-plugin" "10.5.2"
     "@storybook/icons" "^2.0.2"
-    "@storybook/react-dom-shim" "10.5.3"
+    "@storybook/react-dom-shim" "10.5.2"
     react "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
     react-dom "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
     ts-dedent "^2.0.0"
 
-"@storybook/csf-plugin@10.5.3":
-  version "10.5.3"
-  resolved "https://registry.yarnpkg.com/@storybook/csf-plugin/-/csf-plugin-10.5.3.tgz#0818709c2761910f1e42710f6231f773eb97fb41"
-  integrity sha512-mkPq6zru8fN5+46uC1cZEbKW2ws1hh9KvF4g4/Gu8pNbKnvqULPhk0/Bf0ZCtlr7zI7DvcFhyCy3dbvN+2n4Gw==
+"@storybook/csf-plugin@10.5.2":
+  version "10.5.2"
+  resolved "https://registry.yarnpkg.com/@storybook/csf-plugin/-/csf-plugin-10.5.2.tgz#a359dffe0b842dfffacb0e94ad98da0ccb13ba69"
+  integrity sha512-PK/wXiALFf88mt4HmDtiZJ6NRvhExSXEM9uFIN+OIHxGqg7Xbp6MB0SPdhsTbMY9720ahiu/DJx5iIzkidcA3w==
   dependencies:
     unplugin "^2.3.5"
 
@@ -4035,10 +4035,10 @@
   resolved "https://registry.yarnpkg.com/@storybook/icons/-/icons-2.1.0.tgz#edfc2450a39c5e780f28c6cbc49acd7bff59b41a"
   integrity sha512-Fxh9vYpX9bQqFeHRiY8h2ApeRGDzRSMLwJwNZ/AIRqnyOKHxRKL+yFe+ctEkVJmuptRE9u1Hrn8ZZNHyfDKKNg==
 
-"@storybook/react-dom-shim@10.5.3":
-  version "10.5.3"
-  resolved "https://registry.yarnpkg.com/@storybook/react-dom-shim/-/react-dom-shim-10.5.3.tgz#e176a6549aa02002e375cb66467a00c5403745f8"
-  integrity sha512-eUWBsRRax5R3MDJVFs/CrFDF1bYS58AMB9tX02lLRuiZe6xy1cKh3CRFS+2xH571l0fNaXQ+7j69TOJ0fk2tmA==
+"@storybook/react-dom-shim@10.5.2":
+  version "10.5.2"
+  resolved "https://registry.yarnpkg.com/@storybook/react-dom-shim/-/react-dom-shim-10.5.2.tgz#993077c517ee1a1c065c82bf0143ae08856a3c90"
+  integrity sha512-TbdYVLuD7gwj1CFsDJhCHUiwfVmzFWzalKEUGy9XgXyNpyOV1CYRsdmRdhaOHgmn2ljQZuTAxSnG7NlElghVaw==
 
 "@superset-ui/core@^0.20.4":
   version "0.20.4"
@@ -4697,86 +4697,86 @@
   dependencies:
     apg-lite "^1.0.4"
 
-"@swc/core-darwin-arm64@1.15.46":
-  version "1.15.46"
-  resolved "https://registry.yarnpkg.com/@swc/core-darwin-arm64/-/core-darwin-arm64-1.15.46.tgz#393903c7eda790dbd89abd8fa0afdd9041543e5f"
-  integrity sha512-IsISIT22EfktVJrlvIpnAxG2u/A9aob9l99HMlx80x72WlFmFPk1V3UhkEzx86eJP8hw049KTFv/RISho2cq2Q==
+"@swc/core-darwin-arm64@1.15.43":
+  version "1.15.43"
+  resolved "https://registry.yarnpkg.com/@swc/core-darwin-arm64/-/core-darwin-arm64-1.15.43.tgz#386294f8427dde2df1a70dd0a5826d67af70e996"
+  integrity sha512-v1aVuvXdo/BHxJzco9V2xpHrvwWmhfS8t6gziY5wJxd+Z2h8AeJRnAwPD8itCDaGXVBwJ/CaKfxEzTkG0Va0OA==
 
-"@swc/core-darwin-x64@1.15.46":
-  version "1.15.46"
-  resolved "https://registry.yarnpkg.com/@swc/core-darwin-x64/-/core-darwin-x64-1.15.46.tgz#ddf16787e320636621180df480a3490fd9a868ca"
-  integrity sha512-4Tj4ppVIPCmUMpmGFiGtyEriwLyJ+yi/US4WfBrP/ok8COGddDZXLEzQETnKyK46mjvr1v0jevrS23zjoff7vA==
+"@swc/core-darwin-x64@1.15.43":
+  version "1.15.43"
+  resolved "https://registry.yarnpkg.com/@swc/core-darwin-x64/-/core-darwin-x64-1.15.43.tgz#c4823529c424e2ae25b7eb786438474741521fcb"
+  integrity sha512-lp3d4Lamc8dt5huYdGLSR+9hLxmfr1jb0l+4XXG2zPqZwYWRN9R0U2qYoTrggiU2RWW0oV9VbWM3kBnqIc2kdQ==
 
-"@swc/core-linux-arm-gnueabihf@1.15.46":
-  version "1.15.46"
-  resolved "https://registry.yarnpkg.com/@swc/core-linux-arm-gnueabihf/-/core-linux-arm-gnueabihf-1.15.46.tgz#7bee01b7311c43b913771ef9c7012931871de73b"
-  integrity sha512-i8tUGnNjyOgMmfmgFSg4aeJLQoFyfpIHK5FjpQAwpRyQIqEUB2w1e8zIDQzY1WhOxx8NoS1S5iUL813Un4Sf5A==
+"@swc/core-linux-arm-gnueabihf@1.15.43":
+  version "1.15.43"
+  resolved "https://registry.yarnpkg.com/@swc/core-linux-arm-gnueabihf/-/core-linux-arm-gnueabihf-1.15.43.tgz#c0a0ed17cffc5d4af192935667f12f05feeb39f9"
+  integrity sha512-JWTQQELtsG5GgphDrr/XqqmM2pDN3cZqbMS0Mrg+iTiXL3F74sn/S2IyYE/5u4h2KLkTf9qQ7dXyxsbx7YzkeA==
 
-"@swc/core-linux-arm64-gnu@1.15.46":
-  version "1.15.46"
-  resolved "https://registry.yarnpkg.com/@swc/core-linux-arm64-gnu/-/core-linux-arm64-gnu-1.15.46.tgz#964596d757d18f04a02873d85a3660416c09c187"
-  integrity sha512-c0OnhqzdhfOvv6qhNCcByepB+sNYOGZyhtr2Qa6ZCHvAWTYhSRw4j/u92Stue9PbZ/6q74b9nHzi76+kVzqQHQ==
+"@swc/core-linux-arm64-gnu@1.15.43":
+  version "1.15.43"
+  resolved "https://registry.yarnpkg.com/@swc/core-linux-arm64-gnu/-/core-linux-arm64-gnu-1.15.43.tgz#1eb2d9c5eeee5bb9d00599b475ddc31dc2870d22"
+  integrity sha512-B4otJRdPWIsmiSBf0uG7Z/+vMWmkufjz5MmYxubwKuZazDW14Zd3symga1N62QR4RT+kEFeHEgsXfZGyn/w0hw==
 
-"@swc/core-linux-arm64-musl@1.15.46":
-  version "1.15.46"
-  resolved "https://registry.yarnpkg.com/@swc/core-linux-arm64-musl/-/core-linux-arm64-musl-1.15.46.tgz#213d3ece772689a8166ed51064836346c6ce1c2a"
-  integrity sha512-imyRpNEcUzFQFV2LE4jL68ErvmKEuZCbvZru77iQREunJ+bR4i658cupTgtG1mLYM3F1Tzy3Sb9xYb02KghWTg==
+"@swc/core-linux-arm64-musl@1.15.43":
+  version "1.15.43"
+  resolved "https://registry.yarnpkg.com/@swc/core-linux-arm64-musl/-/core-linux-arm64-musl-1.15.43.tgz#ea6b5c38088f3921a57922d3931b2d74fd23a9fd"
+  integrity sha512-6zB6OnpViBxYy4tgY3v2i6AZY9fwkcHZ032UOwtwUuW1d19sdT07qF0kZe6/3UR1tUaK6jjg2rmVcUIBCEYVjQ==
 
-"@swc/core-linux-ppc64-gnu@1.15.46":
-  version "1.15.46"
-  resolved "https://registry.yarnpkg.com/@swc/core-linux-ppc64-gnu/-/core-linux-ppc64-gnu-1.15.46.tgz#4d2ec554103c6bef60cc1e294f374ea5a5edaf78"
-  integrity sha512-ctEfcl/HcUeomK33cbySiHZm98GEDIxTm1EkpBsYCiHxElYBzvTXVeuQT2YwbUXn9XCrjiw4ipyUNk33k26qRg==
+"@swc/core-linux-ppc64-gnu@1.15.43":
+  version "1.15.43"
+  resolved "https://registry.yarnpkg.com/@swc/core-linux-ppc64-gnu/-/core-linux-ppc64-gnu-1.15.43.tgz#538fac30bbd5f1e678bb7bac9ccc62246a6f6d7a"
+  integrity sha512-coxE1ZWdB3uSDVNoEtYNrRi/1epvckZx9cTJ8ICUxTMTxGk+yvQ/Twacp3ruZSaMPGCriUjP86C37VhaT6nyRg==
 
-"@swc/core-linux-s390x-gnu@1.15.46":
-  version "1.15.46"
-  resolved "https://registry.yarnpkg.com/@swc/core-linux-s390x-gnu/-/core-linux-s390x-gnu-1.15.46.tgz#097a19792ec22e2f51f6bfac02da1e0b3f5e5bb1"
-  integrity sha512-DxlMdnt84TtRVTv7WL/thWyz9+QU8QZNNoAP9rrk0P68LziuhfePp8MjQ44zIprpTHTsEwyziIuGUUN5iSC1bQ==
+"@swc/core-linux-s390x-gnu@1.15.43":
+  version "1.15.43"
+  resolved "https://registry.yarnpkg.com/@swc/core-linux-s390x-gnu/-/core-linux-s390x-gnu-1.15.43.tgz#ee564b45f3f578b1fc82136c4dab163189316641"
+  integrity sha512-lXfLhs+LpBsD5inuYx+YDH5WsPPBQ95KPUiy8P5wq9ob9xKDZFqwNfU2QW6bGO8NqRO/H9JQomTSt5Yyh+FGfA==
 
-"@swc/core-linux-x64-gnu@1.15.46":
-  version "1.15.46"
-  resolved "https://registry.yarnpkg.com/@swc/core-linux-x64-gnu/-/core-linux-x64-gnu-1.15.46.tgz#39c1ca215f9ca643a4aa3ca6250cc38ba5f5c673"
-  integrity sha512-SKxI7J6t90XPl8hRUqtJi9NfGdunN/E/vZMc7Bc0figeRdOPDBT+Tm8g7cx9xM0T0mewh2l+8dewa3Am27/P+A==
+"@swc/core-linux-x64-gnu@1.15.43":
+  version "1.15.43"
+  resolved "https://registry.yarnpkg.com/@swc/core-linux-x64-gnu/-/core-linux-x64-gnu-1.15.43.tgz#e6e3bfea76921c7f5e16d50a126615f2e04ce1c8"
+  integrity sha512-07XnKwTmKy8TGOZG3D9fRnLWGynxPjwQnZLVmBFbo6F+7vHYzBIOuwXEhemrChBWb6yDNZsVCcMWCPX6FDD2xg==
 
-"@swc/core-linux-x64-musl@1.15.46":
-  version "1.15.46"
-  resolved "https://registry.yarnpkg.com/@swc/core-linux-x64-musl/-/core-linux-x64-musl-1.15.46.tgz#323a720bc965fffeedacdc3167b46a291553b5e0"
-  integrity sha512-qj9T6B7bosI0VEsrWOVXZN1OXxS8Tp63ywyrLxNdOycnUtLdkgYcoBsN5y8ImnDDsnwrEWZOy1e+J4xSe7mA3Q==
+"@swc/core-linux-x64-musl@1.15.43":
+  version "1.15.43"
+  resolved "https://registry.yarnpkg.com/@swc/core-linux-x64-musl/-/core-linux-x64-musl-1.15.43.tgz#539f6f2721c0cc32e5db5cf0d453c82045f6662d"
+  integrity sha512-TJc+bsSIaBh+hZvZ5GRtW/K1bw66TJ9vsUwvVIsZdiWxU5ObLwZvfcnZ3UpgVfMnFibRes9uriJrQNBHEEogRQ==
 
-"@swc/core-win32-arm64-msvc@1.15.46":
-  version "1.15.46"
-  resolved "https://registry.yarnpkg.com/@swc/core-win32-arm64-msvc/-/core-win32-arm64-msvc-1.15.46.tgz#9c2cfd2a59be74671a018097b8914f8cfbcc698d"
-  integrity sha512-8p7l4c3LU+eA5g9Et1JPhNeMC1oQwXTGU+uah8DPIBX7YXzqswvaBtyKVmXefVGi/DJU1x3YJsc3mbAp9aWzSQ==
+"@swc/core-win32-arm64-msvc@1.15.43":
+  version "1.15.43"
+  resolved "https://registry.yarnpkg.com/@swc/core-win32-arm64-msvc/-/core-win32-arm64-msvc-1.15.43.tgz#b7bb6b611d484ac19d0ee21469e7012d646c28b5"
+  integrity sha512-jfd7s2/bUQYkOHLs+LWQNKZdmDa8+sufKLllhpWAhVQ2GDCwsHe3vR/j+OSiItZNtkzFuaawa3+SAKz9y5gYfw==
 
-"@swc/core-win32-ia32-msvc@1.15.46":
-  version "1.15.46"
-  resolved "https://registry.yarnpkg.com/@swc/core-win32-ia32-msvc/-/core-win32-ia32-msvc-1.15.46.tgz#bd7bd009a47b0f9826212e7ed36385d32fe193d8"
-  integrity sha512-tUEnfr3Bn9u6FOjUb3PN9p+09qZC2j+wNDLKHzXXZn22rqGcUqR/ohCRSS+nG9B9+X+U+3FewNEHJkTmdIvMjQ==
+"@swc/core-win32-ia32-msvc@1.15.43":
+  version "1.15.43"
+  resolved "https://registry.yarnpkg.com/@swc/core-win32-ia32-msvc/-/core-win32-ia32-msvc-1.15.43.tgz#e5b25722a7d27bb0c9a9bdee7863f29c8674364e"
+  integrity sha512-rLAE8JvucqEW1ZGohxPQrQWPBQeJG4+ypKbWfdlU/qmKScvCkxf9/Jxnzki1dkUQCQ7P5Enp13RlvqOlvx/32g==
 
-"@swc/core-win32-x64-msvc@1.15.46":
-  version "1.15.46"
-  resolved "https://registry.yarnpkg.com/@swc/core-win32-x64-msvc/-/core-win32-x64-msvc-1.15.46.tgz#8371845a5bdb330cf05b009f602bb8c4636c6beb"
-  integrity sha512-Vux7UDzBJYQggSuPfcl2w9iu+IJpgpRCxHzgCaVkELnAXAE4XZMOTX9HNcaNiwfeIDqdu2rkr69RuDm6wY8neA==
+"@swc/core-win32-x64-msvc@1.15.43":
+  version "1.15.43"
+  resolved "https://registry.yarnpkg.com/@swc/core-win32-x64-msvc/-/core-win32-x64-msvc-1.15.43.tgz#d28842621201c345383d468d40c09648b6cd6e68"
+  integrity sha512-h8MLDHZcfIukwQWj03rIJZx1I0E81AYj2X7J/nGErG4nz+QAv6G1Z+peotvinL3lqpbo32tLYSMFo32/ySzxKg==
 
