fix(SafeMarkdown): guard attribute-key lookup against malformed override elements

getAttributeDefinitionKey assumed any non-string definition was an indexable tuple, so a malformed element (e.g. null) in an operator- supplied htmlSchemaOverrides attribute array would throw on definition[0] instead of being ignored. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
fix(SafeMarkdown): guard against malformed attribute overrides, fix misleading test name
2026-07-27 00:52:33 +00:00 · 2026-07-21 11:13:29 -07:00 · 2026-07-18 10:33:02 -07:00 · 2026-07-18 08:07:00 -07:00 · 2026-07-18 07:23:17 -07:00 · 2026-07-18 07:23:13 -07:00
18 changed files with 818 additions and 504 deletions
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -65,6 +65,11 @@ updates:
      lumagl:
        patterns:
          - "@luma.gl/*"
+      storybook:
+        patterns:
+          - "@storybook/*"
+          - "storybook"
+          - "eslint-plugin-storybook"
    open-pull-requests-limit: 30
    versioning-strategy: increase
    cooldown:
@@ -99,6 +104,22 @@ updates:
    directory: "/docs/"
    schedule:
      interval: "daily"
+    groups:
+      storybook:
+        patterns:
+          - "@storybook/*"
+          - "storybook"
+      docusaurus:
+        patterns:
+          - "@docusaurus/*"
+      docusaurus-openapi:
+        patterns:
+          - "docusaurus-plugin-openapi-docs"
+          - "docusaurus-theme-openapi-docs"
+      typescript-eslint:
+        patterns:
+          - "@typescript-eslint/*"
+          - "typescript-eslint"
    open-pull-requests-limit: 10
    versioning-strategy: increase
    cooldown:
--- a/docs/package.json
+++ b/docs/package.json
@@ -44,12 +44,12 @@
  },
  "dependencies": {
    "@ant-design/icons": "^6.2.5",
-    "@docusaurus/core": "^3.10.1",
-    "@docusaurus/faster": "^3.10.1",
-    "@docusaurus/plugin-client-redirects": "^3.10.1",
-    "@docusaurus/preset-classic": "3.10.1",
-    "@docusaurus/theme-live-codeblock": "^3.10.1",
-    "@docusaurus/theme-mermaid": "^3.10.1",
+    "@docusaurus/core": "^3.10.2",
+    "@docusaurus/faster": "^3.10.2",
+    "@docusaurus/plugin-client-redirects": "^3.10.2",
+    "@docusaurus/preset-classic": "3.10.2",
+    "@docusaurus/theme-live-codeblock": "^3.10.2",
+    "@docusaurus/theme-mermaid": "^3.10.2",
    "@emotion/core": "^11.0.0",
    "@emotion/react": "^11.13.3",
    "@emotion/styled": "^11.14.1",
@@ -58,14 +58,14 @@
    "@fontsource/inter": "^5.2.8",
    "@mdx-js/react": "^3.1.1",
    "@saucelabs/theme-github-codeblock": "^0.3.0",
-    "@storybook/addon-docs": "^10.4.5",
+    "@storybook/addon-docs": "^10.5.0",
    "@superset-ui/core": "^0.20.4",
    "@swc/core": "^1.15.43",
    "antd": "^6.5.0",
    "baseline-browser-mapping": "^2.10.40",
    "caniuse-lite": "^1.0.30001803",
-    "docusaurus-plugin-openapi-docs": "^5.1.1",
-    "docusaurus-theme-openapi-docs": "^5.1.1",
+    "docusaurus-plugin-openapi-docs": "^5.1.2",
+    "docusaurus-theme-openapi-docs": "^5.1.2",
    "js-yaml": "^5.2.0",
    "json-bigint": "^1.0.0",
    "prism-react-renderer": "^2.4.1",
@@ -77,20 +77,20 @@
    "react-table": "^7.8.0",
    "remark-import-partial": "^0.0.2",
    "reselect": "^5.2.0",
-    "storybook": "^10.4.5",
+    "storybook": "^10.5.0",
    "swagger-ui-react": "^5.32.8",
    "swc-loader": "^0.2.7",
    "tinycolor2": "^1.4.2",
    "unist-util-visit": "^5.1.0"
  },
  "devDependencies": {
-    "@docusaurus/module-type-aliases": "^3.10.1",
-    "@docusaurus/tsconfig": "^3.10.1",
+    "@docusaurus/module-type-aliases": "^3.10.2",
+    "@docusaurus/tsconfig": "^3.10.2",
    "@eslint/js": "^9.39.2",
    "@types/js-yaml": "^4.0.9",
    "@types/react": "^19.1.8",
-    "@typescript-eslint/eslint-plugin": "^8.59.3",
-    "@typescript-eslint/parser": "^8.63.0",
+    "@typescript-eslint/eslint-plugin": "^8.64.0",
+    "@typescript-eslint/parser": "^8.64.0",
    "eslint": "^9.39.2",
    "eslint-config-prettier": "^10.1.8",
    "eslint-plugin-prettier": "^5.5.6",
@@ -124,8 +124,6 @@
    "serialize-javascript": "7.0.5",
    "d3-color": "3.1.0",
    "ws": "^8.21.0",
-    "@docusaurus/core/@docusaurus/utils/gray-matter/js-yaml": "^3.15.0",
-    "@docusaurus/core/**/js-yaml": "^4.3.0",
    "docusaurus-plugin-openapi-docs/**/js-yaml": "^4.3.0"
  },
  "packageManager": "yarn@1.22.22+sha1.ac34549e6aa8e7ead463a7407e1c7390f61a6610"
--- a/docs/yarn.lock
+++ b/docs/yarn.lock
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -63,7 +63,7 @@ dependencies = [
    "flask-session>=0.4.0, <1.0",
    "flask-wtf>=1.3.0, <2.0",
    "geopy",
-    "greenlet<=3.5.1, >=3.5.1",
+    "greenlet<=3.5.3, >=3.5.3",
    "gunicorn>=26.0.0, <27; sys_platform != 'win32'",
    "hashids>=1.3.1, <2",
    # holidays>=0.45 required for security fix
@@ -113,7 +113,7 @@ dependencies = [
    "sqlglot>=30.12.0, <31",
    # newer pandas needs 0.9+
    "tabulate>=0.10.0, <1.0",
-    "typing-extensions>=4, <5",
+    "typing-extensions>=4.16.0, <5",
    "waitress; sys_platform == 'win32'",
    "watchdog>=6.0.0",
    "wtforms>=3.2.2, <4",
@@ -126,7 +126,7 @@ dependencies = [
 athena = ["pyathena[pandas]>=2, <4"]
 aurora-data-api = ["preset-sqlalchemy-aurora-data-api>=0.2.8,<0.3"]
 bigquery = [
-    "pandas-gbq>=0.19.1",
+    "pandas-gbq>=0.35.0",
    "sqlalchemy-bigquery>=1.17.0",
    "google-cloud-bigquery>=3.42.1",
 ]
@@ -149,7 +149,7 @@ dremio = ["sqlalchemy-dremio>=1.2.1, <4"]
 drill = ["sqlalchemy-drill>=1.1.10, <2"]
 druid = ["pydruid>=0.6.5,<0.7"]
 duckdb = ["duckdb>=1.5.4,<2", "duckdb-engine>=0.17.0"]
-dynamodb = ["pydynamodb>=0.4.2"]
+dynamodb = ["pydynamodb>=0.8.2"]
 solr = ["sqlalchemy-solr >= 0.2.4.3"]
 elasticsearch = ["elasticsearch-dbapi>=0.2.13, <0.3.0"]
 exasol = ["sqlalchemy-exasol>=2.4.0, <8.0"]
@@ -213,7 +213,7 @@ tdengine = [
 teradata = ["teradatasql>=20.0.0.62"]
 thumbnails = [] # deprecated, will be removed in 7.0
 vertica = ["sqlalchemy-vertica-python>= 0.6.3, < 0.7"]
-netezza = ["nzalchemy>=11.0.2, < 11.2"]
