fix(dataset): stop a stale edit modal from silently reverting a saved change (#43583)

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: hainenber <dotronghai96@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: hainenber <dotronghai96@gmail.com>

.rat-excludes

@@ -10,6 +10,7 @@
 .stylelintignore
 .flake8
 .nvmrc
+.npmrc
 .rat-excludes
 .swcrc
 .*log

docs/developer_docs/contributing/development-setup.md

@@ -493,8 +493,8 @@ Frontend assets (TypeScript, JavaScript, CSS, and images) must be compiled in or
 
 First, be sure you are using the following versions of Node.js and npm:
 
-- `Node.js`: Version 22 (LTS)
-- `npm`: Version 10
+- `Node.js`: Version 24 (see `superset-frontend/.nvmrc` for the exact version)
+- `npm`: Version 11
 
 We recommend using [nvm](https://github.com/nvm-sh/nvm) to manage your node environment:
 
@@ -507,8 +507,8 @@ export NVM_DIR="$HOME/.nvm"
 [ -s "$NVM_DIR/bash_completion" ] && \. "$NVM_DIR/bash_completion"  # This loads nvm bash_completion
 
 cd superset-frontend
-nvm install --lts
-nvm use --lts
+nvm install
+nvm use
 ```
 
 Or if you use the default macOS starting with Catalina shell `zsh`, try:

superset-core/src/superset_core/common/models.py

@@ -390,19 +390,3 @@ def get_session() -> scoped_session:
     :returns: The SQLAlchemy scoped session instance.
     """
     raise NotImplementedError("Function will be replaced during initialization")
-
-
-__all__ = [
-    "Dataset",
-    "Database",
-    "Chart",
-    "Dashboard",
-    "User",
-    "Role",
-    "Group",
-    "Tag",
-    "KeyValue",
-    "Subject",
-    "CoreModel",
-    "get_session",
-]

superset-core/src/superset_core/mcp/decorators.py

@@ -183,10 +183,3 @@ def prompt(
         "MCP prompt decorator not initialized. "
         "This decorator should be replaced during Superset startup."
     )
-
-
-__all__ = [
-    "tool",
-    "prompt",
-    "ToolAnnotations",
-]

superset-core/src/superset_core/queries/daos.py

@@ -55,9 +55,3 @@ class SavedQueryDAO(BaseDAO[SavedQuery]):
     model_cls = None
     base_filter = None
     id_column_name = "id"
-
-
-__all__ = [
-    "QueryDAO",
-    "SavedQueryDAO",
-]

superset-core/src/superset_core/queries/models.py

@@ -71,9 +71,3 @@ class SavedQuery(CoreModel):
     database_id: int | None
     description: str | None
     user_id: int | None
-
-
-__all__ = [
-    "Query",
-    "SavedQuery",
-]

superset-core/src/superset_core/queries/query.py

@@ -46,6 +46,3 @@ def get_sqlglot_dialect(database: "Database") -> Dialects:
     :returns: The SQLGlot dialect enum corresponding to the database.
     """
     raise NotImplementedError("Function will be replaced during initialization")
-
-
-__all__ = ["get_sqlglot_dialect"]

superset-core/src/superset_core/queries/types.py

@@ -165,13 +165,3 @@ class AsyncQueryHandle:
         :returns: True if cancellation was successful
         """
         raise NotImplementedError("Method will be replaced during initialization")
-
-
-__all__ = [
-    "QueryStatus",
-    "QueryOptions",
-    "QueryResult",
-    "StatementResult",
-    "AsyncQueryHandle",
-    "CacheOptions",
-]

superset-core/src/superset_core/rest_api/api.py

@@ -27,6 +27,3 @@ class RestApi(BaseApi):
     """
 
     allow_browser_login = True
-
-
-__all__ = ["RestApi"]

superset-core/src/superset_core/rest_api/decorators.py

@@ -98,6 +98,3 @@ def api(
         "API decorator not initialized. "
         "This decorator should be replaced during Superset startup."
     )
-
-
-__all__ = ["api"]

superset-core/src/superset_core/semantic_layers/daos.py

@@ -164,6 +164,3 @@ class AbstractSemanticViewDAO(BaseDAO[SemanticViewModel]):
         :return: SemanticViewModel instance or None
         """
         ...
-
-
-__all__ = ["AbstractSemanticLayerDAO", "AbstractSemanticViewDAO"]

superset-core/src/superset_core/semantic_layers/decorators.py

@@ -97,6 +97,3 @@ def semantic_layer(
         "Semantic layer decorator not initialized. "
         "This decorator should be replaced during Superset startup."
     )
-
-
-__all__ = ["semantic_layer"]

superset-core/src/superset_core/semantic_layers/layer.py

@@ -21,6 +21,7 @@ from abc import ABC, abstractmethod
 from typing import Any, Generic, TypeVar
 
 from pydantic import BaseModel
+
 from superset_core.semantic_layers.view import SemanticView
 
 ConfigT = TypeVar("ConfigT", bound=BaseModel)

superset-core/src/superset_core/semantic_layers/models.py

@@ -80,6 +80,3 @@ class SemanticViewModel(CoreModel):
     semantic_layer_uuid: UUID
     created_on: datetime | None
     changed_on: datetime | None
-
-
-__all__ = ["SemanticLayerModel", "SemanticViewModel"]

superset-core/src/superset_core/tasks/daos.py

@@ -71,6 +71,3 @@ class TaskDAO(BaseDAO[Task]):
         :returns: Task instance or None if not found or not active
         """
         ...
-
-
-__all__ = ["TaskDAO"]

superset-core/src/superset_core/tasks/decorators.py

@@ -144,9 +144,3 @@ def get_context() -> TaskContext:
             )
     """
     raise NotImplementedError("Function will be replaced during initialization")
-
-
-__all__ = [
-    "task",
-    "get_context",
-]

superset-core/src/superset_core/tasks/models.py

@@ -161,9 +161,3 @@ class TaskSubscriber(CoreModel):
     changed_on: datetime | None
     created_by_fk: int | None
     changed_by_fk: int | None
-
-
-__all__ = [
-    "Task",
-    "TaskSubscriber",
-]

superset-core/src/superset_core/tasks/types.py

@@ -226,12 +226,3 @@ class TaskContext(ABC):
                 cleanup_partial_work()
         """
         ...
-
-
-__all__ = [
-    "TaskStatus",
-    "TaskScope",
-    "TaskProperties",
-    "TaskContext",
-    "TaskOptions",
-]

superset-embedded-sdk/.npmrc

@@ -0,0 +1 @@
+../superset-frontend/.npmrc

superset-frontend/.npmrc

@@ -0,0 +1 @@
+min-release-age=3

superset-frontend/jest.config.js

@@ -77,7 +77,7 @@ module.exports = {
     // @ant-design/colors and @ant-design/fast-color are allowed through because
     // @ant-design/icons >= 6.3 deep-imports the ESM build of @ant-design/colors
     // from its CJS output, so babel-jest must transform those files.
-    'node_modules/(?!@ant-design/(colors|fast-color)|@formatjs/.*|d3-(array|interpolate|color|time|scale|time-format|format|selection)|internmap|@mapbox/tiny-sdf|remark-gfm|(?!@ngrx|(?!deck.gl)|d3-scale)|markdown-table|micromark-*.|decode-named-character-reference|character-entities|mdast-util-*.|unist-util-*.|ccount|escape-string-regexp|nanoid|uuid|@rjsf/*.|@x0k/.*|echarts|zrender|fetch-mock|pretty-ms|parse-ms|ol|@babel/runtime|@emotion|cheerio|cheerio/lib|parse5|dom-serializer|entities|htmlparser2|rehype-sanitize|hast-util-sanitize|unified|unist-.*|hast-.*|hastscript|refractor|rehype-.*|remark-.*|mdast-.*|micromark-.*|parse-entities|character-reference-invalid|is-alphanumerical|is-alphabetical|is-decimal|is-hexadecimal|property-information|space-separated-tokens|comma-separated-tokens|bail|devlop|zwitch|longest-streak|geostyler|geostyler-.*|(?!geostyler)lodash|react-error-boundary|react-json-tree|react-base16-styling|lodash-es|rbush|quickselect|react-diff-viewer-continued|storybook/*.|json-stringify-pretty-compact|@x0k/json-schema-merge)',
+    'node_modules/(?!@ant-design/(colors|fast-color)|@formatjs/.*|d3-(array|interpolate|color|time|scale|time-format|format|selection)|internmap|@mapbox/tiny-sdf|remark-gfm|(?!@ngrx|(?!deck.gl)|d3-scale)|markdown-table|micromark-*.|decode-named-character-reference|character-entities|mdast-util-*.|unist-util-*.|ccount|escape-string-regexp|nanoid|uuid|@rjsf/*.|@x0k/.*|echarts|zrender|fetch-mock|pretty-ms|parse-ms|ol|@babel/runtime|@emotion|cheerio|cheerio/lib|parse5|dom-serializer|entities|htmlparser2|rehype-sanitize|hast-util-sanitize|unified|unist-.*|hast-.*|hastscript|refractor|rehype-.*|remark-.*|mdast-.*|micromark-.*|parse-entities|character-reference-invalid|is-alphanumerical|is-alphabetical|is-decimal|is-hexadecimal|property-information|space-separated-tokens|comma-separated-tokens|bail|devlop|zwitch|longest-streak|geostyler|geostyler-.*|(?!geostyler)lodash|react-error-boundary|react-json-tree|react-base16-styling|lodash-es|rbush|quickselect|react-diff-viewer-continued|storybook/*.|json-stringify-pretty-compact|@x0k/json-schema-merge|content-disposition)',
   ],
   preset: 'ts-jest',
   transform: {

superset-frontend/package-lock.json

@@ -84,7 +84,7 @@
         "antd": "^6.6.1",
         "chrono-node": "^2.10.1",
         "classnames": "^2.2.5",
-        "content-disposition": "^2.0.1",
+        "content-disposition": "^3.0.0",
         "d3-scale": "^4.0.2",
         "dayjs": "^1.11.23",
         "dom-to-image-more": "^3.10.2",
@@ -17451,12 +17451,12 @@
       }
     },
     "node_modules/content-disposition": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-2.0.1.tgz",
-      "integrity": "sha512-e+H0ZXHSWYrENhQzw1LPuP4oF5MzVKmDU6d3hxlvaPEYLLg62MxtQNPRx4SYSuYJSBUgnQIG4HIN2tEtNv7Dog==",
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-3.0.0.tgz",
+      "integrity": "sha512-ZH/0Xs9rMIFWCOmGdmS9eHBTF62qqQYNz4nVjQhkdIO/a0fCP4UIM3mRz/wiqL0L14YgAz/1xio4OaSY4+ON/A==",
       "license": "MIT",
       "engines": {
-        "node": ">=18"
+        "node": ">=22"
       },
       "funding": {
         "type": "opencollective",

superset-frontend/package.json

@@ -161,7 +161,7 @@
     "antd": "^6.6.1",
     "chrono-node": "^2.10.1",
     "classnames": "^2.2.5",
-    "content-disposition": "^2.0.1",
