fix(OAuth2): Support creating OAuth2 connections via SQLAlchemy URI

chore(deps-dev): update clickhouse-connect requirement from <2.0,>=1.6.0 to >=1.7.1,<2.0 (#43419 )
Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-25 01:21:18 +00:00 · 2026-08-24 18:10:14 -03:00 · 2026-08-24 13:54:23 -07:00 · 2026-08-24 13:54:19 -07:00 · 2026-08-24 12:31:50 -07:00 · 2026-08-24 12:13:34 -07:00
282 changed files with 15397 additions and 1409 deletions
@@ -3,9 +3,7 @@ codecov:
        after_n_builds: 4
 ignore:
  - "superset/migrations/versions/*.py"
-  - "superset-frontend/packages/superset-ui-demo/**/*"
  - "**/*.stories.tsx"
-  - "**/*.stories.jsx"
 coverage:
  status:
    project:
@@ -105,6 +105,7 @@ jobs:
          tool: customSmallerIsBetter
          output-file-path: bundle-size-summary.json
          external-data-json-path: bundle-size-history.json
+          github-token: ${{ secrets.GITHUB_TOKEN }}
          fail-on-alert: false
          summary-always: true

@@ -93,7 +93,7 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0

      - name: Copy image to GHCR
        env:
@@ -75,13 +75,18 @@ jobs:
          SUPERSET_SECRET_KEY: not-a-secret
        run: |
          pytest --durations-min=0.5 --cov-report= --cov=superset ./tests/common ./tests/unit_tests --cache-clear --maxfail=50 --junit-xml=test-results/junit-unit.xml
+      # COVERAGE_FILE keeps these scoped gates off the default .coverage that
+      # the step above wrote. pytest-cov starts a fresh data file per run, so
+      # without it the last gate replaces the full-suite data and the report
+      # uploaded below contains only that gate's subtree -- every other file
+      # then reads as uncovered, and patch coverage on an unrelated PR is 0%.
      - name: Python 100% coverage unit tests
        env:
          SUPERSET_TESTENV: true
          SUPERSET_SECRET_KEY: not-a-secret
        run: |
-          pytest --durations-min=0.5 --cov=superset/sql/ ./tests/unit_tests/sql/ --cache-clear --cov-fail-under=100 --junit-xml=test-results/junit-sql-coverage.xml
-          pytest --durations-min=0.5 --cov=superset/semantic_layers/ ./tests/unit_tests/semantic_layers/ --cache-clear --cov-fail-under=100 --junit-xml=test-results/junit-semantic-layers-coverage.xml
+          COVERAGE_FILE="${RUNNER_TEMP}/.coverage.sql" pytest --durations-min=0.5 --cov=superset/sql/ ./tests/unit_tests/sql/ --cache-clear --cov-fail-under=100 --junit-xml=test-results/junit-sql-coverage.xml
+          COVERAGE_FILE="${RUNNER_TEMP}/.coverage.semantic_layers" pytest --durations-min=0.5 --cov=superset/semantic_layers/ ./tests/unit_tests/semantic_layers/ --cache-clear --cov-fail-under=100 --junit-xml=test-results/junit-semantic-layers-coverage.xml
      - name: Upload code coverage
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
@@ -58,6 +58,7 @@ the old counter to use the outcome-specific replacements.

 - [42930](https://github.com/apache/superset/pull/42930): Dataset import data-URI fetches no longer honor an HTTP(S) proxy when `DATASET_IMPORT_ALLOW_INTERNAL_DATA_URLS` is `False` (the default): the connection is now made directly to the destination so the peer-address check validates the real target instead of a proxy's. Deployments that require an egress proxy to reach legitimate external data URLs for dataset import should set `DATASET_IMPORT_ALLOW_INTERNAL_DATA_URLS = True` or otherwise ensure those URLs resolve without one.
 - [42935](https://github.com/apache/superset/pull/42935): The MCP service now refuses to start (`MCPAuthConfigError`) when `MCP_JWT_ISSUER` trusts more than one issuer and no `MCP_USER_RESOLVER` is configured, instead of only logging a warning. This was already a documented misconfiguration (the default resolver isn't issuer-scoped, so distinct trusted issuers minting the same username/email would resolve to the same Superset user); deployments trusting multiple issuers must configure an `MCP_USER_RESOLVER` that derives its identity from the token's `iss` claim before upgrading. Single-issuer deployments are unaffected.
+- [43388](https://github.com/apache/superset/pull/43388): The MCP service now refuses to start (`MCPAuthConfigError`) if `MCP_DEV_USERNAME` and `MCP_AUTH_ENABLED = True` are both set, and separately if `MCP_AUTH_ENABLED = True` but no usable JWT key material is configured (RSA key/JWKS, or an explicit `MCP_JWT_SECRET` for HMAC) — both previously started with authentication silently weaker than configured. Deployments combining a dev-mode username with JWT auth enabled, or enabling JWT auth without key material, must pick one before upgrading: unset `MCP_DEV_USERNAME` for a real auth deployment, or unset `MCP_AUTH_ENABLED` (or configure the key material) for a dev-mode one. Response caching (`MCP_CACHE_CONFIG["enabled"] = True`) now also excludes every tool with a side effect by default, not only a partial list, so a previously-cached mutating tool call is no longer served from cache; no config change is needed to pick this up.
 - [42393](https://github.com/apache/superset/pull/42393): Exported dataset YAML now carries a `uuid` for each metric and column so that custom folder assignments (which reference metrics/columns by UUID) survive an import into another workspace. This affects any export bundle that contains datasets, not just a dataset export: chart, dashboard, database and full-asset exports all embed the same dataset YAML, so a dashboard exported from this release also fails to import into an older one even though no dataset was exported directly. As with `folders` and `currency_code_column`, the affected `datasets/` files fail schema validation (`Unknown field: uuid`) when imported into Superset releases that predate this change; regenerate or hand-edit exports for older targets in mixed-version fleets.
 - [42300](https://github.com/apache/superset/pull/42300): Timeseries charts (line/area/bar) with a Y-axis bound in effect — either an explicit `yAxisBounds` or one derived from `truncateYAxis` — now clamp out-of-range data points to that bound instead of letting ECharts drop the point (and the line segments around it) entirely. Any existing chart with a configured Y-axis bound and data outside it will look different after upgrading: a gap becomes a point pinned to the boundary. The clamp also rewrites the value ECharts reads for that point's tooltip and data label, so the displayed value is the bound rather than the true observation.
 - [42087](https://github.com/apache/superset/pull/42087): Stored calculated-column and metric expressions are validated when a query is built, under the same sub-query policy already applied to adhoc expressions. Previously only the dataset update path checked them on save, so expressions written by v1 import, by dataset duplication, or before that check existed were never validated. Since `ALLOW_ADHOC_SUBQUERY` defaults to `False` (see [19242](https://github.com/apache/superset/pull/19242)), a dataset whose stored expression contains a sub-query works before upgrading and afterwards fails at chart render with `Custom SQL fields cannot contain sub-queries.` There is no migration step, and the error does not name the offending dataset column, so audit stored expressions before upgrading: either rewrite them without the sub-query, or set `ALLOW_ADHOC_SUBQUERY = True` to keep the previous behaviour for both stored and adhoc expressions.
@@ -782,13 +782,18 @@ Enable response caching for read-heavy workloads (dashboards/datasets that don't
 ```python
 MCP_CACHE_CONFIG = {
    "enabled": True,
+    # Cache keys don't include the requesting principal and hits are served
+    # ahead of auth/RBAC, so a shared cache can return one caller's response
+    # to another. Required for caching to actually start -- only appropriate
+    # when every request is guaranteed to come from the same principal.
+    "dangerously_share_cache_across_principals": True,
    "CACHE_KEY_PREFIX": "mcp_cache_",
    "call_tool_ttl": 3600,
 }
 MCP_STORE_CONFIG = {"enabled": True, "CACHE_REDIS_URL": "redis://redis:6379/0"}
 ```

-Mutating tools (`generate_chart`, `update_chart`, `execute_sql`, `generate_dashboard`) are always excluded from caching regardless of this setting.
+Every tool with a side effect (create/update/delete/execute) is always excluded from caching regardless of this setting -- see the `excluded_tools` default in `superset/mcp_service/mcp_config.py` for the current list.

 ---

@@ -11,6 +11,11 @@ When soft-delete is enabled, deleting a chart, dashboard, or dataset archives it
 instead of removing it permanently. The **Recently Archived** view lets owners
 and admins find archived objects and restore them.

+A chart used by an alert or report cannot be archived while that dependency
+exists. In the chart list view, the archive confirmation lists the alerts and
+reports that use the chart; a blocked attempt names them and asks you to
+detach or delete them first.
+
 :::note

 This view is gated by the `SOFT_DELETE` feature flag. When the flag is off the
@@ -60,13 +60,13 @@
    "@saucelabs/theme-github-codeblock": "^0.3.0",
    "@storybook/addon-docs": "^10.5.8",
    "@superset-ui/core": "^0.20.4",
-    "@swc/core": "^1.15.47",
+    "@swc/core": "^1.16.0",
    "antd": "^6.6.0",
-    "baseline-browser-mapping": "^2.11.13",
+    "baseline-browser-mapping": "^2.11.15",
    "caniuse-lite": "^1.0.30001809",
    "docusaurus-plugin-openapi-docs": "^5.2.0",
    "docusaurus-theme-openapi-docs": "^5.2.0",
-    "js-yaml": "^5.2.3",
+    "js-yaml": "^5.3.0",
    "json-bigint": "^1.0.0",
    "prism-react-renderer": "^2.4.1",
    "react": "^18.3.1",
@@ -67,7 +67,7 @@ const communityLinks = [
      'Join our monthly virtual meetups and register for any upcoming events on Meetup',
  },
  {
-    url: 'https://github.com/apache/superset/blob/master/RESOURCES/INTHEWILD.md',
+    url: 'https://superset.apache.org/inTheWild/',
    title: 'Organizations',
    description:
      'A list of some of the organizations using Superset in production.',
@@ -4855,86 +4855,86 @@
  dependencies:
    apg-lite "^1.0.4"

-"@swc/core-darwin-arm64@1.15.47":
-  version "1.15.47"
-  resolved "https://registry.yarnpkg.com/@swc/core-darwin-arm64/-/core-darwin-arm64-1.15.47.tgz#345ce6a1bf4033da189c2e3eff1244190195d15b"
-  integrity sha512-GsoMtan3ojGGMGFbl31mmRu5ctZ56re8grGE8mO/OHJ8O+JRkzod02fe7X6ZQ8JvamA3imkEkx/h3u+vsOgPgA==
+"@swc/core-darwin-arm64@1.16.0":
+  version "1.16.0"
+  resolved "https://registry.yarnpkg.com/@swc/core-darwin-arm64/-/core-darwin-arm64-1.16.0.tgz#8c5a2af031c62ebcb6354aa6975bfb7eac895223"
+  integrity sha512-SJQPl+xG/zB8bNjC/gTg3WOmOvz7EzlQD+VShfCKFYPNr2qvb+vATUY11vYEjnMWCn6wV8H8eAtjQrVflYyX5A==

-"@swc/core-darwin-x64@1.15.47":
-  version "1.15.47"
-  resolved "https://registry.yarnpkg.com/@swc/core-darwin-x64/-/core-darwin-x64-1.15.47.tgz#f3debf50b5c1602bf392acb412bd33fd6d7e4f98"
-  integrity sha512-leTi7Rx3KF4zcC637iqWgk9SoV8VXAD8ppQYXsep63px5A/UftOcxLN1pmr8Z1si/YvX90ompP/rHgpYkgwXWg==
+"@swc/core-darwin-x64@1.16.0":
+  version "1.16.0"
+  resolved "https://registry.yarnpkg.com/@swc/core-darwin-x64/-/core-darwin-x64-1.16.0.tgz#0d2496c0429d7e8bc45b50348adf9d105bb56793"
+  integrity sha512-ql2JVch8V5t1i+HxiiuD4oVDI1dOku4/e3QiCkplONrm3SLitqNAP+nztHN51fSG2IgGuOwpAi3hgA+ukT5yQg==

-"@swc/core-linux-arm-gnueabihf@1.15.47":
-  version "1.15.47"
-  resolved "https://registry.yarnpkg.com/@swc/core-linux-arm-gnueabihf/-/core-linux-arm-gnueabihf-1.15.47.tgz#14a247a12c6d3de1ee63fa4fdbf5a4302936b5d6"
-  integrity sha512-hBqHuoWKKIsKmDBn9qVeWqj5GWZhtlcczVaqQmNRXsDfq+voR5CxKRfamA367QjJXtceYuliLFfEL8QsskRM2g==
+"@swc/core-linux-arm-gnueabihf@1.16.0":
+  version "1.16.0"
+  resolved "https://registry.yarnpkg.com/@swc/core-linux-arm-gnueabihf/-/core-linux-arm-gnueabihf-1.16.0.tgz#5f02a85842a04cd21f2ab9e8e67dc4b16f7024a4"
+  integrity sha512-PcdDBaRbe39y37h1rXVkhNy7mEU7f8b34KD761C68R23EsfMsj5oDPVddRzGdSRAvwwSfH0WSNEHgYmc/AJipg==

-"@swc/core-linux-arm64-gnu@1.15.47":
-  version "1.15.47"
-  resolved "https://registry.yarnpkg.com/@swc/core-linux-arm64-gnu/-/core-linux-arm64-gnu-1.15.47.tgz#3b8d09c481ae51c7b72d98fb6ce98f7b90065a1a"
-  integrity sha512-TBxvRz+B4K205TWHHZxWVxkC2RFNP/Mz3PNcECBos5PsKwxjg3QSJzdoebr0VCf0Bfh8HOPldKxAP/8XkFe9gA==
+"@swc/core-linux-arm64-gnu@1.16.0":
+  version "1.16.0"
+  resolved "https://registry.yarnpkg.com/@swc/core-linux-arm64-gnu/-/core-linux-arm64-gnu-1.16.0.tgz#6264498c88c51649511c6b4af532d330d3cf0631"
+  integrity sha512-t21IUztHQ/COucy7Kk9eIlehmq08H/hYq7aRA6fZox3S5ddi6TxWPK6e5S/+aTCf6+Od9qQ+LIpjHMiTy737vA==

-"@swc/core-linux-arm64-musl@1.15.47":
-  version "1.15.47"
-  resolved "https://registry.yarnpkg.com/@swc/core-linux-arm64-musl/-/core-linux-arm64-musl-1.15.47.tgz#7ff2baa16e67b29017fdf7c6b69e40de7920ce1a"
-  integrity sha512-3Yu3Uq/VgytqsPjTMbkPU1ExADytbdWbruJYhA584E9jrpE2Ki+R6VVPoZCeAVk1Cb7QxcRTgblw6bSa6a/R+w==
+"@swc/core-linux-arm64-musl@1.16.0":
+  version "1.16.0"
+  resolved "https://registry.yarnpkg.com/@swc/core-linux-arm64-musl/-/core-linux-arm64-musl-1.16.0.tgz#7a451eba69aa9a80799b9b8b9af46bf6f49803bd"
+  integrity sha512-d9+iajbMB87b0umgbP+Gy3yBDSDgty4Q6H5pZ8fgTb/dOoKIwwynP4L4kvWCOFg2i49kxmAAUs1uJZh9s0E+RQ==

-"@swc/core-linux-ppc64-gnu@1.15.47":
-  version "1.15.47"
-  resolved "https://registry.yarnpkg.com/@swc/core-linux-ppc64-gnu/-/core-linux-ppc64-gnu-1.15.47.tgz#a3841982fe2eb2d889648c8e212b6d821db316d6"
-  integrity sha512-wfdMi5IaOaNtmh2/6geRoxIdNfqylUZFdtzTKS655y1axWfIWyx7As74vv0wVdjeCIZ3WmCI9odDd4rUttXOSQ==
+"@swc/core-linux-ppc64-gnu@1.16.0":
+  version "1.16.0"
+  resolved "https://registry.yarnpkg.com/@swc/core-linux-ppc64-gnu/-/core-linux-ppc64-gnu-1.16.0.tgz#99a7ba46a56190a52c646506e940dffe554c5d10"
+  integrity sha512-QRpeKGOg+B0qmo3BFU+6rL/gpoKYYJ7OFSMf5DNMafohYZ/iq2qvAH9Gcrf8NxROj3iooKOVewJ+YgahH1nSLw==