+netezza = ["nzalchemy>= 11.1.2, < 11.2"]
 starrocks = ["starrocks>=1.3.3, <2"]
 doris = ["pydoris>=1.2.0, <2.0.0"]
 oceanbase = ["oceanbase_py>=0.0.1.2"]
--- a/requirements/base.txt
+++ b/requirements/base.txt
@@ -164,7 +164,7 @@ google-auth==2.53.0
    # via
    #   -r requirements/base.in
    #   shillelagh
-greenlet==3.5.1
+greenlet==3.5.3
    # via
    #   apache-superset (pyproject.toml)
    #   shillelagh
@@ -427,7 +427,7 @@ trio==0.33.0
    #   trio-websocket
 trio-websocket==0.12.2
    # via selenium
-typing-extensions==4.15.0
+typing-extensions==4.16.0
    # via
    #   apache-superset (pyproject.toml)
    #   alembic
--- a/requirements/development.txt
+++ b/requirements/development.txt
@@ -340,7 +340,6 @@ gevent==26.4.0
 google-api-core==2.23.0
    # via
    #   google-cloud-bigquery
-    #   google-cloud-bigquery-storage
    #   google-cloud-core
    #   pandas-gbq
    #   sqlalchemy-bigquery
@@ -350,7 +349,6 @@ google-auth==2.53.0
    #   google-api-core
    #   google-auth-oauthlib
    #   google-cloud-bigquery
-    #   google-cloud-bigquery-storage
    #   google-cloud-core
    #   pandas-gbq
    #   pydata-google-auth
@@ -365,8 +363,6 @@ google-cloud-bigquery==3.42.1
    #   apache-superset
    #   pandas-gbq
    #   sqlalchemy-bigquery
-google-cloud-bigquery-storage==2.26.0
-    # via pandas-gbq
 google-cloud-core==2.4.1
    # via google-cloud-bigquery
 google-crc32c==1.6.0
@@ -377,7 +373,7 @@ googleapis-common-protos==1.66.0
    # via
    #   google-api-core
    #   grpcio-status
-greenlet==3.5.1
+greenlet==3.5.3
    # via
    #   -c requirements/base-constraint.txt
    #   apache-superset
@@ -638,6 +634,7 @@ packaging==25.0
    #   kombu
    #   limits
    #   matplotlib
+    #   pandas-gbq
    #   pytest
    #   shillelagh
    #   sqlalchemy-bigquery
@@ -649,7 +646,7 @@ pandas==2.1.4
    #   db-dtypes
    #   pandas-gbq
    #   prophet
-pandas-gbq==0.19.1
+pandas-gbq==0.35.0
    # via apache-superset
 parameterized==0.9.0
    # via apache-superset
@@ -705,18 +702,17 @@ prompt-toolkit==3.0.51
 prophet==1.2.0
    # via apache-superset
 proto-plus==1.25.0
-    # via
-    #   google-api-core
-    #   google-cloud-bigquery-storage
+    # via google-api-core
 protobuf==5.29.6
    # via
    #   google-api-core
-    #   google-cloud-bigquery-storage
    #   googleapis-common-protos
    #   grpcio-status
    #   proto-plus
 psutil==6.1.0
-    # via apache-superset
+    # via
+    #   apache-superset
+    #   pandas-gbq
 psycopg2-binary==2.9.12
    # via apache-superset
 py-key-value-aio==0.4.4
@@ -1043,7 +1039,7 @@ trio-websocket==0.12.2
    # via
    #   -c requirements/base-constraint.txt
    #   selenium
-typing-extensions==4.15.0
+typing-extensions==4.16.0
    # via
    #   -c requirements/base-constraint.txt
    #   alembic
--- a/superset-frontend/package-lock.json
+++ b/superset-frontend/package-lock.json
@@ -89,7 +89,7 @@
        "content-disposition": "^2.0.1",
        "d3-scale": "^4.0.2",
        "dayjs": "^1.11.21",
-        "dom-to-image-more": "^3.10.0",
+        "dom-to-image-more": "^3.10.2",
        "dom-to-pdf": "^0.3.2",
        "echarts": "^6.1.0",
        "fast-glob": "^3.3.2",
@@ -128,7 +128,7 @@
        "react-dnd-html5-backend": "^11.1.3",
        "react-dom": "^18.3.0",
        "react-google-recaptcha": "^3.1.0",
-        "react-intersection-observer": "^10.0.3",
+        "react-intersection-observer": "^10.1.0",
        "react-json-tree": "^0.20.0",
        "react-lines-ellipsis": "^0.16.1",
        "react-loadable": "^5.5.0",
@@ -178,13 +178,13 @@
        "@babel/types": "^7.29.7",
        "@emotion/babel-plugin": "^11.13.5",
        "@emotion/jest": "^11.14.2",
-        "@formatjs/intl-durationformat": "^0.10.16",
+        "@formatjs/intl-durationformat": "^0.10.17",
        "@istanbuljs/nyc-config-typescript": "^1.0.1",
        "@playwright/test": "^1.61.1",
        "@pmmmwh/react-refresh-webpack-plugin": "^0.6.2",
-        "@storybook/addon-docs": "10.4.6",
-        "@storybook/addon-links": "10.4.6",
-        "@storybook/react-webpack5": "10.4.6",
+        "@storybook/addon-docs": "10.5.0",
+        "@storybook/addon-links": "10.5.0",
+        "@storybook/react-webpack5": "10.5.0",
        "@storybook/test-runner": "0.24.4",
        "@svgr/webpack": "^8.1.0",
        "@swc/core": "^1.15.43",
@@ -240,7 +240,7 @@
        "eslint-plugin-prettier": "^5.5.6",
        "eslint-plugin-react-prefer-function-component": "^5.0.0",
        "eslint-plugin-react-you-might-not-need-an-effect": "^1.0.1",
-        "eslint-plugin-storybook": "10.4.6",
+        "eslint-plugin-storybook": "10.5.0",
        "eslint-plugin-testing-library": "^7.16.2",
        "eslint-plugin-theme-colors": "file:eslint-rules/eslint-plugin-theme-colors",
        "fetch-mock": "^12.6.0",
@@ -273,7 +273,7 @@
        "source-map": "^0.7.6",
        "source-map-support": "^0.5.21",
        "speed-measure-webpack-plugin": "^1.6.0",
-        "storybook": "10.4.6",
+        "storybook": "10.5.0",
        "style-loader": "^4.0.0",
        "stylelint": "^17.14.0",
        "swc-loader": "^0.2.7",
@@ -4093,38 +4093,38 @@
      }
    },
    "node_modules/@formatjs/bigdecimal": {
-      "version": "0.2.6",
-      "resolved": "https://registry.npmjs.org/@formatjs/bigdecimal/-/bigdecimal-0.2.6.tgz",
-      "integrity": "sha512-aPzKsGQOkQRHUEbyO/ZtYfr4EqaBQnSs6U4tzTla1xBnIdEHgY2GqEqso28UMwWRkzKqqTj5+/6BmuOsRkfn2A==",
+      "version": "0.2.7",
+      "resolved": "https://registry.npmjs.org/@formatjs/bigdecimal/-/bigdecimal-0.2.7.tgz",
+      "integrity": "sha512-B4+XY/e4u5v261r3a37Kq2ax91gPZSKGyVpx8X5dygAggLlUz+6MeBpmAhaBFGB8WQ4JB1qD+QtKHk9aJkEb9Q==",
      "dev": true,
      "license": "MIT"
    },
    "node_modules/@formatjs/fast-memoize": {
-      "version": "3.1.6",
-      "resolved": "https://registry.npmjs.org/@formatjs/fast-memoize/-/fast-memoize-3.1.6.tgz",
-      "integrity": "sha512-H5aexk1Le7T9TPmscacZ+1pR6CTa2n1wq+HDVGXhH8TzUlQQpeXzZs91dRtmFHrbeNbjPFPfQujUqm7MHgVoXQ==",