+    "content-disposition": "^3.0.0",
     "d3-scale": "^4.0.2",
     "dayjs": "^1.11.23",
     "dom-to-image-more": "^3.10.2",
@@ -392,7 +392,7 @@
     "@luma.gl/shadertools": "~9.2.5",
     "@luma.gl/webgl": "~9.2.5",
     "core-js": "^3.38.1",
-    "dompurify": "^3.4.11",
+    "dompurify": "^3.4.13",
     "esbuild": "^0.28.1",
     "eslint-plugin-import": {
       "eslint": "$eslint"

superset-frontend/packages/superset-ui-core/src/number-format/factories/createMemoryFormatter.ts

@@ -38,11 +38,21 @@ function formatMemory(
         : ['B', 'kB', 'MB', 'GB', 'TB', 'PB', 'EB', 'ZB', 'YB', 'RB', 'QB'];
       const base = binary ? 1024 : 1000;
 
-      const i = Math.min(
-        suffixes.length - 1,
-        Math.floor(Math.log(absValue) / Math.log(base)),
+      let i = Math.max(
+        0,
+        Math.min(
+          suffixes.length - 1,
+          Math.floor(Math.log(absValue) / Math.log(base)),
+        ),
       );
-      formatted = `${sign}${parseFloat((absValue / Math.pow(base, i)).toFixed(decimals))}${suffixes[i]}`;
+      let scaled = parseFloat((absValue / Math.pow(base, i)).toFixed(decimals));
+
+      if (scaled >= base && i < suffixes.length - 1) {
+        i += 1;
+        scaled = parseFloat((absValue / Math.pow(base, i)).toFixed(decimals));
+      }
+
+      formatted = `${sign}${scaled}${suffixes[i]}`;
     }
 
     if (transfer) {

superset-frontend/packages/superset-ui-core/src/ui-overrides/types.ts

@@ -30,6 +30,7 @@ import type {
   QueryFormData,
 } from '../query';
 import type { JsonResponse } from '../connection';
+import type { MenuItem } from '../components/Menu';
 
 /**
  * A function which returns text (or marked-up text)
@@ -164,6 +165,13 @@ export interface SliceHeaderExtension {
   dashboardId: number;
 }
 
+/**
+ * Interface for extensions to the Slice Header more-options menu
+ */
+export interface SliceHeaderMenuExtension extends SliceHeaderExtension {
+  sliceName: string;
+}
+
 /**
  * Interface for extensions to Embed Modal
  */
@@ -262,6 +270,9 @@ export type Extensions = Partial<{
   'sqleditor.extension.form': ComponentType<SQLFormExtensionProps>;
   'sqleditor.extension.resultTable': ComponentType<SQLResultTableExtensionProps>;
   'dashboard.slice.header': ComponentType<SliceHeaderExtension>;
+  'dashboard.slice.header.menu': (
+    context: SliceHeaderMenuExtension,
+  ) => MenuItem[];
   'sqleditor.extension.customAutocomplete': (
     args: CustomAutoCompleteArgs,
   ) => CustomAutocomplete[] | undefined;

superset-frontend/packages/superset-ui-core/test/number-format/factories/createMemoryFormatter.test.ts

@@ -60,6 +60,31 @@ test('formats float bytes in human readable format with default options', () =>
   expect(formatter(1200.666)).toBe('1.2kB');
 });
 
+test('formats values below one byte without dropping the unit', () => {
+  const formatter = createMemoryFormatter();
+  expect(formatter(0.5)).toBe('0.5B');
+  expect(formatter(0.004)).toBe('0B');
+  expect(formatter(-0.25)).toBe('-0.25B');
+
+  const binaryFormatter = createMemoryFormatter({ binary: true });
+  expect(binaryFormatter(0.5)).toBe('0.5B');
+});
+
+test('rolls over to the next unit when rounding reaches the base', () => {
+  const formatter = createMemoryFormatter();
+  expect(formatter(999999)).toBe('1MB');
+  expect(formatter(999995)).toBe('1MB');
+  expect(formatter(999994)).toBe('999.99kB');
+  expect(formatter(-999999)).toBe('-1MB');
+
+  const binaryFormatter = createMemoryFormatter({ binary: true });
+  expect(binaryFormatter(1024 * 1024 - 1)).toBe('1MiB');
+
+  // the largest unit has nothing to roll over into
+  const largest = createMemoryFormatter();
+  expect(largest(Math.pow(1000, 11))).toBe('1000QB');
+});
+
 test('formats bytes in human readable format with additional binary option', () => {
   const formatter = createMemoryFormatter({ binary: true });
   expect(formatter(0)).toBe('0B');

superset-frontend/plugins/plugin-chart-echarts/src/MixedTimeseries/controlPanel.tsx

@@ -38,6 +38,8 @@ import { EchartsTimeseriesSeriesType } from '../Timeseries/types';
 import {
   legendSection,
   minorTicks,
+  axisTicks,
+  gridlines,
   richTooltipSection,
   truncateXAxis,
   xAxisBounds,
@@ -391,6 +393,8 @@ const config: ControlPanelConfig = {
         ...createCustomizeSection(t('Query B'), 'B'),
         ['zoomable'],
         [minorTicks],
+        [axisTicks],
+        [gridlines],
         ...legendSection,
         [<ControlSubSectionHeader>{t('X Axis')}</ControlSubSectionHeader>],
         ['x_axis_time_format'],

superset-frontend/plugins/plugin-chart-echarts/src/MixedTimeseries/transformProps.ts

@@ -184,6 +184,8 @@ export default function transformProps(
     opacityB,
     minorSplitLine,
     minorTicks,
+    gridlines,
+    axisTicks,
     seriesType,
     seriesTypeB,
     showLegend,
@@ -788,6 +790,8 @@ export default function transformProps(
         }),
       },
       minorTick: { show: minorTicks },
+      axisTick: { show: axisTicks ? 'auto' : false },
+      ...(gridlines ? {} : { splitLine: { show: false } }),
       minInterval:
         xAxisType === AxisType.Time && resolvedTimeGrain && !forceMaxInterval
           ? (TIMEGRAIN_TO_TIMESTAMP[
@@ -818,6 +822,8 @@ export default function transformProps(
         min: yAxisMin,
         max: yAxisMax,
         minorTick: { show: minorTicks },
+        axisTick: { show: axisTicks ? 'auto' : false },
+        splitLine: { show: gridlines },
         minorSplitLine: { show: minorSplitLine },
         axisLabel: {
           formatter: getYAxisFormatter(
@@ -840,6 +846,7 @@ export default function transformProps(
         min: minSecondary,
         max: maxSecondary,
         minorTick: { show: minorTicks },
+        axisTick: { show: axisTicks ? 'auto' : false },
         splitLine: { show: false },
         minorSplitLine: { show: minorSplitLine },
         axisLabel: {

superset-frontend/plugins/plugin-chart-echarts/src/MixedTimeseries/types.ts

@@ -48,6 +48,8 @@ export type EchartsMixedTimeseriesFormData = QueryFormData & {
   // shared properties
   minorSplitLine: boolean;
   minorTicks: boolean;
+  gridlines: boolean;
+  axisTicks: boolean;
   logAxis: boolean;
   logAxisSecondary: boolean;
   yAxisFormat?: string;
@@ -113,6 +115,8 @@ export const DEFAULT_FORM_DATA: EchartsMixedTimeseriesFormData = {
   ...DEFAULT_LEGEND_FORM_DATA,
   annotationLayers: [],
   minorSplitLine: TIMESERIES_DEFAULTS.minorSplitLine,
+  gridlines: TIMESERIES_DEFAULTS.gridlines,
+  axisTicks: TIMESERIES_DEFAULTS.axisTicks,
   truncateYAxis: TIMESERIES_DEFAULTS.truncateYAxis,
   truncateYAxisSecondary: TIMESERIES_DEFAULTS.truncateYAxis,
   logAxis: TIMESERIES_DEFAULTS.logAxis,

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/Area/controlPanel.tsx

@@ -44,6 +44,8 @@ import {
   truncateXAxis,
   xAxisBounds,
   minorTicks,
+  axisTicks,
+  gridlines,
   forceMaxInterval,
 } from '../../controls';
 import { AreaChartStackControlOptions } from '../../constants';
@@ -174,6 +176,8 @@ const config: ControlPanelConfig = {
           },
         ],
         [minorTicks],
+        [axisTicks],
+        [gridlines],
         ['zoomable'],
         ...legendSection,
         [<ControlSubSectionHeader>{t('X Axis')}</ControlSubSectionHeader>],

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/EchartsTimeseries.test.tsx

@@ -133,6 +133,8 @@ const defaultFormData: EchartsTimeseriesFormData & {
   metrics: [],
   minorSplitLine: false,
   minorTicks: false,
+  gridlines: true,
+  axisTicks: true,
   opacity: 1,
   orderDesc: false,
   rowLimit: 0,

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/Regular/Bar/controlPanel.tsx

@@ -40,6 +40,8 @@ import {
 import {
   legendSection,
   minorTicks,
+  axisTicks,
+  gridlines,
   richTooltipSection,
   seriesOrderSection,
   showValueSectionWithoutStream,
@@ -388,6 +390,8 @@ const config: ControlPanelConfig = {
           },
         ],
         [minorTicks],
+        [axisTicks],
+        [gridlines],
         ['zoomable'],
         ...legendSection,
         [<ControlSubSectionHeader>{t('X Axis')}</ControlSubSectionHeader>],

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/Regular/Line/controlPanel.tsx

@@ -37,6 +37,8 @@ import {
 import {
   legendSection,
   minorTicks,
+  axisTicks,
+  gridlines,
   richTooltipSection,
   seriesOrderSection,
   showValueSection,
@@ -156,6 +158,8 @@ const config: ControlPanelConfig = {
         ],
         ['zoomable'],
         [minorTicks],
+        [axisTicks],
+        [gridlines],
         ...legendSection,
         [<ControlSubSectionHeader>{t('X Axis')}</ControlSubSectionHeader>],
         [

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/Regular/Scatter/controlPanel.tsx

@@ -42,6 +42,8 @@ import {
 import {
   legendSection,
   minorTicks,
+  axisTicks,
+  gridlines,
   richTooltipSection,
   seriesOrderSection,
   showValueSection,
@@ -480,6 +482,8 @@ const config: ControlPanelConfig = {
         ],
         ['zoomable'],
         [minorTicks],
+        [axisTicks],
+        [gridlines],
         ...legendSection,
         [<ControlSubSectionHeader>{t('X Axis')}</ControlSubSectionHeader>],
         ...createAxisControl('x'),

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/Regular/SmoothLine/controlPanel.tsx

@@ -37,6 +37,8 @@ import {
 import {
   legendSection,
   minorTicks,
+  axisTicks,