-"@swc/core@^1.15.40", "@swc/core@^1.15.46":
-  version "1.15.46"
-  resolved "https://registry.yarnpkg.com/@swc/core/-/core-1.15.46.tgz#8acc0f68ee55010fdc876adf2a8faf0b097c681b"
-  integrity sha512-Ri3em2mBpq3h2zSPliCYl63otDGqek8PPEfv2nWgRQEbZ/VBCNyypVTVQ6cEbTCXBhy+WE2T3fQb08moIyuYaw==
+"@swc/core@^1.15.40", "@swc/core@^1.15.43":
+  version "1.15.43"
+  resolved "https://registry.yarnpkg.com/@swc/core/-/core-1.15.43.tgz#653e6573968fd5c74163b9885ea0a933012c9f22"
+  integrity sha512-1CuKjFkPxIgGdeHVuNbkxmBxkcbdc08u0aiI43pFq6yY1tTVKmXT9hFEooyyKs/sJ3xf1GPHyEwTtk9Xl8dvQw==
   dependencies:
     "@swc/counter" "^0.1.3"
     "@swc/types" "^0.1.27"
   optionalDependencies:
-    "@swc/core-darwin-arm64" "1.15.46"
-    "@swc/core-darwin-x64" "1.15.46"
-    "@swc/core-linux-arm-gnueabihf" "1.15.46"
-    "@swc/core-linux-arm64-gnu" "1.15.46"
-    "@swc/core-linux-arm64-musl" "1.15.46"
-    "@swc/core-linux-ppc64-gnu" "1.15.46"
-    "@swc/core-linux-s390x-gnu" "1.15.46"
-    "@swc/core-linux-x64-gnu" "1.15.46"
-    "@swc/core-linux-x64-musl" "1.15.46"
-    "@swc/core-win32-arm64-msvc" "1.15.46"
-    "@swc/core-win32-ia32-msvc" "1.15.46"
-    "@swc/core-win32-x64-msvc" "1.15.46"
+    "@swc/core-darwin-arm64" "1.15.43"
+    "@swc/core-darwin-x64" "1.15.43"
+    "@swc/core-linux-arm-gnueabihf" "1.15.43"
+    "@swc/core-linux-arm64-gnu" "1.15.43"
+    "@swc/core-linux-arm64-musl" "1.15.43"
+    "@swc/core-linux-ppc64-gnu" "1.15.43"
+    "@swc/core-linux-s390x-gnu" "1.15.43"
+    "@swc/core-linux-x64-gnu" "1.15.43"
+    "@swc/core-linux-x64-musl" "1.15.43"
+    "@swc/core-win32-arm64-msvc" "1.15.43"
+    "@swc/core-win32-ia32-msvc" "1.15.43"
+    "@swc/core-win32-x64-msvc" "1.15.43"
 
 "@swc/counter@^0.1.3":
   version "0.1.3"
@@ -5527,100 +5527,100 @@
   dependencies:
     "@types/yargs-parser" "*"
 
-"@typescript-eslint/eslint-plugin@8.65.0", "@typescript-eslint/eslint-plugin@^8.65.0":
-  version "8.65.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.65.0.tgz#0a58df6fea8c0bf6b396f518077099bc8b762bb5"
-  integrity sha512-IEgob78X12rHpUmtcwFsXhZdVGJtwTVP8FiCLZkR6GlYVrl2PcuB+KhCE5BlVC/eQpQnu8WXRtkHZuPar+gCRA==
+"@typescript-eslint/eslint-plugin@8.64.0", "@typescript-eslint/eslint-plugin@^8.64.0":
+  version "8.64.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.64.0.tgz#71a0c3d5f8a5e6c5dfdb4f0f04bd1bfb572d5e24"
+  integrity sha512-CGvQPBxN3wZLu6Rz2kFUpZeoCm78xUic92ck39KPePkO1NPOwjCqdQnm5Q87tpWw9vcBvW8XLrDXjH9PWYtJ3Q==
   dependencies:
     "@eslint-community/regexpp" "^4.12.2"
-    "@typescript-eslint/scope-manager" "8.65.0"
-    "@typescript-eslint/type-utils" "8.65.0"
-    "@typescript-eslint/utils" "8.65.0"
-    "@typescript-eslint/visitor-keys" "8.65.0"
+    "@typescript-eslint/scope-manager" "8.64.0"
+    "@typescript-eslint/type-utils" "8.64.0"
+    "@typescript-eslint/utils" "8.64.0"
+    "@typescript-eslint/visitor-keys" "8.64.0"
     ignore "^7.0.5"
     natural-compare "^1.4.0"
     ts-api-utils "^2.5.0"
 
-"@typescript-eslint/parser@8.65.0", "@typescript-eslint/parser@^8.65.0":
-  version "8.65.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/parser/-/parser-8.65.0.tgz#5295c1058c0a1dd746ef28baaf9c0341dbdf03dc"
-  integrity sha512-CZ4nMxWwgu1HEEFNkeaCptra9QCtkmKdgf3sWh1rl1trIhmxLilgTV4cwcbQ4wemnT4sWQN8CaKOmdYx+g2gMA==
+"@typescript-eslint/parser@8.64.0", "@typescript-eslint/parser@^8.64.0":
+  version "8.64.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/parser/-/parser-8.64.0.tgz#c9864a1cc28a13ff29a7314fbdef0528bb122f72"
+  integrity sha512-KA0OshtlcCCXmbfqyZkM5pV3/WNraJf7DkJRLpyrmwPtud57H5BDX7C3k0LPSPxpprfRL+cJDGabF10mvNCoCw==
   dependencies:
-    "@typescript-eslint/scope-manager" "8.65.0"
-    "@typescript-eslint/types" "8.65.0"
-    "@typescript-eslint/typescript-estree" "8.65.0"
-    "@typescript-eslint/visitor-keys" "8.65.0"
+    "@typescript-eslint/scope-manager" "8.64.0"
+    "@typescript-eslint/types" "8.64.0"
+    "@typescript-eslint/typescript-estree" "8.64.0"
+    "@typescript-eslint/visitor-keys" "8.64.0"
     debug "^4.4.3"
 
-"@typescript-eslint/project-service@8.65.0":
-  version "8.65.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/project-service/-/project-service-8.65.0.tgz#65fbbc9a1591abffaeab5513200f848271cb0aa5"
-  integrity sha512-SxnPhbTsGahizDgbu7oqFH/xVtzIqMd/s+WtnSxNxJZJpLbdT5IPdzg8EZxO3+PoKahXmwJLeNQOpKJb3/bi7Q==
+"@typescript-eslint/project-service@8.64.0":
+  version "8.64.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/project-service/-/project-service-8.64.0.tgz#14c4e29390d7325a7f8a1218c2788fd649b85da6"
+  integrity sha512-tk4WpOJ6IEbGrVHaNmM0YRrwAD3exZlIK3iadQNAxh4YKk6jvUQ4ecq18n+v7+meh+cJ3j+D8nbk8sRKhlwLQg==
   dependencies:
-    "@typescript-eslint/tsconfig-utils" "^8.65.0"
-    "@typescript-eslint/types" "^8.65.0"
+    "@typescript-eslint/tsconfig-utils" "^8.64.0"
+    "@typescript-eslint/types" "^8.64.0"
     debug "^4.4.3"
 
-"@typescript-eslint/scope-manager@8.65.0":
-  version "8.65.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/scope-manager/-/scope-manager-8.65.0.tgz#9547202ce7e608e7b6283df585703b980a0ea70d"
-  integrity sha512-Esbl8OSYiVxBokYgWPf7VVWg/BE798wXhimnn9ML9Pt5qoDf8bfQlgjlKXR/k98+AcNzlLKYrpCcrcuZ9DZLgg==
+"@typescript-eslint/scope-manager@8.64.0":
+  version "8.64.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/scope-manager/-/scope-manager-8.64.0.tgz#d45f15304a94c85c39db317b717b158fb6259958"
+  integrity sha512-CXEaFdYXjSTgKhisNkwCcJwTP8Pl+fmRrEQrri4nm3vU743bALrxzLmq7fHG/7e6a5xO0lDYeURpZmBuhHk54w==
   dependencies:
-    "@typescript-eslint/types" "8.65.0"
-    "@typescript-eslint/visitor-keys" "8.65.0"
+    "@typescript-eslint/types" "8.64.0"
+    "@typescript-eslint/visitor-keys" "8.64.0"
 
-"@typescript-eslint/tsconfig-utils@8.65.0", "@typescript-eslint/tsconfig-utils@^8.65.0":
-  version "8.65.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.65.0.tgz#36f168fcdbb1295f7446ff0379667f98c3cf1bf3"
-  integrity sha512-j6GzGqCiRdA7Qhur2VVmKZAkBLfnHFQfx4TaJGL9RMveZqCo48jSHHO0DTgizEnGhtWnqmbtCUSrqSkdiY/0Hg==
+"@typescript-eslint/tsconfig-utils@8.64.0", "@typescript-eslint/tsconfig-utils@^8.64.0":
+  version "8.64.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.64.0.tgz#c62ac8ea9173c3cac8b38b8e66e30a046b548851"
+  integrity sha512-2yo8rRNKuzbVWQp5kslhANqZ2uDAeROQHBRZNPu8JDsHmeFNj/XJJhX/FhNUWmkHHvoNsKa6+tHJiig87EzsQw==
 
-"@typescript-eslint/type-utils@8.65.0":
-  version "8.65.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/type-utils/-/type-utils-8.65.0.tgz#d316d7522d93cff4cd14f305e02f3df2d804f9c1"
-  integrity sha512-YjaZ7PRI5qY7ax2L3PbvX0rRyGtipAReCWs0mhhDBHjH/vl0g0BonaGXrKdKpMbIIsMIwDgbk/xzkBTyAltS5g==
+"@typescript-eslint/type-utils@8.64.0":
+  version "8.64.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/type-utils/-/type-utils-8.64.0.tgz#106fa7d58cf9cf7758f3dd8e426ac8237eceacf3"
+  integrity sha512-XWG4Fmmv/6SvyS9nH8jWrKs6terwJvE8cyRt1CzYYqzp9OrPhCT4cMc/f7C6RZCwG+qMmiffJS1/qJP8G1URtg==
   dependencies:
-    "@typescript-eslint/types" "8.65.0"
-    "@typescript-eslint/typescript-estree" "8.65.0"
-    "@typescript-eslint/utils" "8.65.0"
+    "@typescript-eslint/types" "8.64.0"
+    "@typescript-eslint/typescript-estree" "8.64.0"
+    "@typescript-eslint/utils" "8.64.0"
     debug "^4.4.3"
     ts-api-utils "^2.5.0"
 
-"@typescript-eslint/types@8.65.0", "@typescript-eslint/types@^8.65.0":
-  version "8.65.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/types/-/types-8.65.0.tgz#3e86738416a777c8b8925ab46745f48ecf904c9f"
-  integrity sha512-JSSwWNy+H0E/01jJEM+hrX6N0OFDzFzeIhHFSAS01tlVaevpG8cFyYRPhS5yjGOvBUx3sqQHVMjCL1CAZZMxBg==
+"@typescript-eslint/types@8.64.0", "@typescript-eslint/types@^8.64.0":
+  version "8.64.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/types/-/types-8.64.0.tgz#b41f8ef5dd40616908658b991197a9d486cda60b"
+  integrity sha512-qjhfuTfLXjA4IOzXvz0rTjT01BqEiIgPoUeMwiEjnaHKJMTNo8rH5pYW1a2L/0Dnux2fPC85AeyJoWaGa8WxTA==
 
-"@typescript-eslint/typescript-estree@8.65.0":
-  version "8.65.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/typescript-estree/-/typescript-estree-8.65.0.tgz#f1f514808f6aa713e2d678ae8ff592a65e1632af"
-  integrity sha512-JboAE2swaYt4tb1fHhHTABE2K+OLy09XfcTbhnk4Pw96f9dd2e9iYsJ28gBggHlo5z5x1rkyWvcPoTuNTd4oGg==
+"@typescript-eslint/typescript-estree@8.64.0":
+  version "8.64.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/typescript-estree/-/typescript-estree-8.64.0.tgz#b8d51255e2d726eb4bd80d397a4fb4170c02eecc"
+  integrity sha512-Pztpsn1aCE1oWDvDEfUk31nngvvF7vUB5SwHFEaZIFpvw7WJtqUHHL4plBZDA9HfWJJjL13BdG0YrJInTUvoVA==
   dependencies:
-    "@typescript-eslint/project-service" "8.65.0"
-    "@typescript-eslint/tsconfig-utils" "8.65.0"
-    "@typescript-eslint/types" "8.65.0"
-    "@typescript-eslint/visitor-keys" "8.65.0"
+    "@typescript-eslint/project-service" "8.64.0"
+    "@typescript-eslint/tsconfig-utils" "8.64.0"
+    "@typescript-eslint/types" "8.64.0"
+    "@typescript-eslint/visitor-keys" "8.64.0"
     debug "^4.4.3"
     minimatch "^10.2.2"
     semver "^7.7.3"
     tinyglobby "^0.2.15"
     ts-api-utils "^2.5.0"
 
-"@typescript-eslint/utils@8.65.0":
-  version "8.65.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/utils/-/utils-8.65.0.tgz#afedd974a0c8deeef553b509df5800bafd615a72"
-  integrity sha512-gXiwIHsYreboxeJucHKPvgwl7dXt50mF8s1/c00cP/WoVTyWKFdtfhRWwZiXYFU5H2O8vVoSLNrexFZjYS/SGA==
+"@typescript-eslint/utils@8.64.0":
+  version "8.64.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/utils/-/utils-8.64.0.tgz#98bb2010cfb754b41985b9c93e6e8b3dcd7bd600"
+  integrity sha512-aJUGVB3+U0htrrCjoA8qukw8cm8fNCGAxK/tVoS70k8aeb7DETKeFozRiVFIwEeN9WJLsjaP3ph8I60tY2XZoQ==
   dependencies:
     "@eslint-community/eslint-utils" "^4.9.1"
-    "@typescript-eslint/scope-manager" "8.65.0"
-    "@typescript-eslint/types" "8.65.0"
-    "@typescript-eslint/typescript-estree" "8.65.0"
+    "@typescript-eslint/scope-manager" "8.64.0"
+    "@typescript-eslint/types" "8.64.0"
+    "@typescript-eslint/typescript-estree" "8.64.0"
 
-"@typescript-eslint/visitor-keys@8.65.0":
-  version "8.65.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/visitor-keys/-/visitor-keys-8.65.0.tgz#e3704c13cb4a1c22454c1abf28ff4737e15018c6"
-  integrity sha512-8C71BQkGjiMmXtop7pHVJu1l2NNShFdkCyD6a2ezzs5vU/L3LRtb69EtcteFwz0mYMPzIgOw0n6OV4VBUWZd7A==
+"@typescript-eslint/visitor-keys@8.64.0":
+  version "8.64.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/visitor-keys/-/visitor-keys-8.64.0.tgz#7a08421d10e54960733352cd7c95fab1784e8473"
+  integrity sha512-mrtuL8Nsn6gi2H4mo5KMTp823M+3Q19Ew/i+Zlikq20tIMm99C3Ez0dCmkWWnxut20esQvTg8aUSEhMcAOXhEw==
   dependencies:
-    "@typescript-eslint/types" "8.65.0"
+    "@typescript-eslint/types" "8.64.0"
     eslint-visitor-keys "^5.0.0"
 
 "@ungap/structured-clone@^1.0.0":
@@ -5835,6 +5835,11 @@ acorn-dynamic-import@^4.0.0:
   resolved "https://registry.yarnpkg.com/acorn-dynamic-import/-/acorn-dynamic-import-4.0.0.tgz#482210140582a36b83c3e342e1cfebcaa9240948"
   integrity sha512-d3OEjQV4ROpoflsnUA8HozoIR504TFxNivYEUi6uwz0IYhBkTDXGuWlNdMtybRt3nqVx/L6XqMt0FxkXuWKZhw==
 
+acorn-import-phases@^1.0.3:
+  version "1.0.4"
+  resolved "https://registry.yarnpkg.com/acorn-import-phases/-/acorn-import-phases-1.0.4.tgz#16eb850ba99a056cb7cbfe872ffb8972e18c8bd7"
+  integrity sha512-wKmbr/DDiIXzEOiWrTTUcDm24kQ2vGfZQvM2fwg2vXqR5uW6aapr7ObPtj1th32b9u90/Pf4AItvdTh42fBmVQ==
+
 acorn-jsx@^5.0.0, acorn-jsx@^5.0.1, acorn-jsx@^5.3.2:
   version "5.3.2"
   resolved "https://registry.yarnpkg.com/acorn-jsx/-/acorn-jsx-5.3.2.tgz#7ed5bb55908b3b2f1bc55c6af1653bada7f07937"
@@ -6023,10 +6028,10 @@ ansis@^3.2.0:
   resolved "https://registry.yarnpkg.com/ansis/-/ansis-3.17.0.tgz#fa8d9c2a93fe7d1177e0c17f9eeb562a58a832d7"
   integrity sha512-0qWUglt9JEqLFr3w1I1pbrChn1grhaiAR2ocX1PP/flRmxgtwTzPFFFnfIlD6aMOLQZgSuCRlidD70lvx8yhzg==
 
-antd@^6.5.2:
-  version "6.5.2"
-  resolved "https://registry.yarnpkg.com/antd/-/antd-6.5.2.tgz#d771211beddf539f37303f862df24e8aaf32b7c4"
-  integrity sha512-ntYx0lr4Jq192QnBkDWkDqEeoberXZ34vSE9SgiP/0J6DY8O0pzR3bVZLBsdpCSguVkwjtEAP+QNeMN7LNAvgw==
+antd@^6.5.1:
+  version "6.5.1"
+  resolved "https://registry.yarnpkg.com/antd/-/antd-6.5.1.tgz#2623db1f3b0ae32a2e311ef20f2f1413934d0094"
+  integrity sha512-VZVVF9zYI6S0NHqboVhCoY9Iiqj6dphW1NPB+sEaAf2HuIQ0haXWXj7ZvAXTRDzusktV6+cvvrSZEdRi4twATg==
   dependencies:
     "@ant-design/colors" "^8.0.1"
     "@ant-design/cssinjs" "^2.1.2"
@@ -6068,9 +6073,9 @@ antd@^6.5.2:
     "@rc-component/tour" "~2.4.0"
     "@rc-component/tree" "~1.3.2"
     "@rc-component/tree-select" "~1.11.0"
-    "@rc-component/trigger" "^3.10.1"
+    "@rc-component/trigger" "^3.10.0"
     "@rc-component/upload" "~1.1.1"
-    "@rc-component/util" "^1.12.0"
+    "@rc-component/util" "^1.11.1"
     clsx "^2.1.1"
     dayjs "^1.11.11"
     scroll-into-view-if-needed "^3.1.0"
@@ -6363,10 +6368,10 @@ base64-js@^1.3.1, base64-js@^1.5.1:
   resolved "https://registry.yarnpkg.com/base64-js/-/base64-js-1.5.1.tgz#1b1b440160a5bf7ad40b650f095963481903930a"
   integrity sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==
 