+      "version": "3.1.7",
+      "resolved": "https://registry.npmjs.org/@formatjs/fast-memoize/-/fast-memoize-3.1.7.tgz",
+      "integrity": "sha512-zXfhLpvA6T7+efdt9JLbBwZ00tT7NsBMDVnDu8rpHeNNv8KfRZAMo2gkG0k9lK/Nzc//3kJ9pImsfuJxk3KhUA==",
      "dev": true,
      "license": "MIT"
    },
    "node_modules/@formatjs/intl-durationformat": {
-      "version": "0.10.16",
-      "resolved": "https://registry.npmjs.org/@formatjs/intl-durationformat/-/intl-durationformat-0.10.16.tgz",
-      "integrity": "sha512-Ponn8K7eQAA7qeZRRD85lrvsByfeRDxw6aEE9EXapQ47wknptM0aYgumImVsMaBdJikpWYryGAMRZIB7IYYfmQ==",
+      "version": "0.10.17",
+      "resolved": "https://registry.npmjs.org/@formatjs/intl-durationformat/-/intl-durationformat-0.10.17.tgz",
+      "integrity": "sha512-YXm0u5WMaSQ8Gr3th33RFNzoI24nMDScg6iZ9EQZk2CNY3Sg19qklq+FQIuuQEbrDwBlQGrMSDE97m4mETnOxw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@formatjs/bigdecimal": "0.2.6",
-        "@formatjs/intl-localematcher": "0.8.11"
+        "@formatjs/bigdecimal": "0.2.7",
+        "@formatjs/intl-localematcher": "0.8.12"
      }
    },
    "node_modules/@formatjs/intl-localematcher": {
-      "version": "0.8.11",
-      "resolved": "https://registry.npmjs.org/@formatjs/intl-localematcher/-/intl-localematcher-0.8.11.tgz",
-      "integrity": "sha512-MzBbR9ifqgtzHwUl2PGEDtRVZGXF9nXPtrMyN6/iKbQaim1Ob7fnPJQMllVkHm3RK74o5VqnLrZIE9egWJhf5g==",
+      "version": "0.8.12",
+      "resolved": "https://registry.npmjs.org/@formatjs/intl-localematcher/-/intl-localematcher-0.8.12.tgz",
+      "integrity": "sha512-5H3r5ZJ2jZqHEv9K343lvHmeMDKMxssawAVD2H4J9xtu0ZXb6MlNxwLqdwBxJSHFU0C24KSZnffgmAi+59mK4A==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@formatjs/fast-memoize": "3.1.6"
+        "@formatjs/fast-memoize": "3.1.7"
      }
    },
    "node_modules/@gar/promise-retry": {
@@ -10321,16 +10321,16 @@
      "license": "MIT"
    },
    "node_modules/@storybook/addon-docs": {
-      "version": "10.4.6",
-      "resolved": "https://registry.npmjs.org/@storybook/addon-docs/-/addon-docs-10.4.6.tgz",
-      "integrity": "sha512-aWAfP5JMiT5a3zBJizwroCRzOCqZwDTJmvsYvwMD3ilIEa/kT1vhf6Xrbk4XIPhDwbh8Hpb/Gfnka1xBYEISWg==",
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/@storybook/addon-docs/-/addon-docs-10.5.0.tgz",
+      "integrity": "sha512-kbZGdX+mysiY4xezhpcFEwzQ1zSXcMhSS3u09Qt8+w5XetCAMMSv/yAxzpi6z+YoH+EdQ53e1q3MFtPUkzkfUA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@mdx-js/react": "^3.0.0",
-        "@storybook/csf-plugin": "10.4.6",
+        "@storybook/csf-plugin": "10.5.0",
        "@storybook/icons": "^2.0.2",
-        "@storybook/react-dom-shim": "10.4.6",
+        "@storybook/react-dom-shim": "10.5.0",
        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
        "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
        "ts-dedent": "^2.0.0"
@@ -10341,7 +10341,7 @@
      },
      "peerDependencies": {
        "@types/react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "storybook": "^10.4.6"
+        "storybook": "^10.5.0"
      },
      "peerDependenciesMeta": {
        "@types/react": {
@@ -10350,9 +10350,9 @@
      }
    },
    "node_modules/@storybook/addon-links": {
-      "version": "10.4.6",
-      "resolved": "https://registry.npmjs.org/@storybook/addon-links/-/addon-links-10.4.6.tgz",
-      "integrity": "sha512-VGfERTsGRFmfvNP3SKprFWkC6Od5kXzSutT5PSZjQ/O9NnCdHhd/RILxFDN2TzZn9ywDc7t5b4AldKmSYCv3EQ==",
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/@storybook/addon-links/-/addon-links-10.5.0.tgz",
+      "integrity": "sha512-pZlBqBjJc9Lo3LbcPx2ch0+BXD/efFQ0x9v7w+siCTs4IfqiePBuMK6ZSBQfxai+x/zHm0vKNTmOikEvP8j1wA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -10365,7 +10365,7 @@
      "peerDependencies": {
        "@types/react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "storybook": "^10.4.6"
+        "storybook": "^10.5.0"
      },
      "peerDependenciesMeta": {
        "@types/react": {
@@ -10377,13 +10377,13 @@
      }
    },
    "node_modules/@storybook/builder-webpack5": {
-      "version": "10.4.6",
-      "resolved": "https://registry.npmjs.org/@storybook/builder-webpack5/-/builder-webpack5-10.4.6.tgz",
-      "integrity": "sha512-klJUCBlkr1mFqXxsyYc7akIBhT5VOBTRcHChSFXq6Kbh+qQYOvfmgBpY0Tv+f7ffBmzp6gxpTorg7eGxlklxeQ==",
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/@storybook/builder-webpack5/-/builder-webpack5-10.5.0.tgz",
+      "integrity": "sha512-RFqlqK/wCtI9JzZ45o7aTsh+tDsg1TXn8KcLimBPh/Dfp77wZsZaOD+eS+0Fb8d2EbOgReLS500KjZruX3f3JQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@storybook/core-webpack": "10.4.6",
+        "@storybook/core-webpack": "10.5.0",
        "case-sensitive-paths-webpack-plugin": "^2.4.0",
        "cjs-module-lexer": "^1.2.3",
        "css-loader": "^7.1.2",
@@ -10391,6 +10391,7 @@
        "fork-ts-checker-webpack-plugin": "^9.1.0",
        "html-webpack-plugin": "^5.5.0",
        "magic-string": "^0.30.5",
+        "semver": "^7.7.3",
        "style-loader": "^4.0.0",
        "terser-webpack-plugin": "^5.3.17",
        "ts-dedent": "^2.0.0",
@@ -10404,7 +10405,7 @@
        "url": "https://opencollective.com/storybook"
      },
      "peerDependencies": {
-        "storybook": "^10.4.6"
+        "storybook": "^10.5.0"
      },
      "peerDependenciesMeta": {
        "typescript": {
@@ -10413,9 +10414,9 @@
      }
    },
    "node_modules/@storybook/core-webpack": {
-      "version": "10.4.6",
-      "resolved": "https://registry.npmjs.org/@storybook/core-webpack/-/core-webpack-10.4.6.tgz",
-      "integrity": "sha512-DDhpgaFGb1AC0lzfR2LOozCj+uT14tsr2R9551PHgcC3ru1yfhL2DNbIjdiMuQP8nVm+2HKeXWhybJGYtk9z9g==",
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/@storybook/core-webpack/-/core-webpack-10.5.0.tgz",
+      "integrity": "sha512-8O/h7nk1h91w4DBtZo6yo89cvPxzryTcYaFxOsSG5jrn/HMWxZIcyXm3nu3metCbTffnVBu2pmLuHaiCkv/9Ng==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -10426,13 +10427,13 @@