+  gridlines,
   richTooltipSection,
   seriesOrderSection,
   showValueSectionWithoutStack,
@@ -105,6 +107,8 @@ const config: ControlPanelConfig = {
         ],
         ['zoomable'],
         [minorTicks],
+        [axisTicks],
+        [gridlines],
         ...legendSection,
         [<ControlSubSectionHeader>{t('X Axis')}</ControlSubSectionHeader>],
         [

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/Step/controlPanel.tsx

@@ -35,6 +35,8 @@ import { DEFAULT_FORM_DATA, TIME_SERIES_DESCRIPTION_TEXT } from '../constants';
 import {
   legendSection,
   minorTicks,
+  axisTicks,
+  gridlines,
   richTooltipSection,
   seriesOrderSection,
   showValueSection,
@@ -157,6 +159,8 @@ const config: ControlPanelConfig = {
         ],
         ['zoomable'],
         [minorTicks],
+        [axisTicks],
+        [gridlines],
         ...legendSection,
         [<ControlSubSectionHeader>{t('X Axis')}</ControlSubSectionHeader>],
         [

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/constants.ts

@@ -67,6 +67,8 @@ export const DEFAULT_FORM_DATA: EchartsTimeseriesFormData = {
   maxMarkerSize: 30,
   minMarkerSize: 5,
   minorSplitLine: false,
+  gridlines: true,
+  axisTicks: true,
   opacity: 0.2,
   orderDesc: true,
   rowLimit: 10000,

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/transformProps.ts

@@ -283,6 +283,8 @@ export default function transformProps(
     metrics,
     minorSplitLine,
     minorTicks,
+    gridlines,
+    axisTicks,
     onlyTotal,
     opacity,
     orientation,
@@ -1280,6 +1282,8 @@ export default function transformProps(
       }),
     },
     minorTick: { show: minorTicks },
+    axisTick: { show: axisTicks ? 'auto' : false },
+    ...(gridlines ? {} : { splitLine: { show: false } }),
     minInterval:
       xAxisType === AxisType.Time && resolvedTimeGrain && !forceMaxInterval
         ? (TIMEGRAIN_TO_TIMESTAMP[
@@ -1324,7 +1328,7 @@ export default function transformProps(
     max: yAxisMax,
     minorTick: { show: isSmallChart ? false : minorTicks },
     minorSplitLine: { show: isSmallChart ? false : minorSplitLine },
-    splitLine: { show: !isSmallChart },
+    splitLine: { show: isSmallChart ? false : gridlines },
     axisLabel: {
       show: !isMicroChart,
       showMinLabel: !isMicroChart,
@@ -1338,7 +1342,7 @@ export default function transformProps(
         yAxisFormat,
       ),
     },
-    axisTick: { show: !isSmallChart },
+    axisTick: { show: isSmallChart ? false : axisTicks },
     scale: truncateYAxis,
     name: isSmallChart ? undefined : yAxisTitle,
     nameGap: convertInteger(yAxisTitleMargin),

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/types.ts

@@ -73,6 +73,8 @@ export type EchartsTimeseriesFormData = QueryFormData & {
   metrics: QueryFormMetric[];
   minorSplitLine: boolean;
   minorTicks: boolean;
+  gridlines: boolean;
+  axisTicks: boolean;
   opacity: number;
   orderDesc: boolean;
   rowLimit: number;

superset-frontend/plugins/plugin-chart-echarts/src/controls.tsx

@@ -495,6 +495,28 @@ export const minorTicks: ControlSetItem = {
   },
 };
 
+export const axisTicks: ControlSetItem = {
+  name: 'axisTicks',
+  config: {
+    type: 'CheckboxControl',
+    label: t('Axis ticks'),
+    default: true,
+    renderTrigger: true,
+    description: t('Show the main ticks on axes.'),
+  },
+};
+
+export const gridlines: ControlSetItem = {
+  name: 'gridlines',
+  config: {
+    type: 'CheckboxControl',
+    label: t('Gridlines'),
+    default: true,
+    renderTrigger: true,
+    description: t('Draw split lines for the main value axis ticks.'),
+  },
+};
+
 export const forceCategorical: ControlSetItem = {
   name: 'forceCategorical',
   config: {

superset-frontend/plugins/plugin-chart-echarts/test/MixedTimeseries/transformProps.test.ts

@@ -116,6 +116,8 @@ const formData: EchartsMixedTimeseriesFormData = {
   markerSizeB: 0,
   minorSplitLine: false,
   minorTicks: false,
+  gridlines: true,
+  axisTicks: true,
   opacity: 0,
   opacityB: 0,
   orderDesc: false,
@@ -1509,3 +1511,56 @@ describe('EchartsMixedTimeseries tooltip truncation', () => {
     expect(html).not.toContain(longSeriesName);
   });
 });
+
+function transformWithChrome(
+  overrides: Partial<EchartsMixedTimeseriesFormData>,
+) {
+  const chartProps = createEchartsTimeseriesTestChartProps<
+    EchartsMixedTimeseriesFormData,
+    EchartsMixedTimeseriesProps
+  >({
+    ...MIXED_TIMESERIES_CHART_PROPS_DEFAULTS,
+    defaultQueriesData: queriesData,
+    formData: { ...formData, ...overrides },
+    queriesData,
+  });
+  const { echartOptions } = transformProps(chartProps);
+  return {
+    xAxis: echartOptions.xAxis as any,
+    yAxis: echartOptions.yAxis as any[],
+  };
+}
+
+test('draws gridlines and axis ticks when both are enabled', () => {
+  const { xAxis, yAxis } = transformWithChrome({});
+
+  expect(yAxis[0].splitLine.show).toBe(true);
+  // Both axes keep ECharts' own default, which the Mixed chart never overrode.
+  expect(yAxis[0].axisTick.show).toBe('auto');
+  expect(xAxis.axisTick.show).toBe('auto');
+});
+
+test('hides the gridlines on the primary axis', () => {
+  const { xAxis, yAxis } = transformWithChrome({ gridlines: false });
+
+  expect(yAxis[0].splitLine.show).toBe(false);
+  // The secondary axis never draws gridlines, so the two grids cannot double up.
+  expect(yAxis[1].splitLine.show).toBe(false);
+  expect(xAxis.splitLine.show).toBe(false);
+});
+
+test('never turns the secondary axis gridlines on', () => {
+  const { xAxis, yAxis } = transformWithChrome({ gridlines: true });
+
+  expect(yAxis[0].splitLine.show).toBe(true);
+  expect(yAxis[1].splitLine.show).toBe(false);
+  expect(xAxis.splitLine).toBeUndefined();
+});
+
+test('hides the ticks on the x axis and both y axes', () => {
+  const { xAxis, yAxis } = transformWithChrome({ axisTicks: false });
+
+  expect(xAxis.axisTick.show).toBe(false);
+  expect(yAxis[0].axisTick.show).toBe(false);
+  expect(yAxis[1].axisTick.show).toBe(false);
+});

superset-frontend/plugins/plugin-chart-echarts/test/Timeseries/transformProps.test.ts

@@ -2766,3 +2766,76 @@ describe('tooltip for metrics whose labels end in forecast suffixes', () => {
     expect(html).toContain('>ci<');
   });
 });
+
+test('shows gridlines and axis ticks by default', () => {
+  const { echartOptions } = transformProps(createTestChartProps({}));
+  const xAxis = echartOptions.xAxis as any;
+  const yAxis = echartOptions.yAxis as any;
+
+  expect(yAxis.splitLine.show).toBe(true);
+  expect(yAxis.axisTick.show).toBe(true);
+  // Left to ECharts, which draws no ticks on a banded category axis. Forcing
+  // true would add ticks the chart does not have today.
+  expect(xAxis.axisTick.show).toBe('auto');
+});
+
+test('hides gridlines without touching the minor split lines', () => {
+  const { echartOptions } = transformProps(
+    createTestChartProps({ formData: { gridlines: false } }),
+  );
+  const yAxis = echartOptions.yAxis as any;
+
+  expect(yAxis.splitLine.show).toBe(false);
+  expect(yAxis.minorSplitLine.show).toBe(DEFAULT_FORM_DATA.minorSplitLine);
+  expect(yAxis.axisTick.show).toBe(true);
+});
+
+test('leaves the category axis split lines alone until gridlines are turned off', () => {
+  const shown = transformProps(createTestChartProps({}));
+  // Writing show:true here would draw gridlines on axis types that default to
+  // none, so the key is only ever added to hide them.
+  expect((shown.echartOptions.xAxis as any).splitLine).toBeUndefined();
+
+  const hidden = transformProps(
+    createTestChartProps({ formData: { gridlines: false } }),
+  );
+  expect((hidden.echartOptions.xAxis as any).splitLine.show).toBe(false);
+});
+
+test('hides the ticks on both axes', () => {
+  const { echartOptions } = transformProps(
+    createTestChartProps({ formData: { axisTicks: false } }),
+  );
+
+  expect((echartOptions.yAxis as any).axisTick.show).toBe(false);
+  expect((echartOptions.xAxis as any).axisTick.show).toBe(false);
+  expect((echartOptions.yAxis as any).splitLine.show).toBe(true);
+});
+
+test('keeps gridlines and ticks off on a compact chart even when both are enabled', () => {
+  const { echartOptions } = transformProps(
+    createTestChartProps({
+      height: TIMESERIES_CONSTANTS.compactChartHeight - 1,
+      formData: { gridlines: true, axisTicks: true },
+    }),
+  );
+  const yAxis = echartOptions.yAxis as any;
+
+  expect(yAxis.splitLine.show).toBe(false);
+  expect(yAxis.axisTick.show).toBe(false);
+});
+
+test('applies gridlines to the value axis after a horizontal orientation swaps it', () => {
+  const { echartOptions } = transformProps(
+    createTestChartProps({
+      formData: {
+        orientation: OrientationType.Horizontal,
+        gridlines: false,
+      },
+    }),
+  );
+
+  // The transform swaps the axes for a horizontal chart, so the value axis —
+  // and the gridlines belonging to it — end up on xAxis.
+  expect((echartOptions.xAxis as any).splitLine.show).toBe(false);
+});

superset-frontend/src/components/Datasource/DatasourceModal/DatasourceModal.test.tsx

@@ -67,14 +67,23 @@ async function renderAndWait(props = mockedProps) {
   container = renderedContainer;
 }
 
-beforeEach(() => {
+// A modal that wasn't handed an `etag` reads the dataset itself and can't save
+// until that lands, so tests must wait before acting on the Save button.