-"@swc/core-linux-s390x-gnu@1.15.47":
-  version "1.15.47"
-  resolved "https://registry.yarnpkg.com/@swc/core-linux-s390x-gnu/-/core-linux-s390x-gnu-1.15.47.tgz#edbfd705d6285f7dce48915871478bc9603904c3"
-  integrity sha512-3hHYBY0yx8Ez7GMRrkhXHQzMdR5IZA6Wq5Ee4svlgwvSECLpnAJ9+0AimEGUFDvuLwE7nV/2+PYe8+Nm4rvNcQ==
+"@swc/core-linux-s390x-gnu@1.16.0":
+  version "1.16.0"
+  resolved "https://registry.yarnpkg.com/@swc/core-linux-s390x-gnu/-/core-linux-s390x-gnu-1.16.0.tgz#61473e056d1dd0d4690352a875c14f41bdd9f60a"
+  integrity sha512-q+Vr/hmHCcRXT/WFzOJC+T6GGEEtq2iaTtmyLfxO7yzu4ckgcqSNkg9m181wfNhuMwfNBoBhOfwQCnLsGZ5F4g==

-"@swc/core-linux-x64-gnu@1.15.47":
-  version "1.15.47"
-  resolved "https://registry.yarnpkg.com/@swc/core-linux-x64-gnu/-/core-linux-x64-gnu-1.15.47.tgz#e7f61a7771d6a9b5b274521ba61809b3d7644325"
-  integrity sha512-TjfhjgP/jGCfFHYC3JQPhJA1HwErbIJ9JfREDc1KNkvY6P0LodCgKVIlQ5deeTbkG7ih3bF5PHJLuLpaZjdRyQ==
+"@swc/core-linux-x64-gnu@1.16.0":
+  version "1.16.0"
+  resolved "https://registry.yarnpkg.com/@swc/core-linux-x64-gnu/-/core-linux-x64-gnu-1.16.0.tgz#008fc149a9135bca92b1e1f63037e2612c4d0fb5"
+  integrity sha512-DWVBc3QnpsSgKoq8N4rmZeZa5r/XrHdLkITsExN/tvTdqPtAPDPt+Ysy33OfgBlyN8lNe4xwsXWe6DXlRkJeRQ==

-"@swc/core-linux-x64-musl@1.15.47":
-  version "1.15.47"
-  resolved "https://registry.yarnpkg.com/@swc/core-linux-x64-musl/-/core-linux-x64-musl-1.15.47.tgz#7c1ef8305444bcc7894de177fe225f2d8f3be609"
-  integrity sha512-CQpS8Ge/avfjZd0UEwG/sds83Uu32deQXcV1Jo3jD0mmvQQqtYAjpsDZXugmheeAwmt+YIuoVtVHro8LMYHqsQ==
+"@swc/core-linux-x64-musl@1.16.0":
+  version "1.16.0"
+  resolved "https://registry.yarnpkg.com/@swc/core-linux-x64-musl/-/core-linux-x64-musl-1.16.0.tgz#4300ea0c63864dc3989ca0e956b4a5e4c666196c"
+  integrity sha512-6XCgDSc1HPf/5dpjvABhKHICiBcsuZyW3hQMkn8sxel0TqprkJGp+H4iaBYIUTPixhrBub2hBPtfjcZLE6yL3w==

-"@swc/core-win32-arm64-msvc@1.15.47":
-  version "1.15.47"
-  resolved "https://registry.yarnpkg.com/@swc/core-win32-arm64-msvc/-/core-win32-arm64-msvc-1.15.47.tgz#953856d26b28956d1a18ef10e5f221202b2cb8f1"
-  integrity sha512-0W8IKHsUTYiT7G2RqtOoVWk+89yzZikIiDUb/sCK6BmQDBhN91hQSfyUtW12jhEWLzYgcfmisfsZrmZE+84U1A==
+"@swc/core-win32-arm64-msvc@1.16.0":
+  version "1.16.0"
+  resolved "https://registry.yarnpkg.com/@swc/core-win32-arm64-msvc/-/core-win32-arm64-msvc-1.16.0.tgz#1d4146b7c1aada2992692cdc72bb0b43a885136e"
+  integrity sha512-T/+9VVCZJ3AKEth9IP3U9AJ2YscQq+7LUqRTvfR4a2q36+Ri22oOwUizpAKOqQ42vb2Y/kOa4TOcJOfHoDIT/w==

-"@swc/core-win32-ia32-msvc@1.15.47":
-  version "1.15.47"
-  resolved "https://registry.yarnpkg.com/@swc/core-win32-ia32-msvc/-/core-win32-ia32-msvc-1.15.47.tgz#2743a5bccc49f252c23bad3135193640cbdcef3a"
-  integrity sha512-ZIp49d2Z4/ka2jO9otOg4hDvTdPmp86kVOgS2M5FCPI7eKKZ1W0boxWn+8XeZrfERtFGW0AlMRm4JhlJa7l3NA==
+"@swc/core-win32-ia32-msvc@1.16.0":
+  version "1.16.0"
+  resolved "https://registry.yarnpkg.com/@swc/core-win32-ia32-msvc/-/core-win32-ia32-msvc-1.16.0.tgz#c5c2a60905ffa9e4647214bef75778f0c73ba0d4"
+  integrity sha512-Pr1lsR/PMs8ndL0UWMrW8nLZ7H7sspIxBRDdjL8f+YJ/FJNASgzfunbVVXAqj0csgIJYHPZy+OW9smjFmk1Rcg==

-"@swc/core-win32-x64-msvc@1.15.47":
-  version "1.15.47"
-  resolved "https://registry.yarnpkg.com/@swc/core-win32-x64-msvc/-/core-win32-x64-msvc-1.15.47.tgz#9674ad0c9187b7cbe5cc3080b31b960d3ee688b9"
-  integrity sha512-2h8Iek95vnixkBRCo+H8p09+Q5ll2NgSMFrWTy0iKt7+/t+8/T5mBpiT6c0ZxSS7wcWjwZ9sGZkK70tTSYHdDw==
+"@swc/core-win32-x64-msvc@1.16.0":
+  version "1.16.0"
+  resolved "https://registry.yarnpkg.com/@swc/core-win32-x64-msvc/-/core-win32-x64-msvc-1.16.0.tgz#67dd85a90437e6fa9951cce7842f6cac3ec3f60d"
+  integrity sha512-ktdeYLgOQdaonvsj5tJijqgpb0wk7gfF80wCFVA0kucI1hhSUIyfcGbjo5+9sdqv38OhMnTdLoA6xbqgOgPQjw==

-"@swc/core@^1.15.40", "@swc/core@^1.15.47":
-  version "1.15.47"
-  resolved "https://registry.yarnpkg.com/@swc/core/-/core-1.15.47.tgz#6226e842160e247eb79a9aeac1095ebddb56639f"
-  integrity sha512-FbsO5JcfOjfH38W/rohBRBweJeERsAuIP4f377lmkmxTcq9exjtx4SkRuZY5CdfhR2CBVwDIJegBpJDffwNsOg==
+"@swc/core@^1.15.40", "@swc/core@^1.16.0":
+  version "1.16.0"
+  resolved "https://registry.yarnpkg.com/@swc/core/-/core-1.16.0.tgz#79cd13789725d3e3ad0df605dc88d9e255d7ebfd"
+  integrity sha512-zSdvEHxBg00WhUNtW/u58hhcdR33gjtMQvOBo8F7POWJDyjRCt/miKfhidT3hCc/118RUwNnlEAmxiihFMbK4Q==
  dependencies:
    "@swc/counter" "^0.1.3"
-    "@swc/types" "^0.1.27"
+    "@swc/types" "^0.1.28"
  optionalDependencies:
-    "@swc/core-darwin-arm64" "1.15.47"
-    "@swc/core-darwin-x64" "1.15.47"
-    "@swc/core-linux-arm-gnueabihf" "1.15.47"
-    "@swc/core-linux-arm64-gnu" "1.15.47"
-    "@swc/core-linux-arm64-musl" "1.15.47"
-    "@swc/core-linux-ppc64-gnu" "1.15.47"
-    "@swc/core-linux-s390x-gnu" "1.15.47"
-    "@swc/core-linux-x64-gnu" "1.15.47"
-    "@swc/core-linux-x64-musl" "1.15.47"
-    "@swc/core-win32-arm64-msvc" "1.15.47"
-    "@swc/core-win32-ia32-msvc" "1.15.47"
-    "@swc/core-win32-x64-msvc" "1.15.47"
+    "@swc/core-darwin-arm64" "1.16.0"
+    "@swc/core-darwin-x64" "1.16.0"
+    "@swc/core-linux-arm-gnueabihf" "1.16.0"
+    "@swc/core-linux-arm64-gnu" "1.16.0"
+    "@swc/core-linux-arm64-musl" "1.16.0"
+    "@swc/core-linux-ppc64-gnu" "1.16.0"
+    "@swc/core-linux-s390x-gnu" "1.16.0"
+    "@swc/core-linux-x64-gnu" "1.16.0"
+    "@swc/core-linux-x64-musl" "1.16.0"
+    "@swc/core-win32-arm64-msvc" "1.16.0"
+    "@swc/core-win32-ia32-msvc" "1.16.0"
+    "@swc/core-win32-x64-msvc" "1.16.0"

 "@swc/counter@^0.1.3":
  version "0.1.3"
@@ -5021,10 +5021,10 @@
    "@swc/html-win32-ia32-msvc" "1.15.43"
    "@swc/html-win32-x64-msvc" "1.15.43"

-"@swc/types@^0.1.27":
-  version "0.1.27"
-  resolved "https://registry.yarnpkg.com/@swc/types/-/types-0.1.27.tgz#12080b0c426dea450634f202d9a3c82ac396e793"
-  integrity sha512-K6h3iUlqeM946U4sXFYeahefR1YBbXJvko+hv8WS8/0BNJ4OHiHRywMnQUJCqkR7Y9+hqQ1TvEpiKqUhz7NEFg==
+"@swc/types@^0.1.28":
+  version "0.1.28"
+  resolved "https://registry.yarnpkg.com/@swc/types/-/types-0.1.28.tgz#e3cd892383fba3b8904c40518bbe1265a50753f2"
+  integrity sha512-V6Mnml8v09QALx6K0elJ7o9K/MkVDtW3t6L+7Ou/JcWtb3xwId2AH4FeOceySd2JaO87IMw4+6vSZxLm34LPbw==
  dependencies:
    "@swc/counter" "^0.1.3"

@@ -6522,10 +6522,10 @@ base64-js@^1.3.1, base64-js@^1.5.1:
  resolved "https://registry.yarnpkg.com/base64-js/-/base64-js-1.5.1.tgz#1b1b440160a5bf7ad40b650f095963481903930a"
  integrity sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==

-baseline-browser-mapping@^2.10.38, baseline-browser-mapping@^2.11.13, baseline-browser-mapping@^2.9.19:
-  version "2.11.13"
-  resolved "https://registry.yarnpkg.com/baseline-browser-mapping/-/baseline-browser-mapping-2.11.13.tgz#660073103c1bee93e54df55f117b7528adf6af19"
-  integrity sha512-k9HNuUVMlqVjQ9UHzfPjIqiDbWw7WqT1AoT7GL8VwvF3r0ZfArtgiSPAlmupyNquNgOJHTuH4CKYf8ttMTWBTQ==
+baseline-browser-mapping@^2.10.38, baseline-browser-mapping@^2.11.15, baseline-browser-mapping@^2.9.19:
+  version "2.11.15"
+  resolved "https://registry.yarnpkg.com/baseline-browser-mapping/-/baseline-browser-mapping-2.11.15.tgz#9c0cac93d7d304f3d61bb41088a102cd62e68676"
+  integrity sha512-FwMjJJ7HnyZpWe+oWxegG0fezZyBZUagI5LZEoO3GCbtbKNwRfMH9Ue5d5v01PNePBy1QSfPSDTTeVL0Hb9EzA==

 batch@0.6.1:
  version "0.6.1"
@@ -10291,10 +10291,10 @@ js-yaml@4.1.0, js-yaml@=4.3.1, js-yaml@^4.1.0, js-yaml@^4.1.1, js-yaml@^4.2.0, j
  dependencies:
    argparse "^2.0.1"

-js-yaml@^5.2.3:
-  version "5.2.3"
-  resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-5.2.3.tgz#0942ae8f507e22eb0e54624871789cd477106e54"
-  integrity sha512-n+mUVyUX5bVv7G/G2zyIHOhdxfuU1dY2NOFzTQUWiMUbFss8b57NFlgCCaggU78wSw5KVS9cllzeLyzyR+n5nw==
+js-yaml@^5.3.0:
+  version "5.3.0"
+  resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-5.3.0.tgz#526430a6da31065127528ae695ce168cfc5f91f0"
+  integrity sha512-muutsYr+e2+d3rTgUGslq5rxbBlUy3cJ61IsHag2QNDQV+7zXWjkUpmALIajhrlLlrgRUiymj6U3zUr/TMK84Q==
  dependencies:
    argparse "^2.0.1"