        "url": "https://opencollective.com/storybook"
      },
      "peerDependencies": {
-        "storybook": "^10.4.6"
+        "storybook": "^10.5.0"
      }
    },
    "node_modules/@storybook/csf-plugin": {
-      "version": "10.4.6",
-      "resolved": "https://registry.npmjs.org/@storybook/csf-plugin/-/csf-plugin-10.4.6.tgz",
-      "integrity": "sha512-NILLxDqpA/JR/AazGWpsz+4fadJwRU4uhHephGtYpVOWnQA/DkJfKT6zpcJVq8+QA8A2zKMLX3GVKsXIrxjuDA==",
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/@storybook/csf-plugin/-/csf-plugin-10.5.0.tgz",
+      "integrity": "sha512-R7VFw6FnDZTWct0ekOcFnTfDgdHnnAuQW+AbGG9A9IZPvyH9uLJivK7L86+r9MITRrO2+v81HaFDsT/OFk6ZkQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -10445,7 +10446,7 @@
      "peerDependencies": {
        "esbuild": "*",
        "rollup": "*",
-        "storybook": "^10.4.6",
+        "storybook": "^10.5.0",
        "vite": "*",
        "webpack": "*"
      },
@@ -10483,17 +10484,17 @@
      }
    },
    "node_modules/@storybook/preset-react-webpack": {
-      "version": "10.4.6",
-      "resolved": "https://registry.npmjs.org/@storybook/preset-react-webpack/-/preset-react-webpack-10.4.6.tgz",
-      "integrity": "sha512-D6EjK1sknC/1GmdWQjV38HEP+tBxJ5ObNuCUWQzGsJqsiq45HaOemZbIyJqxp3dYx2/YpFd0bawn7PlOP4yNOQ==",
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/@storybook/preset-react-webpack/-/preset-react-webpack-10.5.0.tgz",
+      "integrity": "sha512-x26YF06xSR8sYhHn/cOmbJl8VGQhOWGd49teU80cCwdUHTSu98jVAPyGQhuGmHEw3WndnWarIxXIu1iGhZ414w==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@storybook/core-webpack": "10.4.6",
+        "@storybook/core-webpack": "10.5.0",
        "@storybook/react-docgen-typescript-plugin": "1.0.6--canary.9.0c3f3b7.0",
        "@types/semver": "^7.7.1",
        "magic-string": "^0.30.5",
-        "react-docgen": "^7.1.1",
+        "react-docgen": "^8.0.2",
        "resolve": "^1.22.8",
        "semver": "^7.7.3",
        "tsconfig-paths": "^4.2.0",
@@ -10506,7 +10507,7 @@
      "peerDependencies": {
        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
        "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "storybook": "^10.4.6"
+        "storybook": "^10.5.0"
      },
      "peerDependenciesMeta": {
        "typescript": {
@@ -10515,14 +10516,14 @@
      }
    },
    "node_modules/@storybook/react": {
-      "version": "10.4.6",
-      "resolved": "https://registry.npmjs.org/@storybook/react/-/react-10.4.6.tgz",
-      "integrity": "sha512-9Y7YecrVFe1/01KYjfOLxVqTg2Aq+IO6TEv6sC2U0PfD0AWCSCmQ91QqgBpN/XW4aFFWoiZNinyXMUlU8zxy2w==",
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/@storybook/react/-/react-10.5.0.tgz",
+      "integrity": "sha512-2IhddiREy7NqAqnFsEOfW6HBG7azIcLxhRQYploSsaemOncR29xhzvAZsG+xlWgrtvxv4h3fYQTTR4TNn8CgPQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@storybook/global": "^5.0.0",
-        "@storybook/react-dom-shim": "10.4.6",
+        "@storybook/react-dom-shim": "10.5.0",
        "react-docgen": "^8.0.2",
        "react-docgen-typescript": "^2.2.2"
      },
@@ -10535,7 +10536,7 @@
        "@types/react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
        "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "storybook": "^10.4.6",
+        "storybook": "^10.5.0",
        "typescript": ">= 4.9.x"
      },
      "peerDependenciesMeta": {
@@ -10615,9 +10616,9 @@
      }
    },
    "node_modules/@storybook/react-dom-shim": {
-      "version": "10.4.6",
-      "resolved": "https://registry.npmjs.org/@storybook/react-dom-shim/-/react-dom-shim-10.4.6.tgz",
-      "integrity": "sha512-iGNmKzrq9vgl2PDrYAnZKI+yvac3Ym+lJXXuQaqlFRS23zA5MNm4EBX+rAG7WulqchoK6NaZ0KQOs2mAgEpTMg==",
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/@storybook/react-dom-shim/-/react-dom-shim-10.5.0.tgz",
+      "integrity": "sha512-GwGA6zDj4Cfw6vGsdfPKfF39L0W6solNbbnjdjGa57m2ooASkidLhrXo2wgC9wh3o/jcfonmYPDRGY6sEhGDtg==",
      "dev": true,
      "license": "MIT",
      "funding": {
@@ -10629,7 +10630,7 @@
        "@types/react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
        "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "storybook": "^10.4.6"
+        "storybook": "^10.5.0"
      },
      "peerDependenciesMeta": {
        "@types/react": {
@@ -10641,15 +10642,15 @@
      }
    },
    "node_modules/@storybook/react-webpack5": {
-      "version": "10.4.6",
-      "resolved": "https://registry.npmjs.org/@storybook/react-webpack5/-/react-webpack5-10.4.6.tgz",
-      "integrity": "sha512-34rOHFRa4NrBnMKsQMq8QTvw65QQJUtasYfEOw1/Pa9+CFWfFQZ3kfDLRxatphUyc0rbKxmVrVE4SFEMY/eMsA==",
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/@storybook/react-webpack5/-/react-webpack5-10.5.0.tgz",
+      "integrity": "sha512-Z5Tpg0jNelMOzxfP47oH+AESyol/52WzariOJB6/rUAj5S9vMb/IM7KrF/3QQUa/j3om6dmclxA83CUhGgreig==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@storybook/builder-webpack5": "10.4.6",
-        "@storybook/preset-react-webpack": "10.4.6",
-        "@storybook/react": "10.4.6"
+        "@storybook/builder-webpack5": "10.5.0",
+        "@storybook/preset-react-webpack": "10.5.0",
+        "@storybook/react": "10.5.0"
      },
      "funding": {
        "type": "opencollective",
@@ -10658,7 +10659,7 @@
      "peerDependencies": {
        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
        "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "storybook": "^10.4.6",
+        "storybook": "^10.5.0",
        "typescript": ">= 4.9.x"
      },
      "peerDependenciesMeta": {
@@ -10667,28 +10668,6 @@
        }
      }
    },
-    "node_modules/@storybook/react/node_modules/react-docgen": {
-      "version": "8.0.3",
-      "resolved": "https://registry.npmjs.org/react-docgen/-/react-docgen-8.0.3.tgz",