+async function waitForSaveEnabled() {
+  await waitFor(() =>
+    expect(screen.getByTestId('datasource-modal-save')).toBeEnabled(),
+  );
+}
+
+beforeEach(async () => {
   fetchMock.clearHistory().removeRoutes();
   cleanup();
-  renderAndWait();
   fetchMock.post(SAVE_ENDPOINT, SAVE_PAYLOAD);
   fetchMock.put(SAVE_DATASOURCE_ENDPOINT, {});
   fetchMock.get(GET_DATASOURCE_ENDPOINT, { result: {} });
   fetchMock.get(GET_DATABASE_ENDPOINT, { result: [] });
+  renderAndWait();
+  await waitForSaveEnabled();
 });
 
 // eslint-disable-next-line no-restricted-globals -- TODO: Migrate from describe blocks
@@ -118,6 +127,7 @@ describe('DatasourceModal', () => {
       onDatasourceSave:
         onDatasourceSave as unknown as typeof mockedProps.onDatasourceSave,
     });
+    await waitForSaveEnabled();
     const saveButton = screen.getByTestId('datasource-modal-save');
     fireEvent.click(saveButton);
     const okButton = await screen.findByRole('button', { name: 'Confirm' });
@@ -151,6 +161,96 @@ describe('DatasourceModal', () => {
     putSpy.mockRestore();
   });
 
+  test('sends the supplied etag as If-Match so a stale save is refused', async () => {
+    cleanup();
+    renderAndWait({ ...mockedProps, etag: '"v1"' } as typeof mockedProps);
+
+    fireEvent.click(screen.getByTestId('datasource-modal-save'));
+    fireEvent.click(await screen.findByRole('button', { name: 'Confirm' }));
+
+    await waitFor(() => {
+      const putCall = fetchMock.callHistory
+        .calls()
+        .find(call => call.options?.method === 'put');
+      expect(
+        new Headers(putCall?.options?.headers as HeadersInit).get('If-Match'),
+      ).toEqual('"v1"');
+    });
+  });
+
+  test('reads the etag from the dataset when the caller supplies none', async () => {
+    cleanup();
+    fetchMock.clearHistory().removeRoutes();
+    fetchMock.put(SAVE_DATASOURCE_ENDPOINT, {});
+    fetchMock.get(GET_DATASOURCE_ENDPOINT, {
+      body: { result: {} },
+      headers: { ETag: '"v2"' },
+    });
+    fetchMock.get(GET_DATABASE_ENDPOINT, { result: [] });
+
+    renderAndWait();
+
+    // The form is seeded from the same read as the validator, so saving is
+    // unavailable until it lands.
+    expect(screen.getByTestId('datasource-modal-save')).toBeDisabled();
+    await screen.findByTestId('datasource-editor');
+
+    fireEvent.click(screen.getByTestId('datasource-modal-save'));
+    fireEvent.click(await screen.findByRole('button', { name: 'Confirm' }));
+
+    await waitFor(() => {
+      const putCall = fetchMock.callHistory
+        .calls()
+        .find(call => call.options?.method === 'put');
+      expect(
+        new Headers(putCall?.options?.headers as HeadersInit).get('If-Match'),
+      ).toEqual('"v2"');
+    });
+  });
+
+  test('never saves unguarded while the validator read is in flight', async () => {
+    cleanup();
+    fetchMock.clearHistory().removeRoutes();
+    fetchMock.put(SAVE_DATASOURCE_ENDPOINT, {});
+    // A read that never resolves: the save path must stay closed rather than
+    // fall through to an unconditional PUT.
+    fetchMock.get(GET_DATASOURCE_ENDPOINT, new Promise(() => {}));
+    fetchMock.get(GET_DATABASE_ENDPOINT, { result: [] });
+
+    renderAndWait();
+
+    const saveButton = await screen.findByTestId('datasource-modal-save');
+    expect(saveButton).toBeDisabled();
+    fireEvent.click(saveButton);
+
+    expect(
+      fetchMock.callHistory
+        .calls()
+        .find(call => call.options?.method === 'put'),
+    ).toBeUndefined();
+  });
+
+  test('shows a conflict dialog instead of a generic error on 412', async () => {
+    const putSpy = jest
+      .spyOn(SupersetClient, 'put')
+      .mockRejectedValue(new Response('', { status: 412 }));
+
+    try {
+      fireEvent.click(screen.getByTestId('datasource-modal-save'));
+      fireEvent.click(await screen.findByRole('button', { name: 'Confirm' }));
+
+      const conflictElements = await screen.findAllByText(
+        'Dataset changed since you opened it',
+      );
+      expect(conflictElements.length).toBeGreaterThan(0);
+      expect(
+        screen.queryByText('Error saving dataset'),
+      ).not.toBeInTheDocument();
+    } finally {
+      putSpy.mockRestore();
+    }
+  });
+
   test('shows sync columns checkbox when SQL changes', async () => {
     cleanup();
     const datasourceWithSQL = {
@@ -163,15 +263,24 @@ describe('DatasourceModal', () => {
     };
 
     const { rerender } = render(
-      <DatasourceModal {...mockedProps} datasource={datasourceWithSQL} />,
+      <DatasourceModal
+        {...mockedProps}
+        datasource={datasourceWithSQL}
+        etag='"v1"'
+      />,
       { store, useRouter: true },
     );
 
     // Update with modified SQL
     rerender(
-      <DatasourceModal {...mockedProps} datasource={modifiedDatasource} />,
+      <DatasourceModal
+        {...mockedProps}
+        datasource={modifiedDatasource}
+        etag='"v1"'
+      />,
     );
 
+    await waitForSaveEnabled();
     const saveButton = screen.getByTestId('datasource-modal-save');
     fireEvent.click(saveButton);
 
@@ -208,15 +317,24 @@ describe('DatasourceModal', () => {
     fetchMock.get(GET_DATABASE_ENDPOINT, { result: [] });
 
     const { rerender } = render(
-      <DatasourceModal {...mockedProps} datasource={datasourceWithSQL} />,
+      <DatasourceModal
+        {...mockedProps}
+        datasource={datasourceWithSQL}
+        etag='"v1"'
+      />,
       { store, useRouter: true },
     );
 
     // Update with modified SQL to trigger checkbox
     rerender(
-      <DatasourceModal {...mockedProps} datasource={modifiedDatasource} />,
+      <DatasourceModal
+        {...mockedProps}
+        datasource={modifiedDatasource}
+        etag='"v1"'
+      />,
     );
 
+    await waitForSaveEnabled();
     const saveButton = screen.getByTestId('datasource-modal-save');
     fireEvent.click(saveButton);
 
@@ -269,15 +387,24 @@ describe('DatasourceModal', () => {
     fetchMock.get(GET_DATABASE_ENDPOINT, { result: [] });
 
     const { rerender } = render(
-      <DatasourceModal {...mockedProps} datasource={datasourceWithSQL} />,
+      <DatasourceModal
+        {...mockedProps}
+        datasource={datasourceWithSQL}
+        etag='"v1"'
+      />,
       { store, useRouter: true },
     );
 
     // Update with modified SQL to trigger checkbox
     rerender(
-      <DatasourceModal {...mockedProps} datasource={modifiedDatasource} />,
+      <DatasourceModal
+        {...mockedProps}
+        datasource={modifiedDatasource}
+        etag='"v1"'
+      />,
     );
 
+    await waitForSaveEnabled();
     const saveButton = screen.getByTestId('datasource-modal-save');
     fireEvent.click(saveButton);
 

superset-frontend/src/components/Datasource/DatasourceModal/DatasourceModal.useModal.test.tsx

@@ -21,6 +21,7 @@ import {
   screen,
   fireEvent,
   act,
+  waitFor,
   defaultStore as store,
 } from 'spec/helpers/testing-library';
 import fetchMock from 'fetch-mock';
@@ -72,6 +73,9 @@ test('DatasourceModal - should handle sync columns state without imperative moda
   render(<DatasourceModal {...mockedProps} />, { store });
 
   const saveButton = screen.getByTestId('datasource-modal-save');
+  // The modal fetches the current dataset version on open; save stays disabled
+  // until that settles
+  await waitFor(() => expect(saveButton).toBeEnabled());
 
   // This should not throw any DOM errors
   await act(async () => {

superset-frontend/src/components/Datasource/DatasourceModal/index.tsx

@@ -33,12 +33,14 @@ import {
   Icons,
   Button,
   Checkbox,
+  Loading,
   Modal,
   AsyncEsmComponent,
 } from '@superset-ui/core/components';
 import withToasts from 'src/components/MessageToasts/withToasts';
 import { ErrorMessageWithStackTrace } from 'src/components';
 import type { DatasetObject } from 'src/features/datasets/types';
+import { withCertificationFields } from '../utils';
 import { mapSubjectValuesToIds } from 'src/features/subjects/SubjectPicker';
 import type { DatasourceModalProps } from '../types';
 
@@ -91,12 +93,18 @@ export function buildExtraJsonObject(
 const DatasourceModal: FunctionComponent<DatasourceModalProps> = ({
   addSuccessToast,
   datasource,
+  etag,
   onDatasourceSave,
   onHide,
   show,
 }) => {
   const theme = useTheme();
   const [currentDatasource, setCurrentDatasource] = useState(datasource);
+  // SQL of the server snapshot the form started from. The caller's, unless
+  // this modal read the dataset itself — then "did the SQL change?" has to be
+  // asked against the snapshot the payload is actually built from.
+  const [seededSql, setSeededSql] = useState<string | undefined>();
+  const [versionEtag, setVersionEtag] = useState(etag);
   const [syncColumns, setSyncColumns] = useState(false);
   const currencies = useSelector<
     {
@@ -111,6 +119,52 @@ const DatasourceModal: FunctionComponent<DatasourceModalProps> = ({
   const [isEditing, setIsEditing] = useState<boolean>(false);
   const [modal, contextHolder] = Modal.useModal();
   const [confirmModalOpen, setConfirmModalOpen] = useState(false);
+  const [isLoadingDatasource, setIsLoadingDatasource] = useState(false);
+
+  // Callers that read the dataset themselves (the dataset list) hand down the
+  // ETag of that read. The rest — Explore, where `datasource` comes from the
+  // page's bootstrap state — read it here, and must seed the form from the
+  // *same* response: a payload built from an older snapshot than the ETag
+  // guarding it would still be accepted, and would still clobber.
+  useEffect(() => {
+    setVersionEtag(etag);
+    if (etag || !show || !datasource.id) {
+      return undefined;
+    }
+    let cancelled = false;
+    setIsLoadingDatasource(true);
+    SupersetClient.get({
+      endpoint: `/api/v1/dataset/${datasource.id}`,
+    })
+      .then(({ json, response }) => {
+        if (cancelled) {
+          return;
+        }
+        const seeded = {
+          ...datasource,
+          ...json.result,
+          columns: withCertificationFields(json.result.columns),
+        };
+        setSeededSql(seeded.sql);
+        setCurrentDatasource(seeded);
+        setVersionEtag(response.headers.get('ETag') ?? undefined);
+      })
+      .catch(() => {
+        // The read failed outright, so there is no fresher snapshot to edit
+        // and no validator to send. Fall back to the caller's snapshot and an
+        // unconditional save, which is what this modal did before the guard.