@@ -80,7 +80,7 @@ dependencies = [
    # marshmallow 4 compatibility: see superset/marshmallow_compatibility.py for a
    # Flask-AppBuilder workaround. Tracking issue:
    # https://github.com/apache/superset/issues/33162
-    "marshmallow>=3.0, <5",
+    "marshmallow>=4.3.1, <5",
    "marshmallow-union>=0.1.15.post1",
    "msgpack>=1.2.0, <1.3",
    "nh3>=0.3.5, <0.4",
@@ -101,7 +101,7 @@ dependencies = [
    "python-dateutil",
    "python-dotenv", # optional dependencies for Flask but required for Superset, see https://flask.palletsprojects.com/en/stable/installation/#optional-dependencies
    "pygeohash",
-    "pyarrow>=24.0.0, <26", # before upgrading pyarrow, check that all db dependencies support this, see e.g. https://github.com/apache/superset/pull/34693
+    "pyarrow>=25.0.1, <26", # before upgrading pyarrow, check that all db dependencies support this, see e.g. https://github.com/apache/superset/pull/34693
    "pyyaml>=6.0.3, <7.0.0",
    "PyJWT>=2.4.0, <3.0",
    "redis>=5.0.0, <9.0",
@@ -111,10 +111,10 @@ dependencies = [
    "sshtunnel>=0.4.0, <0.5",
    "simplejson>=4.1.1",
    "slack_sdk>=3.43.0, <4",
-    "sqlalchemy>=2.0.0, <2.1",
+    "sqlalchemy>=2.0.52, <2.1",
    "sqlalchemy-continuum>=1.6.0, <2.0.0",
    "sqlalchemy-utils>=0.42.1, <0.43", # expanding lowerbound to work with pydoris
-    "sqlglot>=30.16.0, <31", # 30.16.0 adds Trino inline UDF IF/CASE routine statement parsing
+    "sqlglot>=30.17.0, <31", # 30.16.0 adds Trino inline UDF IF/CASE routine statement parsing
    # newer pandas needs 0.9+
    "tabulate>=0.10.0, <1.0",
    "typing-extensions>=4.16.0, <5",
@@ -141,7 +141,7 @@ bigquery = [
    "sqlalchemy-bigquery>=1.17.2",
    "google-cloud-bigquery>=3.42.3",
 ]
-clickhouse = ["clickhouse-connect>=1.6.0, <2.0"]
+clickhouse = ["clickhouse-connect>=1.7.1, <2.0"]
 cockroachdb = ["cockroachdb>=0.3.5, <0.4"]
 crate = ["sqlalchemy-cratedb>=0.43.1, <1"]
 # sqlalchemy-d1's only release (0.1.0, Nov 2025) pins sqlalchemy<2,>=1.4,
@@ -197,7 +197,7 @@ fastmcp = [
 # landed (discussion #40273).
 firebird = ["sqlalchemy-firebird>=2.2.0"]
 firebolt = ["firebolt-sqlalchemy>=1.1.2, <2"]
-gevent = ["gevent>=26.7.0"]
+gevent = ["gevent>=26.8.0"]
 gsheets = ["shillelagh[gsheetsapi]>=1.4.5, <2"]
 hana = ["hdbcli==2.29.25", "sqlalchemy_hana==3.0.3"]
 hive = [
@@ -232,7 +232,7 @@ playwright = ["playwright>=1.62.0, <2"]
 postgres = ["psycopg2-binary==2.9.12"]
 presto = ["pyhive[presto]>=0.6.5"]
 trino = ["trino>=0.338.0"]
-prophet = ["prophet>=1.3.0, <2"]
+prophet = ["prophet>=1.4.0, <2"]
 # sqlalchemy-redshift cuts hard from SQLAlchemy 1.4-only (0.8.x) to 2.0-only
 # (>=1.0.0) with no dual-compat release. Bumped now that Superset's own
 # SQLAlchemy 2.0 core bump has landed (discussion #40273).
@@ -255,7 +255,7 @@ tdengine = [
    "taospy>=2.8.10",
    "taos-ws-py>=0.7.0"
 ]
-teradata = ["teradatasql>=20.0.0.64"]
+teradata = ["teradatasql>=20.0.0.65"]
 thumbnails = [] # deprecated, will be removed in 7.0
 vertica = ["sqlalchemy-vertica-python>= 0.6.3, < 0.7"]
 netezza = ["nzalchemy>= 11.1.2, < 11.2"]
@@ -30,7 +30,7 @@ cryptography>=50.0.0,<51.0.0
 # Security: Snyk - XSS vulnerability in Mako templates
 mako>=1.4.1,<2.0.0
 # Security: CVE-2024-52338 (CRITICAL) - Deserialization of untrusted data in IPC/Parquet readers
-pyarrow>=24.0.0,<26.0.0
+pyarrow>=25.0.1,<26.0.0
 # Security: CVE-2026-27459 - pyopenssl certificate validation
 pyopenssl>=26.0.0,<27.0.0
 # Security: CVE-2026-25645 (MEDIUM) - Insecure Temporary File
@@ -222,7 +222,7 @@ markupsafe==3.0.2
    #   mako
    #   werkzeug
    #   wtforms
-marshmallow==4.3.0
+marshmallow==4.3.1
    # via
    #   apache-superset (pyproject.toml)
    #   flask-appbuilder
@@ -287,7 +287,7 @@ prison==0.2.1
    # via flask-appbuilder
 prompt-toolkit==3.0.51
    # via click-repl
-pyarrow==25.0.0
+pyarrow==25.0.1
    # via
    #   -r requirements/base.in
    #   apache-superset (pyproject.toml)
@@ -381,7 +381,7 @@ six==1.17.0
    #   wtforms-json
 slack-sdk==3.43.0
    # via apache-superset (pyproject.toml)
-sqlalchemy==2.0.51
+sqlalchemy==2.0.52
    # via
    #   apache-superset (pyproject.toml)
    #   alembic
@@ -399,7 +399,7 @@ sqlalchemy-utils==0.42.1
    #   apache-superset (pyproject.toml)
    #   apache-superset-core
    #   flask-appbuilder
-sqlglot==30.16.0
+sqlglot==30.17.0
    # via
    #   apache-superset (pyproject.toml)
    #   apache-superset-core
@@ -337,7 +337,7 @@ geopy==2.4.1
    # via
    #   -c requirements/base-constraint.txt
    #   apache-superset
-gevent==26.7.0
+gevent==26.8.0
    # via apache-superset
 google-api-core==2.33.0
    # via
@@ -434,8 +434,6 @@ importlib-metadata==8.7.0
    # via
    #   keyring
    #   opentelemetry-api
-importlib-resources==6.5.2
-    # via prophet
 iniconfig==2.0.0
    # via pytest
 isodate==0.7.2
@@ -530,7 +528,7 @@ markupsafe==3.0.2
    #   mako
    #   werkzeug
    #   wtforms
-marshmallow==4.3.0
+marshmallow==4.3.1
    # via
    #   -c requirements/base-constraint.txt
    #   apache-superset
@@ -693,7 +691,7 @@ prompt-toolkit==3.0.51
    # via
    #   -c requirements/base-constraint.txt
    #   click-repl
-prophet==1.3.0
+prophet==1.4.0
    # via apache-superset
 proto-plus==1.25.0
    # via google-api-core
@@ -711,7 +709,7 @@ psycopg2-binary==2.9.12
    # via apache-superset
 py-key-value-aio==0.4.4
    # via fastmcp-slim
-pyarrow==25.0.0
+pyarrow==25.0.1
    # via
    #   -c requirements/base-constraint.txt
    #   apache-superset
@@ -950,7 +948,7 @@ slack-sdk==3.43.0
    #   apache-superset
 sniffio==1.3.1
    # via anyio
-sqlalchemy==2.0.51
+sqlalchemy==2.0.52
    # via
    #   -c requirements/base-constraint.txt
    #   alembic
@@ -976,7 +974,7 @@ sqlalchemy-utils==0.42.1
    #   apache-superset
    #   apache-superset-core
    #   flask-appbuilder
-sqlglot==30.16.0
+sqlglot==30.17.0
    # via
    #   -c requirements/base-constraint.txt
    #   apache-superset
@@ -42,6 +42,7 @@ RETRYABLE_STATUS_CODES: frozenset[int] = frozenset({429})
 PATTERNS = {
    "python": [
        r"^\.github/workflows/.*python",
+        r"^\.github/workflows/frontend-bundle-size-nightly\.yml$",
        r"^\.github/workflows/scheduled-docker-image-refresh\.yml$",
        r"^docker-compose-image-tag\.yml$",
        r"^tests/",
@@ -45,9 +45,9 @@
        "@luma.gl/shadertools": "~9.2.5",
        "@luma.gl/webgl": "~9.2.5",
        "@reduxjs/toolkit": "^1.9.3",
-        "@rjsf/core": "^6.7.1",
+        "@rjsf/core": "^6.8.0",
        "@rjsf/utils": "^6.6.2",
-        "@rjsf/validator-ajv8": "^6.7.1",
+        "@rjsf/validator-ajv8": "^6.8.0",
        "@scarf/scarf": "^1.4.0",
        "@superset-ui/chart-controls": "file:./packages/superset-ui-chart-controls",
        "@superset-ui/core": "file:./packages/superset-ui-core",
@@ -86,7 +86,7 @@
        "classnames": "^2.2.5",
        "content-disposition": "^2.0.1",
        "d3-scale": "^4.0.2",
-        "dayjs": "^1.11.21",
+        "dayjs": "^1.11.22",
        "dom-to-image-more": "^3.10.2",
        "dom-to-pdf": "^0.3.2",
        "echarts": "^6.1.0",
@@ -100,7 +100,7 @@
        "geostyler-style": "11.0.2",
        "geostyler-wfs-parser": "^3.0.1",
        "google-auth-library": "^11.0.2",
-        "immer": "^11.1.16",
+        "immer": "^11.1.17",
        "interweave": "^13.1.1",
        "jquery": "^4.0.0",
        "js-levenshtein": "^1.1.6",
@@ -220,7 +220,7 @@
        "babel-plugin-jsx-remove-data-test-id": "^3.0.0",
        "baseline-browser-mapping": "^2.11.14",
        "cheerio": "1.2.0",
-        "concurrently": "^10.0.4",
+        "concurrently": "^10.0.5",
        "copy-webpack-plugin": "^14.0.0",
        "cross-env": "^10.1.0",
        "css-loader": "^7.1.4",
@@ -10340,9 +10340,9 @@
      "license": "MIT"
    },
    "node_modules/@rjsf/core": {
-      "version": "6.7.1",
-      "resolved": "https://registry.npmjs.org/@rjsf/core/-/core-6.7.1.tgz",
-      "integrity": "sha512-/CQfIGUzcXceBNRhEH3wsTvxcT8dMrjPLXhYSfcJUTftKxOCdisqi2wFwt7LOyIvFvzHUxag0r0xXs/MXS9jmA==",
+      "version": "6.8.0",
+      "resolved": "https://registry.npmjs.org/@rjsf/core/-/core-6.8.0.tgz",
+      "integrity": "sha512-HZ2e/l/QNcz8PTslBXyGWkiycMe3LgIfwgXo0qO3DPgyFKj4G+obJTKBq/W+DaIUmz1HicvH5WtOdXWWqK+gbA==",
      "license": "Apache-2.0",
      "dependencies": {
        "lodash": "^4.18.1",
@@ -10354,19 +10354,19 @@
        "node": ">=20"
      },
      "peerDependencies": {
-        "@rjsf/utils": "^6.7.1",
+        "@rjsf/utils": "^6.8.0",
        "react": ">=18"
      }
    },
    "node_modules/@rjsf/utils": {
-      "version": "6.7.1",
-      "resolved": "https://registry.npmjs.org/@rjsf/utils/-/utils-6.7.1.tgz",
-      "integrity": "sha512-6goBapMwyHcXvjLkCnFs4S3P1oKUi1H083BdPk4pDZALFWn5ZdG50ECNfHSddBmL3O0pyx1/WFq1C/MuR7Y54A==",
+      "version": "6.8.0",
+      "resolved": "https://registry.npmjs.org/@rjsf/utils/-/utils-6.8.0.tgz",
+      "integrity": "sha512-gHcqPFSHdOz29tZiLlzDvD+Gfq21zVIFBufprSYTiHpUdcVNJEK6+V5aw++FtQncHdDWnTf2YCky/e1Bol2NEQ==",
      "license": "Apache-2.0",
      "dependencies": {
        "@x0k/json-schema-merge": "^1.0.3",
        "fast-equals": "^6.0.0",
-        "fast-uri": "^4.1.1",
+        "fast-uri": "^4.1.2",
        "jsonpointer": "^5.0.1",
        "lodash": "^4.18.1",
        "lodash-es": "^4.18.1",
@@ -10380,9 +10380,9 @@
      }
    },
    "node_modules/@rjsf/validator-ajv8": {
-      "version": "6.7.1",
-      "resolved": "https://registry.npmjs.org/@rjsf/validator-ajv8/-/validator-ajv8-6.7.1.tgz",
-      "integrity": "sha512-oG9reR8VgUUTxfsO8WybZWTjKs6SLUdhmUCp55SXmJvwVbeKZ+Mz4SI+y+T1Mdpbm1kLZWQPRyF2Md97soWXkw==",
+      "version": "6.8.0",
+      "resolved": "https://registry.npmjs.org/@rjsf/validator-ajv8/-/validator-ajv8-6.8.0.tgz",
+      "integrity": "sha512-F36I952/miMFZzWSlupwFHbl+j+5bVQ3tR6HtBS+vXV10kY5dT3OwTjbFRo4fQM1KpqrUZC0t3/E5CZRX1o1jA==",
      "license": "Apache-2.0",
      "dependencies": {
        "ajv": "^8.20.0",
@@ -10394,7 +10394,7 @@
        "node": ">=20"
      },
      "peerDependencies": {
-        "@rjsf/utils": "^6.7.1"
+        "@rjsf/utils": "^6.8.0"
      }
    },
    "node_modules/@rtsao/scc": {
@@ -17190,9 +17190,9 @@
      "license": "MIT"
    },
    "node_modules/concurrently": {
-      "version": "10.0.4",
-      "resolved": "https://registry.npmjs.org/concurrently/-/concurrently-10.0.4.tgz",
-      "integrity": "sha512-trZql+7l/0+WRAsAnEdctr4+iiOS6ZrViI6H8QWcCF9MFS/LT0dKpe8vluB1to6it+OxSI4VospFTIFMW8DJRw==",
+      "version": "10.0.5",
+      "resolved": "https://registry.npmjs.org/concurrently/-/concurrently-10.0.5.tgz",
+      "integrity": "sha512-JaP/CoftUrCcAFW/g//RbgEGwlelnEae6cfBLgH6ZdO6s8jPkn6p9SB9u6pdVxYXoiSnFqseOlHfrEfF82TVOg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -18541,9 +18541,9 @@
      }
    },
    "node_modules/dayjs": {
-      "version": "1.11.21",
-      "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.21.tgz",
-      "integrity": "sha512-98IT+HOahAisibz/yjKbzuOBwYcjJ7BCLPzARyHiyEBmRz4fatF+KPJszEHXsGYjUG234aH/cOjW1wwTbKUZlA==",
+      "version": "1.11.22",
+      "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.22.tgz",
+      "integrity": "sha512-1YRnxzt/AabP3GHxnaB9/b+ZScCKu5TeF+co+BWG+lnWVIwEcTFc1FVE0WLNmNO3sA6GGXL40i5qkHfbLzpwrg==",
      "license": "MIT"
    },
    "node_modules/debounce": {
@@ -23907,9 +23907,9 @@
      "license": "MIT"
    },
    "node_modules/immer": {
-      "version": "11.1.16",
-      "resolved": "https://registry.npmjs.org/immer/-/immer-11.1.16.tgz",
-      "integrity": "sha512-Xs7H9rBc+kti1J6RueUvbEBkmOz7jqj11XYgf+YMXAYzu8EeE7hwZ9poLXdVfVnGmJu7QAf41T7H2KuF6QoK6Q==",
+      "version": "11.1.17",
+      "resolved": "https://registry.npmjs.org/immer/-/immer-11.1.17.tgz",
+      "integrity": "sha512-8Vu44Y0MuMBlTQz/jQ8HEMYNq/bBqk87MnBwYR5mC8AthfhEXidZ5aT/oA/CUqboa8THKltnD9L3xyqhU/Sy1Q==",
      "license": "MIT",
      "funding": {
        "type": "opencollective",
@@ -34873,12 +34873,18 @@
      }
    },
    "node_modules/react-error-boundary": {
-      "version": "6.1.2",
-      "resolved": "https://registry.npmjs.org/react-error-boundary/-/react-error-boundary-6.1.2.tgz",
-      "integrity": "sha512-3DpCr5HVdZ0caUjYE/kIHBEJN0mNP3ZCgf16c48uJ5TbWjorKVp+YG8W3XqlJ7vJAVNw6wNIImyPXmFydwmyng==",
+      "version": "6.1.3",
+      "resolved": "https://registry.npmjs.org/react-error-boundary/-/react-error-boundary-6.1.3.tgz",
+      "integrity": "sha512-GnSKpCohFi2nQmJCWwP8O8wub7zexlePvpsejvQr35vS5RTouS1+utTNOmyc540yw5vyOXnSL1rBWsCQDmkyUA==",
      "license": "MIT",
      "peerDependencies": {
+        "@types/react": "^18.0.0 || ^19.0.0",
        "react": "^18.0.0 || ^19.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
      }
    },
    "node_modules/react-google-recaptcha": {
@@ -42962,7 +42968,7 @@
        "d3-scale": "^4.0.2",
        "d3-time": "^3.1.0",
        "d3-time-format": "^4.1.0",
-        "dayjs": "^1.11.21",
+        "dayjs": "^1.11.22",
        "dompurify": "^3.4.13",
        "fetch-retry": "^6.0.0",
        "handlebars": "^4.7.9",
@@ -42974,7 +42980,7 @@
        "re-resizable": "^6.11.2",
        "react-ace": "^14.0.1",
        "react-draggable": "^4.7.1",
-        "react-error-boundary": "^6.1.2",
+        "react-error-boundary": "^6.1.3",
        "react-js-cron": "^6.0.2",
        "react-markdown": "^10.1.0",
        "react-resize-detector": "^7.1.2",
@@ -43073,15 +43079,6 @@
        "node": ">=12"
      }
    },
-    "packages/superset-ui-core/node_modules/dompurify": {
-      "version": "3.4.13",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.13.tgz",
-      "integrity": "sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ==",
-      "license": "(MPL-2.0 OR Apache-2.0)",
-      "optionalDependencies": {
-        "@types/trusted-types": "^2.0.7"
-      }
-    },
    "packages/superset-ui-core/node_modules/react-ace": {
      "version": "14.0.1",
      "resolved": "https://registry.npmjs.org/react-ace/-/react-ace-14.0.1.tgz",
@@ -122,9 +122,9 @@
    "@luma.gl/shadertools": "~9.2.5",
    "@luma.gl/webgl": "~9.2.5",
    "@reduxjs/toolkit": "^1.9.3",
-    "@rjsf/core": "^6.7.1",
+    "@rjsf/core": "^6.8.0",
    "@rjsf/utils": "^6.6.2",
-    "@rjsf/validator-ajv8": "^6.7.1",
+    "@rjsf/validator-ajv8": "^6.8.0",
    "@scarf/scarf": "^1.4.0",
    "@superset-ui/chart-controls": "file:./packages/superset-ui-chart-controls",
    "@superset-ui/core": "file:./packages/superset-ui-core",
@@ -163,7 +163,7 @@
    "classnames": "^2.2.5",
    "content-disposition": "^2.0.1",
    "d3-scale": "^4.0.2",
-    "dayjs": "^1.11.21",
+    "dayjs": "^1.11.22",
    "dom-to-image-more": "^3.10.2",
    "dom-to-pdf": "^0.3.2",
    "echarts": "^6.1.0",
@@ -177,7 +177,7 @@
    "geostyler-style": "11.0.2",
    "geostyler-wfs-parser": "^3.0.1",
    "google-auth-library": "^11.0.2",
-    "immer": "^11.1.16",
+    "immer": "^11.1.17",
    "interweave": "^13.1.1",
    "jquery": "^4.0.0",
    "js-levenshtein": "^1.1.6",
@@ -297,7 +297,7 @@
    "babel-plugin-jsx-remove-data-test-id": "^3.0.0",
    "baseline-browser-mapping": "^2.11.14",
    "cheerio": "1.2.0",
-    "concurrently": "^10.0.4",
+    "concurrently": "^10.0.5",
    "copy-webpack-plugin": "^14.0.0",
    "cross-env": "^10.1.0",
    "css-loader": "^7.1.4",
@@ -51,6 +51,20 @@ export interface MetricOptionProps {
  shouldShowTooltip?: boolean;
 }