-      "integrity": "sha512-aEZ9qP+/M+58x2qgfSFEWH1BxLyHe5+qkLNJOZQb5iGS017jpbRnoKhNRrXPeA6RfBrZO5wZrT9DMC1UqE1f1w==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/core": "^7.28.0",
-        "@babel/traverse": "^7.28.0",
-        "@babel/types": "^7.28.2",
-        "@types/babel__core": "^7.20.5",
-        "@types/babel__traverse": "^7.20.7",
-        "@types/doctrine": "^0.0.9",
-        "@types/resolve": "^1.20.2",
-        "doctrine": "^3.0.0",
-        "resolve": "^1.22.1",
-        "strip-indent": "^4.0.0"
-      },
-      "engines": {
-        "node": "^20.9.0 || >=22"
-      }
-    },
    "node_modules/@storybook/test-runner": {
      "version": "0.24.4",
      "resolved": "https://registry.npmjs.org/@storybook/test-runner/-/test-runner-0.24.4.tgz",
@@ -18676,9 +18655,9 @@
      "license": "MIT"
    },
    "node_modules/dom-to-image-more": {
-      "version": "3.10.0",
-      "resolved": "https://registry.npmjs.org/dom-to-image-more/-/dom-to-image-more-3.10.0.tgz",
-      "integrity": "sha512-APrFEimSmH4phJKs8DlURuSr3BFwDqNi62l14bx73Wrhx0OhE4dd0qzZR+4E3sH8PnHxvax1LOrosC9oXRFA5A==",
+      "version": "3.10.2",
+      "resolved": "https://registry.npmjs.org/dom-to-image-more/-/dom-to-image-more-3.10.2.tgz",
+      "integrity": "sha512-+ZNbiRB7Fpsfzn8WSCmAIKUFSXp8uahlI+LsY8t8oWtAATqokeKS3eD3oQikheouap6aVMht8y0b4oAobWRr9w==",
      "license": "MIT"
    },
    "node_modules/dom-to-pdf": {
@@ -19848,17 +19827,18 @@
      }
    },
    "node_modules/eslint-plugin-storybook": {
-      "version": "10.4.6",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-storybook/-/eslint-plugin-storybook-10.4.6.tgz",
-      "integrity": "sha512-CfGSXn6zFspeYTU8R7v797MOmJFj8xc6MWf/oGuRwbKeMoSwnliR+OlXSjMZYM1D6gfmwiuH1VX58LSHdn+ZPg==",
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-storybook/-/eslint-plugin-storybook-10.5.0.tgz",
+      "integrity": "sha512-UyhbK11baKAYqzyDUHlwDlm1aP/wxPMR0vFmsxA5984BGaPwarhoXUWng1Xa0cd9BdPbQ+zr/y8ADk6XxtwkYg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
+        "@typescript-eslint/types": "^8.48.0",
        "@typescript-eslint/utils": "^8.48.0"
      },
      "peerDependencies": {
        "eslint": ">=8",
-        "storybook": "^10.4.6"
+        "storybook": "^10.5.0"
      }
    },
    "node_modules/eslint-plugin-testing-library": {
@@ -35136,17 +35116,17 @@
      }
    },
    "node_modules/react-docgen": {
-      "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/react-docgen/-/react-docgen-7.1.1.tgz",
-      "integrity": "sha512-hlSJDQ2synMPKFZOsKo9Hi8WWZTC7POR8EmWvTSjow+VDgKzkmjQvFm2fk0tmRw+f0vTOIYKlarR0iL4996pdg==",
+      "version": "8.0.3",
+      "resolved": "https://registry.npmjs.org/react-docgen/-/react-docgen-8.0.3.tgz",
+      "integrity": "sha512-aEZ9qP+/M+58x2qgfSFEWH1BxLyHe5+qkLNJOZQb5iGS017jpbRnoKhNRrXPeA6RfBrZO5wZrT9DMC1UqE1f1w==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@babel/core": "^7.18.9",
-        "@babel/traverse": "^7.18.9",
-        "@babel/types": "^7.18.9",
-        "@types/babel__core": "^7.18.0",
-        "@types/babel__traverse": "^7.18.0",
+        "@babel/core": "^7.28.0",
+        "@babel/traverse": "^7.28.0",
+        "@babel/types": "^7.28.2",
+        "@types/babel__core": "^7.20.5",
+        "@types/babel__traverse": "^7.20.7",
        "@types/doctrine": "^0.0.9",
        "@types/resolve": "^1.20.2",
        "doctrine": "^3.0.0",
@@ -35154,7 +35134,7 @@
        "strip-indent": "^4.0.0"
      },
      "engines": {
-        "node": ">=16.14.0"
+        "node": "^20.9.0 || >=22"
      }
    },
    "node_modules/react-docgen-typescript": {
@@ -35218,9 +35198,9 @@
      }
    },
    "node_modules/react-intersection-observer": {
-      "version": "10.0.3",
-      "resolved": "https://registry.npmjs.org/react-intersection-observer/-/react-intersection-observer-10.0.3.tgz",
-      "integrity": "sha512-luICLMbs0zxTO/70Zy7K5jOXkABPEVSAF8T3FdZUlctsrIaPLmx8TZe2SSA+CY2HGWfz2INyNTnp82pxNNsShA==",
+      "version": "10.1.0",
+      "resolved": "https://registry.npmjs.org/react-intersection-observer/-/react-intersection-observer-10.1.0.tgz",
+      "integrity": "sha512-V8HDu3+Llg6OEhOxx8LnUSS0t4VS+1Xk9ZatkI8Jct/H0CwKnqFTCu8NT3q7ghJTghTdIrEMPSWr2dkKPG+gdQ==",
      "license": "MIT",
      "peerDependencies": {
        "react": "^17.0.0 || ^18.0.0 || ^19.0.0",
@@ -38380,20 +38360,22 @@
      }
    },
    "node_modules/storybook": {
-      "version": "10.4.6",
-      "resolved": "https://registry.npmjs.org/storybook/-/storybook-10.4.6.tgz",
-      "integrity": "sha512-6wkA6LxfDSSilloITsrFOJfsnw0mDUP2h8Ls+lRt8oRsudtz2RWFhLv+Toiwg6NW7hUpdTDc2hzR7DztJid6+A==",
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/storybook/-/storybook-10.5.0.tgz",
+      "integrity": "sha512-dRhM/kSSvHQR8DmZO41v5sJuz9U6zDjjR2gRBTgZN2RBSXbmF0Brvgszrvvxyx2VfxuYKzhB+xumKwWkwlBtig==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@storybook/global": "^5.0.0",
        "@storybook/icons": "^2.0.2",
+        "@testing-library/dom": "^10.4.1",
        "@testing-library/jest-dom": "^6.9.1",
        "@testing-library/user-event": "^14.6.1",
        "@vitest/expect": "3.2.4",
        "@vitest/spy": "3.2.4",
        "@webcontainer/env": "^1.1.1",
        "esbuild": "^0.18.0 || ^0.19.0 || ^0.20.0 || ^0.21.0 || ^0.22.0 || ^0.23.0 || ^0.24.0 || ^0.25.0 || ^0.26.0 || ^0.27.0 || ^0.28.0",
+        "jsonc-parser": "^3.3.1",
        "open": "^10.2.0",
        "oxc-parser": "^0.127.0",
        "oxc-resolver": "^11.19.1",
@@ -38412,7 +38394,7 @@
      "peerDependencies": {
        "@types/react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
        "prettier": "^2 || ^3",
-        "vite-plus": "^0.1.15"
+        "vite-plus": "^0.1.15 || ^0.2.0"
      },
      "peerDependenciesMeta": {
        "@types/react": {
@@ -38426,6 +38408,26 @@
        }
      }
    },
+    "node_modules/storybook/node_modules/@testing-library/dom": {
+      "version": "10.4.1",
+      "resolved": "https://registry.npmjs.org/@testing-library/dom/-/dom-10.4.1.tgz",