+      })
+      .finally(() => {
+        if (!cancelled) {
+          setIsLoadingDatasource(false);
+        }
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, [datasource.id, etag, show]);
+  const baselineSql = seededSql ?? datasource.sql;
+
   const buildPayload = (datasource: Record<string, any>) => {
     const payload: Record<string, any> = {
       table_name: datasource.table_name,
@@ -197,11 +251,13 @@ const DatasourceModal: FunctionComponent<DatasourceModalProps> = ({
       await SupersetClient.put({
         endpoint: `/api/v1/dataset/${currentDatasource.id}?override_columns=${syncColumns}`,
         jsonPayload: buildPayload(currentDatasource),
+        ...(versionEtag ? { headers: { 'If-Match': versionEtag } } : {}),
       });
 
-      const { json } = await SupersetClient.get({
+      const { json, response } = await SupersetClient.get({
         endpoint: `/api/v1/dataset/${currentDatasource?.id}`,
       });
+      setVersionEtag(response.headers.get('ETag') ?? undefined);
 
       addSuccessToast(t('The dataset has been saved'));
       // eslint-disable-next-line no-param-reassign
@@ -213,6 +269,19 @@ const DatasourceModal: FunctionComponent<DatasourceModalProps> = ({
       onHide();
     } catch (response) {
       setIsSaving(false);
+      if ((response as Response)?.status === 412) {
+        modal.error({
+          title: t('Dataset changed since you opened it'),
+          okButtonProps: { danger: true, className: 'btn-danger' },
+          content: t(
+            'Someone else, or another one of your browser tabs, saved this ' +
+              'dataset after you opened it. Saving now would undo those ' +
+              'changes, so it was cancelled. Copy your edits, close this ' +
+              'dialog, and reopen the dataset to reapply them.',
+          ),
+        });
+        return;
+      }
       const error = await getClientErrorObject(response);
       let errorResponse: SupersetError | undefined;
       let errorText: string | undefined;
@@ -264,7 +333,7 @@ const DatasourceModal: FunctionComponent<DatasourceModalProps> = ({
                 here may affect other charts
                 in undesirable ways.`)}
         />
-        {datasource.sql !== currentDatasource.sql && (
+        {baselineSql !== currentDatasource.sql && (
           <div
             css={theme => ({
               marginBottom: theme.marginMD,
@@ -298,14 +367,14 @@ const DatasourceModal: FunctionComponent<DatasourceModalProps> = ({
         {t('Are you sure you want to save and apply changes?')}
       </div>
     ),
-    [currentDatasource.sql, datasource.sql, syncColumns],
+    [currentDatasource.sql, baselineSql, syncColumns],
   );
 
   useEffect(() => {
-    if (datasource.sql !== currentDatasource.sql) {
+    if (baselineSql !== currentDatasource.sql) {
       setSyncColumns(true);
     }
-  }, [datasource.sql, currentDatasource.sql]);
+  }, [baselineSql, currentDatasource.sql]);
 
   const onClickSave = () => {
     setConfirmModalOpen(true);
@@ -356,6 +425,7 @@ const DatasourceModal: FunctionComponent<DatasourceModalProps> = ({
             onClick={onClickSave}
             disabled={
               isSaving ||
+              isLoadingDatasource ||
               errors.length > 0 ||
               currentDatasource.is_managed_externally
             }
@@ -381,14 +451,18 @@ const DatasourceModal: FunctionComponent<DatasourceModalProps> = ({
       }}
       draggable
     >
-      <DatasourceEditor
-        showLoadingForImport
-        height={500}
-        datasource={currentDatasource}
-        onChange={onDatasourceChange}
-        setIsEditing={setIsEditing}
-        currencies={currencies}
-      />
+      {isLoadingDatasource ? (
+        <Loading />
+      ) : (
+        <DatasourceEditor
+          showLoadingForImport
+          height={500}
+          datasource={currentDatasource}
+          onChange={onDatasourceChange}
+          setIsEditing={setIsEditing}
+          currencies={currencies}
+        />
+      )}
       {contextHolder}
       <Modal
         title={t('Confirm save')}

superset-frontend/src/components/Datasource/index.ts

@@ -20,4 +20,5 @@ import ChangeDatasourceModal from './ChangeDatasourceModal';
 import DatasourceModal from './DatasourceModal';
 
 export { ChangeDatasourceModal, DatasourceModal };
+export { withCertificationFields } from './utils';
 export type { DatasourceModalProps, ChangeDatasourceModalProps } from './types';

superset-frontend/src/components/Datasource/types.ts

@@ -29,6 +29,12 @@ export interface DatasourceModalProps {
   addSuccessToast: (msg: string) => void;
   addDangerToast: (msg: string) => void;
   datasource: DatasetObject;
+  /**
+   * ETag of the dataset read the form was seeded from. Replayed as `If-Match`
+   * on save so a stale form can't clobber a newer write. Fetched by the modal
+   * when the caller doesn't already have one.
+   */
+  etag?: string;
   onChange: () => {};
   onDatasourceSave: (datasource: object, errors?: Array<any>) => {};
   onHide: () => {};

superset-frontend/src/components/Datasource/utils/index.ts

@@ -27,6 +27,7 @@ import { nanoid } from 'nanoid';
 import { SupersetClient } from '@superset-ui/core';
 import { tn } from '@apache-superset/core/translation';
 import rison from 'rison';
+import type { ColumnObject } from 'src/features/datasets/types';
 
 // Type definitions
 
@@ -248,3 +249,29 @@ export async function fetchSyncedColumns(
   const { json } = await SupersetClient.get({ endpoint, signal });
   return json as ColumnMetadata[];
 }
+
+/**
+ * Lift each column's certification out of its `extra` JSON into the flat
+ * fields the datasource editor binds to.
+ */
+export function withCertificationFields(columns: ColumnObject[] = []) {
+  return columns.map(column => {
+    // Malformed `extra` must not take out the whole column list, the way an
+    // uncaught parse would — same fallback as `hydrateMetricExtra`.
+    let parsedExtra;
+    try {
+      parsedExtra = JSON.parse(column.extra || '{}') || {};
+    } catch {
+      parsedExtra = {};
+    }
+    const {
+      certification: { details = '', certified_by: certifiedBy = '' } = {},
+    } = parsedExtra;
+    return {
+      ...column,
+      certification_details: details || '',
+      certified_by: certifiedBy || '',
+      is_certified: details || certifiedBy,
+    };
+  });
+}

superset-frontend/src/dashboard/actions/dashboardLayout.ts

@@ -312,7 +312,7 @@ export function handleComponentDrop(dropResult: DropResult) {
       source &&
       !(
         // ensure it has moved
-        (destination.id === source.id && destination.index === source.index)
+        destination.id === source.id && destination.index === source.index
       )
     ) {
       dispatch(moveComponent(dropResult));

superset-frontend/src/dashboard/components/SliceHeaderControls/SliceHeaderControls.test.tsx

@@ -23,7 +23,7 @@ import {
   userEvent,
   waitFor,
 } from 'spec/helpers/testing-library';
-import { FeatureFlag, VizType } from '@superset-ui/core';
+import { FeatureFlag, VizType, getExtensionsRegistry } from '@superset-ui/core';
 import mockState from 'spec/fixtures/mockState';
 import { cachedSupersetGet } from 'src/utils/cachedSupersetGet';
 import downloadAsImage from 'src/utils/downloadAsImage';
@@ -165,6 +165,9 @@ beforeEach(() => {
 
 afterEach(() => {
   Reflect.deleteProperty(document, 'fullscreenElement');
+  // TypedRegistry has no remove(); reset to a no-op so a registered slot does
+  // not leak into other tests (the empty array is guarded, so nothing injects).
+  getExtensionsRegistry().set('dashboard.slice.header.menu', () => []);
 });
 
 test('Should render', () => {
@@ -173,6 +176,58 @@ test('Should render', () => {
   expect(screen.getByTestId(`slice_${SLICE_ID}-menu`)).toBeInTheDocument();
 });
 
+test('Injects dashboard.slice.header.menu items at the top of the menu', () => {
+  getExtensionsRegistry().set('dashboard.slice.header.menu', () => [
+    { key: 'custom-ext', label: 'Custom Menu Extension' },
+  ]);
+  renderWrapper();
+  openMenu();
+
+  const injected = screen.getByText('Custom Menu Extension');
+  expect(injected).toBeInTheDocument();
+  // Sits above the built-in entries.
+  const forceRefresh = screen.getByText('Force refresh');
+  expect(
+    injected.compareDocumentPosition(forceRefresh) &
+      Node.DOCUMENT_POSITION_FOLLOWING,
+  ).toBeTruthy();
+});
+
+test('Injects nothing when dashboard.slice.header.menu returns no items', () => {
+  getExtensionsRegistry().set('dashboard.slice.header.menu', () => []);
+  renderWrapper();
+  openMenu();
+
+  expect(screen.queryByText('Custom Menu Extension')).not.toBeInTheDocument();
+  // The menu still renders its built-in entries unchanged (no dangling divider
+  // is added since the empty array is guarded).
+  expect(screen.getByText('Force refresh')).toBeInTheDocument();
+});
+
+test('Menu survives a dashboard.slice.header.menu extension that throws', () => {
+  getExtensionsRegistry().set('dashboard.slice.header.menu', () => {
+    throw new Error('boom');
+  });
+  renderWrapper();
+  openMenu();
+
+  // The throw is isolated: the built-in menu still renders.
+  expect(screen.getByText('Force refresh')).toBeInTheDocument();
+  expect(screen.getByText('Enter fullscreen')).toBeInTheDocument();
+});
+
+test('Injects nothing when the extension returns a non-array', () => {
+  getExtensionsRegistry().set(
+    'dashboard.slice.header.menu',
+    // JS registrations bypass the MenuItem[] type; a bad return must not crash.
+    (() => undefined) as never,
+  );
+  renderWrapper();
+  openMenu();
+
+  expect(screen.getByText('Force refresh')).toBeInTheDocument();
+});
+
 test('Should render default props', () => {
   const props = createProps();
 

superset-frontend/src/dashboard/components/SliceHeaderControls/index.tsx

@@ -34,11 +34,13 @@ import {
   isFeatureEnabled,
   FeatureFlag,
   getChartMetadataRegistry,
+  getExtensionsRegistry,
   VizType,
   BinaryQueryObjectFilterClause,
   JsonObject,
   QueryFormData,
 } from '@superset-ui/core';
+import { logging } from '@apache-superset/core/utils';
 import { css, useTheme, styled } from '@apache-superset/core/theme';
 import { useSelector } from 'react-redux';
 import { Menu, MenuItem } from '@superset-ui/core/components/Menu';
@@ -165,6 +167,8 @@ const queueChartResize = () => {
   }, 300);
 };
 
+const extensionsRegistry = getExtensionsRegistry();
+
 const SliceHeaderControls = (
   props: SliceHeaderControlsPropsWithRouter | SliceHeaderControlsProps,
 ) => {
@@ -514,6 +518,26 @@ const SliceHeaderControls = (
     },
   ];
 
+  const sliceHeaderMenuExtension = extensionsRegistry.get(
+    'dashboard.slice.header.menu',
+  );
+  if (sliceHeaderMenuExtension) {
+    // Isolate the extension: a bad registration (throwing, or returning a
+    // non-array) must not take down the whole dashboard render.