+/**
+ * `url` is an arbitrary caller-supplied string rendered as an href. Only
+ * http(s) and relative URLs become links; other schemes degrade to plain
+ * text.
+ */
+function isSafeHref(url: string): boolean {
+  try {
+    const { protocol } = new URL(url, window.location.origin);
+    return protocol === 'http:' || protocol === 'https:';
+  } catch {
+    return false;
+  }
+}
+
 export function MetricOption({
  metric,
  labelRef,
@@ -70,7 +84,7 @@ export function MetricOption({
      `}
      ref={labelRef}
    >
-      {url ? (
+      {url && isSafeHref(url) ? (
        <Typography.Link
          href={url}
          target={openInNewWindow ? '_blank' : ''}
@@ -122,6 +122,12 @@ export const timeComparisonControls: ({
            }
            return newState;
          },
+          // Re-run this control's validation whenever `time_compare` changes so
+          // the "date required" error clears once a non-custom shift is picked.
+          // Without it the stale error survives in Redux (see the
+          // dependantControls path in exploreReducer's SET_FIELD_VALUE handler)
+          // and blocks further chart updates until a page refresh.
+          validationDependencies: ['time_compare'],
        },
      },
    ],
@@ -112,3 +112,26 @@ test('shows a Tooltip for the verbose metric name', () => {
  const { getByTestId } = setup();
  expect(getByTestId('mock-tooltip')).toBeInTheDocument();
 });
+test('does not render javascript: URLs as links', () => {
+  // Regression test: the url prop can be creator-authored and must
+  // never become a script-bearing href for other viewers.
+  const { queryByRole, getByText } = setup({
+    url: 'javascript:alert(document.domain)', // eslint-disable-line no-script-url
+  });
+  expect(queryByRole('link')).not.toBeInTheDocument();
+  expect(getByText(defaultProps.metric.verbose_name)).toBeInTheDocument();
+});
+test('does not render data: URLs as links', () => {
+  const { queryByRole } = setup({
+    url: 'data:text/html,<script>alert(1)</script>',
+  });
+  expect(queryByRole('link')).not.toBeInTheDocument();
+});
+test('renders relative URLs as links', () => {
+  const { getByRole } = setup({
+    url: '/superset/dashboard/1/',
+  });
+  expect(
+    getByRole('link', { name: defaultProps.metric.verbose_name }),
+  ).toHaveAttribute('href', '/superset/dashboard/1/');
+});
@@ -67,7 +67,7 @@
    "d3-scale": "^4.0.2",
    "d3-time": "^3.1.0",
    "d3-time-format": "^4.1.0",
-    "dayjs": "^1.11.21",
+    "dayjs": "^1.11.22",
    "dompurify": "^3.4.13",
    "fetch-retry": "^6.0.0",
    "handlebars": "^4.7.9",
@@ -79,7 +79,7 @@
    "re-resizable": "^6.11.2",
    "react-ace": "^14.0.1",
    "react-draggable": "^4.7.1",
-    "react-error-boundary": "^6.1.2",
+    "react-error-boundary": "^6.1.3",
    "react-js-cron": "^6.0.2",
    "react-markdown": "^10.1.0",
    "react-resize-detector": "^7.1.2",
@@ -71,6 +71,9 @@ export type AntdExposedProps = Pick<
  | 'virtual'
  | 'getPopupContainer'
  | 'menuItemSelectedIcon'
+  // lets a caller with long option labels stop the popup inheriting the
+  // trigger's width, which otherwise truncates every option
+  | 'popupMatchSelectWidth'
 >;

 export type SelectOptionsType = Exclude<AntdProps['options'], undefined>;
@@ -49,5 +49,6 @@ export { default as finestTemporalGrainFormatter } from './formatters/finestTemp

 export { default as normalizeTimestamp } from './utils/normalizeTimestamp';
 export { default as denormalizeTimestamp } from './utils/denormalizeTimestamp';
+export { default as createTimeRangeFromGranularity } from './utils/createTimeRangeFromGranularity';

 export * from './types';
@@ -123,6 +123,25 @@ describe('isProbablyHTML', () => {
    expect(isProbablyHTML('<canvas></canvas>')).toBe(true);
    expect(isProbablyHTML('<iframe src="page.html"></iframe>')).toBe(true);
  });
+
+  test('should return true for script-capable and foreign-content tags', () => {
+    expect(isProbablyHTML('<svg onload="alert(1)"></svg>')).toBe(true);
+    expect(isProbablyHTML('<math><mi>x</mi></math>')).toBe(true);
+    expect(
+      isProbablyHTML('<details open ontoggle="alert(1)">x</details>'),
+    ).toBe(true);
+    expect(isProbablyHTML('<summary>x</summary>')).toBe(true);
+    expect(isProbablyHTML('<object data="x"></object>')).toBe(true);
+    expect(isProbablyHTML('<embed src="x">')).toBe(true);
+    expect(isProbablyHTML('<marquee>x</marquee>')).toBe(true);
+    expect(isProbablyHTML('<template>x</template>')).toBe(true);
+    expect(isProbablyHTML('<dialog open>x</dialog>')).toBe(true);
+  });
+
+  test('should return true for elements that parse into document.head', () => {
+    expect(isProbablyHTML('<style>body { display: none; }</style>')).toBe(true);
+    expect(isProbablyHTML('<title>injected</title>')).toBe(true);
+  });
 });

 describe('sanitizeHtmlIfNeeded', () => {
@@ -137,6 +156,24 @@ describe('sanitizeHtmlIfNeeded', () => {
    const sanitizedString = sanitizeHtmlIfNeeded(plainText);
    expect(sanitizedString).toEqual(plainText);
  });
+
+  test('should sanitize svg/details/style payloads instead of passing them through', () => {
+    const svgPayload = '<svg onload="alert(document.cookie)"></svg>';
+    const sanitizedSvg = sanitizeHtmlIfNeeded(svgPayload);
+    expect(sanitizedSvg).not.toContain('<svg');
+    expect(sanitizedSvg).not.toContain('onload');
+
+    // `details` (with its `open` attribute) is in js-xss's default
+    // whitelist, so the tag itself survives sanitization; the fix is that
+    // the payload is now routed through FilterXSS at all, which strips the
+    // non-whitelisted `ontoggle` handler instead of returning it verbatim.
+    const detailsPayload = '<details open ontoggle="alert(1)">x</details>';
+    const sanitizedDetails = sanitizeHtmlIfNeeded(detailsPayload);
+    expect(sanitizedDetails).toEqual('<details open>x</details>');
+
+    const stylePayload = '<style>body { display: none; }</style>';
+    expect(sanitizeHtmlIfNeeded(stylePayload)).not.toContain('<style');
+  });
 });

 describe('safeHtmlSpan', () => {
@@ -154,6 +154,20 @@ const KNOWN_HTML_TAGS = new Set([
  'html',
  'head',
  'body',
+  // Script-capable elements and foreign-content roots (SVG/MathML). These
+  // must be classified as HTML so that downstream sanitization is applied;
+  // omitting them makes the heuristic fail open — payloads such as
+  // `<svg onload=...>` or `<details open ontoggle=...>` would be classified
+  // "not HTML" and returned verbatim by sanitizeHtmlIfNeeded.
+  'svg',
+  'math',
+  'details',
+  'summary',
+  'object',
+  'embed',
+  'marquee',
+  'template',
+  'dialog',
 ]);

 const HTML_TAG_PATTERN = new RegExp(
@@ -183,10 +197,15 @@ export function isProbablyHTML(text: string) {
  const parser = new DOMParser();
  const doc = parser.parseFromString(cleanedStr, 'text/html');

-  // Check if parsing created actual HTML elements (not just text nodes)
-  const elements = Array.from(doc.body.childNodes).filter(
-    node => node.nodeType === 1,
-  ) as Element[];
+  // Check if parsing created actual HTML elements (not just text nodes).
+  // Some elements (e.g. <style>, <title>, <meta>, <link>) parse into
+  // document.head rather than document.body, so both must be inspected —
+  // otherwise a bare <style> payload is classified "not HTML" and skips
+  // sanitization.
+  const elements = [
+    ...Array.from(doc.head.childNodes),
+    ...Array.from(doc.body.childNodes),
+  ].filter(node => node.nodeType === 1) as Element[];

  // If no elements were created, it's not HTML
  if (elements.length === 0) {
@@ -96,16 +96,57 @@ export class Menu {
    itemText: string,
    options?: { timeout?: number },
  ): Promise<void> {
+    const popup = await this.openSubmenu(submenuText, {
+      timeout: options?.timeout,
+      itemText,
+    });
+
+    // Use dispatchEvent instead of click to bypass viewport and pointer interception
+    // issues. Ant Design renders submenu popups in a portal that can be positioned
+    // outside the viewport or behind chart content (e.g., large tables with z-index).
+    await popup.getByText(itemText, { exact: true }).dispatchEvent('click');
+  }
+
+  /**
+   * Opens a submenu and returns its popup locator, without selecting an item.
+   * Useful when the caller needs to read the popup's contents (e.g. the set of
+   * offered items) rather than clicking a known item.
+   *
+   * Uses hover as primary approach, falls back to keyboard then dispatchEvent -
+   * same fallback chain as {@link selectSubmenuItem}.
+   *
+   * @param submenuText - The text of the submenu to open (e.g., "Download")
+   * @param options - Optional timeout, an `itemText` to scope the popup lookup
+   *   to (useful when multiple submenu popups could otherwise match), and a
+   *   `popupSelector` override for submenus that render with an additional,
+   *   more specific class than the generic Ant Design popup class.
+   */
+  async openSubmenu(
+    submenuText: string,
+    options?: { timeout?: number; itemText?: string; popupSelector?: string },
+  ): Promise<Locator> {
    const timeout = options?.timeout ?? TIMEOUT.FORM_LOAD;
+    const matchPopup = (): Locator => {
+      const base = this.page.locator(
+        options?.popupSelector ?? Menu.SELECTORS.SUBMENU_POPUP,
+      );
+      return options?.itemText
+        ? base.filter({ hasText: options.itemText })
+        : base;
+    };

    // Try hover first (most natural user interaction)
-    let popup = await this.openSubmenuWithHover(submenuText, itemText, timeout);
+    let popup = await this.openSubmenuWithHover(
+      submenuText,
+      matchPopup,
+      timeout,
+    );

    // Fallback to keyboard navigation
    if (!popup) {
      popup = await this.openSubmenuWithKeyboard(
        submenuText,
-        itemText,
+        matchPopup,
        timeout,
      );
    }
@@ -114,7 +155,7 @@ export class Menu {
    if (!popup) {
      popup = await this.openSubmenuWithDispatchEvent(
        submenuText,
-        itemText,
+        matchPopup,
        timeout,
      );
    }
@@ -125,10 +166,7 @@ export class Menu {
      );
    }

-    // Use dispatchEvent instead of click to bypass viewport and pointer interception
-    // issues. Ant Design renders submenu popups in a portal that can be positioned
-    // outside the viewport or behind chart content (e.g., large tables with z-index).
-    await popup.getByText(itemText, { exact: true }).dispatchEvent('click');
+    return popup;
  }

  /**
@@ -137,17 +175,14 @@ export class Menu {
   */
  private async openSubmenuWithHover(
    submenuText: string,
-    itemText: string,
+    matchPopup: () => Locator,
    timeout: number,
  ): Promise<Locator | null> {
    try {
      const submenuTitle = this.getSubmenuTitle(submenuText);
      await submenuTitle.hover();

-      // Find the popup that contains the expected item (scopes to correct popup)
-      const popup = this.page
-        .locator(Menu.SELECTORS.SUBMENU_POPUP)
-        .filter({ hasText: itemText });
+      const popup = matchPopup();
      await popup.waitFor({ state: 'visible', timeout });

      // Allow Ant Design's slide-in animation to complete before clicking.
@@ -166,7 +201,7 @@ export class Menu {
   */
  private async openSubmenuWithKeyboard(
    submenuText: string,
-    itemText: string,
+    matchPopup: () => Locator,
    timeout: number,
  ): Promise<Locator | null> {
    try {
@@ -174,9 +209,7 @@ export class Menu {
      await submenuTitle.focus();
      await this.page.keyboard.press('ArrowRight');

-      const popup = this.page
-        .locator(Menu.SELECTORS.SUBMENU_POPUP)
-        .filter({ hasText: itemText });
+      const popup = matchPopup();
      await popup.waitFor({ state: 'visible', timeout });

      return popup;
@@ -191,7 +224,7 @@ export class Menu {
   */
  private async openSubmenuWithDispatchEvent(
    submenuText: string,
-    itemText: string,
+    matchPopup: () => Locator,
    timeout: number,
  ): Promise<Locator | null> {
    try {
@@ -214,9 +247,7 @@ export class Menu {
        );
      });