-baseline-browser-mapping@^2.10.38, baseline-browser-mapping@^2.11.1, baseline-browser-mapping@^2.9.19:
-  version "2.11.1"
-  resolved "https://registry.yarnpkg.com/baseline-browser-mapping/-/baseline-browser-mapping-2.11.1.tgz#390b4714558634093df77add4acca0c5c0c1605e"
-  integrity sha512-HYXq73DDpCtNzOmrFsm9eSwCvWCql0RzqjpDzXN9EadiLJ4DNat0nsZ/Bzmy+Ud12mb4/zKDY0cQ805ZzN+i0A==
+baseline-browser-mapping@^2.10.38, baseline-browser-mapping@^2.10.43, baseline-browser-mapping@^2.9.19:
+  version "2.10.43"
+  resolved "https://registry.yarnpkg.com/baseline-browser-mapping/-/baseline-browser-mapping-2.10.43.tgz#7b5d11590ce5acdbe4859443e3c940e81ce8c02d"
+  integrity sha512-AjYpR78kDWAY3Efj+cDTFH9t9SCoL7OoTp1BOb0mQV7S+6CiLwnWM3FyxhJtdPufDFKzmCSFoUncKjWgJEZTCQ==
 
 batch@0.6.1:
   version "0.6.1"
@@ -6389,9 +6394,9 @@ binary-extensions@^2.0.0:
   integrity sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw==
 
 body-parser@~1.20.5:
-  version "1.20.6"
-  resolved "https://registry.yarnpkg.com/body-parser/-/body-parser-1.20.6.tgz#60c789c78e0992d906da0a29d71ae01d15c1ed76"
-  integrity sha512-p5tAzS57i5MV9fZFDj9LeIiTZEufbSe2eDozP+ElheSUq1m74CRq1jI4mYNDdVs9vQztXFLuk/Gd6BWTdwRJ5g==
+  version "1.20.5"
+  resolved "https://registry.yarnpkg.com/body-parser/-/body-parser-1.20.5.tgz#303c8c34423d1d6fa799bc764e93c1e4dc6ebf64"
+  integrity sha512-3grm+/2tUOvu2cjJkvsIxrv/wVpfXQW4PsQHYm7yk4vfpu7Ekl6nEsYBoJUL6qDwZUx8wUhQ8tR2qz+ad9c9OA==
   dependencies:
     bytes "~3.1.2"
     content-type "~1.0.5"
@@ -6597,10 +6602,10 @@ caniuse-api@^3.0.0:
     lodash.memoize "^4.1.2"
     lodash.uniq "^4.5.0"
 
-caniuse-lite@^1.0.0, caniuse-lite@^1.0.30001799, caniuse-lite@^1.0.30001806:
-  version "1.0.30001806"
-  resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001806.tgz#1bc8e502b723fa393455dfbedd5ccec0c29bb74e"
-  integrity sha512-72Cuvd95zbSYPKq6Fhg8eDJRlzgWDf7/mtoZv6Qe/DYNCEBdNxoA3+rZAU2ZhGCpZlns3EssFavaZomckT5Uuw==
+caniuse-lite@^1.0.0, caniuse-lite@^1.0.30001799, caniuse-lite@^1.0.30001805:
+  version "1.0.30001805"
+  resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001805.tgz#78d5d5968a69b7ff81af87a96d7ddc7ea6670b1e"
+  integrity sha512-52noaS3DubycKSXaU30TwPGIp+POyQSUVa5jBEq3vkRkY0kjyb3LQgvhU6WGyCcyXqVLWO0Cw0Q6BSdD0kUfVA==
 
 ccount@^2.0.0:
   version "2.0.1"
@@ -7002,7 +7007,7 @@ copy-text-to-clipboard@^3.2.0:
   resolved "https://registry.yarnpkg.com/copy-text-to-clipboard/-/copy-text-to-clipboard-3.2.2.tgz#99bc79db3f2d355ec33a08d573aff6804491ddb9"
   integrity sha512-T6SqyLd1iLuqPA90J5N4cTalrtovCySh58iiZDGJ6FGznbclKh4UI+FGacQSgFzwKG77W7XT5gwbVEbd9cIH1A==
 
-copy-to-clipboard@^3.3.3:
+copy-to-clipboard@^3.3.1:
   version "3.3.3"
   resolved "https://registry.yarnpkg.com/copy-to-clipboard/-/copy-to-clipboard-3.3.3.tgz#55ac43a1db8ae639a4bd99511c148cdd1b83a1b0"
   integrity sha512-2KV8NhB5JqC3ky0r9PMCAZKbUHSwtEo4CwCs0KXgruG43gX5PMqDEBbVU4OUzw2MuAWUfsuFmWvEKG5QRfSnJA==
@@ -7957,10 +7962,10 @@ domhandler@^5.0.2, domhandler@^5.0.3:
   dependencies:
     domelementtype "^2.3.0"
 
-dompurify@^3.3.3, dompurify@^3.4.12:
-  version "3.4.12"
-  resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-3.4.12.tgz#6fa2265e9bbdce882c4ace4107626051b448ffa8"
-  integrity sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==
+dompurify@^3.3.3, dompurify@^3.4.11:
+  version "3.4.11"
+  resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-3.4.11.tgz#29c8ba496475f279ef4015784068452fb14a0680"
+  integrity sha512-zhlUV12GsaRzMsf9q5M254YhA4+VuF0fG+QFqu6aYpoGlKtz+w8//jBcGVYBgQkR5GHjUomejY84AV+/uPbWdw==
   optionalDependencies:
     "@types/trusted-types" "^2.0.7"
 
@@ -8061,10 +8066,10 @@ encodeurl@~2.0.0:
   resolved "https://registry.yarnpkg.com/encodeurl/-/encodeurl-2.0.0.tgz#7b8ea898077d7e409d3ac45474ea38eaf0857a58"
   integrity sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==
 
-enhanced-resolve@^5.24.2:
-  version "5.24.5"
-  resolved "https://registry.yarnpkg.com/enhanced-resolve/-/enhanced-resolve-5.24.5.tgz#b4dad3255b7545f07ba5535189868e9f85f47573"
-  integrity sha512-L1l8TNvomm6UVW5B253AGxQagSQr+vGwhMlrrfRS2qmhx46AMpMVJKQYLvWYbysTMY8VoicOvzHzoHMbyzB+4A==
+enhanced-resolve@^5.22.2:
+  version "5.24.1"
+  resolved "https://registry.yarnpkg.com/enhanced-resolve/-/enhanced-resolve-5.24.1.tgz#b2439adf5d31d7e4764de1f9ecf942d6cd3fc874"
+  integrity sha512-7DdUaTjmNwMcH2gLr1qycesKII3BK4RLy/mdAb7x10Lq7bR4aNKHt1BR1ZALSv0rPM/hF5wYF0PhGop/rJm8vw==
   dependencies:
     graceful-fs "^4.2.4"
     tapable "^2.3.3"
@@ -8677,9 +8682,9 @@ fast-safe-stringify@^2.0.7:
   integrity sha512-W+KJc2dmILlPplD/H4K9l9LcAHAfPtP6BY84uVLXQ6Evcz9Lcg33Y2z1IVblT6xdY54PXYVHEv+0Wpq8Io6zkA==
 
 fast-uri@^3.0.1:
-  version "3.1.4"
-  resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.1.4.tgz#3b3daf9ce68f41f956df0b505132c0cfce9ec7af"
-  integrity sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==
+  version "3.1.3"
+  resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.1.3.tgz#f695a40f006aba505631573a0021ddb21194ad11"
+  integrity sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg==
 
 fastq@^1.6.0:
   version "1.20.1"
@@ -9562,10 +9567,10 @@ immer@^11.0.0:
   resolved "https://registry.yarnpkg.com/immer/-/immer-11.1.11.tgz#bbf825a333ae1b16fd450d8da5f61d54de6a553d"
   integrity sha512-qzXuyXAkPySAGYkfsAwodDPWT8Zm7/Uo5BNt4BjhMhG5WlWyZZ4wQqnWwdS8kjlQ1Cwu6gjw3A6+0gTQwlyYtw==
 
-immutable@^4.3.9:
-  version "4.3.9"
-  resolved "https://registry.yarnpkg.com/immutable/-/immutable-4.3.9.tgz#c98349e05e9c6e2a4d8fe88ac0b363e0d536b544"
-  integrity sha512-ObHy4YN7ycwZOUCLI1/6svfyAFu7vL8RhAvVu/bh/RZW9EPlOyDaQ9jDQWCtdqzaXUjgXZCW1migtHE7YI7UGQ==
+immutable@^3.x.x:
+  version "3.8.3"
+  resolved "https://registry.yarnpkg.com/immutable/-/immutable-3.8.3.tgz#0a8d2494a94d4b2d4f0e99986e74dd25d1e9a859"
+  integrity sha512-AUY/VyX0E5XlibOmWt10uabJzam1zlYjwiEgQSDc5+UIkFNaF9WM0JxXKaNMGf+F/ffUF+7kRKXM9A7C0xXqMg==
 
 immutable@^5.1.5:
   version "5.1.9"
@@ -10136,17 +10141,24 @@ js-levenshtein@^1.1.6:
   resolved "https://registry.yarnpkg.com/js-tokens/-/js-tokens-4.0.0.tgz#19203fb59991df98e3a287050d4647cdeaf32499"
   integrity sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==
 
-js-yaml@4.1.0, js-yaml@=4.3.0, js-yaml@^4.1.0, js-yaml@^4.1.1, js-yaml@^4.2.0, js-yaml@^4.3.0:
+js-yaml@4.1.0, js-yaml@^4.1.0, js-yaml@^4.1.1, js-yaml@^4.2.0, js-yaml@^4.3.0:
   version "4.3.0"
   resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.3.0.tgz#d1900572a7f7cf0b5f540c83673e60bad3436592"
   integrity sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==
   dependencies:
     argparse "^2.0.1"
 
-js-yaml@^5.2.2:
-  version "5.2.2"
-  resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-5.2.2.tgz#497bfe63f0b0db11c7bbc5ce8bc568e836c8b08c"
-  integrity sha512-dayzUzKkJ1MkuUtZglSebU43utNXH0OWQByK9rKOOuYIO8M5TV1y+n8ALMdG0rdzBnfNkOmZEqrURepb0ejqBw==
+js-yaml@=4.2.0:
+  version "4.2.0"
+  resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.2.0.tgz#2bd9e85682dd91bd469afb809d816043b3d49524"
+  integrity sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==
+  dependencies:
+    argparse "^2.0.1"
+
+js-yaml@^5.2.0:
+  version "5.2.1"
+  resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-5.2.1.tgz#bb3f2e87295ebfe6ef0a75e17c62834daeff9ce2"
+  integrity sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw==
   dependencies:
     argparse "^2.0.1"
 
@@ -10426,6 +10438,11 @@ liquid-json@0.3.1:
   resolved "https://registry.yarnpkg.com/liquid-json/-/liquid-json-0.3.1.tgz#9155a18136d8a6b2615e5f16f9a2448ab6b50eea"
   integrity sha512-wUayTU8MS827Dam6MxgD72Ui+KOSF+u/eIqpatOtjnvgJ0+mnDq33uC2M7J0tPK+upe/DpUAuK4JUU89iBoNKQ==
 
+loader-runner@^4.3.2:
+  version "4.3.2"
+  resolved "https://registry.yarnpkg.com/loader-runner/-/loader-runner-4.3.2.tgz#9913d3a15971f8f635915e601fb5c9d495d918e9"
+  integrity sha512-DFEqQ3ihfS9blba08cLfYf1NRAIEm+dDjic073DRDc3/JspI/8wYmtDsHwd3+4hwvdxSK7PGaElfTmm0awWJ4w==
+
 loader-utils@^2.0.0:
   version "2.0.4"
   resolved "https://registry.yarnpkg.com/loader-utils/-/loader-utils-2.0.4.tgz#8b5cb38b5c34a9a018ee1fc0e6a066d1dfcc528c"
@@ -11664,10 +11681,10 @@ mz@^2.7.0:
     object-assign "^4.0.1"
     thenify-all "^1.0.0"
 
-nanoid@^3.3.16:
-  version "3.3.16"
-  resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.16.tgz#a04d8ec4b1f10009d2d533947aefe4293737816c"
-  integrity sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==
+nanoid@^3.3.12:
+  version "3.3.15"
+  resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.15.tgz#36c490fad8c6e86c824c940dfdde999b69ed4316"
+  integrity sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA==
 
 natural-compare@^1.4.0:
   version "1.4.0"
@@ -12957,11 +12974,11 @@ postcss-zindex@^6.0.2:
   integrity sha512-5BxW9l1evPB/4ZIc+2GobEBoKC+h8gPGCMi+jxsYvd2x0mjq7wazk6DrP71pStqxE9Foxh5TVnonbWpFZzXaYg==
 
 postcss@^8.4.21, postcss@^8.4.24, postcss@^8.4.33, postcss@^8.5.4:
-  version "8.5.23"
-  resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.5.23.tgz#3493550116f478487298301d2c2e8dc5a56e6594"
-  integrity sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==
+  version "8.5.16"
+  resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.5.16.tgz#1230ce0b5df354c24c0ea45f99ce5f6a88279d28"
+  integrity sha512-vuwillviilfKZsg0VGj5R/YwwcHx4SLsIOI/7K6mQkWx+l5cUHTjj5g0AasTBcyXsbfTgrwsUNmVUb5xVwyPwg==
   dependencies:
-    nanoid "^3.3.16"
+    nanoid "^3.3.12"
     picocolors "^1.1.1"
     source-map-js "^1.2.1"
 
@@ -13012,10 +13029,10 @@ prettier-linter-helpers@^1.0.1:
   dependencies:
     fast-diff "^1.1.2"
 
-prettier@^3.9.6:
-  version "3.9.6"
-  resolved "https://registry.yarnpkg.com/prettier/-/prettier-3.9.6.tgz#b3ea5146515d40fc53f18aa63f74dfab1e10dbf6"
-  integrity sha512-OpN0zzVdiaiAhxpuuj5efpIS4sY9j7bY6uR5mnj5yPzGkdkjNKSJeUThPb60Jw29QuAZgA4o+/iB49kFiaBX6g==
+prettier@^3.9.5:
+  version "3.9.5"
+  resolved "https://registry.yarnpkg.com/prettier/-/prettier-3.9.5.tgz#4fec97736e33b9d0b620b48914fe93b530e835ad"
+  integrity sha512-/FVl766LpUfB5vXgCYOYa0MeV/441Ia99AeICQIQFTY/Nw0roZwULcXpku5i1/m5kt/baz+s4Zogspd839HSMg==
 
 pretty-error@^4.0.0:
   version "4.0.0"
@@ -13226,12 +13243,12 @@ rc@1.2.8:
     minimist "^1.2.0"
     strip-json-comments "~2.0.1"
 
-react-copy-to-clipboard@5.1.1:
-  version "5.1.1"
-  resolved "https://registry.yarnpkg.com/react-copy-to-clipboard/-/react-copy-to-clipboard-5.1.1.tgz#76adb8be03616e99692fcf3f762365ed3fb5ff16"
-  integrity sha512-s+HrzLyJBxrpGTYXF15dTgMjAJpEPZT/Yp6NytAtZMRngejxt6Pt5WrfFxLAcsqUDU6sY1Jz6tyHwIicE1U2Xg==
+react-copy-to-clipboard@5.1.0:
+  version "5.1.0"
+  resolved "https://registry.yarnpkg.com/react-copy-to-clipboard/-/react-copy-to-clipboard-5.1.0.tgz#09aae5ec4c62750ccb2e6421a58725eabc41255c"
+  integrity sha512-k61RsNgAayIJNoy9yDsYzDe/yAZAzEbEgcz3DZMhF686LEyukcE1hzurxe85JandPUG+yTfGVFzuEw3xt8WP/A==
   dependencies:
-    copy-to-clipboard "^3.3.3"
+    copy-to-clipboard "^3.3.1"
     prop-types "^15.8.1"
 
 react-debounce-input@=3.3.0:
@@ -13317,16 +13334,11 @@ react-is@^17.0.1:
   resolved "https://registry.yarnpkg.com/react-is/-/react-is-17.0.2.tgz#e691d4a8e9c789365655539ab372762b0efb54f0"
   integrity sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w==
 