+    try {
+      const extensionItems = sliceHeaderMenuExtension({
+        sliceId: slice.slice_id,
+        sliceName: slice.slice_name,
+        dashboardId,
+      });
+      if (Array.isArray(extensionItems) && extensionItems.length) {
+        newMenuItems.unshift(...extensionItems, { type: 'divider' });
+      }
+    } catch (error) {
+      logging.error('dashboard.slice.header.menu extension failed', error);
+    }
+  }
+
   if (slice.description) {
     newMenuItems.push({
       key: MenuKeys.ToggleChartDescription,

superset-frontend/src/dataMask/reducer.ts

@@ -126,7 +126,7 @@ function fillNativeFilters(
       !(
         // Treat all-null arrays (range filters use [null, null] as their
         // canonical cleared value) and empty arrays as "no value".
-        (Array.isArray(loadedValue) && loadedValue.every(v => v === null))
+        Array.isArray(loadedValue) && loadedValue.every(v => v === null)
       );
     const loadedHasExtraFormData =
       !!loaded?.extraFormData && Object.keys(loaded.extraFormData).length > 0;

superset-frontend/src/explore/components/controls/ColumnConfigControl/types.ts

@@ -29,7 +29,9 @@ import { ControlFormItemComponents } from './ControlForm';
  * Column formatting configs.
  */
 export type ColumnConfig = {
-  [key in SharedColumnConfigProp]?: (typeof SHARED_COLUMN_CONFIG_PROPS)[key]['value'];
+  [
+    key in SharedColumnConfigProp
+  ]?: (typeof SHARED_COLUMN_CONFIG_PROPS)[key]['value'];
 } & Record<string, StrictJsonValue>;
 
 /**

superset-frontend/src/explore/components/controls/DatasourceControl/DatasourceControl.test.tsx

@@ -297,6 +297,12 @@ test('Click on Edit dataset', async () => {
   const props = createProps();
   fetchMock.removeRoute(getDbWithQuery);
   fetchMock.get(getDbWithQuery, { result: [] }, { name: getDbWithQuery });
+  fetchMock.removeRoute(getDatasetWithAllMockRouteName);
+  fetchMock.get(
+    getDatasetWithAll,
+    { result: {} },
+    { name: getDatasetWithAllMockRouteName },
+  );
   render(<DatasourceControl {...props} />, {
     useRedux: true,
     useRouter: true,
@@ -307,7 +313,9 @@ test('Click on Edit dataset', async () => {
     await userEvent.click(screen.getByText('Edit dataset'));
   });
 
-  expect(screen.getByTestId('mock-datasource-editor')).toBeInTheDocument();
+  expect(
+    await screen.findByTestId('mock-datasource-editor'),
+  ).toBeInTheDocument();
 });
 
 test('Edit dataset should be disabled when user is not admin', async () => {

superset-frontend/src/pages/DatasetList/index.tsx

@@ -43,7 +43,6 @@ import {
 } from 'src/views/CRUD/utils';
 import { SUBJECT_OPTION_FILTER_PROPS } from 'src/features/subjects/SubjectSelectLabel';
 import { SubjectPile } from 'src/features/subjects/SubjectPile';
-import { ColumnObject } from 'src/features/datasets/types';
 import { useListViewResource } from 'src/views/CRUD/hooks';
 import {
   ActionButton,
@@ -62,6 +61,7 @@ import {
 } from '@superset-ui/core/components';
 import {
   DatasourceModal,
+  withCertificationFields,
   GenericLink,
   ImportModal as ImportModelsModal,
   ModifiedInfo,
@@ -496,6 +496,8 @@ const DatasetList: FunctionComponent<DatasetListProps> = ({
 
   const [datasetCurrentlyEditing, setDatasetCurrentlyEditing] =
     useState<Dataset | null>(null);
+  const [datasetCurrentlyEditingEtag, setDatasetCurrentlyEditingEtag] =
+    useState<string | undefined>();
 
   const [datasetCurrentlyDuplicating, setDatasetCurrentlyDuplicating] =
     useState<VirtualDataset | null>(null);
@@ -565,24 +567,11 @@ const DatasetList: FunctionComponent<DatasetListProps> = ({
       SupersetClient.get({
         endpoint: `/api/v1/dataset/${id}`,
       })
-        .then(({ json = {} }) => {
-          const addCertificationFields = json.result.columns.map(
-            (column: ColumnObject) => {
-              const {
-                certification: {
-                  details = '',
-                  certified_by: certifiedBy = '',
-                } = {},
-              } = JSON.parse(column.extra || '{}') || {};
-              return {
-                ...column,
-                certification_details: details || '',
-                certified_by: certifiedBy || '',
-                is_certified: details || certifiedBy,
-              };
-            },
+        .then(({ json = {}, response }) => {
+          setDatasetCurrentlyEditingEtag(
+            response.headers.get('ETag') ?? undefined,
           );
-          json.result.columns = [...addCertificationFields];
+          json.result.columns = withCertificationFields(json.result.columns);
           setDatasetCurrentlyEditing(json.result);
         })
         .catch(() => {
@@ -1524,6 +1513,7 @@ const DatasetList: FunctionComponent<DatasetListProps> = ({
       {datasetCurrentlyEditing && (
         <DatasourceModal
           datasource={datasetCurrentlyEditing}
+          etag={datasetCurrentlyEditingEtag}
           onDatasourceSave={refreshData}
           onHide={closeDatasetEditModal}
           show

superset-websocket/.npmrc

@@ -0,0 +1 @@
+../superset-frontend/.npmrc

superset/cli/viz_migrations.py

@@ -160,7 +160,7 @@ def migrate_by_id(ids: tuple[int, ...], is_downgrade: bool = False) -> None:
     """
     Migrate a subset of charts by IDs.
 
-    :param id: Tuple of chart IDs to migrate
+    :param ids: Tuple of chart IDs to migrate
     :param is_downgrade: Whether to downgrade the charts. Default is upgrade.
     """
     slices = db.session.query(Slice).filter(Slice.id.in_(ids))

superset/datasets/api.py

@@ -29,7 +29,7 @@ from flask_appbuilder.api import expose, protect, rison as parse_rison, safe
 from flask_appbuilder.api.schemas import get_item_schema
 from flask_appbuilder.const import API_RESULT_RES_KEY, API_SELECT_COLUMNS_RIS_KEY
 from flask_appbuilder.models.sqla.interface import SQLAInterface
-from flask_babel import ngettext
+from flask_babel import gettext as _, ngettext
 from jinja2.exceptions import TemplateError
 from marshmallow import ValidationError
 from sqlalchemy.orm.exc import MultipleResultsFound
@@ -95,13 +95,20 @@ from superset.subjects.filters import FilterRelatedSubjects, subject_type_filter
 from superset.utils import json
 from superset.utils.core import parse_boolean_string, send_export_zip
 from superset.versioning.api_helpers import (
-    current_entity_etag_uuid,
+    concurrency_token_from,
     current_entity_version_info,
+    entity_concurrency_token,
     get_version_endpoint,
     list_versions_endpoint,
+    lock_entity_for_update,
     restore_version_endpoint,
 )
-from superset.versioning.etag import set_version_etag
+from superset.versioning.etag import (
+    is_conditional_write,
+    raise_for_stale_write,
+    set_version_etag,
+    StaleEntityError,
+)
 from superset.versioning.schemas import VersionListItemSchema
 from superset.views.base import DatasourceFilter
 from superset.views.base_api import (
@@ -278,6 +285,18 @@ class DatasetRestApi(SoftDeleteApiMixin, BaseSupersetModelRestApi):
         "database.backend",
         "database.allow_multi_catalog",
         "columns.advanced_data_type",
+        # Certification/warning metadata is stored serialized in the ``extra``
+        # column and surfaced through model properties. Exposing them keeps this
+        # payload consistent with the datasource serialization used by Explore,
+        # so clients hydrating from this endpoint don't lose the badges.
+        "columns.certification_details",
+        "columns.certified_by",
+        "columns.is_certified",
+        "columns.warning_markdown",
+        "metrics.certification_details",
+        "metrics.certified_by",
+        "metrics.is_certified",
+        "metrics.warning_markdown",
         "is_managed_externally",
         "uid",
         "uuid",
@@ -530,6 +549,14 @@ class DatasetRestApi(SoftDeleteApiMixin, BaseSupersetModelRestApi):
             schema:
               type: boolean
             name: override_columns
+          - in: header
+            schema:
+              type: string
+            name: If-Match
+            description: >-
+              Optional optimistic-concurrency guard. Pass the ``ETag`` returned
+              by a prior read of this dataset; the update is rejected with 412
+              if the dataset has changed since.
           requestBody:
             description: Dataset schema
             required: true
@@ -606,6 +633,17 @@ class DatasetRestApi(SoftDeleteApiMixin, BaseSupersetModelRestApi):
               $ref: '#/components/responses/403'
             404:
               $ref: '#/components/responses/404'
+            412:
+              description: >-
+                The dataset changed since the version identified by the
+                request's ``If-Match`` header; the update was not applied.
+              content:
+                application/json:
+                  schema:
+                    type: object
+                    properties:
+                      message:
+                        type: string
             422:
               $ref: '#/components/responses/422'
             500:
@@ -622,10 +660,32 @@ class DatasetRestApi(SoftDeleteApiMixin, BaseSupersetModelRestApi):
         except ValidationError as error:
             return self.response_400(message=error.messages)
 
+        # Serialise conditional saves on this dataset: the guard below reads
+        # the live version, the command writes, and the two must not interleave
+        # with another request's. Only a conditional save pays for the lock; an
+        # unconditional PUT behaves exactly as it did before the guard existed.
+        if is_conditional_write():
+            lock_entity_for_update(SqlaTable, pk)
+
         # Live version identifiers before the update (empty + query-free when
         # ``ENABLE_VERSIONING_CAPTURE`` is off).
         old_info = current_entity_version_info(SqlaTable, pk)
 
+        try:
+            raise_for_stale_write(concurrency_token_from(old_info))
+        except StaleEntityError:
+            return set_version_etag(
+                self.response(
+                    412,
+                    message=_(
+                        "The dataset was changed by another user or browser tab "
+                        "after you opened it. Reopen it to pick up the latest "
+                        "version, then reapply your changes."