-      const popup = this.page
-        .locator(Menu.SELECTORS.SUBMENU_POPUP)
-        .filter({ hasText: itemText });
+      const popup = matchPopup();
      await popup.waitFor({ state: 'visible', timeout });

      return popup;
@@ -0,0 +1,133 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Locator, Page } from '@playwright/test';
+import { Modal } from '../core';
+
+/**
+ * The "Drill to detail" modal (`DrillDetailModal.tsx`), opened from a chart's
+ * "More Options" menu or its right-click context menu. Renders the chart's
+ * underlying sample rows, optionally scoped to a drilled-by value, via the
+ * `/datasource/samples` API.
+ */
+export class DrillDetailModal extends Modal {
+  private static readonly SELECTORS = {
+    CLOSE_BUTTON: '[data-test="close-drilltodetail-modal"]',
+    ROW_COUNT_LABEL: '[data-test="row-count-label"]',
+    METADATA_BAR: '[data-test="metadata-bar"]',
+    FILTER_COLUMN: '[data-test="filter-col"]',
+    FILTER_VALUE: '[data-test="filter-val"]',
+    PAGE_ITEM: '.ant-pagination-item',
+    ACTIVE_PAGE_ITEM: '.ant-pagination-item-active',
+    GRID_CELL: '.virtual-table-cell',
+  } as const;
+
+  private readonly specificLocator: Locator;
+
+  constructor(page: Page) {
+    super(page);
+    // Matched by accessible name rather than a data-test: the antd Modal's own
+    // data-test (`${name}-modal`) is derived from this same i18n'd `name`
+    // prop, so it isn't a locale-independent alternative. No data-test exists
+    // on the dialog root itself.
+    this.specificLocator = page.getByRole('dialog', {
+      name: /^Drill to detail:/,
+    });
+  }
+
+  override get element(): Locator {
+    return this.specificLocator;
+  }
+
+  /**
+   * The applied-filter value tags (`<col>=<val>`). Empty when the drill was
+   * whole-chart (no row/point-level filter applied).
+   */
+  get filterValues(): Locator {
+    return this.element.locator(DrillDetailModal.SELECTORS.FILTER_VALUE);
+  }
+
+  /** The applied-filter chip(s); each is closable via its own "Close" icon. */
+  get filterColumns(): Locator {
+    return this.element.locator(DrillDetailModal.SELECTORS.FILTER_COLUMN);
+  }
+
+  /** Row-count label above the results grid, e.g. "1-50 of 500 rows". */
+  get rowCountLabel(): Locator {
+    return this.element.locator(DrillDetailModal.SELECTORS.ROW_COUNT_LABEL);
+  }
+
+  /** The metadata bar (column/row summary) shown once samples have loaded. */
+  get metadataBar(): Locator {
+    return this.element.locator(DrillDetailModal.SELECTORS.METADATA_BAR);
+  }
+
+  /** Pagination page-number items below the results grid. */
+  get pageItems(): Locator {
+    return this.element.locator(DrillDetailModal.SELECTORS.PAGE_ITEM);
+  }
+
+  /** The currently active pagination page-number item. */
+  get activePageItem(): Locator {
+    return this.element.locator(DrillDetailModal.SELECTORS.ACTIVE_PAGE_ITEM);
+  }
+
+  /** Cells of the virtualized results grid. */
+  get gridCells(): Locator {
+    return this.element.locator(DrillDetailModal.SELECTORS.GRID_CELL);
+  }
+
+  /**
+   * Removes the first applied filter by clicking its chip's Close icon,
+   * re-fetching the unfiltered samples.
+   */
+  async clearFirstFilter(): Promise<void> {
+    await this.filterColumns.first().getByLabel('Close').click();
+  }
+
+  /** Navigates to the given 1-indexed pagination page. */
+  async goToPage(pageNumber: number): Promise<void> {
+    await this.pageItems.nth(pageNumber - 1).click();
+  }
+
+  /**
+   * Re-fetches the current samples query, resetting pagination to page 1.
+   *
+   * Matched by accessible name: the Reload icon carries an i18n'd
+   * `aria-label` (`t('Reload')`) and no data-test, so this breaks in
+   * non-English locales the same way `DrillDetailModal.tsx`'s dialog `name`
+   * does above; the predecessor Cypress test used the same English string.
+   */
+  async reload(): Promise<void> {
+    await this.element.getByRole('button', { name: 'Reload' }).click();
+  }
+
+  /**
+   * Closes the modal via its footer Close button.
+   *
+   * Targets the button by data-test rather than Modal.clickFooterButton,
+   * which finds buttons by their visible text. The button label is i18n'd
+   * ("Close" / "Fermer" / …), so name-based lookups break in non-English
+   * locales; see DeleteConfirmationModal.clickDelete for the same rationale.
+   */
+  async close(): Promise<void> {
+    await this.element.locator(DrillDetailModal.SELECTORS.CLOSE_BUTTON).click();
+    await this.waitForHidden();
+  }
+}
@@ -21,6 +21,7 @@
 export { ChartPropertiesModal } from './ChartPropertiesModal';
 export { ConfirmDialog } from './ConfirmDialog';
 export { DeleteConfirmationModal } from './DeleteConfirmationModal';
+export { DrillDetailModal } from './DrillDetailModal';
 export { DuplicateDatasetModal } from './DuplicateDatasetModal';
 export { EditDatasetModal } from './EditDatasetModal';
 export { ImportDatasetModal } from './ImportDatasetModal';
@@ -20,6 +20,7 @@
 import { Page, Download, Locator, expect } from '@playwright/test';
 import { Button, Input, Menu, Tabs } from '../components/core';
 import { DashboardFilterBar } from '../components/dashboard';
+import { DrillDetailModal } from '../components/modals';
 import { gotoWithRetry } from '../helpers/navigation';
 import { html5DragAndDrop } from '../helpers/dnd';
 import { TIMEOUT } from '../utils/constants';
@@ -454,4 +455,124 @@ export class DashboardPage {