-react-is@^18.0.0:
+react-is@^18.0.0, react-is@^18.2.0:
   version "18.3.1"
   resolved "https://registry.yarnpkg.com/react-is/-/react-is-18.3.1.tgz#e83557dc12eae63a99e003a46388b1dcbb44db7e"
   integrity sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==
 
-react-is@^19.2.7:
-  version "19.2.8"
-  resolved "https://registry.yarnpkg.com/react-is/-/react-is-19.2.8.tgz#09826f9fbc187bc668e3e5c62edc001f804d5018"
-  integrity sha512-s5un28nYxKJw5gvUHyW5PCC28CvBqLu9r3cWgzHT4Vo/5fqqkFcdRYsGcKf50WMPpjjFZS5d76fn3YCo2njKwQ==
-
 react-json-view-lite@^2.3.0:
   version "2.5.0"
   resolved "https://registry.yarnpkg.com/react-json-view-lite/-/react-json-view-lite-2.5.0.tgz#c7ff011c7cc80e9900abc7aa4916c6a5c6d6c1c6"
@@ -14615,10 +14627,10 @@ stop-iteration-iterator@^1.1.0:
     es-errors "^1.3.0"
     internal-slot "^1.1.0"
 
-storybook@^10.5.3:
-  version "10.5.3"
-  resolved "https://registry.yarnpkg.com/storybook/-/storybook-10.5.3.tgz#72ee7cc02e3b6353eeec9633c2367437cf2ac86e"
-  integrity sha512-c8Wumu5qz0N2fnzWBxcPzUsY+8BpKBKChNyl4BEh9qhMV6KW587gL8il8emRB+4Hay+zMjDHA7cIeTkl4FKYuw==
+storybook@^10.5.0:
+  version "10.5.2"
+  resolved "https://registry.yarnpkg.com/storybook/-/storybook-10.5.2.tgz#751aca53cbeea086886d84ceb46c8a29a5f802f3"
+  integrity sha512-zkYxVZoDMj8njzZc3EH5UyY7885wpi9a1mmWVwFiNHSo+i5r2Go84E2OI1cdOctRymLkNvgs1j5jqAKA0ftBqg==
   dependencies:
     "@storybook/global" "^5.0.0"
     "@storybook/icons" "^2.0.2"
@@ -14877,9 +14889,9 @@ svg-parser@^2.0.4:
   integrity sha512-e4hG1hRwoOdRb37cIMSgzNsxyzKfayW6VOflrwvR+/bzrkyxY/31WkbgnQpgtrNp1SdpJvpUAGTa/ZoiPNDuRQ==
 
 svgo@^3.0.2, svgo@^3.2.0:
-  version "3.3.4"
-  resolved "https://registry.yarnpkg.com/svgo/-/svgo-3.3.4.tgz#fd2aa10ff585b3bd2b83ce3602f5582bc0718bb5"
-  integrity sha512-GsNRis4e8jxn2Y9ENz/8lbJ93CstG8svtMnuRaHbiF2LTJ5tK0/q3t/URPq9Zc7zVWBJnNnJMIp6bevK7bSmNg==
+  version "3.3.3"
+  resolved "https://registry.yarnpkg.com/svgo/-/svgo-3.3.3.tgz#8246aee0b08791fde3b0ed22b5661b471fadf58e"
+  integrity sha512-+wn7I4p7YgJhHs38k2TNjy1vCfPIfLIJWR5MnCStsN8WuuTcBnRKcMHQLMM2ijxGZmDoZwNv8ipl5aTTen62ng==
   dependencies:
     commander "^7.2.0"
     css-select "^5.1.0"
@@ -14889,10 +14901,10 @@ svgo@^3.0.2, svgo@^3.2.0:
     picocolors "^1.0.0"
     sax "^1.5.0"
 
-swagger-client@^3.37.7:
-  version "3.37.7"
-  resolved "https://registry.yarnpkg.com/swagger-client/-/swagger-client-3.37.7.tgz#75cd740b6aebdebce5e7c9eada193b63d00e21ad"
-  integrity sha512-AzmF/FDSPYBcoxXarHPnqK3lSXoKH9Fh0EjLHAlP0h/D7EG1Fofl/wEuGqhYT+IBpriu3mSgWCh2xAftsYdL8w==
+swagger-client@^3.37.4:
+  version "3.37.5"
+  resolved "https://registry.yarnpkg.com/swagger-client/-/swagger-client-3.37.5.tgz#2c55c034319e1aeede336524a6eeea7b35e15cd4"
+  integrity sha512-MuABJgD8vIsT5GVBTGj3HjmiEhArf58ng+YP4fo23NOJb/mKXOpKW3Rln90fnoi7ROt6IJsJy9d5kg8Yidn0/Q==
   dependencies:
     "@babel/runtime-corejs3" "^7.22.15"
     "@scarf/scarf" "=1.4.0"
@@ -14912,33 +14924,11 @@ swagger-client@^3.37.7:
     openapi-server-url-templating "^1.3.0"
     ramda "^0.30.1"
     ramda-adjunct "^5.1.0"
-  optionalDependencies:
-    "@swagger-api/apidom-ns-asyncapi-2" "^1.11.3"
-    "@swagger-api/apidom-ns-asyncapi-3" "^1.11.3"
-    "@swagger-api/apidom-ns-openapi-2" "^1.11.3"
-    "@swagger-api/apidom-parser-adapter-api-design-systems-json" "^1.11.3"
-    "@swagger-api/apidom-parser-adapter-api-design-systems-yaml" "^1.11.3"
-    "@swagger-api/apidom-parser-adapter-arazzo-json-1" "^1.11.3"
-    "@swagger-api/apidom-parser-adapter-arazzo-yaml-1" "^1.11.3"
-    "@swagger-api/apidom-parser-adapter-asyncapi-json-2" "^1.11.3"
-    "@swagger-api/apidom-parser-adapter-asyncapi-json-3" "^1.11.3"
-    "@swagger-api/apidom-parser-adapter-asyncapi-yaml-2" "^1.11.3"
-    "@swagger-api/apidom-parser-adapter-asyncapi-yaml-3" "^1.11.3"
-    "@swagger-api/apidom-parser-adapter-json" "^1.11.3"
-    "@swagger-api/apidom-parser-adapter-openapi-json-2" "^1.11.3"
-    "@swagger-api/apidom-parser-adapter-openapi-json-3-0" "^1.11.3"
-    "@swagger-api/apidom-parser-adapter-openapi-json-3-1" "^1.11.3"
-    "@swagger-api/apidom-parser-adapter-openapi-json-3-2" "^1.11.3"
-    "@swagger-api/apidom-parser-adapter-openapi-yaml-2" "^1.11.3"
-    "@swagger-api/apidom-parser-adapter-openapi-yaml-3-0" "^1.11.3"
-    "@swagger-api/apidom-parser-adapter-openapi-yaml-3-1" "^1.11.3"
-    "@swagger-api/apidom-parser-adapter-openapi-yaml-3-2" "^1.11.3"
-    "@swagger-api/apidom-parser-adapter-yaml-1-2" "^1.11.3"
 
-swagger-ui-react@^5.32.11:
-  version "5.32.11"
-  resolved "https://registry.yarnpkg.com/swagger-ui-react/-/swagger-ui-react-5.32.11.tgz#9a98015aca1101c086968df9e7d2897e93875a9a"
-  integrity sha512-84WYsBEs6vIpWXtqxq7kIrJRs2+YeZPQFULPJ/afjuHKw+rKWvwyA1uQsUC2VWq3oA9XIig3pjlMVE5xXaCDyA==
+swagger-ui-react@^5.32.8:
+  version "5.32.8"
+  resolved "https://registry.yarnpkg.com/swagger-ui-react/-/swagger-ui-react-5.32.8.tgz#0608b45cf552f33fcc9b3fc5e07740c9a854861f"
+  integrity sha512-Cstx4Tq8fT5l2TBxHxts8pG+ks0qKSkuO1pwUwgrQQiZ241Mqs+KUODLVIonsYXL/gqX143rkcipUa4d0Rid7w==
   dependencies:
     "@babel/runtime-corejs3" "^7.27.1"
     "@scarf/scarf" "=1.4.0"
@@ -14947,16 +14937,16 @@ swagger-ui-react@^5.32.11:
     classnames "^2.5.1"
     css.escape "1.5.1"
     deep-extend "0.6.0"
-    dompurify "^3.4.12"
+    dompurify "^3.4.11"
     ieee754 "^1.2.1"
-    immutable "^4.3.9"
+    immutable "^3.x.x"
     js-file-download "^0.4.12"
-    js-yaml "=4.3.0"
+    js-yaml "=4.2.0"
     lodash "^4.18.1"
     prop-types "^15.8.1"
     randexp "^0.5.3"
     randombytes "^2.1.0"
-    react-copy-to-clipboard "5.1.1"
+    react-copy-to-clipboard "5.1.0"
     react-debounce-input "=3.3.0"
     react-immutable-proptypes "2.2.0"
     react-immutable-pure-component "^2.2.0"
@@ -14969,7 +14959,7 @@ swagger-ui-react@^5.32.11:
     reselect "^5.1.1"
     serialize-error "^8.1.0"
     sha.js "^2.4.12"
-    swagger-client "^3.37.7"
+    swagger-client "^3.37.4"
     url-parse "^1.5.10"
     xml "=1.0.1"
     xml-but-prettier "^1.0.1"
@@ -15319,15 +15309,15 @@ types-ramda@^0.30.1:
   dependencies:
     ts-toolbelt "^9.6.0"
 
-typescript-eslint@^8.65.0:
-  version "8.65.0"
-  resolved "https://registry.yarnpkg.com/typescript-eslint/-/typescript-eslint-8.65.0.tgz#754c953fd6a9a3d36fa54015bdba80a6eb2a4957"
-  integrity sha512-/ggrHAwyjENDusvyxbuqxAC2dTnZg/Z8F+fgQtYIz+L6n/9HfSlEZcFGV/NsMNa6CkGk0xUjUAFwC0vHOflvIA==
+typescript-eslint@^8.64.0:
+  version "8.64.0"
+  resolved "https://registry.yarnpkg.com/typescript-eslint/-/typescript-eslint-8.64.0.tgz#4984dae4de9dc8bf892acf5c394d0a2a5f08c3e1"
+  integrity sha512-0qg+pDNMnqYzqH9AnNK+39tejHvsShUOUUoRUgtnTGE7QuMZhiFDnozq8nHJVq+Wae6NMLKNWLg5WmkcC/ndyQ==
   dependencies:
-    "@typescript-eslint/eslint-plugin" "8.65.0"
-    "@typescript-eslint/parser" "8.65.0"
-    "@typescript-eslint/typescript-estree" "8.65.0"
-    "@typescript-eslint/utils" "8.65.0"
+    "@typescript-eslint/eslint-plugin" "8.64.0"
+    "@typescript-eslint/parser" "8.64.0"
+    "@typescript-eslint/typescript-estree" "8.64.0"
+    "@typescript-eslint/utils" "8.64.0"
 
 typescript@~6.0.3:
   version "6.0.3"
@@ -15850,20 +15840,20 @@ webpack-merge@^6.0.1:
     flat "^5.0.2"
     wildcard "^2.0.1"
 
-webpack-sources@^3.5.1:
-  version "3.5.1"
-  resolved "https://registry.yarnpkg.com/webpack-sources/-/webpack-sources-3.5.1.tgz#76c2418486dcc02b2aa0694c104176c2858fe84a"
-  integrity sha512-jyuiGJdtvY434z5bUZrjz67v76/ePNvFZTp9Mdz29IlH4+GPsgyGjiv0fKI+M7BdkU6ADjulUcKAd3tUK3WlEw==
+webpack-sources@^3.5.0:
+  version "3.5.0"
+  resolved "https://registry.yarnpkg.com/webpack-sources/-/webpack-sources-3.5.0.tgz#87bf7f5801a4e985b1f1c92b64b9620a02f76d08"
+  integrity sha512-HPuy+uuoTCaaoEoI1LQ3JN9+vrPBvEesnnX1jADHy728cHSMlq4wUc4afYqahq2B1mhQVZxCXOkNTnXltr+2vQ==
 
 webpack-virtual-modules@^0.6.2:
   version "0.6.2"
   resolved "https://registry.yarnpkg.com/webpack-virtual-modules/-/webpack-virtual-modules-0.6.2.tgz#057faa9065c8acf48f24cb57ac0e77739ab9a7e8"
   integrity sha512-66/V2i5hQanC51vBQKPH4aI8NMAcBW59FVBs+rC7eGHupMyfn34q7rZIE+ETlJ+XTevqfUhVVBgSUNSW2flEUQ==
 
-webpack@^5.109.0, webpack@^5.88.1, webpack@^5.95.0:
-  version "5.109.0"
-  resolved "https://registry.yarnpkg.com/webpack/-/webpack-5.109.0.tgz#871d8eee5e2d5e6eaf5ec8d1a6db74ea65491030"
-  integrity sha512-vomrngskVVXEZF9sMZfYAd4pXZUnfaWdJGlF+BTNF+gJBCKYCQBnOeVPlrh39Ewl7nlCsirDplMy6o5g9xJHBg==
+webpack@^5.108.2, webpack@^5.88.1, webpack@^5.95.0:
+  version "5.108.4"
+  resolved "https://registry.yarnpkg.com/webpack/-/webpack-5.108.4.tgz#141818a411662773a0bb32dc5536acc5409943b7"
+  integrity sha512-yur8LyJoeiWh47dErD+Ok7vlbmDsJ3UbbRPAoxbGJ54WpE2y5yVo5G/inUzujnYgw3tPmBRdn+G7PoxXaYC33w==
   dependencies:
     "@types/estree" "^1.0.8"
     "@types/json-schema" "^7.0.15"
@@ -15871,20 +15861,22 @@ webpack@^5.109.0, webpack@^5.88.1, webpack@^5.95.0:
     "@webassemblyjs/wasm-edit" "^1.14.1"
     "@webassemblyjs/wasm-parser" "^1.14.1"
     acorn "^8.16.0"
+    acorn-import-phases "^1.0.3"
     browserslist "^4.28.1"
     chrome-trace-event "^1.0.2"
-    enhanced-resolve "^5.24.2"
+    enhanced-resolve "^5.22.2"
     es-module-lexer "^2.1.0"
     eslint-scope "5.1.1"
     events "^3.2.0"
     graceful-fs "^4.2.11"
+    loader-runner "^4.3.2"
     mime-db "^1.54.0"
     minimizer-webpack-plugin "^5.6.1"
     neo-async "^2.6.2"
     schema-utils "^4.3.3"
     tapable "^2.3.0"
     watchpack "^2.5.2"
-    webpack-sources "^3.5.1"
+    webpack-sources "^3.5.0"
 
 webpackbar@^7.0.0:
   version "7.0.0"

helm/superset/Chart.yaml

@@ -29,7 +29,7 @@ maintainers:
   - name: craig-rueda
     email: craig@craigrueda.com
     url: https://github.com/craig-rueda
-version: 0.22.4 # See [README](https://github.com/apache/superset/blob/master/helm/superset/README.md#versioning) for version details.
+version: 0.22.0 # See [README](https://github.com/apache/superset/blob/master/helm/superset/README.md#versioning) for version details.
 dependencies:
   - name: postgresql
     version: 16.7.27

helm/superset/README.md

@@ -23,7 +23,7 @@ NOTE: This file is generated by helm-docs: https://github.com/norwoodj/helm-docs
 
 # superset
 
-![Version: 0.22.4](https://img.shields.io/badge/Version-0.22.4-informational?style=flat-square)
+![Version: 0.22.0](https://img.shields.io/badge/Version-0.22.0-informational?style=flat-square)
 
 Apache Superset is a modern, enterprise-ready business intelligence web application
 