+                    ),
+                ),
+                concurrency_token_from(old_info),
+            )
+
         try:
             # Two commands, two commits, two Continuum transactions for an
             # ``override_columns`` save — deliberately NOT merged into one
@@ -649,13 +709,13 @@ class DatasetRestApi(SoftDeleteApiMixin, BaseSupersetModelRestApi):
             new_info = current_entity_version_info(
                 SqlaTable, changed_model.id, changed_model.uuid
             )
-            etag_version_uuid = new_info.version_uuid
+            etag_version_uuid = concurrency_token_from(new_info)
             if override_columns:
                 RefreshDatasetCommand(pk).run()
                 # The ETag must reflect the entity's *current live* version,
                 # which after the refresh is the refresh's transaction —
                 # re-read it rather than reusing the pre-refresh uuid.
-                etag_version_uuid = current_entity_etag_uuid(
+                etag_version_uuid = entity_concurrency_token(
                     SqlaTable, changed_model.id, changed_model.uuid
                 )
             response = self.response(
@@ -1688,7 +1748,7 @@ class DatasetRestApi(SoftDeleteApiMixin, BaseSupersetModelRestApi):
 
         return set_version_etag(
             self.response(200, **response),
-            current_entity_etag_uuid(SqlaTable, table.id, table.uuid),
+            entity_concurrency_token(SqlaTable, table.id, table.uuid),
         )
 
     @expose("/<int:pk>/drill_info/", methods=("GET",))

superset/migrations/shared/constraints.py

@@ -45,9 +45,9 @@ def redefine(
     Redefine the foreign key constraint to include the ON DELETE and ON UPDATE
     constructs for cascading purposes.
 
-    :params foreign_key: The foreign key constraint
-    :param ondelete: If set, emit ON DELETE <value> when issuing DDL operations
-    :param onupdate: If set, emit ON UPDATE <value> when issuing DDL operations
+    :param foreign_key: The foreign key constraint
+    :param on_delete: If set, emit ON DELETE <value> when issuing DDL operations
+    :param on_update: If set, emit ON UPDATE <value> when issuing DDL operations
     """
 
     bind = op.get_bind()

superset/models/helpers.py

@@ -1646,16 +1646,28 @@ class ExtraJSONMixin:
         return value
 
 
+_EXTRA_DICT_CACHE_UNSET = object()
+
+
 class CertificationMixin:
     """Mixin to add extra certification fields"""
 
     extra = sa.Column(sa.Text, default="{}")
 
     def get_extra_dict(self) -> dict[str, Any]:
-        try:
-            return json.loads(self.extra)
-        except (TypeError, json.JSONDecodeError):
-            return {}
+        # Cache the parsed ``extra`` payload on the instance, keyed by the raw
+        # string it was parsed from, so callers reading multiple
+        # certification/warning properties off the same object don't each
+        # trigger their own ``json.loads``. The cache is transient (not a
+        # mapped column) and self-invalidates whenever ``extra`` changes.
+        cache_raw = getattr(self, "_extra_dict_cache_raw", _EXTRA_DICT_CACHE_UNSET)
+        if cache_raw is _EXTRA_DICT_CACHE_UNSET or cache_raw != self.extra:
+            try:
+                self._extra_dict_cache = json.loads(self.extra)
+            except (TypeError, json.JSONDecodeError):
+                self._extra_dict_cache = {}
+            self._extra_dict_cache_raw = self.extra
+        return self._extra_dict_cache
 
     @property
     def is_certified(self) -> bool:

superset/semantic_layers/models.py

@@ -404,7 +404,7 @@ class SemanticView(AuditMixinNullable, Model):
                 for dimension in dimensions
             },
         }
-        column_formats = {
+        column_formats: dict[str, str | None] = {
             metric.name: metric.d3format for metric in metrics if metric.d3format
         }
 

superset/utils/screenshots.py

@@ -333,7 +333,7 @@ class BaseScreenshot:
         Computes the thumbnail and caches the result
 
         :param user: If no user is given will use the current context
-        :param cache: The cache to keep the thumbnail payload
+        :param cache_key: The cache key to store the thumbnail payload under
         :param window_size: The window size from which will process the thumb
         :param thumb_size: The final thumbnail size
         :param force: Will force the computation even if it's already cached

superset/versioning/api_helpers.py

@@ -72,6 +72,11 @@ class EntityVersionInfo:
     version: int | None = None
     transaction_id: int | None = None
     version_uuid: str | None = None
+    #: Resolved uuid of the entity itself, carried so callers that need a
+    #: concurrency token for an entity with no version rows yet don't have to
+    #: re-run the ``SELECT uuid`` this helper already issued. Not part of the
+    #: API response.
+    entity_uuid: UUID | None = None
 
 
 def _capture_enabled() -> bool:
@@ -123,6 +128,7 @@ def current_entity_version_info(
         version=version,
         transaction_id=transaction_id,
         version_uuid=str(version_uuid) if version_uuid else None,
+        entity_uuid=entity_uuid,
     )
 
 
@@ -144,6 +150,77 @@ def current_entity_etag_uuid(
     return str(version_uuid) if version_uuid else None
 
 
+# Sentinel Continuum transaction id for an entity that has no version rows
+# yet. Continuum sequences start at 1, so it can never collide with a real
+# one, and the derived uuid stops matching the moment the first version row
+# lands — which is exactly the transition a concurrency guard must catch.
+_UNVERSIONED_TRANSACTION_ID = 0
+
+
+def unversioned_entity_token(entity_uuid: UUID) -> str:
+    """Concurrency token for an entity Continuum hasn't versioned yet."""
+    return str(VersionDAO.derive_version_uuid(entity_uuid, _UNVERSIONED_TRANSACTION_ID))
+
+
+def entity_concurrency_token(
+    model_cls: type[Model],
+    entity_id: int | None,
+    entity_uuid: UUID | None,
+) -> str | None:
+    """Resolve the optimistic-concurrency validator for *entity*.
+
+    Differs from :func:`current_entity_etag_uuid` in what it does for an
+    entity with no version rows: baseline rows are written lazily, on the
+    first update after the versioning migration, so a never-since-saved
+    entity has none. Reporting ``None`` there would leave the *first*
+    concurrent save on every such entity unguarded — the exact case a
+    two-tab race hits on a pristine entity. Those entities get a
+    deterministic unversioned token instead.
+
+    ``None`` still means "no validator exists": capture is off, or the
+    entity is missing.
+    """
+    if entity_id is None or entity_uuid is None or not _capture_enabled():
+        return None
+    return current_entity_etag_uuid(
+        model_cls, entity_id, entity_uuid
+    ) or unversioned_entity_token(entity_uuid)
+
+
+def lock_entity_for_update(model_cls: type[Model], entity_id: int | None) -> None:
+    """Row-lock *entity* so a conditional write's check and its update are atomic.
+
+    ``If-Match`` is verified against a read taken before the update command
+    runs. Without a lock two overlapping requests can both read the same live
+    version, both pass the check, and then commit one after the other,
+    reintroducing the lost update the check exists to prevent. The lock is
+    held until the command commits, because both run in the same scoped
+    session.
+
+    Renders no ``FOR UPDATE`` on SQLite, which serialises writers anyway.
+    """
+    try:
+        # The PUT route declares ``/<pk>`` (a string segment), so a non-numeric
+        # id must not raise a SQL cast error ahead of the command's 404.
+        entity_id = int(entity_id)  # type: ignore[arg-type]
+    except (TypeError, ValueError):
+        return
+    db.session.execute(
+        sa.select(model_cls.id).where(model_cls.id == entity_id).with_for_update()
+    )
+
+
+def concurrency_token_from(info: EntityVersionInfo) -> str | None:
+    """Concurrency token for an already-resolved :class:`EntityVersionInfo`.
+
+    Lets a write endpoint reuse the pre-update version lookup it already
+    made rather than issuing a second one.
+    """
+    if info.entity_uuid is None:
+        return None
+    return info.version_uuid or unversioned_entity_token(info.entity_uuid)
+
+
 # Maps the versioned model class name to the keyword argument
 # ``security_manager.raise_for_access`` expects for the per-resource
 # gate. Slice → ``chart=``, Dashboard → ``dashboard=``, SqlaTable →

superset/versioning/etag.py

@@ -22,6 +22,7 @@ from typing import TYPE_CHECKING
 from uuid import UUID
 
 import sqlalchemy as sa
+from flask import request
 from flask_appbuilder import Model
 
 from superset.extensions import db
@@ -76,3 +77,46 @@ def set_version_etag_by_uuid(
         response,
         VersionDAO.current_live_version_uuid(model_cls, entity_id, entity_uuid),
     )
+
+
+class StaleEntityError(Exception):
+    """The request's ``If-Match`` doesn't match the entity's live version."""
+
+
+def _entity_tag(tag: str) -> str:
+    """Strip the content-coding suffix ``Flask-Compress`` appends to ETags.
+
+    A compressed response legitimately carries a different validator than the
+    identity one — Flask-Compress rewrites ``"<uuid>"`` to ``"<uuid>:zstd"``
+    (see ``flask_compress``) — so a client replaying the ETag it read never
+    matches the raw version uuid. Version uuids contain no ``:``, so cutting
+    at the first one recovers the entity identity from either form.
+    """
+    return tag.split(":", 1)[0]
+
+
+def is_conditional_write() -> bool:
+    """Whether the request carries an ``If-Match`` precondition."""
+    return bool(request.if_match)
+
+
+def raise_for_stale_write(current_version_uuid: str | None) -> None:
+    """Enforce ``If-Match`` on a write request, if the client sent one.
+
+    Clients that read an entity's ``ETag`` may replay it as ``If-Match`` on a
+    subsequent write to get optimistic concurrency: the write is rejected when
+    the entity moved on in the meantime, instead of silently clobbering
+    whatever landed in between.
+
+    The condition is skipped — rather than failing closed — when the caller
+    has no validator to offer (``ENABLE_VERSIONING_CAPTURE`` off). Failing
+    closed there would block every conditional write on deployments running
+    without version capture, and those are no worse off than before they sent
+    the header.
+    """
+    if_match = request.if_match
+    if not if_match or if_match.star_tag or current_version_uuid is None:
+        return
+    live = _entity_tag(str(current_version_uuid))
+    if not any(_entity_tag(tag) == live for tag in if_match.as_set(True)):
+        raise StaleEntityError()

tests/integration_tests/datasets/api_tests.py

@@ -20,6 +20,7 @@ import copy
 import unittest
 from datetime import timedelta
 from io import BytesIO
+from typing import Any
 from unittest.mock import ANY, patch
 from zipfile import is_zipfile, ZipFile
 
@@ -72,6 +73,27 @@ from tests.integration_tests.fixtures.importexport import (
     dataset_ui_export,
 )
 
+# Fields the dataset ``show`` payload exposes but the ``PUT`` schema doesn't
+# accept: audit timestamps plus attributes derived from the model (type
+# affinity and the certification/warning metadata stored in ``extra``).
+DATASET_READ_ONLY_ITEM_FIELDS = (
+    "changed_on",
+    "created_on",
+    "type_generic",
+    "certification_details",
+    "certified_by",
+    "is_certified",
+    "warning_markdown",
+)
+
+
+def strip_read_only_fields(items: list[dict[str, Any]]) -> list[dict[str, Any]]:
+    """Drop read-only fields so a ``show`` payload can be fed back to ``PUT``."""