+      "integrity": "sha512-o4PXJQidqJl82ckFaXUeoAW+XysPLauYI43Abki5hABd853iMhitooc6znOnczgbTYmEP6U6/y1ZyKAIsvMKGg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/code-frame": "^7.10.4",
+        "@babel/runtime": "^7.12.5",
+        "@types/aria-query": "^5.0.1",
+        "aria-query": "5.3.0",
+        "dom-accessibility-api": "^0.5.9",
+        "lz-string": "^1.5.0",
+        "picocolors": "1.1.1",
+        "pretty-format": "^27.0.2"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
    "node_modules/storybook/node_modules/@testing-library/user-event": {
      "version": "14.6.1",
      "resolved": "https://registry.npmjs.org/@testing-library/user-event/-/user-event-14.6.1.tgz",
@@ -38440,6 +38442,16 @@
        "@testing-library/dom": ">=7.21.4"
      }
    },
+    "node_modules/storybook/node_modules/aria-query": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.3.0.tgz",
+      "integrity": "sha512-b0P0sZPKtyu8HkeRAfCq0IfURZK+SuwMjY1UXGBU27wpAiTwQAIlq56IbIO+ytk/JjS1fMR14ee5WBBfKi5J6A==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "dequal": "^2.0.3"
+      }
+    },
    "node_modules/storybook/node_modules/define-lazy-prop": {
      "version": "3.0.0",
      "resolved": "https://registry.npmjs.org/define-lazy-prop/-/define-lazy-prop-3.0.0.tgz",
@@ -38469,6 +38481,13 @@
        "url": "https://github.com/sponsors/sindresorhus"
      }
    },
+    "node_modules/storybook/node_modules/jsonc-parser": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.3.1.tgz",
+      "integrity": "sha512-HUgH65KyejrUFPvHFPbqOY0rsFip3Bo5wb4ngvdi1EpCYWUQDC5V+Y7mZws+DLkr4M//zQJoanu1SP+87Dv1oQ==",
+      "dev": true,
+      "license": "MIT"
+    },
    "node_modules/storybook/node_modules/open": {
      "version": "10.2.0",
      "resolved": "https://registry.npmjs.org/open/-/open-10.2.0.tgz",
@@ -41025,9 +41044,9 @@
      }
    },
    "node_modules/unplugin/node_modules/picomatch": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
+      "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
      "dev": true,
      "license": "MIT",
      "engines": {
--- a/superset-frontend/package.json
+++ b/superset-frontend/package.json
@@ -174,7 +174,7 @@
    "content-disposition": "^2.0.1",
    "d3-scale": "^4.0.2",
    "dayjs": "^1.11.21",
-    "dom-to-image-more": "^3.10.0",
+    "dom-to-image-more": "^3.10.2",
    "dom-to-pdf": "^0.3.2",
    "echarts": "^6.1.0",
    "fast-glob": "^3.3.2",
@@ -213,7 +213,7 @@
    "react-dnd-html5-backend": "^11.1.3",
    "react-dom": "^18.3.0",
    "react-google-recaptcha": "^3.1.0",
-    "react-intersection-observer": "^10.0.3",
+    "react-intersection-observer": "^10.1.0",
    "react-json-tree": "^0.20.0",
    "react-lines-ellipsis": "^0.16.1",
    "react-loadable": "^5.5.0",
@@ -263,13 +263,13 @@
    "@babel/types": "^7.29.7",
    "@emotion/babel-plugin": "^11.13.5",
    "@emotion/jest": "^11.14.2",
-    "@formatjs/intl-durationformat": "^0.10.16",
+    "@formatjs/intl-durationformat": "^0.10.17",
    "@istanbuljs/nyc-config-typescript": "^1.0.1",
    "@playwright/test": "^1.61.1",
    "@pmmmwh/react-refresh-webpack-plugin": "^0.6.2",
-    "@storybook/addon-docs": "10.4.6",
-    "@storybook/addon-links": "10.4.6",
-    "@storybook/react-webpack5": "10.4.6",
+    "@storybook/addon-docs": "10.5.0",
+    "@storybook/addon-links": "10.5.0",
+    "@storybook/react-webpack5": "10.5.0",
    "@storybook/test-runner": "0.24.4",
    "@svgr/webpack": "^8.1.0",
    "@swc/core": "^1.15.43",
@@ -325,7 +325,7 @@
    "eslint-plugin-prettier": "^5.5.6",
    "eslint-plugin-react-prefer-function-component": "^5.0.0",
    "eslint-plugin-react-you-might-not-need-an-effect": "^1.0.1",
-    "eslint-plugin-storybook": "10.4.6",
+    "eslint-plugin-storybook": "10.5.0",
    "eslint-plugin-testing-library": "^7.16.2",
    "eslint-plugin-theme-colors": "file:eslint-rules/eslint-plugin-theme-colors",
    "fetch-mock": "^12.6.0",
@@ -358,7 +358,7 @@
    "source-map": "^0.7.6",
    "source-map-support": "^0.5.21",
    "speed-measure-webpack-plugin": "^1.6.0",
-    "storybook": "10.4.6",
+    "storybook": "10.5.0",
    "style-loader": "^4.0.0",
    "stylelint": "^17.14.0",
    "swc-loader": "^0.2.7",
--- a/superset-frontend/packages/superset-ui-core/src/components/SafeMarkdown/SafeMarkdown.tsx
+++ b/superset-frontend/packages/superset-ui-core/src/components/SafeMarkdown/SafeMarkdown.tsx
@@ -78,19 +78,78 @@ export function transformLinkUri(uri: string): string {
  return DANGEROUS_LINK_PROTOCOLS.includes(scheme) ? '' : url;
 }

+// A hast-util-sanitize attribute definition is either a bare property name
+// (any value allowed) or a tuple of `[propertyName, ...allowedValues]` (only
+// the listed values allowed). See hast-util-sanitize's `PropertyDefinition`.
+type AttributeDefinition = string | readonly [string, ...unknown[]];
+
+function getAttributeDefinitionKey(
+  definition: AttributeDefinition,
+): string | undefined {
+  if (typeof definition === 'string') return definition;
+  // htmlSchemaOverrides comes from runtime config and isn't guaranteed to
+  // match the expected shape; a malformed element (e.g. `null`) has no key
+  // rather than crashing the lookup.
+  return Array.isArray(definition) ? definition[0] : undefined;
+}
+
+/**
+ * Merge an operator-supplied list of attribute definitions for a tag (or the
+ * `'*'` wildcard) with the corresponding default definitions.
+ *
+ * hast-util-sanitize's `findDefinition` returns only the FIRST definition it
+ * finds for a given property name, so a naive concat leaves whichever list
+ * happens to declare that property first in charge. The default schema
+ * already declares restrictive tuples for some properties (e.g.
+ * `li: [['className', 'task-list-item']]`), so appending an operator's
+ * override after it never took effect. Because a failed allowlist check
+ * returns `[]` rather than `undefined`, hast-util-sanitize's own `'*'`
+ * fallback never kicked in either.