@@ -131,7 +131,7 @@ Alternatively, perform a fresh install. This is a one-time migration; subsequent
 | httproute.hostnames | list | `[]` | Hostnames that match against the HTTP Host header (templated) |
 | httproute.labels | object | `{}` | Additional labels to add to the HTTPRoute |
 | httproute.parentRefs | list | `[]` | Gateways this HTTPRoute attaches to |
-| httproute.rules | list | `[{"matches":[{"path":{"type":"PathPrefix","value":"/"}}]}]` | Routing rules. Each rule is backed by the Superset service. Set `weight` per rule to leave room for traffic splitting (defaults to 1). When `supersetWebsockets.enabled` is true, an extra rule routing `supersetWebsockets.ingress.path` to the `-ws` service is appended automatically, mirroring the ingress behavior. When both `supersetMcp.enabled` and `supersetMcp.httproute.enabled` are true, an extra rule routing `supersetMcp.httproute.path` to the `-mcp` service is also appended. |
+| httproute.rules | list | `[{"matches":[{"path":{"type":"PathPrefix","value":"/"}}]}]` | Routing rules. Each rule is backed by the Superset service. Set `weight` per rule to leave room for traffic splitting (defaults to 1). When `supersetWebsockets.enabled` is true, an extra rule routing `supersetWebsockets.ingress.path` to the `-ws` service is appended automatically, mirroring the ingress behavior. |
 | image.pullPolicy | string | `"IfNotPresent"` |  |
 | image.repository | string | `"apachesuperset.docker.scarf.sh/apache/superset"` |  |
 | image.tag | string | `nil` |  |
@@ -159,10 +159,6 @@ Alternatively, perform a fresh install. This is a one-time migration; subsequent
 | init.extraInitContainers | list | `[]` | Extra init containers appended after init job initContainers |
 | init.initContainers | list | a container waiting for postgres | List of initContainers |
 | init.initscript | string | unused; kept for backwards-compatibility only | DEPRECATED: this field is no longer used by the chart. The init script is rendered entirely from the internal `superset.initScript` template (which runs `superset db upgrade`, `superset init`, admin creation, and examples). Any customization placed here is silently ignored. See UPGRADING.md. |
-| init.istio | object | `{"disableSidecarInjection":false,"quitEndpoint":"http://localhost:15020/quitquitquit","terminateSidecarOnExit":false}` | Configuration for compatibility with the Istio service mesh. Without these mitigations, when the init-db Job runs in a namespace with automatic Istio sidecar injection enabled, the injected envoy-proxy container keeps running after the init container has exited, preventing the Job from ever reaching the Completed state. See https://github.com/apache/superset/issues/25798 |
-| init.istio.disableSidecarInjection | bool | `false` | When true, adds the `sidecar.istio.io/inject: "false"` label to the init job pod template, opting it out of Istio automatic sidecar injection. This is the recommended fix when the cluster's mesh policy allows opting out per pod. |
-| init.istio.quitEndpoint | string | `"http://localhost:15020/quitquitquit"` | Endpoint that the trap POSTs to in order to terminate the sidecar. The default matches the standard Istio pilot-agent admin port. |
-| init.istio.terminateSidecarOnExit | bool | `false` | When true, the rendered `superset_init.sh` script (from the internal `superset.initScript` template) registers an `EXIT` trap that POSTs to the Istio pilot-agent's `/quitquitquit` endpoint after the init logic finishes, gracefully terminating an injected envoy-proxy sidecar so the Job can complete. Enable this when sidecar injection cannot be disabled per pod (e.g. when enforced by a cluster-wide Istio policy). Note: requires `curl` to be available in the init container image (it is included in the default `apache/superset` image) and only takes effect when `init.command` sources the rendered `superset_init.sh`. |
 | init.jobAnnotations."helm.sh/hook" | string | `"post-install,post-upgrade"` |  |
 | init.jobAnnotations."helm.sh/hook-delete-policy" | string | `"before-hook-creation"` |  |
 | init.loadExamples | bool | `false` |  |
@@ -180,10 +176,7 @@ Alternatively, perform a fresh install. This is a one-time migration; subsequent
 | redis | object | see `values.yaml` | Configuration values for the Redis dependency. ref: https://github.com/bitnami/charts/blob/master/bitnami/redis More documentation can be found here: https://artifacthub.io/packages/helm/bitnami/redis |
 | resources | object | `{}` |  |
 | runAsUser | int | `0` | User ID directive. This user must have enough permissions to run the bootstrap script Running containers as root is not recommended in production. Change this to another UID - e.g. 1000 to be more secure |
-| secretConfig | object | `{"annotations":{}}` | Specify whether Helm should apply additional settings to a secret containing configuration files |
-| secretConfig.annotations | object | `{}` | Annotations to be added to the secret which contains configuration files |
-| secretEnv | object | `{"annotations":{},"create":true}` | Specify rather or not helm should create the secret described in `secret-env.yaml` template |
-| secretEnv.annotations | object | `{}` | Annotations to be added to the secret |
+| secretEnv | object | `{"create":true}` | Specify rather or not helm should create the secret described in `secret-env.yaml` template |
 | secretEnv.create | bool | `true` | Change to false in order to support externally created secret (Binami "Sealed Secrets" for Kubernetes or External Secrets Operator) note: when externally creating the secret, the chart still expects to pull values from a secret with the name of the release defaults to `release-name-superset-env` - full logic located in _helpers.tpl file: `define "superset.fullname"` |
 | service.annotations | object | `{}` |  |
 | service.loadBalancerIP | string | `nil` |  |
@@ -270,8 +263,6 @@ Alternatively, perform a fresh install. This is a one-time migration; subsequent
 | supersetMcp.extraContainers | list | `[]` | Launch additional containers into supersetMcp pods |
 | supersetMcp.extraInitContainers | list | `[]` | Extra init containers appended after supersetMcp initContainers |
 | supersetMcp.forceReload | bool | `false` | If true, forces deployment to reload on each upgrade |
-| supersetMcp.httproute.enabled | bool | `false` | If true, the MCP server will be exposed via the HTTPRoute /mcp subpath |
-| supersetMcp.httproute.path | string | `"/mcp"` |  |
 | supersetMcp.ingress.enabled | bool | `false` | If true, the MCP server will be exposed via the ingress /mcp subpath |
 | supersetMcp.ingress.path | string | `"/mcp"` |  |
 | supersetMcp.ingress.pathType | string | `"Prefix"` |  |
@@ -370,7 +361,6 @@ Alternatively, perform a fresh install. This is a one-time migration; subsequent
 | supersetWebsockets.affinity | object | `{}` | Affinity to be added to supersetWebsockets deployment |
 | supersetWebsockets.command | list | `[]` |  |
 | supersetWebsockets.config | object | see `values.yaml` | The config.json to pass to the server, see https://github.com/apache/superset/tree/master/superset-websocket Note that the configuration can also read from environment variables (which will have priority), see https://github.com/apache/superset/blob/master/superset-websocket/src/config.ts for a list of supported variables |
-| supersetWebsockets.configAnnotations | object | `{}` | Annotations to be added to the secret which contains config.json |
 | supersetWebsockets.containerSecurityContext | object | `{}` |  |
 | supersetWebsockets.deploymentAdditionalPodSpec | object | `{}` | Custom pod spec to be added to supersetWebsockets deployment |
 | supersetWebsockets.deploymentAnnotations | object | `{}` |  |

helm/superset/templates/_helpers.tpl

@@ -685,14 +685,6 @@ TALISMAN_CONFIG = {
 {{- define "superset.initScript" -}}
 #!/bin/sh
 set -eu
-{{- if dig "istio" "terminateSidecarOnExit" false .Values.init }}
-# Notify the Istio pilot-agent sidecar to exit when this script completes
-# (whether successfully or via `set -e`), so that the Job can reach the
-# Completed state instead of hanging on a still-running envoy-proxy.
-# See https://github.com/apache/superset/issues/25798
-ISTIO_QUIT_ENDPOINT={{ dig "istio" "quitEndpoint" "http://localhost:15020/quitquitquit" .Values.init | replace "'" "'\\''" | squote }}
-trap 'rc=$?; curl -fsS -m 5 -X POST "$ISTIO_QUIT_ENDPOINT" >/dev/null 2>&1 || echo "WARNING: failed to notify Istio sidecar at $ISTIO_QUIT_ENDPOINT to quit; the Job may hang if sidecar injection is active" >&2; exit $rc' EXIT
-{{- end }}
 echo "Upgrading DB schema..."
 superset db upgrade
 echo "Initializing roles and permissions..."

helm/superset/templates/httproute.yaml

@@ -80,16 +80,4 @@ spec:
             type: PathPrefix
             value: {{ .Values.supersetWebsockets.ingress.path }}
     {{- end }}
-    {{- if and .Values.supersetMcp.enabled .Values.supersetMcp.httproute.enabled }}
-    - backendRefs:
-        - group: ''
-          kind: Service
-          name: {{ $fullName }}-mcp
-          port: {{ .Values.supersetMcp.service.port }}
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: {{ .Values.supersetMcp.httproute.path }}
-    {{- end }}
 {{- end }}

helm/superset/templates/init-job.yaml

@@ -35,7 +35,6 @@ spec:
       {{- if .Values.init.podAnnotations }}
       annotations: {{- toYaml .Values.init.podAnnotations | nindent 8 }}
       {{- end }}
-      {{- $istioDisableInject := dig "istio" "disableSidecarInjection" false .Values.init }}
       labels:
         {{- include "superset.componentSelectorLabels" (dict "component" "init" "root" .) | nindent 8 }}
         job: {{ template "superset.fullname" . }}-init-db
@@ -45,9 +44,6 @@ spec:
         {{- if .Values.init.podLabels }}
           {{- toYaml .Values.init.podLabels | nindent 8 }}
         {{- end }}
-        {{- if $istioDisableInject }}
-        sidecar.istio.io/inject: "false"
-        {{- end }}
     spec:
       {{- if .Values.init.additionalPodSpec }}
       {{- tpl (toYaml .Values.init.additionalPodSpec) . | nindent 6 }}

helm/superset/templates/secret-env.yaml

@@ -24,9 +24,6 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "superset.labels" . | nindent 4 }}
-  {{- if .Values.secretEnv.annotations }}
-  annotations: {{- toYaml .Values.secretEnv.annotations | nindent 4 }}
-  {{- end }}
 type: Opaque
 stringData:
     DB_HOST: {{ include "superset.db.host" . | quote }}

helm/superset/templates/secret-superset-config.yaml

@@ -24,9 +24,6 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "superset.labels" . | nindent 4 }}
-  {{- if .Values.secretConfig.annotations }}
-  annotations: {{- toYaml .Values.secretConfig.annotations | nindent 4 }}
-  {{- end }}
 type: Opaque
 stringData:
   superset_config.py: |

helm/superset/templates/secret-ws.yaml

@@ -25,9 +25,6 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "superset.labels" . | nindent 4 }}
-  {{- if .Values.supersetWebsockets.configAnnotations }}
-  annotations: {{- toYaml .Values.supersetWebsockets.configAnnotations | nindent 4 }}
-  {{- end }}
 type: Opaque
 stringData:
   config.json: |

helm/superset/tests/httproute_test.yaml

@@ -1,92 +0,0 @@
-#
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-suite: HTTPRoute
-templates:
-  - httproute.yaml
-tests:
-  - it: routes the general Superset path
-    set:
-      httproute.enabled: true
-    asserts:
-      - lengthEqual:
-          path: spec.rules
-          count: 1
-      - equal:
-          path: spec.rules[0].backendRefs[0].name
-          value: RELEASE-NAME-superset
-      - equal:
-          path: spec.rules[0].backendRefs[0].port
-          value: 8088
-      - equal:
-          path: spec.rules[0].matches[0].path.value
-          value: /
-
-  - it: routes the WebSocket path when WebSockets are enabled
-    set:
-      httproute.enabled: true
-      supersetWebsockets.enabled: true
-    asserts:
-      - lengthEqual:
-          path: spec.rules
-          count: 2
-      - equal:
-          path: spec.rules[1].backendRefs[0].name
-          value: RELEASE-NAME-superset-ws
-      - equal:
-          path: spec.rules[1].backendRefs[0].port
-          value: 8080
-      - equal:
-          path: spec.rules[1].matches[0].path.value
-          value: /ws
-
-  - it: does not route the WebSocket path when WebSockets are disabled
-    set:
-      httproute.enabled: true
-      supersetWebsockets.enabled: false
-    asserts:
-      - lengthEqual:
-          path: spec.rules
-          count: 1
-
-  - it: routes the MCP path when MCP HTTPRoute is enabled
-    set:
-      httproute.enabled: true
-      supersetMcp.enabled: true
-      supersetMcp.httproute.enabled: true
-    asserts:
-      - lengthEqual:
-          path: spec.rules
-          count: 2
-      - equal:
-          path: spec.rules[1].backendRefs[0].name
-          value: RELEASE-NAME-superset-mcp
-      - equal:
-          path: spec.rules[1].backendRefs[0].port
-          value: 5008
-      - equal:
-          path: spec.rules[1].matches[0].path.value
-          value: /mcp
-
-  - it: does not route MCP when MCP HTTPRoute is disabled
-    set:
-      httproute.enabled: true
-      supersetMcp.enabled: true
-      supersetMcp.httproute.enabled: false
-    asserts:
-      - lengthEqual:
-          path: spec.rules
-          count: 1

helm/superset/tests/test-istio.sh

@@ -1,183 +0,0 @@
-#!/usr/bin/env bash
-#
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# Renders the chart with `helm template` for several `init.istio.*` value
-# combinations and asserts that the relevant manifests contain (or omit)
-# the expected fields. Intended to be run from the chart directory or via
-# `bash helm/superset/tests/test-istio.sh` from the repo root.
-#
-# Covers the fix for:
-#   https://github.com/apache/superset/issues/25798
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-CHART_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
-
-pass=0
-fail=0
-
-assert_contains() {
-    local label="$1"
-    local needle="$2"
-    local haystack="$3"
-    if grep -qF -- "${needle}" <<<"${haystack}"; then
-        echo "  PASS: ${label}"
-        pass=$((pass + 1))
-    else
-        echo "  FAIL: ${label}"
-        echo "    expected to contain: ${needle}"
-        fail=$((fail + 1))
-    fi
-}
-
-assert_not_contains() {
-    local label="$1"
-    local needle="$2"
-    local haystack="$3"
-    if ! grep -qF -- "${needle}" <<<"${haystack}"; then
-        echo "  PASS: ${label}"
-        pass=$((pass + 1))
-    else
-        echo "  FAIL: ${label}"
-        echo "    expected NOT to contain: ${needle}"
-        fail=$((fail + 1))
-    fi
-}
-
-render() {
-    helm template release "${CHART_DIR}" "$@"
-}
-
-extract_init_job() {
-    awk '
-        /^# Source: superset\/templates\/init-job\.yaml/ { capture = 1 }
-        capture && /^---$/ { capture = 0 }
-        capture { print }
-    ' <<<"$1"
-}
-
-extract_config_secret() {
-    awk '
-        /^# Source: superset\/templates\/secret-superset-config\.yaml/ { capture = 1 }
-        capture && /^---$/ { capture = 0 }
-        capture { print }
-    ' <<<"$1"
-}
-
-echo "==> defaults: no istio mitigations applied"
-out_default="$(render)"
-init_job_default="$(extract_init_job "${out_default}")"
-config_default="$(extract_config_secret "${out_default}")"
-assert_not_contains "default does not set sidecar.istio.io/inject label" \
-    'sidecar.istio.io/inject' "${init_job_default}"
-assert_not_contains "default initscript does not register quitquitquit trap" \
-    'quitquitquit' "${config_default}"
-
-echo "==> init.istio.disableSidecarInjection=true"
-out_disable="$(render --set init.istio.disableSidecarInjection=true)"
-init_job_disable="$(extract_init_job "${out_disable}")"
-config_disable="$(extract_config_secret "${out_disable}")"
-assert_contains "init job sets sidecar.istio.io/inject: \"false\"" \
-    'sidecar.istio.io/inject: "false"' "${init_job_disable}"
-assert_not_contains "disableSidecarInjection alone does not add quitquitquit trap" \
-    'quitquitquit' "${config_disable}"
-
-echo "==> init.istio.terminateSidecarOnExit=true"
-out_terminate="$(render --set init.istio.terminateSidecarOnExit=true)"
-init_job_terminate="$(extract_init_job "${out_terminate}")"
-config_terminate="$(extract_config_secret "${out_terminate}")"
-assert_not_contains "terminateSidecarOnExit alone does not add inject label" \
-    'sidecar.istio.io/inject' "${init_job_terminate}"
-assert_contains "initscript registers EXIT trap that calls quitquitquit" \
-    "trap 'rc=\$?; curl -fsS -m 5 -X POST" "${config_terminate}"
-assert_contains "initscript trap targets the configured quit endpoint" \
-    'http://localhost:15020/quitquitquit' "${config_terminate}"
-assert_contains "initscript trap binds to the EXIT signal" \
-    "' EXIT" "${config_terminate}"
-
-echo "==> init.istio.quitEndpoint override"
-out_endpoint="$(render --set init.istio.terminateSidecarOnExit=true \
-    --set init.istio.quitEndpoint=http://127.0.0.1:15020/quitquitquit)"
-config_endpoint="$(extract_config_secret "${out_endpoint}")"
-assert_contains "trap honours custom quitEndpoint" \
-    'http://127.0.0.1:15020/quitquitquit' "${config_endpoint}"
-
-echo "==> both options combined"
-out_both="$(render --set init.istio.disableSidecarInjection=true \
-    --set init.istio.terminateSidecarOnExit=true)"
-init_job_both="$(extract_init_job "${out_both}")"
-config_both="$(extract_config_secret "${out_both}")"
-assert_contains "combined: inject label present" \
-    'sidecar.istio.io/inject: "false"' "${init_job_both}"
-assert_contains "combined: trap present" \
-    'quitquitquit' "${config_both}"
-
-echo "==> existing init.podLabels are preserved alongside istio label"
-out_labels="$(render --set init.istio.disableSidecarInjection=true \
-    --set init.podLabels.team=data-platform)"
-init_job_labels="$(extract_init_job "${out_labels}")"
-assert_contains "user-supplied podLabel still rendered" \
-    'team: data-platform' "${init_job_labels}"
-assert_contains "istio inject label rendered alongside" \
-    'sidecar.istio.io/inject: "false"' "${init_job_labels}"
-
-echo "==> init.istio explicitly overridden to null"
-out_null_istio="$(render --set init.istio=null)"
-init_job_null_istio="$(extract_init_job "${out_null_istio}")"
-config_null_istio="$(extract_config_secret "${out_null_istio}")"
-assert_not_contains "null init.istio does not set inject label" \
-    'sidecar.istio.io/inject' "${init_job_null_istio}"
-assert_not_contains "null init.istio does not register quitquitquit trap" \
-    'quitquitquit' "${config_null_istio}"
-
-echo "==> EXIT trap propagates the script's exit code, not the notification's"
-# The trap's own curl call is best-effort (failures are logged with
-# `|| echo ... >&2`, not swallowed with `|| true`) and must not mask a
-# failed migration. Extract the two rendered lines and actually run them,
-# with curl pointed at a closed local port so the notification itself fails,
-# to make sure the wrapped script's real exit code still comes through.
-quit_endpoint_line="$(grep -F 'ISTIO_QUIT_ENDPOINT=' <<<"${config_terminate}" || true)"
-trap_line="$(grep -F "trap 'rc=\$?; curl" <<<"${config_terminate}" || true)"
-if [[ -z "${quit_endpoint_line}" || -z "${trap_line}" ]]; then
-    echo "  FAIL: script exit code (42) survives a failing quitquitquit notification"
-    echo "    could not locate the rendered ISTIO_QUIT_ENDPOINT/trap lines to exercise"
-    fail=$((fail + 1))
-else
-    set +e
-    (
-        eval "${quit_endpoint_line}"
-        ISTIO_QUIT_ENDPOINT="http://127.0.0.1:1/quitquitquit"
-        eval "${trap_line}"
-        exit 42
-    )
-    trap_test_rc=$?
-    set -e
-    if [[ "${trap_test_rc}" -eq 42 ]]; then
-        echo "  PASS: script exit code (42) survives a failing quitquitquit notification"
-        pass=$((pass + 1))
-    else
-        echo "  FAIL: script exit code (42) survives a failing quitquitquit notification"
-        echo "    got exit code: ${trap_test_rc}"
-        fail=$((fail + 1))
-    fi
-fi
-
-echo
-echo "passed: ${pass}, failed: ${fail}"
-if [[ ${fail} -gt 0 ]]; then
-    exit 1
-fi