+    for item in items:
+        for field in DATASET_READ_ONLY_ITEM_FIELDS:
+            item.pop(field, None)
+    return items
+
 
 class TestDatasetApi(SupersetTestCase):
     fixture_tables_names = ("ab_permission", "ab_permission_view", "ab_view_menu")
@@ -1316,17 +1338,10 @@ class TestDatasetApi(SupersetTestCase):
         rv = self.get_assert_metric(uri, "get")
         data = json.loads(rv.data.decode("utf-8"))
 
-        for column in data["result"]["columns"]:
-            column.pop("changed_on", None)
-            column.pop("created_on", None)
-            column.pop("type_generic", None)
+        strip_read_only_fields(data["result"]["columns"])
         data["result"]["columns"].append(new_column_data)
 
-        for metric in data["result"]["metrics"]:
-            metric.pop("changed_on", None)
-            metric.pop("created_on", None)
-            metric.pop("type_generic", None)
-
+        strip_read_only_fields(data["result"]["metrics"])
         data["result"]["metrics"].append(new_metric_data)
 
         with freeze_time() as frozen:
@@ -1404,11 +1419,7 @@ class TestDatasetApi(SupersetTestCase):
         rv = self.get_assert_metric(uri, "get")
         data = json.loads(rv.data.decode("utf-8"))
 
-        for column in data["result"]["columns"]:
-            column.pop("changed_on", None)
-            column.pop("created_on", None)
-            column.pop("type_generic", None)
-
+        strip_read_only_fields(data["result"]["columns"])
         data["result"]["columns"].append(new_column_data)
         rv = self.client.put(uri, json={"columns": data["result"]["columns"]})
 
@@ -1443,10 +1454,7 @@ class TestDatasetApi(SupersetTestCase):
         # Get current cols and alter one
         rv = self.get_assert_metric(uri, "get")
         resp_columns = json.loads(rv.data.decode("utf-8"))["result"]["columns"]
-        for column in resp_columns:
-            column.pop("changed_on", None)
-            column.pop("created_on", None)
-            column.pop("type_generic", None)
+        strip_read_only_fields(resp_columns)
 
         resp_columns[0]["groupby"] = False
         resp_columns[0]["filterable"] = False

tests/unit_tests/datasets/api_tests.py

@@ -21,6 +21,7 @@ from unittest.mock import MagicMock, patch
 from sqlalchemy.orm.session import Session
 
 from superset import db
+from superset.utils import json
 
 
 def test_put_invalid_dataset(
@@ -214,3 +215,148 @@ def test_handle_filters_args_returns_request_scoped_filters(
     fresh_filters = api.datamodel.get_filters.return_value
     assert fresh_filters.rest_add_filters.call_count == 2
     assert fresh_filters.get_joined_filters.call_count == 2
+
+
+def _create_dataset(name: str) -> Any:
+    from superset.connectors.sqla.models import SqlaTable
+    from superset.models.core import Database
+
+    SqlaTable.metadata.create_all(db.session.get_bind())
+    dataset = SqlaTable(
+        table_name=name,
+        database=Database(database_name=f"{name}_db", sqlalchemy_uri="sqlite://"),
+    )
+    db.session.add(dataset)
+    db.session.flush()
+    return dataset
+
+
+def test_put_dataset_rejects_stale_if_match(
+    session: Session,
+    client: Any,
+    full_api_access: None,
+) -> None:
+    """
+    A PUT carrying an ``If-Match`` from an older version is refused with 412.
+    """
+    from superset.versioning.api_helpers import EntityVersionInfo
+
+    dataset = _create_dataset("test_put_stale_if_match")
+
+    with patch(
+        "superset.datasets.api.current_entity_version_info",
+        return_value=EntityVersionInfo(
+            version=1,
+            transaction_id=2,
+            version_uuid="new",
+            entity_uuid=dataset.uuid,
+        ),
+    ):
+        response = client.put(
+            f"/api/v1/dataset/{dataset.id}",
+            json={"description": "from a stale tab"},
+            headers={"If-Match": '"old"'},
+        )
+
+    assert response.status_code == 412
+    assert response.headers["ETag"] == '"new"'
+    db.session.expire(dataset)
+    assert dataset.description is None
+
+
+def test_put_dataset_guards_a_dataset_with_no_version_rows(
+    session: Session,
+    client: Any,
+    full_api_access: None,
+) -> None:
+    """Baseline rows are written lazily on the first update, so a dataset that
+    has never been saved has no version rows — it must still be guarded, or
+    the first concurrent save on every pristine dataset goes unprotected.
+    """
+    from superset.versioning.api_helpers import (
+        EntityVersionInfo,
+        unversioned_entity_token,
+    )
+
+    dataset = _create_dataset("test_put_unversioned_guard")
+    entity_uuid = dataset.uuid
+
+    with patch(
+        "superset.datasets.api.current_entity_version_info",
+        # A dataset that has since been versioned by another tab's save.
+        return_value=EntityVersionInfo(
+            version=0,
+            transaction_id=1,
+            version_uuid="written-by-the-other-tab",
+            entity_uuid=entity_uuid,
+        ),
+    ):
+        response = client.put(
+            f"/api/v1/dataset/{dataset.id}",
+            json={"description": "from the tab that opened first"},
+            headers={"If-Match": f'"{unversioned_entity_token(entity_uuid)}"'},
+        )
+
+    assert response.status_code == 412
+    db.session.expire(dataset)
+    assert dataset.description is None
+
+
+def test_get_dataset_exposes_certification_metadata(
+    session: Session,
+    client: Any,
+    full_api_access: None,
+) -> None:
+    """
+    Dataset API: Test that the show payload exposes the certification and
+    warning metadata for both columns and metrics.
+
+    Regression test for #43279: Explore hydrates its datasource from this
+    endpoint after a dataset save or swap. Without these fields the certified
+    and warning badges disappeared until the page was reloaded, because the
+    Explore bootstrap payload serializes them but this endpoint did not.
+    """
+    from superset.connectors.sqla.models import SqlaTable, SqlMetric, TableColumn
+    from superset.models.core import Database
+
+    SqlaTable.metadata.create_all(db.session.get_bind())
+
+    extra = json.dumps(
+        {
+            "certification": {
+                "certified_by": "Data Platform",
+                "details": "Reviewed quarterly",
+            },
+            "warning_markdown": "This is a **warning**",
+        }
+    )
+    database = Database(
+        database_name="my_db",
+        sqlalchemy_uri="sqlite://",
+    )
+    dataset = SqlaTable(
+        table_name="test_certification_table",
+        database=database,
+        columns=[
+            TableColumn(column_name="ds", type="TIMESTAMP", extra=extra),
+            TableColumn(
+                column_name="calculated",
+                type="INTEGER",
+                expression="1 + 1",
+                extra=extra,
+            ),
+        ],
+        metrics=[SqlMetric(metric_name="cnt", expression="COUNT(*)", extra=extra)],
+    )
+    db.session.add(dataset)
+    db.session.flush()
+
+    response = client.get(f"/api/v1/dataset/{dataset.id}")
+
+    assert response.status_code == 200
+    result = response.json["result"]
+    for item in [*result["columns"], *result["metrics"]]:
+        assert item["is_certified"] is True
+        assert item["certified_by"] == "Data Platform"
+        assert item["certification_details"] == "Reviewed quarterly"
+        assert item["warning_markdown"] == "This is a **warning**"

tests/unit_tests/versioning/test_etag.py

@@ -0,0 +1,109 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+from uuid import UUID
+
+import pytest
+from flask import Flask
+
+from superset.versioning.etag import raise_for_stale_write, StaleEntityError
+
+LIVE = "9f1f4c1e-0000-4000-8000-000000000001"
+ENTITY = UUID("9f1f4c1e-0000-4000-8000-0000000000aa")
+
+
+def _put(app: Flask, if_match: str | None):
+    headers = {"If-Match": if_match} if if_match is not None else {}
+    return app.test_request_context("/api/v1/dataset/1", method="PUT", headers=headers)
+
+
+def test_no_if_match_header_passes(app: Flask) -> None:
+    with _put(app, None):
+        raise_for_stale_write(LIVE)
+
+
+def test_matching_if_match_passes(app: Flask) -> None:
+    with _put(app, f'"{LIVE}"'):
+        raise_for_stale_write(LIVE)
+
+
+def test_star_if_match_passes(app: Flask) -> None:
+    with _put(app, "*"):
+        raise_for_stale_write(LIVE)
+
+
+def test_compressed_if_match_passes(app: Flask) -> None:
+    """Flask-Compress rewrites the ETag of a compressed response to
+    ``"<uuid>:<algorithm>"``; a client replaying that must still match."""
+    with _put(app, f'"{LIVE}:zstd"'):
+        raise_for_stale_write(LIVE)
+
+
+def test_compressed_stale_if_match_still_raises(app: Flask) -> None:
+    with _put(app, '"9f1f4c1e-0000-4000-8000-000000000002:gzip"'):
+        with pytest.raises(StaleEntityError):
+            raise_for_stale_write(LIVE)
+
+
+def test_stale_if_match_raises(app: Flask) -> None:
+    with _put(app, '"9f1f4c1e-0000-4000-8000-000000000002"'):
+        with pytest.raises(StaleEntityError):
+            raise_for_stale_write(LIVE)
+
+
+def test_if_match_list_containing_live_passes(app: Flask) -> None:
+    with _put(app, f'"9f1f4c1e-0000-4000-8000-000000000002", "{LIVE}"'):
+        raise_for_stale_write(LIVE)
+
+
+def test_no_validator_available_passes(app: Flask) -> None:
+    """Version capture off (or no version rows yet) degrades to an
+    unconditional write rather than blocking every save."""
+    with _put(app, f'"{LIVE}"'):
+        raise_for_stale_write(None)
+
+
+def test_unversioned_token_is_stable_and_entity_specific() -> None:
+    """A not-yet-versioned entity still gets a validator, derived from its own
+    uuid so two such entities never share one."""
+    from superset.versioning.api_helpers import unversioned_entity_token
+
+    other = UUID("9f1f4c1e-0000-4000-8000-0000000000ff")
+    assert unversioned_entity_token(ENTITY) == unversioned_entity_token(ENTITY)
+    assert unversioned_entity_token(ENTITY) != unversioned_entity_token(other)
+
+
+def test_unversioned_token_differs_from_first_real_version(app: Flask) -> None:
+    """The first version row must invalidate the unversioned token, or the
+    first concurrent save on a pristine entity would go unguarded."""
+    from superset.daos.version import derive_version_uuid
+    from superset.versioning.api_helpers import unversioned_entity_token
+
+    stale = unversioned_entity_token(ENTITY)
+    first_real = str(derive_version_uuid(ENTITY, 1))
+    assert stale != first_real
+    with _put(app, f'"{stale}"'):
+        with pytest.raises(StaleEntityError):
+            raise_for_stale_write(first_real)
+
+
+def test_unversioned_token_matches_while_still_unversioned(app: Flask) -> None:
+    from superset.versioning.api_helpers import unversioned_entity_token
+
+    token = unversioned_entity_token(ENTITY)
+    with _put(app, f'"{token}"'):
+        raise_for_stale_write(token)