+ *
+ * To fix that, an override definition replaces the default definition for
+ * the same property (by property name) instead of being appended alongside
+ * it.
+ */
+function mergeAttributeDefinitions(
+  defaults: readonly AttributeDefinition[],
+  overrides: readonly AttributeDefinition[],
+): AttributeDefinition[] {
+  const overriddenKeys = new Set(
+    overrides.map(getAttributeDefinitionKey).filter(Boolean),
+  );
+  const remainingDefaults = defaults.filter(
+    definition => !overriddenKeys.has(getAttributeDefinitionKey(definition)),
+  );
+  return [...remainingDefaults, ...overrides];
+}
+
 export function getOverrideHtmlSchema(
  originalSchema: typeof defaultSchema,
  htmlSchemaOverrides: SafeMarkdownProps['htmlSchemaOverrides'],
 ) {
-  // Merge into a fresh clone: mergeWith mutates its first argument, and the
-  // array customizer concatenates, so merging into the shared defaultSchema
-  // import would progressively widen the sanitization allowlist for every
-  // SafeMarkdown instance app-wide.
+  // Merge into a fresh clone: mergeWith mutates its first argument, so
+  // merging into the shared defaultSchema import would progressively widen
+  // the sanitization allowlist for every SafeMarkdown instance app-wide.
+  const target = cloneDeep(originalSchema);
  return mergeWith(
-    cloneDeep(originalSchema),
+    target,
    htmlSchemaOverrides,
-    (objValue, srcValue) =>
-      Array.isArray(objValue) ? objValue.concat(srcValue) : undefined,
+    (objValue, srcValue, _key, object) => {
+      if (!Array.isArray(objValue)) return undefined;
+      // Only the per-tag (and `'*'`) arrays nested under `attributes` hold
+      // property definitions that need dedup-by-key; every other array in
+      // the schema (e.g. `tagNames`, `protocols.href`) is a plain list where
+      // concatenation is the correct merge.
+      if (object === target.attributes) {
+        // htmlSchemaOverrides comes from runtime config and isn't guaranteed
+        // to match the expected shape; fall back to the default definitions
+        // for a tag rather than throwing if an operator supplies something
+        // other than an array of attribute definitions.
+        if (!Array.isArray(srcValue)) return objValue;
+        return mergeAttributeDefinitions(objValue, srcValue);
+      }
+      return objValue.concat(srcValue);
+    },
  );
 }

--- a/superset-frontend/packages/superset-ui-core/test/components/SafeMarkdown.test.tsx
+++ b/superset-frontend/packages/superset-ui-core/test/components/SafeMarkdown.test.tsx
@@ -83,6 +83,100 @@ describe('getOverrideHtmlSchema', () => {
      (second.tagNames ?? []).filter(name => name === 'iframe'),
    ).toHaveLength(1);
  });
+
+  // Regression tests for #34191: hast-util-sanitize's real default schema
+  // restricts `li`/`ul`/`ol` `className` to specific task-list values, e.g.
+  // `li: [['className', 'task-list-item']]` (see hast-util-sanitize's
+  // `lib/schema.js`). `rehype-sanitize` is mocked globally in this jest
+  // project (see NOTE above), so `defaultSchema` isn't usable here; this
+  // fixture mirrors just the shape that matters for these tests.
+  //
+  // findDefinition only ever returns the FIRST definition it finds for a
+  // given property name, so simply concatenating the operator's override
+  // after the default restrictive tuple left the default in charge: any
+  // other class value was silently dropped, and (since a failed allowlist
+  // check returns `[]` rather than `undefined`) hast-util-sanitize's own
+  // `'*'` wildcard fallback never kicked in either.
+  const taskListSchemaFixture: typeof defaultSchema = {
+    attributes: {
+      li: [['className', 'task-list-item']],
+      ul: [['className', 'contains-task-list']],
+      ol: [['className', 'contains-task-list']],
+    },
+  };
+
+  test('an override for a property replaces the same-named default definition', () => {
+    const result = getOverrideHtmlSchema(taskListSchemaFixture, {
+      attributes: { li: ['className'] },
+    });
+
+    // The override should fully replace the default `li` className
+    // restriction, not merely be appended after it.
+    expect(result.attributes?.li).toEqual(['className']);
+  });
+
+  test('a "*" wildcard override alone does not widen li, which has its own default definition', () => {
+    const result = getOverrideHtmlSchema(taskListSchemaFixture, {
+      attributes: { '*': ['className'] },
+    });
+
+    expect(result.attributes?.['*']).toContainEqual('className');
+    // The restrictive `li`-specific default is still present (untouched by
+    // this override), but since findDefinition matches on the specific
+    // `li` entry first, this alone documents why an `li`-specific override
+    // is required to unblock arbitrary classes on `li` -- a `'*'` override
+    // does not, by itself, widen a tag that already has its own definition.
+    expect(result.attributes?.li).toEqual(taskListSchemaFixture.attributes?.li);
+  });
+
+  test('a malformed (non-array) attribute override for a tag falls back to the default definition instead of throwing', () => {
+    expect(() =>
+      getOverrideHtmlSchema(taskListSchemaFixture, {
+        // Runtime config isn't guaranteed to match the expected shape; a
+        // string here (rather than an array of attribute definitions) must
+        // not crash markdown rendering.
+        attributes: { li: 'className' as unknown as string[] },
+      }),
+    ).not.toThrow();
+
+    const result = getOverrideHtmlSchema(taskListSchemaFixture, {
+      attributes: { li: 'className' as unknown as string[] },
+    });
+    expect(result.attributes?.li).toEqual(taskListSchemaFixture.attributes?.li);
+  });
+
+  test('a malformed (null) element within an attribute override array falls back to the default definition instead of throwing', () => {
+    expect(() =>
+      getOverrideHtmlSchema(taskListSchemaFixture, {
+        // Runtime config isn't guaranteed to match the expected shape; a
+        // `null` element here must not crash the key lookup used to
+        // dedup overrides against the default definitions.