helm/superset/values.yaml

@@ -61,8 +61,6 @@ secretEnv:
   # -- Change to false in order to support externally created secret (Binami "Sealed Secrets" for Kubernetes or External Secrets Operator)
   # note: when externally creating the secret, the chart still expects to pull values from a secret with the name of the release defaults to `release-name-superset-env` - full logic located in _helpers.tpl file: `define "superset.fullname"`
   create: true
-  # -- Annotations to be added to the secret
-  annotations: {}
 
 # -- Specify service account name to be used
 serviceAccountName: ~
@@ -84,11 +82,6 @@ bootstrapScript: |
 # Note: this secret must have the key superset_config.py in it and can include other files as well
 configFromSecret: '{{ template "superset.fullname" . }}-config'
 
-# -- Specify whether Helm should apply additional settings to a secret containing configuration files
-secretConfig:
-  # -- Annotations to be added to the secret which contains configuration files
-  annotations: {}
-
 # -- The name of the secret which we will use to populate env vars in deployed pods
 # This can be useful for secret keys, etc.
 envFromSecret: '{{ template "superset.fullname" . }}-env'
@@ -98,13 +91,13 @@ envFromSecrets: []
 # -- Extra environment variables that will be passed into pods
 extraEnv: {}
   # Different gunicorn settings, refer to the gunicorn documentation
-  # https://gunicorn.org/reference/settings/
+  # https://docs.gunicorn.org/en/stable/settings.html#
   # These variables are used as Flags at the gunicorn startup
-  # https://github.com/apache/superset/blob/master/docker/entrypoints/run-server.sh#L22
+  # https://github.com/apache/superset/blob/master/docker/run-server.sh#L22
   # Extend timeout to allow long running queries.
   # GUNICORN_TIMEOUT: 300
   # Increase the gunicorn worker amount, can improve performance drastically
-  # See: https://gunicorn.org/design/#how-many-workers
+  # See: https://docs.gunicorn.org/en/stable/design.html#how-many-workers
   # SERVER_WORKER_AMOUNT: 4
   # WORKER_MAX_REQUESTS: 0
   # WORKER_MAX_REQUESTS_JITTER: 0
@@ -277,9 +270,7 @@ httproute:
   # per rule to leave room for traffic splitting (defaults to 1). When
   # `supersetWebsockets.enabled` is true, an extra rule routing
   # `supersetWebsockets.ingress.path` to the `-ws` service is appended
-  # automatically, mirroring the ingress behavior. When both `supersetMcp.enabled` and
-  # `supersetMcp.httproute.enabled` are true, an extra rule routing
-  # `supersetMcp.httproute.path` to the `-mcp` service is also appended.
+  # automatically, mirroring the ingress behavior.
   rules:
     - matches:
         - path:
@@ -901,8 +892,6 @@ supersetWebsockets:
       "jwtSecret": "CHANGE-ME",
       "jwtCookieName": "async-token",
     }
-  # -- Annotations to be added to the secret which contains config.json
-  configAnnotations: {}
   service:
     type: ClusterIP
     annotations: {}
@@ -989,6 +978,7 @@ supersetWebsockets:
   # -- Set priorityClassName for supersetWebsockets pods
   priorityClassName: ~
 
+
 supersetMcp:
   # -- Enables the Superset MCP Server. To expose it via the shared ingress at /mcp,
   # also set supersetMcp.ingress.enabled=true.
@@ -1016,10 +1006,6 @@ supersetMcp:
     enabled: false
     path: /mcp
     pathType: Prefix
-  httproute:
-    # -- If true, the MCP server will be exposed via the HTTPRoute /mcp subpath
-    enabled: false
-    path: /mcp
   service:
     type: ClusterIP
     annotations: {}
@@ -1241,31 +1227,6 @@ init:
   topologySpreadConstraints: []
   # -- Set priorityClassName for init job pods
   priorityClassName: ~
-  # -- Configuration for compatibility with the Istio service mesh.
-  # Without these mitigations, when the init-db Job runs in a namespace with
-  # automatic Istio sidecar injection enabled, the injected envoy-proxy
-  # container keeps running after the init container has exited, preventing
-  # the Job from ever reaching the Completed state.
-  # See https://github.com/apache/superset/issues/25798
-  istio:
-    # -- When true, adds the `sidecar.istio.io/inject: "false"` label to the
-    # init job pod template, opting it out of Istio automatic sidecar
-    # injection. This is the recommended fix when the cluster's mesh policy
-    # allows opting out per pod.
-    disableSidecarInjection: false
-    # -- When true, the rendered `superset_init.sh` script (from the internal
-    # `superset.initScript` template) registers an `EXIT` trap that POSTs to
-    # the Istio pilot-agent's `/quitquitquit` endpoint after the init logic
-    # finishes, gracefully terminating an injected envoy-proxy sidecar so
-    # the Job can complete. Enable this when sidecar injection cannot be
-    # disabled per pod (e.g. when enforced by a cluster-wide Istio policy).
-    # Note: requires `curl` to be available in the init container image
-    # (it is included in the default `apache/superset` image) and only
-    # takes effect when `init.command` sources the rendered `superset_init.sh`.
-    terminateSidecarOnExit: false
-    # -- Endpoint that the trap POSTs to in order to terminate the sidecar.
-    # The default matches the standard Istio pilot-agent admin port.
-    quitEndpoint: "http://localhost:15020/quitquitquit"
 
 # -- Configuration values for the postgresql dependency.
 # ref: https://github.com/bitnami/charts/tree/main/bitnami/postgresql

pyproject.toml

@@ -54,7 +54,7 @@ dependencies = [
     "deprecation>=2.1.0, <2.2.0",
     "flask>=2.2.5, <4.0.0",
     "flask-appbuilder>=5.2.2, <6.0.0",
-    "flask-caching>=2.4.1, <3",
+    "flask-caching>=2.1.0, <3",
     "flask-compress>=1.13, <2.0",
     "flask-talisman>=1.0.0, <2.0",
     "flask-login>=0.6.0, < 1.0",
@@ -92,11 +92,11 @@ dependencies = [
     "Pillow>=11.0.0, <13",
     "polyline>=2.0.0, <3.0",
     "pydantic>=2.8.0",
-    "pyparsing>=3.3.2, <4",
+    "pyparsing>=3.0.6, <4",
     "python-dateutil",
     "python-dotenv", # optional dependencies for Flask but required for Superset, see https://flask.palletsprojects.com/en/stable/installation/#optional-dependencies
     "pygeohash",
-    "pyarrow>=24.0.0, <26", # before upgrading pyarrow, check that all db dependencies support this, see e.g. https://github.com/apache/superset/pull/34693
+    "pyarrow>=24.0.0, <25", # before upgrading pyarrow, check that all db dependencies support this, see e.g. https://github.com/apache/superset/pull/34693
     "pyyaml>=6.0.3, <7.0.0",
     "PyJWT>=2.4.0, <3.0",
     "redis>=5.0.0, <9.0",
@@ -106,7 +106,7 @@ dependencies = [
     "sshtunnel>=0.4.0, <0.5",
     "simplejson>=4.1.1",
     "slack_sdk>=3.43.0, <4",
-    "sqlalchemy>=1.4.43, <2", # 1.4.43 adds the python-oracledb (oracle+oracledb) dialect
+    "sqlalchemy>=1.4, <2",
     "sqlalchemy-continuum>=1.6.0, <2.0.0",
     "sqlalchemy-utils>=0.42.1, <0.43", # expanding lowerbound to work with pydoris
     "sqlglot>=30.12.0, <31",
@@ -127,7 +127,7 @@ aurora-data-api = ["preset-sqlalchemy-aurora-data-api>=0.2.8,<0.3"]
 bigquery = [
     "pandas-gbq>=0.35.0",
     "sqlalchemy-bigquery>=1.17.0",
-    "google-cloud-bigquery>=3.42.2",
+    "google-cloud-bigquery>=3.42.1",
 ]
 clickhouse = ["clickhouse-connect>=1.4.2, <2.0"]
 cockroachdb = ["cockroachdb>=0.3.5, <0.4"]
@@ -139,11 +139,10 @@ d1 = [
 ]
 databend = ["databend-sqlalchemy>=0.5.5, <1.0"]
 databricks = [
-    "databricks-sql-connector>=4.2.6, <4.4.0",
+    "databricks-sql-connector==4.2.6",
     "databricks-sqlalchemy==1.0.5",
 ]
-datafusion = ["flightsql-dbapi>=0.2.2, <0.3"]
-db2 = ["ibm-db-sa<=0.4.4, >=0.4.4"]
+db2 = ["ibm-db-sa>0.3.8, <=0.4.4"]
 denodo = ["denodo-sqlalchemy>=2.0.5,<2.1.0"]
 dremio = ["sqlalchemy-dremio>=1.2.1, <4"]
 drill = ["sqlalchemy-drill>=1.1.10, <2"]
@@ -154,10 +153,6 @@ solr = ["sqlalchemy-solr >= 0.2.4.3"]
 elasticsearch = ["elasticsearch-dbapi>=0.2.13, <0.3.0"]
 exasol = ["sqlalchemy-exasol>=2.4.0, <8.0"]
 excel = ["xlrd>=2.0.2, <2.1"]
-# Async dashboard "Export Data/Images to Excel": uploads the workbook to S3 and
-# emails a pre-signed link. boto3 is imported lazily by superset.utils.s3, so
-# installing this extra is only required to actually run exports.
-excel-export = ["boto3"]
 fastmcp = [
     "fastmcp>=3.4.3,<4.0",
     # tiktoken backs the response-size-guard token estimator. Without
@@ -189,7 +184,7 @@ ocient = [
     "shapely",
     "geojson",
 ]
-oracle = ["oracledb>=4.0.2, <5"]
+oracle = ["oracledb>=2.0.0, <5"]
 parseable = ["sqlalchemy-parseable>=0.1.6,<0.2.0"]
 pinot = ["pinotdb>=5.0.0, <10.0.0"]
 playwright = ["playwright>=1.61.0, <2"]
@@ -201,7 +196,7 @@ redshift = ["sqlalchemy-redshift>=0.8.1, <0.9"]
 risingwave = ["sqlalchemy-risingwave"]
 shillelagh = ["shillelagh[all]>=1.4.4, <2"]
 singlestore = ["sqlalchemy-singlestoredb>=1.2.1, <2"]
-snowflake = ["snowflake-sqlalchemy>=1.11.0, <2"]
+snowflake = ["snowflake-sqlalchemy>=1.10.2, <2"]
 sqlite = ["syntaqlite>=0.7.0,<0.8.0"]
 spark = [
     "pyhive[hive_pure_sasl]>=0.7",
@@ -210,7 +205,7 @@ spark = [
 ]
 tdengine = [
     "taospy>=2.8.9",
-    "taos-ws-py>=0.7.0"
+    "taos-ws-py>=0.6.9"
 ]
 teradata = ["teradatasql>=20.0.0.62"]
 thumbnails = [] # deprecated, will be removed in 7.0
@@ -227,7 +222,7 @@ development = [
     "docker",
     "flask-testing",
     "freezegun",
-    "grpcio>=1.82.1",
+    "grpcio>=1.81.1",
     "openapi-spec-validator",
     "parameterized",
     "pip",

pytest.ini

@@ -32,13 +32,15 @@ filterwarnings =
     error:"Query" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning
     error:"SavedQuery" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning
     error:"SqlaTable" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning
-    error:"SqlMetric" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning
-    error:"TableColumn" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning
+#    error:"SqlMetric" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning
+#    error:"TableColumn" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning
     error:"TaggedObject" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning
     error:The autoload parameter is deprecated:sqlalchemy.exc.RemovedIn20Warning
-    error:The connection.execute\(\) method:sqlalchemy.exc.RemovedIn20Warning
     error:The current statement is being autocommitted using implicit autocommit:sqlalchemy.exc.RemovedIn20Warning
+    error:The connection.execute\(\) method:sqlalchemy.exc.RemovedIn20Warning
+#    error:The current statement is being autocommitted using implicit autocommit:sqlalchemy.exc.RemovedIn20Warning
     error:The ``declarative_base\(\)`` function is now available:sqlalchemy.exc.RemovedIn20Warning
     error:The Engine.execute\(\) method is considered legacy:sqlalchemy.exc.RemovedIn20Warning
     error:The legacy calling style of select\(\) is deprecated:sqlalchemy.exc.RemovedIn20Warning
     error:The "whens" argument to case:sqlalchemy.exc.RemovedIn20Warning
+#    error:"User" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning

requirements/base.in

@@ -30,7 +30,7 @@ cryptography>=49.0.0,<50.0.0
 # Security: Snyk - XSS vulnerability in Mako templates
 mako>=1.3.11,<2.0.0
 # Security: CVE-2024-52338 (CRITICAL) - Deserialization of untrusted data in IPC/Parquet readers
-pyarrow>=24.0.0,<26.0.0
+pyarrow>=24.0.0,<25.0.0
 # Security: CVE-2026-27459 - pyopenssl certificate validation
 pyopenssl>=26.0.0,<27.0.0
 # Security: CVE-2026-25645 (MEDIUM) - Insecure Temporary File