    return { heightBefore: boxBefore.height, heightAfter: boxAfter.height };
  }
+
+  // ---------------------------------------------------------------------------
+  // Drill to detail
+  //
+  // Charts that implement the DRILL_TO_DETAIL behavior expose two entry points:
+  // the chart's "More Options" header menu, and a right-click context menu on
+  // the chart body (a cell, the big-number value, or a canvas data point). Both
+  // open the same DrillDetailModal, which renders the underlying sample rows for
+  // the (optionally filtered) chart by calling the `/datasource/samples` API.
+  // ---------------------------------------------------------------------------
+
+  /**
+   * Open the "Drill to detail" item from a chart's "More Options" header menu.
+   * This is the whole-chart entry point (no row-level filters applied).
+   */
+  async openDrillToDetailFromMenu(chartId: number): Promise<void> {
+    const moreOptions = new Button(
+      this.page,
+      this.getChart(chartId).getByLabel('More Options', { exact: true }),
+    );
+    await moreOptions.click();
+    await this.page
+      .getByRole('menuitem', { name: 'Drill to detail', exact: true })
+      .click();
+  }
+
+  /**
+   * The DrillDetailModal dialog (titled "Drill to detail: <chart name>").
+   */
+  drillModal(): DrillDetailModal {
+    return new DrillDetailModal(this.page);
+  }
+
+  /**
+   * Click the plain "Drill to detail" item in an open chart context menu
+   * (whole chart, no row-level filter).
+   */
+  async contextMenuDrillToDetail(): Promise<void> {
+    await this.page
+      .getByRole('menuitem', { name: 'Drill to detail', exact: true })
+      .click();
+  }
+
+  /**
+   * The "Drill to detail by" submenu parent (title) in an open context menu.
+   * Targeted by its submenu-title element rather than role+name because antd
+   * appends the arrow-icon name ("right") to the accessible name, and the leaf
+   * items ("Drill to detail by boy") would otherwise match a role+name lookup.
+   */
+  drillBySubmenuTitle(): Locator {
+    return this.page.locator('.ant-dropdown-menu-submenu-title', {
+      hasText: 'Drill to detail by',
+    });
+  }
+
+  /**
+   * The chart context menu's Menu component, scoped to the open context
+   * menu's root. Used to open the "Drill to detail by" submenu robustly:
+   * plain hover is not reliably picked up by Ant Design's submenu trigger in
+   * headless Chromium, so this falls back to keyboard and dispatchEvent - see
+   * {@link Menu.openSubmenu}.
+   */
+  private contextMenu(): Menu {
+    return new Menu(this.page, '[data-test="chart-context-menu"]');
+  }
+
+  /**
+   * Opens the "Drill to detail by" submenu and returns its popup, containing
+   * the leaf value items (e.g. "Drill to detail by boy").
+   */
+  private openDrillBySubmenu(): Promise<Locator> {
+    return this.contextMenu().openSubmenu('Drill to detail by', {
+      popupSelector: '.chart-context-submenu',
+    });
+  }
+
+  /**
+   * From an open chart context menu, open the "Drill to detail by" submenu and
+   * click the entry for a specific value (e.g. "boy", "1965", "all").
+   */
+  async contextMenuDrillToDetailBy(value: string): Promise<void> {
+    const popup = await this.openDrillBySubmenu();
+    // Use dispatchEvent instead of click to bypass viewport and pointer
+    // interception issues - see Menu.selectSubmenuItem.
+    await popup
+      .getByRole('menuitem', {
+        name: `Drill to detail by ${value}`,
+        exact: true,
+      })
+      .dispatchEvent('click');
+  }
+
+  /**
+   * From an open chart context menu, open "Drill to detail by" and return the
+   * concrete values offered by the submenu (e.g. ["1965", "boy"]), skipping the
+   * aggregate "all" entry. Used by canvas charts where the value under the
+   * cursor is data-dependent: the test drills by whatever the menu actually
+   * offers and asserts that same value round-trips into the modal, which keeps
+   * the assertion independent of exact pixel/slice geometry.
+   *
+   * Reads rendered (HTML-stripped) menu text rather than the item's
+   * `aria-label`, which carries the raw, unstripped formatted value
+   * (`useDrillDetailMenuItems`). The two only diverge for formatted values
+   * that contain HTML markup; callers pass the returned value both to
+   * `contextMenuDrillToDetailBy` (accessible-name lookup) and to a
+   * displayed-text assertion on the modal's filter chip, so a value straddling
+   * both uses only works when it's markup-free. Every value currently offered
+   * by this dashboard's charts is a plain string, so this hasn't been
+   * reachable in practice; revisit if a test starts exercising HTML-formatted
+   * dimension values.
+   */
+  async drillByOfferedValues(): Promise<string[]> {
+    const popup = await this.openDrillBySubmenu();
+    const items = popup.locator('[role="menuitem"]');
+    await items.first().waitFor();
+    const labels = await items.allInnerTexts();
+    return labels
+      .map(l => l.replace(/^Drill to detail by\s*/i, '').trim())
+      .filter(v => v.length > 0 && v.toLowerCase() !== 'all');
+  }
 }
@@ -0,0 +1,747 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * E2E migration of the Cypress "Drill to detail modal" suite
+ * (dashboard/drilltodetail.test.ts).
+ *
+ * Drill to detail lets a viewer open a modal of the underlying sample rows for a
+ * chart — optionally filtered to a single data point — by either the chart's
+ * "More Options" header menu or a right-click context menu on the chart body.
+ * The modal calls the real `/datasource/samples` API, so this is genuinely
+ * end-to-end: each test API-builds a hermetic dashboard from the `birth_names`
+ * dataset, renders it in the browser, drives the real menus, and asserts the
+ * resulting backend round-trip (the samples POST and the filter the modal
+ * applies).
+ *
+ * Why the original suite was fully `describe.skip`:
+ *   "it has issues with autoscrolling and the locked title flakes intricately
+ *    when the rightClick is obstructed by the title."
+ * That failure mode is Cypress-specific — Cypress auto-scrolls the target under
+ * the sticky chart header before every action. Playwright scrolls once and the
+ * target stays put, so the entry points are portable here.
+ *
+ * What is migrated, and how it is kept deterministic:
+ *   - Modal mechanics (open from header menu, pagination, reload-resets-page)
+ *     and the no-filter big-number drill use stable DOM elements.
+ *   - Table and Pivot drills right-click real DOM cells (no canvas pixels).
+ *   - Canvas (echarts) charts — Pie, Line, Scatter, generic/smooth/step
+ *     time-series, Mixed, Box plot, Funnel, Gauge, Treemap — DID rely on
+ *     hard-coded pixel coordinates in Cypress to land on a specific slice/point.
+ *     Instead of reproducing those brittle pixels, these tests scan a stable
+ *     region of the canvas (see `rightClickCanvasDatum`), read whichever value
+ *     the drill submenu actually offers for the point under the cursor, drill by
+ *     that value, and assert the SAME value round-trips into the modal filter.
+ *     This exercises the full canvas → contextmenu → datum → samples pipeline
+ *     while staying independent of exact geometry. `Big Number with Trendline`
+ *     drills the whole chart (no datum filter), like `Big Number`.
+ *
+ * Excluded (kept out, matching the original's own `describe.skip`s): Bar, Area,
+ * World Map, Radar — skipped upstream for chart-specific reasons.
+ */
+import {
+  testWithAssets,
+  expect,
+  type TestAssets,
+} from '../../helpers/fixtures';
+import type { Page, TestInfo } from '@playwright/test';
+import { TIMEOUT } from '../../utils/constants';
+import { DashboardPage } from '../../pages/DashboardPage';
+import { createDashboardWithCharts } from './dashboard-test-helpers';
+
+const DATASET_NAME = 'birth_names';
+
+/**
+ * Parse a RowCountLabel value ("75.7k rows", "1,234 rows") into a number so
+ * tests can assert the *invariant* (filtered < unfiltered) without hard-coding
+ * the dataset-specific totals the original Cypress suite baked in.
+ */
+function parseRowCount(text: string): number {
+  const m = text.match(/([\d.,]+)\s*([kKmM]?)/);
+  if (!m) return NaN;
+  let n = parseFloat(m[1].replace(/,/g, ''));
+  const suffix = m[2].toLowerCase();
+  if (suffix === 'k') n *= 1e3;
+  if (suffix === 'm') n *= 1e6;
+  return n;
+}
+
+interface ChartSpec {
+  vizType: string;
+  chartNamePrefix: string;
+  params: Record<string, unknown>;
+}
+
+/**
+ * API-build a hermetic single-chart dashboard from birth_names and return its
+ * dashboard and chart ids. Thin single-chart wrapper around
+ * `createDashboardWithCharts`, the build helper shared by the other migrated
+ * dashboard specs — reused here rather than hand-rolling position-json and id
+ * extraction again.
+ */
+async function buildSingleChartDashboard(
+  page: Page,
+  testAssets: TestAssets,
+  testInfo: TestInfo,
+  spec: ChartSpec,
+): Promise<{ dashboardId: number; chartId: number }> {
+  const { dashboardId, charts } = await createDashboardWithCharts(
+    page,
+    testAssets,
+    testInfo,
+    {
+      datasetName: DATASET_NAME,
+      chartNamePrefix: spec.chartNamePrefix,
+      dashboardTitlePrefix: spec.chartNamePrefix,
+      chartSpecs: [{ viz_type: spec.vizType, params: spec.params }],
+    },
+  );
+  return { dashboardId, chartId: charts[0].id };
+}
+
+/**
+ * Right-click an echarts canvas until a data point is hit — i.e. until the
+ * context menu offers an *enabled* "Drill to detail by" submenu (a miss renders
+ * that item disabled, as a plain menu item rather than a submenu title).
+ *
+ * echarts renders to a single canvas, so there is no per-datum DOM element to
+ * target and the exact pixel of a mark depends on chart geometry (donut hole,
+ * legend size, axis padding). Rather than hard-code Cypress's brittle pixel
+ * coordinates, this scans a small set of candidate points — a radial ring for
+ * pie/radial charts, a grid for cartesian charts — and stops at the first that
+ * lands on a mark. The drill value is then whatever that mark represents, so the
+ * caller asserts a value round-trip rather than a specific geometry.
+ */
+async function rightClickCanvasDatum(
+  page: Page,
+  dashboard: DashboardPage,
+  canvas: ReturnType<Page['locator']>,
+  pattern: 'ring' | 'grid' | 'dense',
+): Promise<void> {
+  const box = await canvas.boundingBox();
+  if (!box) throw new Error('canvas has no bounding box');
+
+  const ringPoints = (): Array<{ x: number; y: number }> => {
+    const pts: Array<{ x: number; y: number }> = [];
+    const cx = box.width / 2;
+    const cy = box.height / 2;
+    const minSide = Math.min(box.width, box.height);
+    for (const rf of [0.3, 0.22, 0.38]) {
+      for (let a = 0; a < 360; a += 45) {
+        const rad = (a * Math.PI) / 180;
+        pts.push({
+          x: cx + Math.cos(rad) * minSide * rf,
+          y: cy + Math.sin(rad) * minSide * rf,
+        });
+      }
+    }
+    return pts;
+  };
+  const gridPoints = (): Array<{ x: number; y: number }> => {
+    const pts: Array<{ x: number; y: number }> = [];
+    for (const yf of [0.5, 0.4, 0.6, 0.3, 0.7]) {
+      for (const xf of [0.3, 0.45, 0.6, 0.2, 0.75]) {
+        pts.push({ x: box.width * xf, y: box.height * yf });
+      }
+    }
+    return pts;
+  };
+
+  // 'dense' merges both scans for radial/stacked shapes (gauge, funnel, box
+  // plot) whose drillable marks don't fall neatly on a single ring or grid.
+  let candidates: Array<{ x: number; y: number }>;
+  if (pattern === 'ring') candidates = ringPoints();
+  else if (pattern === 'grid') candidates = gridPoints();
+  else candidates = [...gridPoints(), ...ringPoints()];
+
+  // The submenu *title* element only exists when "Drill to detail by" is an
+  // enabled submenu (a real datum was hit); a miss renders a disabled item.
+  const enabledDrillBy = dashboard.drillBySubmenuTitle();
+  const contextMenu = page.locator('[data-test="chart-context-menu"]');
+
+  for (const pt of candidates) {
+    await canvas.click({ button: 'right', position: pt });
+    const hit = await enabledDrillBy
+      .waitFor({ state: 'visible', timeout: 400 })
+      .then(() => true)
+      .catch(() => false);
+    if (hit) return;
+    await page.keyboard.press('Escape');
+    // Wait for the portal to actually close before the next right-click;
+    // otherwise a still-open (or mid-close-animation) menu can make the
+    // next click/locator behave nondeterministically on slower/contended CI.
+    await contextMenu
+      .waitFor({ state: 'hidden', timeout: 400 })
+      .catch(() => {});
+  }
+  throw new Error(
+    `no drillable datum found on canvas after scanning ${candidates.length} points`,
+  );
+}
+
+/** A samples POST fired (proves the modal hit the real backend). */
+function expectSamplesPost(page: Page) {
+  return page.waitForResponse(
+    r =>
+      r.url().includes('/datasource/samples') &&
+      r.request().method() === 'POST',
+    { timeout: TIMEOUT.API_RESPONSE },
+  );
+}
+
+async function loadDashboardWithChart(
+  dashboard: DashboardPage,
+  dashboardId: number,
+  chartId: number,
+): Promise<void> {
+  await dashboard.gotoById(dashboardId);
+  await dashboard.waitForLoad();
+  await dashboard
+    .getChart(chartId)
+    .locator('[data-test="chart-container"]')
+    .first()
+    .waitFor({ state: 'visible', timeout: TIMEOUT.QUERY_EXECUTION });
+  await dashboard.waitForChartsToLoad();
+}
+
+/**
+ * From an already-open "Drill to detail by" submenu, drill by the first
+ * offered value and assert that same value lands in the modal filter. The
+ * shared tail of every "drill by whatever value is under the cursor" test —
+ * canvas charts and the pivot table alike, which differ only in how they open
+ * the submenu in the first place.
+ */
+async function drillByFirstOfferedValueAndAssert(
+  page: Page,
+  dashboard: DashboardPage,
+): Promise<void> {
+  const offered = await dashboard.drillByOfferedValues();
+  expect(offered.length).toBeGreaterThan(0);
+  const [value] = offered;
+  const samples = expectSamplesPost(page);
+  await dashboard.contextMenuDrillToDetailBy(value);
+  await samples;
+
+  await expect(dashboard.drillModal().element).toBeVisible();
+  await expect(dashboard.drillModal().filterValues.first()).toContainText(
+    value,
+  );
+}
+
+/**
+ * Full canvas-drill round-trip for an echarts (canvas-rendered) chart: build a
+ * hermetic single-chart dashboard, render it, right-click a real datum, drill by
+ * whatever value the submenu offers under the cursor, and assert that same value
+ * lands in the modal filter. Geometry-independent — see rightClickCanvasDatum.
+ * Reused across every canvas viz type so each migrated chart is a thin caller.
+ */
+async function expectCanvasDrillByValueRoundTrips(
+  page: Page,
+  testAssets: TestAssets,
+  testInfo: TestInfo,
+  spec: ChartSpec,
+  pattern: 'ring' | 'grid' | 'dense',
+): Promise<void> {
+  const dashboard = new DashboardPage(page);
+  const { dashboardId, chartId } = await buildSingleChartDashboard(
+    page,
+    testAssets,
+    testInfo,
+    spec,
+  );
+  await loadDashboardWithChart(dashboard, dashboardId, chartId);
+
+  const canvas = dashboard.getChart(chartId).locator('canvas').first();
+  await expect(canvas).toBeVisible();
+  await rightClickCanvasDatum(page, dashboard, canvas, pattern);
+
+  await drillByFirstOfferedValueAndAssert(page, dashboard);
+}
+
+/**
+ * Right-click a big-number chart's rendered value to open its context menu,
+ * drill the whole chart (no row/point filter), and assert the modal opened
+ * with no filter tags and a real row count. Shared by Big Number and Big
+ * Number with Trendline, which differ only in their chart params.
+ */
+async function expectWholeChartDrillFromContextMenu(
+  page: Page,
+  dashboard: DashboardPage,
+  chartId: number,
+): Promise<void> {
+  const samples = expectSamplesPost(page);
+  await dashboard
+    .getChart(chartId)
+    .locator('.header-line')
+    .click({ button: 'right' });
+  await dashboard.contextMenuDrillToDetail();
+  await samples;
+
+  await expect(dashboard.drillModal().element).toBeVisible();
+  // Whole-chart drill: no per-value filter tag.
+  await expect(dashboard.drillModal().filterValues).toHaveCount(0);
+  await expect(dashboard.drillModal().rowCountLabel).toContainText('rows');
+}
+
+// Shared form-data fragment for the echarts time-series family (line/scatter/
+// generic/smooth/step): one temporal axis, one metric, split by gender series.
+const TIMESERIES_PARAMS = {
+  x_axis: 'ds',
+  time_grain_sqla: 'P1Y',
+  metrics: ['count'],
+  groupby: ['gender'],
+  row_limit: 1000,
+};
+
+testWithAssets(
+  'drill-to-detail modal: opens from the header menu, paginates, and reload resets to page 1',
+  async ({ page, testAssets }) => {
+    testWithAssets.setTimeout(TIMEOUT.SLOW_TEST);
+    const dashboard = new DashboardPage(page);
+    const { dashboardId, chartId } = await buildSingleChartDashboard(
+      page,
+      testAssets,
+      testWithAssets.info(),
+      {
+        vizType: 'big_number_total',
+        chartNamePrefix: 'drill_bignum',
+        params: { metric: 'count', adhoc_filters: [] },
+      },
+    );
+
+    await loadDashboardWithChart(dashboard, dashboardId, chartId);
+
+    // Open the modal from the chart's "More Options" header menu.
+    const samplesOnOpen = expectSamplesPost(page);
+    await dashboard.openDrillToDetailFromMenu(chartId);
+    await samplesOnOpen;
+
+    const modal = dashboard.drillModal();
+    await expect(modal.element).toBeVisible();
+    await expect(modal.element).toContainText('Drill to detail:');
+    // The metadata bar and a real row count prove the modal loaded backend data.
+    await expect(modal.metadataBar).toBeVisible();
+    await expect(modal.rowCountLabel).toContainText('rows');
+    // No drill filter was applied (whole-chart drill).
+    await expect(modal.filterValues).toHaveCount(0);
+
+    // The full dataset spans multiple pages, and the grid has rendered rows.
+    expect(await modal.pageItems.count()).toBeGreaterThan(1);
+    await expect(modal.gridCells.first()).toBeVisible();
+    await expect(modal.activePageItem).toContainText('1');
+
+    // Paginate forward: clicking page 2 fires a real samples fetch and moves the
+    // active page to 2.
+    const samplesOnPage2 = expectSamplesPost(page);
+    await modal.goToPage(2);
+    await samplesOnPage2;
+    await expect(modal.activePageItem).toContainText('2');
+
+    // Reload re-fetches and resets back to the first page.
+    const samplesOnReload = expectSamplesPost(page);
+    await modal.reload();
+    await samplesOnReload;
+    await expect(modal.activePageItem).toContainText('1');
+  },
+);
+
+testWithAssets(
+  'drill-to-detail modal: big number value right-click drills the whole chart (no filter)',
+  async ({ page, testAssets }) => {
+    testWithAssets.setTimeout(TIMEOUT.SLOW_TEST);
+    const dashboard = new DashboardPage(page);
+    const { dashboardId, chartId } = await buildSingleChartDashboard(
+      page,
+      testAssets,
+      testWithAssets.info(),
+      {
+        vizType: 'big_number_total',
+        chartNamePrefix: 'drill_bignum_rc',
+        params: { metric: 'count', adhoc_filters: [] },
+      },
+    );
+
+    await loadDashboardWithChart(dashboard, dashboardId, chartId);
+    await expectWholeChartDrillFromContextMenu(page, dashboard, chartId);
+  },
+);
+
+testWithAssets(
+  'drill-to-detail modal: table cell right-click drills by that value and clearing the filter restores the full set',
+  async ({ page, testAssets }) => {
+    testWithAssets.setTimeout(TIMEOUT.SLOW_TEST);
+    const dashboard = new DashboardPage(page);
+    const { dashboardId, chartId } = await buildSingleChartDashboard(
+      page,
+      testAssets,
+      testWithAssets.info(),
+      {
+        vizType: 'table',
+        chartNamePrefix: 'drill_table',
+        params: {
+          query_mode: 'aggregate',
+          groupby: ['gender'],
+          metrics: ['count'],
+          row_limit: 100,
+          server_pagination: false,
+        },
+      },
+    );
+
+    await loadDashboardWithChart(dashboard, dashboardId, chartId);
+
+    // Right-click the "boy" dimension cell and drill by it.
+    const samplesOnDrill = expectSamplesPost(page);
+    await dashboard
+      .getChart(chartId)
+      .getByText('boy', { exact: true })
+      .first()
+      .click({ button: 'right' });
+    await dashboard.contextMenuDrillToDetailBy('boy');
+    await samplesOnDrill;
+
+    const modal = dashboard.drillModal();
+    await expect(modal.element).toBeVisible();
+    await expect(modal.filterValues.first()).toContainText('boy');
+
+    const filteredCount = parseRowCount(await modal.rowCountLabel.innerText());
+    expect(filteredCount).toBeGreaterThan(0);
+
+    // Clearing the filter reloads the samples and restores the larger, unfiltered total.
+    const samplesOnClear = expectSamplesPost(page);
+    await modal.clearFirstFilter();
+    await samplesOnClear;
+    await expect(modal.filterValues).toHaveCount(0);
+    await expect
+      .poll(async () => parseRowCount(await modal.rowCountLabel.innerText()))
+      .toBeGreaterThan(filteredCount);
+  },
+);
+
+testWithAssets(
+  'drill-to-detail modal: pivot table cell right-click drills by the cell value',
+  async ({ page, testAssets }) => {
+    testWithAssets.setTimeout(TIMEOUT.SLOW_TEST);
+    const dashboard = new DashboardPage(page);
+    const { dashboardId, chartId } = await buildSingleChartDashboard(
+      page,
+      testAssets,
+      testWithAssets.info(),
+      {
+        vizType: 'pivot_table_v2',
+        chartNamePrefix: 'drill_pivot',
+        params: {
+          groupbyRows: ['gender'],
+          groupbyColumns: [],
+          metrics: ['count'],
+          aggregateFunction: 'Sum',
+          rowTotals: false,
+          colTotals: false,
+        },
+      },
+    );
+
+    await loadDashboardWithChart(dashboard, dashboardId, chartId);
+
+    await dashboard
+      .getChart(chartId)
+      .locator('[role="gridcell"]')
+      .first()
+      .click({ button: 'right' });
+
+    // The cell's row dimension determines the offered value; drill by it and
+    // assert the same value lands in the modal filter.
+    await drillByFirstOfferedValueAndAssert(page, dashboard);
+  },
+);
+
+testWithAssets(
+  'drill-to-detail modal: pie slice right-click (canvas) drills by the slice value',
+  async ({ page, testAssets }) => {
+    testWithAssets.setTimeout(TIMEOUT.SLOW_TEST);
+    // Pie is a donut by default (center is a hole), so scan the ring for a slice.
+    await expectCanvasDrillByValueRoundTrips(
+      page,
+      testAssets,
+      testWithAssets.info(),
+      {
+        vizType: 'pie',
+        chartNamePrefix: 'drill_pie',
+        params: { groupby: ['gender'], metric: 'count' },
+      },
+      'ring',
+    );
+  },
+);
+
+testWithAssets(
+  'drill-to-detail modal: line chart point right-click (canvas) drills by the point value',
+  async ({ page, testAssets }) => {
+    testWithAssets.setTimeout(TIMEOUT.SLOW_TEST);
+    // Scan the plot grid for a point on one of the series lines.
+    await expectCanvasDrillByValueRoundTrips(
+      page,
+      testAssets,
+      testWithAssets.info(),
+      {
+        vizType: 'echarts_timeseries_line',
+        chartNamePrefix: 'drill_line',
+        params: TIMESERIES_PARAMS,
+      },
+      'grid',
+    );
+  },
+);
+
+testWithAssets(
+  'drill-to-detail modal: big number with trendline right-click drills the whole chart (no filter)',
+  async ({ page, testAssets }) => {
+    testWithAssets.setTimeout(TIMEOUT.SLOW_TEST);
+    const dashboard = new DashboardPage(page);
+    const { dashboardId, chartId } = await buildSingleChartDashboard(
+      page,
+      testAssets,
+      testWithAssets.info(),
+      {
+        vizType: 'big_number',
+        chartNamePrefix: 'drill_bignum_trend',
+        params: {
+          metric: 'count',
+          x_axis: 'ds',
+          time_grain_sqla: 'P1Y',
+          adhoc_filters: [],
+        },
+      },
+    );
+
+    await loadDashboardWithChart(dashboard, dashboardId, chartId);
+    await expectWholeChartDrillFromContextMenu(page, dashboard, chartId);
+  },
+);
+
+interface CanvasDrillCase {
+  title: string;
+  spec: ChartSpec;
+  pattern: 'ring' | 'grid' | 'dense';
+}
+
+// Every remaining canvas (echarts) chart is a thin caller of
+// expectCanvasDrillByValueRoundTrips, differing only in viz type, chart
+// params, and which point-scan pattern finds a drillable mark.
+const CANVAS_DRILL_CASES: CanvasDrillCase[] = [
+  {
+    title:
+      'drill-to-detail modal: scatter chart point right-click (canvas) drills by the point value',
+    spec: {
+      vizType: 'echarts_timeseries_scatter',
+      chartNamePrefix: 'drill_scatter',
+      // Enlarge the markers so a region scan reliably lands on a point;
+      // scatter's default dots are a few pixels wide and a sparse grid misses
+      // them.
+      params: { ...TIMESERIES_PARAMS, markerSize: 20 },
+    },
+    pattern: 'dense',
+  },
+  {
+    title:
+      'drill-to-detail modal: generic time-series point right-click (canvas) drills by the point value',
+    spec: {
+      vizType: 'echarts_timeseries',
+      chartNamePrefix: 'drill_generic',
+      params: TIMESERIES_PARAMS,
+    },
+    pattern: 'grid',
+  },
+  {
+    title:
+      'drill-to-detail modal: smooth line point right-click (canvas) drills by the point value',
+    spec: {
+      vizType: 'echarts_timeseries_smooth',
+      chartNamePrefix: 'drill_smooth',
+      params: TIMESERIES_PARAMS,
+    },
+    pattern: 'grid',
+  },
+  {
+    title:
+      'drill-to-detail modal: step line point right-click (canvas) drills by the point value',
+    spec: {
+      vizType: 'echarts_timeseries_step',
+      chartNamePrefix: 'drill_step',
+      params: TIMESERIES_PARAMS,
+    },
+    pattern: 'grid',
+  },
+  {
+    title:
+      'drill-to-detail modal: mixed time-series point right-click (canvas) drills by the point value',
+    spec: {
+      vizType: 'mixed_timeseries',
+      chartNamePrefix: 'drill_mixed',
+      params: {
+        x_axis: 'ds',
+        time_grain_sqla: 'P1Y',
+        metrics: ['count'],
+        groupby: ['gender'],
+        metrics_b: ['count'],
+        groupby_b: ['gender'],
+        row_limit: 1000,
+      },
+    },
+    pattern: 'grid',
+  },
+  {
+    title:
+      'drill-to-detail modal: box plot right-click (canvas) drills by the box value',
+    spec: {
+      vizType: 'box_plot',
+      chartNamePrefix: 'drill_boxplot',
+      params: {
+        groupby: ['gender'],
+        metrics: ['count'],
+        columns: ['ds'],
+      },
+    },
+    pattern: 'dense',
+  },
+  {
+    title:
+      'drill-to-detail modal: funnel segment right-click (canvas) drills by the segment value',
+    spec: {
+      vizType: 'funnel',
+      chartNamePrefix: 'drill_funnel',
+      params: { groupby: ['gender'], metric: 'count' },
+    },
+    pattern: 'dense',
+  },
+  {
+    title:
+      'drill-to-detail modal: gauge right-click (canvas) drills by the gauge value',
+    spec: {
+      vizType: 'gauge_chart',
+      chartNamePrefix: 'drill_gauge',
+      params: { groupby: ['gender'], metric: 'count' },
+    },
+    pattern: 'dense',
+  },
+  {
+    title:
+      'drill-to-detail modal: treemap tile right-click (canvas) drills by the tile value',
+    spec: {
+      vizType: 'treemap_v2',
+      chartNamePrefix: 'drill_treemap',
+      params: { metric: 'count', groupby: ['gender'] },
+    },
+    pattern: 'dense',
+  },
+];
+
+for (const { title, spec, pattern } of CANVAS_DRILL_CASES) {
+  testWithAssets(title, async ({ page, testAssets }) => {
+    testWithAssets.setTimeout(TIMEOUT.SLOW_TEST);
+    await expectCanvasDrillByValueRoundTrips(
+      page,
+      testAssets,
+      testWithAssets.info(),
+      spec,
+      pattern,
+    );
+  });
+}
+
+testWithAssets(
+  'drill-to-detail modal: drilling a time-series point "by all" applies every dimension of that point',
+  async ({ page, testAssets }) => {
+    testWithAssets.setTimeout(TIMEOUT.SLOW_TEST);
+    const dashboard = new DashboardPage(page);
+    const { dashboardId, chartId } = await buildSingleChartDashboard(
+      page,
+      testAssets,
+      testWithAssets.info(),
+      {
+        vizType: 'echarts_timeseries_line',
+        chartNamePrefix: 'drill_all',
+        // Two groupby dimensions so each point genuinely carries more than one
+        // drillable value — the whole point of "Drill to detail by all".
+        params: { ...TIMESERIES_PARAMS, groupby: ['gender', 'state'] },
+      },
+    );
+
+    await loadDashboardWithChart(dashboard, dashboardId, chartId);
+
+    const canvas = dashboard.getChart(chartId).locator('canvas').first();
+    await expect(canvas).toBeVisible();
+    await rightClickCanvasDatum(page, dashboard, canvas, 'grid');
+
+    // A line point carries two dimensions (the temporal value and the gender
+    // series), so "Drill to detail by all" must apply both as filters.
+    const offered = await dashboard.drillByOfferedValues();
+    expect(offered.length).toBeGreaterThanOrEqual(2);
+    const samples = expectSamplesPost(page);
+    await dashboard.contextMenuDrillToDetailBy('all');
+    await samples;
+
+    await expect(dashboard.drillModal().element).toBeVisible();
+    expect(
+      await dashboard.drillModal().filterValues.count(),
+    ).toBeGreaterThanOrEqual(2);
+  },
+);
+
+testWithAssets(
+  'drill-to-detail modal: table drills correctly by each of multiple dimension values',
+  async ({ page, testAssets }) => {
+    testWithAssets.setTimeout(TIMEOUT.SLOW_TEST);
+    const dashboard = new DashboardPage(page);
+    const { dashboardId, chartId } = await buildSingleChartDashboard(
+      page,
+      testAssets,
+      testWithAssets.info(),
+      {
+        vizType: 'table',
+        chartNamePrefix: 'drill_table_multi',
+        params: {
+          query_mode: 'aggregate',
+          groupby: ['gender'],
+          metrics: ['count'],
+          row_limit: 100,
+          server_pagination: false,
+        },
+      },
+    );
+
+    await loadDashboardWithChart(dashboard, dashboardId, chartId);
+
+    for (const value of ['boy', 'girl']) {
+      const samples = expectSamplesPost(page);
+      await dashboard
+        .getChart(chartId)
+        .getByText(value, { exact: true })
+        .first()
+        .click({ button: 'right' });
+      await dashboard.contextMenuDrillToDetailBy(value);
+      await samples;
+
+      const modal = dashboard.drillModal();
+      await expect(modal.element).toBeVisible();
+      await expect(modal.filterValues.first()).toContainText(value);
+      await modal.close();
+    }
+  },
+);
@@ -40,10 +40,18 @@ import { testWithAssets, expect } from '../../helpers/fixtures';
 import { apiGet } from '../../helpers/api/requests';
 import { apiPostChart, apiPutChart } from '../../helpers/api/chart';
 import { getDatasetByName } from '../../helpers/api/dataset';
+import { getAccessToken } from '../../helpers/api/embedded';
 import { TIMEOUT } from '../../utils/constants';