+        attributes: { li: [null] as unknown as string[] },
+      }),
+    ).not.toThrow();
+
+    const result = getOverrideHtmlSchema(taskListSchemaFixture, {
+      attributes: { li: [null] as unknown as string[] },
+    });
+    expect(result.attributes?.li).toEqual([
+      ...taskListSchemaFixture.attributes!.li!,
+      null,
+    ]);
+  });
+
+  test('the default task-list class restriction on li/ul/ol still applies with no override', () => {
+    const result = getOverrideHtmlSchema(taskListSchemaFixture, {});
+
+    expect(result.attributes?.li).toEqual([['className', 'task-list-item']]);
+    expect(result.attributes?.ul).toContainEqual([
+      'className',
+      'contains-task-list',
+    ]);
+    expect(result.attributes?.ol).toContainEqual([
+      'className',
+      'contains-task-list',
+    ]);
+  });
 });

 describe('transformLinkUri', () => {
--- a/superset-websocket/package-lock.json
+++ b/superset-websocket/package-lock.json
@@ -26,7 +26,7 @@
        "@types/ws": "^8.18.1",
        "@typescript-eslint/eslint-plugin": "^8.63.0",
        "@typescript-eslint/parser": "^8.63.0",
-        "eslint": "^10.5.0",
+        "eslint": "^10.7.0",
        "eslint-config-prettier": "^10.1.8",
        "globals": "^17.6.0",
        "prettier": "^3.9.5",
@@ -1360,9 +1360,9 @@
      }
    },
    "node_modules/eslint": {
-      "version": "10.6.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.6.0.tgz",
-      "integrity": "sha512-6lVbcqSodALYo+4ELD0heG6lFiFxnLMuLkiMi2qV8LMp54N8tE8FT1GMH+ev4Ti00nFjNze2+Su6DsV5OQW3Dg==",
+      "version": "10.7.0",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.7.0.tgz",
+      "integrity": "sha512-GVTD7s1vdIl6UYvAfriOPeY1Df8LIZjfofLvHwde+erDHGGuHyuM6xoxRxmHiebhYuD2p1vN4wWh0XzPARSGDQ==",
      "dev": true,
      "license": "MIT",
      "workspaces": [
--- a/superset-websocket/package.json
+++ b/superset-websocket/package.json
@@ -35,7 +35,7 @@
    "@types/ws": "^8.18.1",
    "@typescript-eslint/eslint-plugin": "^8.63.0",
    "@typescript-eslint/parser": "^8.63.0",
-    "eslint": "^10.5.0",
+    "eslint": "^10.7.0",
    "eslint-config-prettier": "^10.1.8",
    "globals": "^17.6.0",
    "prettier": "^3.9.5",
--- a/superset/charts/api.py
+++ b/superset/charts/api.py
@@ -1084,7 +1084,6 @@ class ChartRestApi(SoftDeleteApiMixin, BaseSupersetModelRestApi):
            mimetype="application/zip",
            as_attachment=True,
            download_name=filename,
-            max_age=0,
        )
        if token := sanitize_cookie_token(request.args.get("token")):
            response.set_cookie(token, "done", max_age=600)
--- a/superset/dashboards/api.py
+++ b/superset/dashboards/api.py
@@ -1478,7 +1478,6 @@ class DashboardRestApi(
            mimetype="application/zip",
            as_attachment=True,
            download_name=filename,
-            max_age=0,
        )
        if token := sanitize_cookie_token(request.args.get("token")):
            response.set_cookie(token, "done", max_age=600)
--- a/superset/datasets/api.py
+++ b/superset/datasets/api.py
@@ -747,7 +747,6 @@ class DatasetRestApi(SoftDeleteApiMixin, BaseSupersetModelRestApi):
            mimetype="application/zip",
            as_attachment=True,
            download_name=filename,
-            max_age=0,
        )
        if token := sanitize_cookie_token(request.args.get("token")):
            response.set_cookie(token, "done", max_age=600)
--- a/superset/importexport/api.py
+++ b/superset/importexport/api.py
@@ -89,7 +89,6 @@ class ImportExportRestApi(BaseSupersetApi):
            mimetype="application/zip",
            as_attachment=True,
            download_name=filename,
-            max_age=0,
        )
        return response

--- a/superset/queries/saved_queries/api.py
+++ b/superset/queries/saved_queries/api.py
@@ -312,7 +312,6 @@ class SavedQueryRestApi(BaseSupersetModelRestApi):
            mimetype="application/zip",
            as_attachment=True,
            download_name=filename,
-            max_age=0,
        )
        if token := sanitize_cookie_token(request.args.get("token")):
            response.set_cookie(token, "done", max_age=600)
--- a/superset/themes/api.py
+++ b/superset/themes/api.py
@@ -489,7 +489,6 @@ class ThemeRestApi(BaseSupersetModelRestApi):
            mimetype="application/zip",
            as_attachment=True,
            download_name=filename,
-            max_age=0,
        )
        if token := sanitize_cookie_token(request.args.get("token")):
            response.set_cookie(token, "done", max_age=600)
Author	SHA1	Message	Date
Evan	df793d88b7	fix(SafeMarkdown): guard attribute-key lookup against malformed override elements getAttributeDefinitionKey assumed any non-string definition was an indexable tuple, so a malformed element (e.g. null) in an operator- supplied htmlSchemaOverrides attribute array would throw on definition[0] instead of being ignored. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-21 11:13:29 -07:00
Evan	a3cccb5d52	fix(SafeMarkdown): guard against malformed attribute overrides, fix misleading test name Fall back to the default attribute definitions for a tag instead of throwing when htmlSchemaOverrides.attributes.<tag> isn't an array (operator-supplied runtime config isn't guaranteed to match the expected shape). Also fixes a test title that claimed the opposite of what it asserts. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-18 10:33:02 -07:00
Evan	78cc4c693c	fix(SafeMarkdown): let htmlSchemaOverrides replace matching default attribute rules hast-util-sanitize's findDefinition returns only the first attribute definition it finds for a given property name, so the previous merge customizer (which concatenated arrays) left the default schema's restrictive tuples (e.g. `li: [['className', 'task-list-item']]`) in charge even after an operator supplied `htmlSchemaOverrides`. Because a failed allowlist check returns `[]` rather than `undefined`, hast-util-sanitize's own `''` wildcard fallback never kicked in either, so classes on list elements were silently stripped down to empty strings regardless of HTML_SANITIZATION_SCHEMA_EXTENSIONS. getOverrideHtmlSchema now merges each tag's attribute definitions by property name: an override definition replaces the default definition for the same property instead of being appended alongside it, so operator-supplied overrides for li/ul/ol (or '') actually take effect. Fixes #34191	2026-07-18 08:07:00 -07:00
dependabot[bot]	023b60c8f0	chore(deps-dev): bump pandas-gbq from 0.19.1 to 0.35.0 (#42161 ) Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-07-18 07:23:17 -07:00
dependabot[bot]	2ada286ee9	chore(deps-dev): update pydynamodb requirement from >=0.4.2 to >=0.8.2 (#42162 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-18 07:23:13 -07:00
dependabot[bot]	42e5640f60	chore(deps-dev): update nzalchemy requirement from <11.2,>=11.0.2 to >=11.1.2,<11.2 (#42164 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-18 07:23:09 -07:00
dependabot[bot]	74703906df	chore(deps): bump dom-to-image-more from 3.10.0 to 3.10.2 in /superset-frontend (#42180 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-18 21:15:23 +07:00
dependabot[bot]	3c23394675	chore(deps-dev): bump eslint from 10.6.0 to 10.7.0 in /superset-websocket (#42159 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-18 16:12:08 +07:00
dependabot[bot]	b6ce28ff72	chore(deps): bump typing-extensions from 4.15.0 to 4.16.0 (#42165 ) Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-07-18 16:11:46 +07:00
dependabot[bot]	79eff6b6f1	chore(deps): bump greenlet from 3.5.1 to 3.5.3 (#42166 ) Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-07-18 16:08:28 +07:00
dependabot[bot]	a58012fc0f	chore(deps): bump the docusaurus-openapi group in /docs with 2 updates (#42195 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-18 16:05:39 +07:00
dependabot[bot]	dab5f30842	chore(deps): bump @docusaurus/faster from 3.10.1 to 3.10.2 in /docs (#42179 ) Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: hainenber <dotronghai96@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Đỗ Trọng Hải <41283691+hainenber@users.noreply.github.com> Co-authored-by: hainenber <dotronghai96@gmail.com>	2026-07-18 15:55:18 +07:00
dependabot[bot]	8299e7f87c	chore(deps-dev): bump storybook from 10.4.6 to 10.5.0 in /superset-frontend (#42185 ) Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: hainenber <dotronghai96@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: hainenber <dotronghai96@gmail.com>	2026-07-18 15:41:22 +07:00
dependabot[bot]	f6acf68dfa	chore(deps): bump react-intersection-observer from 10.0.3 to 10.1.0 in /superset-frontend (#42181 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-18 13:31:08 +07:00
dependabot[bot]	cce77b42f6	chore(deps-dev): bump @formatjs/intl-durationformat from 0.10.16 to 0.10.17 in /superset-frontend (#42184 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-18 13:11:17 +07:00