requirements/base.txt

@@ -28,8 +28,6 @@ babel==2.17.0
     # via flask-babel
 backoff==2.2.1
     # via apache-superset (pyproject.toml)
-backports-zstd==1.6.0
-    # via flask-compress
 bcrypt==4.3.0
     # via paramiko
 billiard==4.2.1
@@ -130,9 +128,9 @@ flask-appbuilder==5.2.2
     #   apache-superset-core
 flask-babel==3.1.0
     # via flask-appbuilder
-flask-caching==2.4.1
+flask-caching==2.3.1
     # via apache-superset (pyproject.toml)
-flask-compress==1.24
+flask-compress==1.17
     # via apache-superset (pyproject.toml)
 flask-cors==6.0.5
     # via apache-superset (pyproject.toml)
@@ -246,7 +244,7 @@ msgpack==1.2.1
     # via apache-superset (pyproject.toml)
 msgspec==0.19.0
     # via flask-session
-nh3==0.3.6
+nh3==0.3.5
     # via apache-superset (pyproject.toml)
 numexpr==2.10.2
     # via -r requirements/base.in
@@ -287,7 +285,7 @@ parsedatetime==2.6
     # via apache-superset (pyproject.toml)
 pgsanity==0.2.9
     # via apache-superset (pyproject.toml)
-pillow==12.3.0
+pillow==12.2.0
     # via apache-superset (pyproject.toml)
 platformdirs==4.3.8
     # via requests-cache
@@ -297,22 +295,22 @@ prison==0.2.1
     # via flask-appbuilder
 prompt-toolkit==3.0.51
     # via click-repl
-pyarrow==25.0.0
+pyarrow==24.0.0
     # via
     #   -r requirements/base.in
     #   apache-superset (pyproject.toml)
     #   apache-superset-core
-pyasn1==0.6.4
+pyasn1==0.6.3
     # via pyasn1-modules
 pyasn1-modules==0.4.2
     # via google-auth
 pycparser==2.22
     # via cffi
-pydantic==2.13.4
+pydantic==2.11.7
     # via
     #   apache-superset (pyproject.toml)
     #   apache-superset-core
-pydantic-core==2.46.4
+pydantic-core==2.33.2
     # via pydantic
 pygeohash==3.2.2
     # via apache-superset (pyproject.toml)
@@ -329,7 +327,7 @@ pyopenssl==26.3.0
     # via
     #   -r requirements/base.in
     #   shillelagh
-pyparsing==3.3.2
+pyparsing==3.2.3
     # via apache-superset (pyproject.toml)
 pysocks==1.7.1
     # via urllib3
@@ -410,7 +408,7 @@ sqlalchemy==1.4.54
     #   shillelagh
     #   sqlalchemy-continuum
     #   sqlalchemy-utils
-sqlalchemy-continuum==1.7.0
+sqlalchemy-continuum==1.6.0
     # via apache-superset (pyproject.toml)
 sqlalchemy-utils==0.42.1
     # via
@@ -445,7 +443,7 @@ typing-extensions==4.16.0
     #   selenium
     #   shillelagh
     #   typing-inspection
-typing-inspection==0.4.2
+typing-inspection==0.4.1
     # via pydantic
 tzdata==2025.2
     # via
@@ -498,3 +496,5 @@ xlsxwriter==3.2.9
     # via
     #   apache-superset (pyproject.toml)
     #   pandas
+zstandard==0.23.0
+    # via flask-compress

requirements/development.txt

@@ -64,10 +64,6 @@ backoff==2.2.1
     #   apache-superset
 backports-tarfile==1.2.0
     # via jaraco-context
-backports-zstd==1.6.0
-    # via
-    #   -c requirements/base-constraint.txt
-    #   flask-compress
 bcrypt==4.3.0
     # via
     #   -c requirements/base-constraint.txt
@@ -276,11 +272,11 @@ flask-babel==3.1.0
     # via
     #   -c requirements/base-constraint.txt
     #   flask-appbuilder
-flask-caching==2.4.1
+flask-caching==2.3.1
     # via
     #   -c requirements/base-constraint.txt
     #   apache-superset
-flask-compress==1.24
+flask-compress==1.17
     # via
     #   -c requirements/base-constraint.txt
     #   apache-superset
@@ -341,7 +337,7 @@ geopy==2.4.1
     #   apache-superset
 gevent==26.4.0
     # via apache-superset
-google-api-core==2.33.0
+google-api-core==2.23.0
     # via
     #   google-cloud-bigquery
     #   google-cloud-core
@@ -362,7 +358,7 @@ google-auth-oauthlib==1.2.1
     # via
     #   pandas-gbq
     #   pydata-google-auth
-google-cloud-bigquery==3.42.2
+google-cloud-bigquery==3.42.1
     # via
     #   apache-superset
     #   pandas-gbq
@@ -386,7 +382,7 @@ greenlet==3.5.3
     #   sqlalchemy
 griffelib==2.0.2
     # via fastmcp-slim
-grpcio==1.83.0
+grpcio==1.81.1
     # via
     #   apache-superset
     #   google-api-core
@@ -574,7 +570,7 @@ msgspec==0.19.0
     #   flask-session
 mysqlclient==2.2.8
     # via apache-superset
-nh3==0.3.6
+nh3==0.3.5
     # via
     #   -c requirements/base-constraint.txt
     #   apache-superset
@@ -669,7 +665,7 @@ pgsanity==0.2.9
     # via
     #   -c requirements/base-constraint.txt
     #   apache-superset
-pillow==12.3.0
+pillow==12.2.0
     # via
     #   -c requirements/base-constraint.txt
     #   apache-superset
@@ -721,14 +717,14 @@ psycopg2-binary==2.9.12
     # via apache-superset
 py-key-value-aio==0.4.4
     # via fastmcp-slim
-pyarrow==25.0.0
+pyarrow==24.0.0
     # via
     #   -c requirements/base-constraint.txt
     #   apache-superset
     #   apache-superset-core
     #   db-dtypes
     #   pandas-gbq
-pyasn1==0.6.4
+pyasn1==0.6.3
     # via
     #   -c requirements/base-constraint.txt
     #   pyasn1-modules
@@ -742,7 +738,7 @@ pycparser==2.22
     # via
     #   -c requirements/base-constraint.txt
     #   cffi
-pydantic==2.13.4
+pydantic==2.11.7
     # via
     #   -c requirements/base-constraint.txt
     #   apache-superset
@@ -751,7 +747,7 @@ pydantic==2.13.4
     #   mcp
     #   openapi-pydantic
     #   pydantic-settings
-pydantic-core==2.46.4
+pydantic-core==2.33.2
     # via
     #   -c requirements/base-constraint.txt
     #   pydantic
@@ -795,7 +791,7 @@ pyopenssl==26.3.0
     #   -c requirements/base-constraint.txt
     #   google-auth
     #   shillelagh
-pyparsing==3.3.2
+pyparsing==3.2.3
     # via
     #   -c requirements/base-constraint.txt
     #   apache-superset
@@ -991,7 +987,7 @@ sqlalchemy==1.4.54
     #   sqlalchemy-utils
 sqlalchemy-bigquery==1.17.0
     # via apache-superset
-sqlalchemy-continuum==1.7.0
+sqlalchemy-continuum==1.6.0
     # via
     #   -c requirements/base-constraint.txt
     #   apache-superset
@@ -1070,7 +1066,7 @@ typing-extensions==4.16.0
     #   shillelagh
     #   starlette
     #   typing-inspection
-typing-inspection==0.4.2
+typing-inspection==0.4.1
     # via
     #   -c requirements/base-constraint.txt
     #   mcp
@@ -1172,4 +1168,7 @@ zope-event==5.0
 zope-interface==5.4.0
     # via gevent
 zstandard==0.23.0
-    # via trino
+    # via
+    #   -c requirements/base-constraint.txt
+    #   flask-compress
+    #   trino

scripts/benchmark_migration.py

@@ -93,7 +93,7 @@ def find_models(module: ModuleType) -> list[type[Model]]:  # noqa: C901
     # where the current model is out-of-sync with the existing table after a
     # downgrade
     sqlalchemy_uri = current_app.config["SQLALCHEMY_DATABASE_URI"]
-    engine = create_engine(sqlalchemy_uri, future=True)
+    engine = create_engine(sqlalchemy_uri)
     Base = automap_base()  # noqa: N806
     Base.prepare(engine, reflect=True)
     seen = set()

scripts/change_detector.py

@@ -31,18 +31,14 @@ from urllib.request import Request, urlopen
 MAX_RETRIES: int = 4
 RETRY_BACKOFF_SECONDS: int = 2
 REQUEST_TIMEOUT_SECONDS: int = 30
-# GitHub returns 429 when throttling, which is transient and worth retrying
-# alongside 5xx server errors. It also returns 403 for two very different
-# reasons — a secondary rate limit, and a token missing the required scope —
-# so 403 is only retried when the response headers show throttling. Retrying a
-# scope failure just delays the error and buries its cause.
-RETRYABLE_STATUS_CODES: frozenset[int] = frozenset({429})
+# GitHub returns 429 (and 403 for secondary rate limits) when throttling, which
+# is transient and worth retrying alongside 5xx server errors.
+RETRYABLE_STATUS_CODES: frozenset[int] = frozenset({403, 429})
 
 # Define patterns for each group of files you're interested in
 PATTERNS = {
     "python": [
         r"^\.github/workflows/.*python",
-        r"^docker-compose-image-tag\.yml$",
         r"^tests/",
         r"^superset/",
         r"^scripts/",
@@ -72,37 +68,6 @@ PATTERNS = {
 GITHUB_TOKEN = os.environ.get("GITHUB_TOKEN")
 
 
-def _is_rate_limited(err: HTTPError) -> bool:
-    """Whether a 403 is GitHub throttling rather than a missing token scope."""
-    headers = getattr(err, "headers", None)
-    if headers is None:
-        return False
-    try:
-        return (
-            headers.get("x-ratelimit-remaining") == "0"
-            or headers.get("retry-after") is not None
-        )
-    except AttributeError:
-        return False
-
-
-def _api_error_detail(err: object) -> str:
-    """The API's own explanation, e.g. ``Resource not accessible by integration``.
-
-    Without this a 403 is indistinguishable from a rate limit in the CI log.
-    """
-    try:
-        body = err.read().decode("utf-8", "replace")  # type: ignore[attr-defined]
-    except Exception:  # noqa: BLE001  # pylint: disable=broad-except
-        return ""
-    try:
-        detail = json.loads(body).get("message") or body
-    except (ValueError, AttributeError):
-        detail = body
-    # Bound the output so a large/HTML error page can't flood the CI log.
-    return detail[:500]
-
-
 def fetch_files_github_api(url: str):  # type: ignore
     """Fetches data using GitHub API, retrying on transient failures."""
     req = Request(url)  # noqa: S310
@@ -122,14 +87,9 @@ def fetch_files_github_api(url: str):  # type: ignore
             # re-raise once the retry budget is exhausted.
             status = getattr(err, "code", None)
             is_transient = (
-                status is None
-                or status >= 500
-                or status in RETRYABLE_STATUS_CODES
-                or (status == 403 and _is_rate_limited(err))  # type: ignore[arg-type]
+                status is None or status >= 500 or status in RETRYABLE_STATUS_CODES
             )
             if not is_transient or attempt == MAX_RETRIES:
-                if detail := _api_error_detail(err):
-                    print(f"GitHub API error {status}: {detail}")
                 raise
             wait = RETRY_BACKOFF_SECONDS * 2 ** (attempt - 1)
             print(

superset-core/src/superset_core/extensions/context.py

@@ -1,119 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-
-"""
-Extension Context API for superset-core extensions.
-
-Provides access to the current extension's context, including metadata
-and scoped resources like storage. Extensions call `get_context()` to
-access their context during execution.
-
-The context is set by the host (Superset) during extension loading and
-is only available within extension code.
-
-Usage:
-    from superset_core.extensions.context import get_context
-
-    def setup():
-        ctx = get_context()
-
-        # Access extension metadata
-        print(f"Running {ctx.extension.displayName} v{ctx.extension.version}")
-
-        # Access extension-scoped storage
-        ctx.storage.ephemeral.set("lastRun", time.time(), EphemeralSetOptions(ttl=3600))
-        data = ctx.storage.ephemeral.get("cachedData")
-"""
-
-from __future__ import annotations
-
-from typing import Protocol, TYPE_CHECKING
-
-if TYPE_CHECKING:
-    from superset_core.extensions.storage.ephemeral import EphemeralStateAccessor
-    from superset_core.extensions.storage.persistent import PersistentStateAccessor
-    from superset_core.extensions.types import BaseExtension
-
-
-class ExtensionStorage(Protocol):
-    """Extension-scoped storage accessor for all available tiers."""
-
-    @property
-    def ephemeral(self) -> "EphemeralStateAccessor":
-        """Server-side cache (Redis/Memcached) with TTL."""
-        ...
-
-    @property
-    def persistent(self) -> "PersistentStateAccessor":
-        """Database-backed persistent storage."""
-        ...
-
-
-class ExtensionContext(Protocol):
-    """
-    Context object providing extension-specific resources.
-
-    This context is only available during extension execution.
-    Calling `get_context()` outside of an extension will raise an error.
-    """
-
-    @property
-    def extension(self) -> "BaseExtension":
-        """Metadata about the current extension."""
-        ...
-
-    @property
-    def storage(self) -> ExtensionStorage:
-        """Extension-scoped storage across all available tiers."""
-        ...
-
-
-def get_context() -> ExtensionContext:
-    """
-    Get the current extension's context.
-
-    This function returns the context for the currently executing extension,
-    providing access to extension metadata and scoped resources like storage.
-
-    Host implementations will replace this function during initialization
-    with a concrete implementation providing actual functionality.
-
-    :returns: The current extension's context.
-    :raises RuntimeError: If called outside of an extension context.
-
-    Example:
-        from superset_core.extensions.context import get_context
-
-        ctx = get_context()
-
-        # Access extension metadata
-        print(f"Extension: {ctx.extension.id}")
-        print(f"Version: {ctx.extension.version}")
-
-        # Access extension-scoped storage
-        ctx.storage.ephemeral.set("tempData", data, EphemeralSetOptions(ttl=3600))
-        value = ctx.storage.ephemeral.get("tempData")
-
-        # Access shared (cross-user) storage
-        ctx.storage.ephemeral.shared.set(
-            "globalCounter", count, EphemeralSetOptions(ttl=3600)
-        )
-    """
-    raise NotImplementedError(
-        "get_context() must be called within an extension context. "
-        "This function is replaced by the host during extension loading."
-    )

superset-core/src/superset_core/extensions/storage/__init__.py

@@ -1,79 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-
-"""
-Storage API for superset-core extensions.
-
-Provides storage tiers for extensions with different persistence characteristics.
-Storage is accessed via `ctx.storage` from `get_context()`.
-
-Tier 1 - Local State (Frontend Only):
-    - local: Browser localStorage - persists across sessions
-    - session: Browser sessionStorage - cleared on tab close
-    These are frontend-only and cannot be imported in backend code.
-
-Tier 2 - Ephemeral State (Server Cache):
-    - ephemeral: Short-lived KV storage backed by server-side cache
-    - Supports TTL, not guaranteed to survive server restarts
-    - Use for temporary state like job progress or intermediate results
-
-Tier 3 - Persistent State (Database):
-    - persistent: Durable KV storage backed by database table
-    - Survives server restarts, supports encryption and resource linking
-    - Use for user preferences, extension config, per-resource settings
-
-All tiers follow the same API pattern:
-    - User-scoped by default (private to current user)
-    - `shared` accessor for data visible to all users
-
-For backend code that needs to query, enumerate, or bulk-manage its own
-Tier 3 rows rather than get/set a single key at a time (for example, a
-cleanup job pruning rows linked to resources that no longer exist), see
-`superset_core.extensions.storage.dao.ExtensionStorageDAO`.
-
-Usage:
-    from superset_core.extensions.context import get_context
-    from superset_core.extensions.storage.ephemeral import EphemeralSetOptions
-
-    ctx = get_context()
-
-    # Tier 2: Ephemeral state
-    ctx.storage.ephemeral.get('preference')
-    ctx.storage.ephemeral.set('preference', 'compact', EphemeralSetOptions(ttl=3600))
-
-    # Tier 2: Shared ephemeral state
-    ctx.storage.ephemeral.shared.get('job_progress')
-    ctx.storage.ephemeral.shared.set(
-        'job_progress', {'pct': 42}, EphemeralSetOptions(ttl=3600)
-    )
-
-    # Tier 3: Persistent state
-    ctx.storage.persistent.get('config')
-    ctx.storage.persistent.set('config', {'version': 2})
-
-    # Tier 3: DAO-style access to this extension's own rows
-    from superset_core.extensions.storage.dao import ExtensionStorageDAO
-
-    entries = ExtensionStorageDAO.filter_by(resource_type='my-resource-type')
-"""
-
-from superset_core.extensions.storage import (
-    dao,  # noqa: F401
-    ephemeral,  # noqa: F401
-    models,  # noqa: F401
-    persistent,  # noqa: F401
-)

superset-core/src/superset_core/extensions/storage/dao.py

@@ -1,70 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-
-"""
-Persistent storage DAO API for superset-core extensions (Tier 3 Storage).
-
-Provides direct DAO-style access to an extension's own Tier 3 persistent
-storage rows, for backend code that needs to query, enumerate, or bulk-manage
-entries rather than get/set a single key at a time (see
-`superset_core.extensions.storage.persistent` for that simpler shape).
-
-Every query and mutation made through this DAO is automatically scoped to
-the extension currently executing — `extension_id` is never a parameter the
-caller supplies, so an extension cannot read or modify another extension's
-storage through this DAO. The scoping is resolved from the ambient
-extension context (the same context `get_context()` reads from), so this DAO
-can only be used from within extension backend code, not host code.
-
-Usage:
-    from superset_core.extensions.storage.dao import ExtensionStorageDAO
-
-    # All entries linked to a specific resource this extension created
-    entries = ExtensionStorageDAO.filter_by(
-        resource_type="my-resource-type",
-        resource_uuid=resource_uuid,
-    )
-
-    # Bulk-delete rows for a resource that no longer exists
-    ExtensionStorageDAO.delete(entries)
-"""
-
-from superset_core.common.daos import BaseDAO
-from superset_core.extensions.storage.models import ExtensionStorageEntry
-
-
-class ExtensionStorageDAO(BaseDAO[ExtensionStorageEntry]):
-    """
-    Abstract DAO for an extension's own Tier 3 persistent storage rows.
-
-    Host implementations will replace this class during initialization
-    with a concrete implementation providing actual functionality.
-
-    Inherits `find_all`, `find_one_or_none`, `filter_by`, `query`, `update`,
-    and `delete` from `BaseDAO`, every one restricted to the calling
-    extension's own rows. `create()` is overridden by the host
-    implementation to always raise: it is a raw insert with no upsert
-    dedup, quota check, or locking against the key
-    `superset_core.extensions.storage.persistent`'s `set()` writes to, so
-    use that (or the ambient `ctx.storage.persistent.set()` accessor) to
-    write a value instead.
-    """
-
-    # Class variables that will be set by host implementation
-    model_cls = None
-    base_filter = None
-    id_column_name = "id"