 const DATASET_NAME = 'birth_names';

+async function authorizeApi(page: Page): Promise<void> {
+  const accessToken = await getAccessToken(page);
+  await page.context().setExtraHTTPHeaders({
+    Authorization: `Bearer ${accessToken}`,
+  });
+}
+
 // Visible row text must never expose synthetic identifiers (layout node
 // ids like CHART-xyz / ROW-… or bare UUIDs) — the rendering layer maps
 // these to human names or kind-only phrasing.
@@ -79,19 +87,35 @@ async function currentUserSubjectId(page: Page): Promise<number> {
 * this reads like its sibling specs, but fall back to whatever the instance
 * has rather than requiring a particular fixture to be loaded.
 */
-async function anyDatasetId(page: Page): Promise<number> {
+async function anyDataset(page: Page): Promise<{
+  id: number;
+  columnName: string;
+}> {
  const named = await getDatasetByName(page, DATASET_NAME);
-  if (named) {
-    return named.id;
+  let datasetId = named?.id;
+  if (!datasetId) {
+    const res = await apiGet(
+      page,
+      `api/v1/dataset/?q=${rison.encode({ columns: ['id'], page_size: 1 })}`,
+    );
+    expect(res.ok(), 'dataset list request').toBeTruthy();
+    const [first] = (await res.json()).result;
+    expect(first, 'the instance has at least one dataset').toBeTruthy();
+    datasetId = first.id;
  }
-  const res = await apiGet(
-    page,
-    `api/v1/dataset/?q=${rison.encode({ columns: ['id'], page_size: 1 })}`,
-  );
-  expect(res.ok(), 'dataset list request').toBeTruthy();
-  const [first] = (await res.json()).result;
-  expect(first, 'the instance has at least one dataset').toBeTruthy();
-  return first.id;
+  if (datasetId === undefined) {
+    throw new Error('Unable to resolve a dataset id');
+  }
+
+  const detailRes = await apiGet(page, `api/v1/dataset/${datasetId}`);
+  expect(detailRes.ok(), 'dataset detail request').toBeTruthy();
+  const { columns } = (await detailRes.json()).result;
+  const [firstColumn] = columns;
+  expect(firstColumn, 'the dataset has at least one column').toBeTruthy();
+  return {
+    id: datasetId,
+    columnName: firstColumn.column_name,
+  };
 }

 /** Open the Explore "Additional actions → View version history" panel. */
@@ -109,7 +133,8 @@ testWithAssets(
  async ({ page, testAssets }) => {
    testWithAssets.setTimeout(TIMEOUT.SLOW_TEST);

-    const datasetId = await anyDatasetId(page);
+    await authorizeApi(page);
+    const { id: datasetId, columnName } = await anyDataset(page);

    const baseName = `version_history_${Date.now()}`;
    const chartResp = await apiPostChart(page, {
@@ -123,7 +148,7 @@ testWithAssets(
        datasource: `${datasetId}__table`,
        viz_type: 'table',
        query_mode: 'raw',
-        all_columns: [],
+        all_columns: [columnName],
        adhoc_filters: [],
        row_limit: 10,
      }),
@@ -171,3 +196,79 @@ testWithAssets(
    ).toBeFalsy();
  },
 );
+
+testWithAssets(
+  'minor edit of a non-canonical chart omits hydration noise',
+  async ({ page, testAssets }) => {
+    testWithAssets.setTimeout(TIMEOUT.SLOW_TEST);
+
+    await authorizeApi(page);
+    const { id: datasetId, columnName } = await anyDataset(page);
+    const baseName = `version_history_normalization_${Date.now()}`;
+    const chartResp = await apiPostChart(page, {
+      slice_name: baseName,
+      viz_type: 'table',
+      datasource_id: datasetId,
+      datasource_type: 'table',
+      // Deliberately omit visualization defaults. Explore hydration supplies
+      // them, reproducing params imported before they were canonical.
+      params: JSON.stringify({
+        datasource: `${datasetId}__table`,
+        viz_type: 'table',
+        query_mode: 'raw',
+        all_columns: [columnName],
+        adhoc_filters: [],
+        extra_form_data: {},
+        dashboards: [],
+        row_limit: 10,
+      }),
+    });
+    expect(chartResp.ok(), 'chart creation').toBeTruthy();
+    const chartBody = await chartResp.json();
+    const chartId: number = chartBody.result?.id ?? chartBody.id;
+    expect(chartId, 'chart creation should return an id').toBeTruthy();
+    testAssets.trackChart(chartId);
+
+    const adminSubjectId = await currentUserSubjectId(page);
+    const editorResp = await apiPutChart(page, chartId, {
+      editors: [adminSubjectId],
+    });
+    expect(editorResp.ok(), 'claim chart editorship').toBeTruthy();
+
+    await page.goto(`explore/?slice_id=${chartId}`);
+    await page.getByRole('combobox', { name: 'Row limit' }).click();
+    await page.getByRole('option', { name: '100', exact: true }).click();
+    await page.locator('[data-test="query-save-button"]').click();
+    await page.locator('[data-test="save-overwrite-radio"]').click();
+
+    const saveResponsePromise = page.waitForResponse(
+      response =>
+        response.request().method() === 'PUT' &&
+        response.url().includes(`/api/v1/chart/${chartId}`),
+    );
+    await page.locator('[data-test="btn-modal-save"]').click();
+    const saveResponse = await saveResponsePromise;
+    expect(saveResponse.ok(), 'chart overwrite').toBeTruthy();
+
+    const requestPayload = saveResponse.request().postDataJSON();
+    const savedParams = JSON.parse(requestPayload.params);
+    expect(
+      savedParams.matrixify_enable,
+      'overwrite contains a default absent from the stored params',
+    ).toBe(false);
+
+    await openVersionHistory(page);
+    const panel = page.locator('[aria-label="Version history"]');
+    const newestGroup = panel
+      .locator('[data-test="version-history-save-group"]')
+      .first();
+    await expect(newestGroup, 'shows the overwrite save group').toBeVisible();
+    await newestGroup.getByRole('button').first().click();
+
+    const rows = newestGroup.locator(
+      '[data-test="version-history-action-row"]',
+    );
+    await expect(rows, 'shows only the intentional edit').toHaveCount(1);
+    await expect(rows.first()).toContainText(/row limit/i);
+  },
+);
@@ -27,11 +27,21 @@ const StyledTotalCell = styled.div`
  `}
 `;

+// `align` originates from the chart's stored column_config
+// (col.config.horizontalAlign), which can be set to an arbitrary string via
+// a direct chart-params API write. Emotion compiles interpolated strings as
+// CSS source, so the value must be clamped to a closed set of keywords
+// before it reaches the stylesheet — never interpolated raw.
+const ALLOWED_ALIGN_VALUES = new Set(['left', 'right', 'center']);
+
+const safeAlign = (align?: string) =>
+  align && ALLOWED_ALIGN_VALUES.has(align) ? align : 'left';
+
 const CellContainer = styled.div<{ backgroundColor?: string; align?: string }>`
  display: flex;
  background-color: ${({ backgroundColor }) =>
    backgroundColor || 'transparent'};
-  justify-content: ${({ align }) => align || 'left'};
+  justify-content: ${({ align }) => safeAlign(align)};
 `;

 const ArrowContainer = styled.div<{ arrowColor?: string }>`
@@ -0,0 +1,59 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import '@testing-library/jest-dom';
+import { render } from '@superset-ui/core/spec';
+import { NumericCellRenderer } from '../src/renderers/NumericCellRenderer';
+
+const renderCell = (horizontalAlign?: string) => {
+  const params = {
+    value: 42,
+    valueFormatted: '42',
+    node: { rowPinned: undefined, rowIndex: 0 },
+    hasBasicColorFormatters: false,
+    basicColorFormatters: [],
+    col: {
+      isNumeric: true,
+      config: horizontalAlign ? { horizontalAlign } : {},
+    },
+    valueRange: undefined,
+    alignPositiveNegative: false,
+    colorPositiveNegative: false,
+  } as unknown as Parameters<typeof NumericCellRenderer>[0];
+  return render(<NumericCellRenderer {...params} />);
+};
+
+const collectInjectedCss = () =>
+  Array.from(document.querySelectorAll('style'))
+    .map(style => style.textContent ?? '')
+    .join('\n');
+
+test('applies an allowed horizontalAlign value from column config', () => {
+  const { container } = renderCell('center');
+  expect(container.firstChild).toHaveStyle({ justifyContent: 'center' });
+});
+
+test('does not compile a malicious horizontalAlign into the stylesheet', () => {
+  const payload =
+    'right;} & { position:fixed; top:0; left:0; width:100vw; height:100vh; z-index:99999; background:#fff url(https://attacker.example/beacon) }';
+  const { container } = renderCell(payload);
+  const css = collectInjectedCss();
+  expect(css).not.toContain('position:fixed');
+  expect(css).not.toContain('attacker.example');
+  expect(container.firstChild).toHaveStyle({ justifyContent: 'left' });
+});
@@ -38,3 +38,11 @@ export const convertUTCTimestampToLocal = (utcTimestamp: number): number => {
  const offsetMs = date.getTimezoneOffset() * 60 * 1000;
  return utcTimestamp + offsetMs;
 };
+
+// Escapes HTML special characters before formatter output reaches an
+// innerHTML sink. Mirrors plugin-chart-country-map's escapeHtml.
+export const escapeHtml = (text: unknown): string => {
+  const div = document.createElement('div');
+  div.textContent = String(text);
+  return div.innerHTML;
+};
@@ -13,6 +13,7 @@ import d3tip from 'd3-tip';
 import { t } from '@apache-superset/core/translation';
 import { getContrastingColor } from '@superset-ui/core';
 import { CALENDAR_TOOLTIP_CLASS } from '../tooltip';
+import { escapeHtml } from '../utils';

 var d3 = typeof require === 'function' ? require('d3') : window.d3;

@@ -22,14 +23,16 @@ var CalHeatMap = function () {
  'use strict';

  var self = this;
+  // d3-tip assigns the .html() return value to the tip node via
+  // innerHTML, so formatter output is HTML-escaped first.
  self.tip = d3tip()
    .attr('class', `d3-tip ${CALENDAR_TOOLTIP_CLASS}`)
    .direction('n')
    .offset([-5, 0])
    .html(
      d => `
-      ${self.options.timeFormatter(d.t)}: <strong>${self.options.valueFormatter(
-        d.v,
+      ${escapeHtml(self.options.timeFormatter(d.t))}: <strong>${escapeHtml(
+        self.options.valueFormatter(d.v),
      )}</strong>
    `,
    );
@@ -37,7 +40,7 @@ var CalHeatMap = function () {
    .attr('class', `d3-tip ${CALENDAR_TOOLTIP_CLASS}`)
    .direction('n')
    .offset([-5, 0])
-    .html(d => self.options.valueFormatter(d));
+    .html(d => escapeHtml(self.options.valueFormatter(d)));

  this.allowedDataType = ['json', 'csv', 'tsv', 'txt'];