superset-core/src/superset_core/extensions/storage/ephemeral.py

@@ -1,162 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-
-"""
-Ephemeral State API for superset-core extensions (Tier 2 Storage).
-
-Provides short-lived KV storage backed by the configured server-side cache
-backend (Redis, Memcached, or filesystem). Automatically expires based on TTL.
-Not guaranteed to survive server restarts.
-
-Host implementations will replace the EphemeralState class during initialization
-with a concrete implementation providing actual functionality.
-
-Cache keys are namespaced automatically:
-- User-scoped (default): superset-ext:{extension_id}:user:{user_id}:{key}
-- Shared (global): superset-ext:{extension_id}:shared:{key}
-
-Usage (via extension context - preferred):
-    from superset_core.extensions.context import get_context
-
-    ctx = get_context()
-
-    # User-scoped state (default - private to current user)
-    ctx.storage.ephemeral.get('preference')
-    ctx.storage.ephemeral.set('preference', 'compact', EphemeralSetOptions(ttl=3600))
-    ctx.storage.ephemeral.remove('preference')
-
-    # Shared state (explicit opt-in - visible to all users)
-    ctx.storage.ephemeral.shared.get('job_progress')
-    ctx.storage.ephemeral.shared.set(
-        'job_progress', {'pct': 42}, EphemeralSetOptions(ttl=3600)
-    )
-    ctx.storage.ephemeral.shared.remove('job_progress')
-"""
-
-from dataclasses import dataclass
-from typing import Any, ClassVar, Protocol
-
-
-@dataclass(frozen=True)
-class EphemeralSetOptions:
-    """
-    Options for an ephemeral state `set` call.
-
-    `ttl` is required (no default): every write must have an explicit
-    expiration, matching the frontend `EphemeralSetOptions` and the REST API.
-    """
-
-    ttl: int
-    #: Name of the codec used to encode `value`, e.g. "json" (default).
-    codec: str = "json"
-
-
-class EphemeralStateAccessor(Protocol):
-    """Protocol for scoped ephemeral state access."""
-
-    def get(self, key: str) -> Any:
-        """Get a value from ephemeral state."""
-        ...
-
-    def set(self, key: str, value: Any, options: EphemeralSetOptions) -> None:
-        """Set a value in ephemeral state with TTL."""
-        ...
-
-    def remove(self, key: str) -> None:
-        """Remove a value from ephemeral state."""
-        ...
-
-
-class _UnconfiguredEphemeralStateAccessor:
-    """Placeholder for `.shared` before host replacement.
-
-    Raises the same `NotImplementedError` as the other stub methods, rather
-    than a bare `AttributeError`, if accessed before the host wires up the
-    concrete implementation.
-    """
-
-    def get(self, key: str) -> Any:
-        raise NotImplementedError("Class will be replaced during initialization")
-
-    def set(self, key: str, value: Any, options: EphemeralSetOptions) -> None:
-        raise NotImplementedError("Class will be replaced during initialization")
-
-    def remove(self, key: str) -> None:
-        raise NotImplementedError("Class will be replaced during initialization")
-
-
-class EphemeralState:
-    """
-    Tier 2 ephemeral state storage for extensions.
-
-    Backed by the configured server-side cache (Redis, Memcached, or filesystem).
-    Data expires based on TTL and is not guaranteed to survive server restarts.
-
-    Host implementations will replace this class during initialization
-    with a concrete implementation providing actual functionality.
-
-    All operations are user-scoped by default (private to the current user).
-    Use `.shared` to access state that is visible to all users.
-    """
-
-    @staticmethod
-    def get(key: str) -> Any:
-        """
-        Get a value from user-scoped ephemeral state.
-
-        Data is automatically scoped to the current authenticated user.
-        Other users cannot see or modify this data.
-
-        :param key: The key to retrieve.
-        :returns: The stored value, or None if not found or expired.
-        """
-        raise NotImplementedError("Class will be replaced during initialization")
-
-    @staticmethod
-    def set(key: str, value: Any, options: EphemeralSetOptions) -> None:
-        """
-        Set a value in user-scoped ephemeral state with TTL.
-
-        Data is automatically scoped to the current authenticated user.
-        Other users cannot see or modify this data.
-
-        :param key: The key to store.
-        :param value: The value to store, encoded with `options.codec`
-            (default "json"). The encoded value must not exceed
-            MAX_VALUE_SIZE from config.
-        :param options: `EphemeralSetOptions`, e.g. `ttl=3600`. Required —
-            `ttl` must not exceed MAX_TTL from config. `codec="pickle"`
-            stores a value that isn't JSON-serializable.
-        """
-        raise NotImplementedError("Class will be replaced during initialization")
-
-    @staticmethod
-    def remove(key: str) -> None:
-        """
-        Remove a value from user-scoped ephemeral state.
-
-        Data is automatically scoped to the current authenticated user.
-
-        :param key: The key to remove.
-        """
-        raise NotImplementedError("Class will be replaced during initialization")
-
-    #: Shared (global) ephemeral state accessor.
-    #: Data stored via this accessor is visible to all users of the extension.
-    #: WARNING: Do not store user-specific or sensitive data here.
-    #: Host implementations will replace this during initialization.
-    shared: ClassVar[EphemeralStateAccessor] = _UnconfiguredEphemeralStateAccessor()

superset-core/src/superset_core/extensions/storage/models.py

@@ -1,74 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-
-"""
-Persistent storage model API for superset-core extensions (Tier 3 Storage).
-
-Provides the model class backing `superset_core.extensions.storage.dao.
-ExtensionStorageDAO`, for extension backend code that needs to enumerate or
-bulk-manage its own persistent storage rows (for example, a periodic cleanup
-job pruning rows linked to resources that no longer exist), rather than the
-single-key get/set/remove shape of `persistent`.
-
-Usage:
-    from superset_core.extensions.storage.models import ExtensionStorageEntry
-"""
-
-from __future__ import annotations
-
-from typing import TYPE_CHECKING
-from uuid import UUID
-
-from superset_core.common.models import CoreModel
-
-if TYPE_CHECKING:
-    from datetime import datetime
-
-
-class ExtensionStorageEntry(CoreModel):
-    """
-    Abstract model interface for a single Tier 3 persistent storage row.
-
-    Host implementations will replace this class during initialization
-    with a concrete implementation providing actual functionality.
-
-    `value` is the raw stored payload (encrypted at rest when `is_encrypted`
-    is set), encoded with the codec named by `codec`; decoding/decryption is
-    handled by `superset_core.extensions.storage.dao.ExtensionStorageDAO`,
-    not by reading this field directly.
-    """
-
-    __abstract__ = True
-
-    # Type hints for expected column attributes
-    id: int
-    uuid: UUID
-    extension_id: str
-    user_fk: int | None
-    resource_type: str | None
-    resource_uuid: str | None
-    key: str
-    value: bytes
-    value_size: int
-    codec: str
-    is_encrypted: bool
-
-    # Audit fields
-    created_on: "datetime | None"
-    changed_on: "datetime | None"
-    created_by_fk: int | None
-    changed_by_fk: int | None

superset-core/src/superset_core/extensions/storage/persistent.py

@@ -1,243 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-
-"""
-Persistent State API for superset-core extensions (Tier 3 Storage).
-
-Provides durable KV storage backed by a dedicated database table.
-Data survives server restarts, cache evictions, and browser clears.
-Suitable for user preferences, saved state, and any data that must not be lost.
-
-Host implementations will replace the PersistentState class during initialization
-with a concrete implementation providing actual functionality.
-
-Database keys are namespaced automatically:
-- User-scoped (default): (extension_id, user_id, key)
-- Shared (global): (extension_id, null, key)
-
-Usage (via extension context - preferred):
-    from superset_core.extensions.context import get_context
-
-    ctx = get_context()
-
-    # User-scoped state (default - private to current user)
-    ctx.storage.persistent.get('preferences')
-    ctx.storage.persistent.set('preferences', {'theme': 'dark'})
-    ctx.storage.persistent.remove('preferences')
-
-    # Shared state (explicit opt-in - visible to all users)
-    ctx.storage.persistent.shared.get('global_config')
-    ctx.storage.persistent.shared.set('global_config', {'version': 2})
-    ctx.storage.persistent.shared.remove('global_config')
-
-    # Encrypted at rest
-    ctx.storage.persistent.set(
-        'api_token', 'sk-...', PersistentSetOptions(encrypt=True)
-    )
-
-    # Listing entries (page and page_size are required)
-    result = ctx.storage.persistent.list(PersistentListOptions(page=0, page_size=10))
-    for entry in result.entries:
-        print(entry.key, entry.value)
-"""
-
-from dataclasses import dataclass, field
-from typing import Any, ClassVar, Protocol
-
-
-@dataclass(frozen=True)
-class PersistentSetOptions:
-    """
-    Options for a persistent state `set` call.
-
-    NOTE: This is intentionally minimal for the initial implementation.
-    Additional options can be added here later without changing the `set`
-    signature on `PersistentStateAccessor`/`PersistentState`.
-    """
-
-    encrypt: bool = False
-    #: Name of the codec used to encode `value`, e.g. "json" (default).
-    codec: str = "json"
-
-
-@dataclass(frozen=True)
-class PersistentListOptions:
-    """Options for a persistent state `list` call.
-
-    `page` and `page_size` are required (no default): `list` returns one
-    page of a caller's entries, not the whole result set, and a default
-    would let that fact go unnoticed at the call site. Check the returned
-    `PersistentListResult.count` against `page_size` to know whether more
-    pages exist.
-
-    `resource_type`/`resource_uuid` are optional filters; omitting them
-    lists every entry in the caller's scope (global or user-scoped,
-    depending on whether `list` is called via `.shared` or directly).
-    """
-
-    #: Zero-indexed page number.
-    page: int
-    #: Entries per page. There is no fixed ceiling on this value, but a
-    #: page whose combined value size exceeds MAX_LIST_PAYLOAD_SIZE from
-    #: config is rejected — reduce page_size and retry if that happens.
-    page_size: int
-    resource_type: str | None = None
-    resource_uuid: str | None = None
-
-
-@dataclass(frozen=True)
-class PersistentListEntry:
-    """A single entry returned by a persistent state `list` call."""
-
-    key: str
-    value: Any
-    #: Name of the codec `value` was encoded with, e.g. "json" or "pickle".
-    codec: str
-
-
-@dataclass(frozen=True)
-class PersistentListResult:
-    """Result of a persistent state `list` call."""
-
-    entries: list[PersistentListEntry] = field(default_factory=list)
-    #: Total number of entries matching the given scope/filters, across all
-    #: pages — not just the number returned in `entries`.
-    count: int = 0
-
-
-class PersistentStateAccessor(Protocol):
-    """Protocol for scoped persistent state access."""
-
-    def get(self, key: str) -> Any:
-        """Get a value from persistent state."""
-        ...
-
-    def set(
-        self, key: str, value: Any, options: PersistentSetOptions | None = None
-    ) -> None:
-        """Set a value in persistent state."""
-        ...
-
-    def list(self, options: PersistentListOptions) -> PersistentListResult:
-        """List entries in persistent state."""
-        ...
-
-    def remove(self, key: str) -> None:
-        """Remove a value from persistent state."""
-        ...
-
-
-class _UnconfiguredPersistentStateAccessor:
-    """Placeholder for `.shared` before host replacement.
-
-    Raises the same `NotImplementedError` as the other stub methods, rather
-    than a bare `AttributeError`, if accessed before the host wires up the
-    concrete implementation.
-    """
-
-    def get(self, key: str) -> Any:
-        raise NotImplementedError("Class will be replaced during initialization")
-
-    def set(
-        self, key: str, value: Any, options: PersistentSetOptions | None = None
-    ) -> None:
-        raise NotImplementedError("Class will be replaced during initialization")
-
-    def list(self, options: PersistentListOptions) -> PersistentListResult:
-        raise NotImplementedError("Class will be replaced during initialization")
-
-    def remove(self, key: str) -> None:
-        raise NotImplementedError("Class will be replaced during initialization")
-
-
-class PersistentState:
-    """
-    Tier 3 persistent state storage for extensions.
-
-    Backed by a dedicated database table. Data survives server restarts,
-    cache evictions, and browser clears.
-
-    Host implementations will replace this class during initialization
-    with a concrete implementation providing actual functionality.
-
-    All operations are user-scoped by default (private to the current user).
-    Use `.shared` to access state that is visible to all users.
-    """
-
-    @staticmethod
-    def get(key: str) -> Any:
-        """
-        Get a value from user-scoped persistent state.
-
-        Data is automatically scoped to the current authenticated user.
-        Other users cannot see or modify this data.
-
-        :param key: The key to retrieve.
-        :returns: The stored value, or None if not found.
-        """
-        raise NotImplementedError("Class will be replaced during initialization")
-
-    @staticmethod
-    def set(key: str, value: Any, options: PersistentSetOptions | None = None) -> None:
-        """
-        Set a value in user-scoped persistent state.
-
-        Data is automatically scoped to the current authenticated user.
-        Other users cannot see or modify this data.
-        Data persists indefinitely until explicitly removed.
-
-        :param key: The key to store.
-        :param value: The value to store, encoded with `options.codec`
-            (default "json"). The encoded value must not exceed
-            MAX_VALUE_SIZE from config.
-        :param options: Optional `PersistentSetOptions`, e.g. `encrypt=True`
-            to store the value encrypted at rest, or `codec="pickle"` to
-            store a value that isn't JSON-serializable.
-        """
-        raise NotImplementedError("Class will be replaced during initialization")
-
-    @staticmethod
-    def list(options: PersistentListOptions) -> PersistentListResult:
-        """
-        List entries in user-scoped persistent state.
-
-        Data is automatically scoped to the current authenticated user.
-        Other users' entries are never returned.
-
-        :param options: `PersistentListOptions`, e.g.
-            `PersistentListOptions(page=0, page_size=10)`.
-        :returns: `PersistentListResult` with the page's entries and the
-            total count across all pages.
-        """
-        raise NotImplementedError("Class will be replaced during initialization")
-
-    @staticmethod
-    def remove(key: str) -> None:
-        """
-        Remove a value from user-scoped persistent state.
-
-        Data is automatically scoped to the current authenticated user.
-
-        :param key: The key to remove.
-        """
-        raise NotImplementedError("Class will be replaced during initialization")
-
-    #: Shared (global) persistent state accessor.
-    #: Data stored via this accessor is visible to all users of the extension.
-    #: WARNING: Do not store user-specific or sensitive data here.
-    #: Host implementations will replace this during initialization.
-    shared: ClassVar[PersistentStateAccessor] = _UnconfiguredPersistentStateAccessor()

superset-core/src/superset_core/extensions/types.py

@@ -25,7 +25,7 @@ Two distinct schemas:
 
 from __future__ import annotations
 
-from pydantic import BaseModel, computed_field, Field  # noqa: I001
+from pydantic import BaseModel, Field  # noqa: I001
 
 from superset_core.extensions.constants import (
     DISPLAY_NAME_PATTERN,
@@ -78,11 +78,6 @@ class BaseExtension(BaseModel):
         description="Permissions required by this extension",
     )
 
-    @computed_field(description="Composite extension ID (publisher.name)")  # type: ignore[prop-decorator]
-    @property
-    def id(self) -> str:
-        return f"{self.publisher}.{self.name}"
-
 
 # =============================================================================
 # ExtensionConfig (extension.json)
@@ -142,6 +137,11 @@ class Manifest(BaseExtension):
     This file is generated by the build tool from extension.json.
     """
 
+    id: str = Field(
+        ...,
+        description="Composite extension ID (publisher.name)",
+        min_length=1,
+    )
     frontend: ManifestFrontend | None = Field(
         default=None,
         description="Frontend manifest",

superset-embedded-sdk/README.md

@@ -215,7 +215,7 @@ Common permissions you might need:
 
 By default, the Embedded SDK creates an `iframe` element without a `referrerPolicy` value enforced. This means that a policy defined for `iframe` elements at the host app level would reflect to it.
 
-This can be an issue as during the embedded enablement for a dashboard it's possible to specify which domain(s) are allowed to embed the dashboard, and this validation happens through the `Referrer` header. That said, in case the hosting app has a more restrictive policy that would omit this header, this validation would fail.
+This can be an issue as during the embedded enablement for a dashboard it's possible to specify which domain(s) are allowed to embed the dashboard, and this validation happens throuth the `Referrer` header. That said, in case the hosting app has a more restrictive policy that would omit this header, this validation would fail.
 
 Use the `referrerPolicy` parameter in the `embedDashboard` method to specify [a particular policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Referrer-Policy) that works for your implementation.