@@ -25,8 +25,12 @@ type FunctionalDateFormat = (date: Date) => string;
 interface CalHeatMapInstance {
  options: {
    dateFormatter: DateFormatter | null;
+    timeFormatter: (t: number) => string;
+    valueFormatter: (v: number) => string;
  };
  formatDate(date: Date, format: string | FunctionalDateFormat): string;
+  tip: { html(): (d: { t: number; v: number }) => string };
+  legendTip: { html(): (d: number) => string };
 }

 const CalHeatMap = CalHeatMapImport as unknown as new () => CalHeatMapInstance;
@@ -59,3 +63,29 @@ test('CalHeatMap keeps the D3 formatter fallback', () => {

  expect(calendar.formatDate(date, '%B')).toBe('January');
 });
+
+test('cell tooltip HTML escapes creator-controlled formatter output', () => {
+  // Regression test: the tip's .html() callback is assigned to the
+  // tooltip node via innerHTML (d3-tip), so formatter output must be
+  // escaped before it's returned.
+  const calendar = new CalHeatMap();
+  calendar.options.timeFormatter = () => '<img src=x onerror=alert(1)>';
+  calendar.options.valueFormatter = () => '<svg onload=alert(2)>';
+
+  const html = calendar.tip.html()({ t: 0, v: 1 });
+
+  expect(html).not.toContain('<img');
+  expect(html).not.toContain('<svg');
+  expect(html).toContain('&lt;img');
+  expect(html).toContain('&lt;svg');
+});
+
+test('legend tooltip HTML escapes creator-controlled formatter output', () => {
+  const calendar = new CalHeatMap();
+  calendar.options.valueFormatter = () => '<img src=x onerror=alert(1)>';
+
+  const html = calendar.legendTip.html()(1);
+
+  expect(html).not.toContain('<img');
+  expect(html).toContain('&lt;img');
+});
@@ -17,7 +17,11 @@
 * under the License.
 */

-import { getFormattedUTCTime, convertUTCTimestampToLocal } from '../src/utils';
+import {
+  getFormattedUTCTime,
+  convertUTCTimestampToLocal,
+  escapeHtml,
+} from '../src/utils';

 test('getFormattedUTCTime formats local timestamp for display as UTC date', () => {
  const utcTimestamp = 1420070400000; // 2015-01-01 00:00:00 UTC
@@ -87,3 +91,22 @@ test('convertUTCTimestampToLocal and getFormattedUTCTime work together to displa
  const formattedTime = getFormattedUTCTime(localTimestamp, '%Y-%m-%d');
  expect(formattedTime).toContain('2024-01-01');
 });
+
+test('escapeHtml neutralizes markup smuggled through a time format string', () => {
+  // Regression test: d3-time-format passes non-% characters through
+  // verbatim, so escaping must happen before the innerHTML sink.
+  const formatted = getFormattedUTCTime(
+    1704067200000,
+    '%Y <img src=x onerror=alert(1)>',
+  );
+  const escaped = escapeHtml(formatted);
+
+  expect(formatted).toContain('<img');
+  expect(escaped).not.toContain('<img');
+  expect(escaped).toContain('&lt;img');
+});
+
+test('escapeHtml stringifies non-string formatter output safely', () => {
+  expect(escapeHtml(1234)).toEqual('1234');
+  expect(escapeHtml('a & b < c')).toEqual('a &amp; b &lt; c');
+});
@@ -33,6 +33,27 @@ import { WmsLayerConf, WfsLayerConf, LayerConf, XyzLayerConf } from '../types';
 import { isWfsLayerConf, isWmsLayerConf, isXyzLayerConf } from '../typeguards';
 import { isVersionBelow } from './serviceUtil';

+/**
+ * Escape HTML special characters in a layer attribution string.
+ *
+ * OpenLayers' Attribution control renders attribution strings via innerHTML,
+ * and the attribution here comes from creator-supplied chart form data, so it
+ * must be treated as untrusted text rather than markup to prevent stored XSS.
+ *
+ * @param attribution The attribution string from the layer configuration
+ *
+ * @returns The attribution with HTML special characters escaped
+ */
+export const escapeAttribution = (attribution?: string): string | undefined =>
+  attribution === undefined
+    ? undefined
+    : attribution
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#039;');
+
 /**
 * Create a WMS layer.
 *
@@ -49,7 +70,7 @@ export const createWmsLayer = (wmsLayerConf: WmsLayerConf) => {
        LAYERS: layersParam,
        VERSION: version,
      },
-      attributions: attribution,
+      attributions: escapeAttribution(attribution),
    }),
  });
 };
@@ -66,7 +87,7 @@ export const createXyzLayer = (xyzLayerConf: XyzLayerConf) => {
  return new TileLayer({
    source: new XyzSource({
      url,
-      attributions: attribution,
+      attributions: escapeAttribution(attribution),
    }),
  });
 };
@@ -90,7 +111,7 @@ export const createWfsLayer = async (wfsLayerConf: WfsLayerConf) => {

  const wfsSource = new VectorSource({
    format: new GeoJSON(),
-    attributions: attribution,
+    attributions: escapeAttribution(attribution),
    url: extent => {
      const requestUrl = new URL(url);
      const params = requestUrl.searchParams;
@@ -17,20 +17,65 @@
 * under the License.
 */

-import { WfsLayerConf } from '../../src/types';
+import { WfsLayerConf, WmsLayerConf, XyzLayerConf } from '../../src/types';
 import {
  createLayer,
  createWfsLayer,
  createWmsLayer,
  createXyzLayer,
+  escapeAttribution,
 } from '../../src/util/layerUtil';

 describe('layerUtil', () => {
+  describe('escapeAttribution', () => {
+    test('escapes HTML markup in attribution strings', () => {
+      expect(escapeAttribution('(c) OSM <img src=x onerror=alert(1)>')).toBe(
+        '(c) OSM &lt;img src=x onerror=alert(1)&gt;',
+      );
+      expect(escapeAttribution('a & "b" \'c\'')).toBe(
+        'a &amp; &quot;b&quot; &#039;c&#039;',
+      );
+      expect(escapeAttribution(undefined)).toBeUndefined();
+    });
+  });
+
  describe('createWmsLayer', () => {
    test('exists', () => {
      // function is trivial
      expect(createWmsLayer).toBeDefined();
    });
+
+    test('escapes HTML in the layer attribution', () => {
+      const wmsLayerConf: WmsLayerConf = {
+        title: 'wms',
+        type: 'WMS',
+        url: 'https://ows-demo.terrestris.de/geoserver/osm/wms',
+        version: '1.3.0',
+        layersParam: 'osm:osm-fuel',
+        attribution: '(c) OSM <img src=x onerror=alert(1)>',
+      };
+      const layer = createWmsLayer(wmsLayerConf);
+      const attributions = layer.getSource()?.getAttributions();
+      expect(attributions?.(undefined as never)).toEqual([
+        '(c) OSM &lt;img src=x onerror=alert(1)&gt;',
+      ]);
+    });
+  });
+
+  describe('createXyzLayer', () => {
+    test('escapes HTML in the layer attribution', () => {
+      const xyzLayerConf: XyzLayerConf = {
+        title: 'osm',
+        type: 'XYZ',
+        url: 'https://tile.openstreetmap.org/{z}/{x}/{y}.png',
+        attribution: '(c) OSM <img src=x onerror=alert(1)>',
+      };
+      const layer = createXyzLayer(xyzLayerConf);
+      const attributions = layer.getSource()?.getAttributions();
+      expect(attributions?.(undefined as never)).toEqual([
+        '(c) OSM &lt;img src=x onerror=alert(1)&gt;',
+      ]);
+    });
  });

  describe('createWfsLayer', () => {
@@ -770,7 +770,9 @@ export default function transformProps(
      nameGap: xAxisTitleMarginPx,
      nameLocation: 'middle',
      axisLabel: {
-        hideOverlap: !(xAxisType === AxisType.Time && xAxisLabelRotation !== 0),
+        hideOverlap: showMaxLabel
+          ? false
+          : !(xAxisType === AxisType.Time && xAxisLabelRotation !== 0),
        formatter: deduplicatedFormatter,
        rotate: xAxisLabelRotation,
        interval: xAxisLabelInterval,
@@ -18,6 +18,7 @@
 */
 import { t } from '@apache-superset/core/translation';
 import { NumberFormatter } from '@superset-ui/core';
+import { sanitizeHtml } from '../utils/series';

 /*
 function for finding the max metric values among all series data for Radar Chart
@@ -63,7 +64,7 @@ export const renderNormalizedTooltip = (
  const { color, name = '', value: values } = params;
  const seriesName = name || 'series0';

-  const colorDot = `<span style="display:inline-block;margin-right:5px;border-radius:50%;width:5px;height:5px;background-color:${color}"></span>`;
+  const colorDot = `<span style="display:inline-block;margin-right:5px;border-radius:50%;width:5px;height:5px;background-color:${sanitizeHtml(color)}"></span>`;

  // Get metric values with denormalization if needed
  const metricValues: TooltipMetricValue[] = metrics.map((metric, index) => {
@@ -85,19 +86,26 @@ export const renderNormalizedTooltip = (
    };
  });

+  // Tooltip is rendered via innerHTML (ECharts default renderMode
+  // 'html'), so seriesName/metric/value/color are HTML-escaped, matching
+  // the treatment every other echarts tooltip path applies.
  const tooltipRows = metricValues
    .map(
      ({ metric, value }) => `
        <div style="display:flex;">
-          <div>${colorDot}${metric}:</div>
-          <div style="font-weight:bold;margin-left:auto;">${value}</div>
+          <div>${colorDot}${sanitizeHtml(metric)}:</div>
+          <div style="font-weight:bold;margin-left:auto;">${sanitizeHtml(
+            String(value),
+          )}</div>
        </div>
      `,
    )
    .join('');

  return `
-    <div style="font-weight:bold;margin-bottom:5px;">${seriesName}</div>
+    <div style="font-weight:bold;margin-bottom:5px;">${sanitizeHtml(
+      seriesName,
+    )}</div>
    ${tooltipRows}
  `;
 };
@@ -21,8 +21,14 @@ import {
  waitFor,
  cleanup,
 } from '../../../../spec/helpers/testing-library';
-import { AxisType, TimeGranularity } from '@superset-ui/core';
+import {
+  AxisType,
+  createTimeRangeFromGranularity,
+  DTTM_ALIAS,
+  TimeGranularity,
+} from '@superset-ui/core';
 import { GenericDataType } from '@apache-superset/core/common';
+import { logging } from '@apache-superset/core/utils';
 import type { EChartsCoreOption } from 'echarts/core';
 import type { ECElementEvent } from 'echarts/types/src/util/types';
 import type { ReactNode } from 'react';
@@ -93,12 +99,17 @@ afterAll(() => {
 });

 afterEach(() => {
+  jest.useRealTimers();
  cleanup();
  mockEchart.mockReset();
  (globalThis as { ResizeObserver?: typeof ResizeObserver }).ResizeObserver =
    originalResizeObserver;
 });

+const advanceClickTimer = () => {
+  jest.advanceTimersByTime(300);
+};
+
 const defaultFormData: EchartsTimeseriesFormData & {
  vizType: string;
  dateFormat: string;
@@ -314,7 +325,8 @@ test('falls back to window resize listener when ResizeObserver is unavailable',
 });

 // Test for issue #25334: Bar chart cross-filter without dimensions
-test('emits cross-filter on X-axis value when no dimensions and categorical X-axis', async () => {
+test('emits cross-filter on X-axis value when no dimensions and categorical X-axis', () => {
+  jest.useFakeTimers();
  const setDataMaskMock = jest.fn();

  const propsWithCategoricalXAxis: TimeseriesChartTransformedProps = {
@@ -348,13 +360,7 @@ test('emits cross-filter on X-axis value when no dimensions and categorical X-ax
      dataIndex: 0,
    });

-    // Wait for the timer (TIMER_DURATION = 300ms)
-    await waitFor(
-      () => {
-        expect(setDataMaskMock).toHaveBeenCalled();
-      },
-      { timeout: 500 },
-    );
+    advanceClickTimer();

    // Verify the cross-filter uses the X-axis column and value, not the metric
    const dataMaskCall = setDataMaskMock.mock.calls[0][0];
@@ -368,7 +374,8 @@ test('emits cross-filter on X-axis value when no dimensions and categorical X-ax
  }
 });

-test('emits cross-filter on category value for horizontal bar clicks', async () => {
+test('emits cross-filter on category value for horizontal bar clicks', () => {
+  jest.useFakeTimers();
  const setDataMaskMock = jest.fn();

  render(
@@ -397,12 +404,7 @@ test('emits cross-filter on category value for horizontal bar clicks', async ()
    dataIndex: 0,
  });

-  await waitFor(
-    () => {
-      expect(setDataMaskMock).toHaveBeenCalled();
-    },
-    { timeout: 500 },
-  );
+  advanceClickTimer();

  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
    {
@@ -424,9 +426,7 @@ test('uses rendered categorical axis for query event handlers', () => {
    />,
  );

-  expect(getLatestEchartProps().queryEventHandlers?.[0].query).toBe(
-    'xAxis.category',
-  );
+  expect(getLatestEchartProps().queryEventHandlers?.[0].query).toBe('xAxis');

  cleanup();
  mockEchart.mockReset();
@@ -445,9 +445,7 @@ test('uses rendered categorical axis for query event handlers', () => {
    />,
  );

-  expect(getLatestEchartProps().queryEventHandlers?.[0].query).toBe(
-    'yAxis.category',
-  );
+  expect(getLatestEchartProps().queryEventHandlers?.[0].query).toBe('yAxis');
 });

 test('emits cross-filter from horizontal categorical axis label clicks', () => {
@@ -473,8 +471,9 @@ test('emits cross-filter from horizontal categorical axis label clicks', () => {
    getLatestEchartProps().queryEventHandlers?.[0].handler;
  expect(labelClickHandler).toBeDefined();
  labelClickHandler?.({
+    targetType: 'axisLabel',
    value: 'Product A',
-  } as ECElementEvent);
+  } as unknown as ECElementEvent);

  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
    {
@@ -485,7 +484,8 @@ test('emits cross-filter from horizontal categorical axis label clicks', () => {
  ]);
 });

-test('does not emit duplicate cross-filter for generic axis label clicks', async () => {
+test('does not emit duplicate cross-filter for generic axis label clicks', () => {
+  jest.useFakeTimers();
  const setDataMaskMock = jest.fn();

  render(
@@ -507,11 +507,28 @@ test('does not emit duplicate cross-filter for generic axis label clicks', async
    name: 'Product A',
  });

-  await new Promise(resolve => setTimeout(resolve, 400));
+  jest.advanceTimersByTime(400);
  expect(setDataMaskMock).not.toHaveBeenCalled();
 });

-test('does not emit cross-filter when no dimensions and time-based X-axis', async () => {
+test('keeps temporal range exclusive ends on whole-second boundaries', () => {
+  const clickedTimestamp = new Date(Date.UTC(2021, 0, 15, 12, 34, 56, 789));
+
+  [TimeGranularity.DAY, TimeGranularity.MONTH, TimeGranularity.YEAR].forEach(
+    grain => {
+      const [, inclusiveEnd] = createTimeRangeFromGranularity(
+        clickedTimestamp,
+        grain,
+        false,
+      );
+      const exclusiveEnd = new Date(inclusiveEnd.getTime() + 1);
+
+      expect(exclusiveEnd.getUTCMilliseconds()).toBe(0);
+    },
+  );
+});
+
+test('emits TEMPORAL_RANGE cross-filter from time axis label click on day bucket', () => {
  const setDataMaskMock = jest.fn();

  const propsWithTimeXAxis: TimeseriesChartTransformedProps = {
@@ -519,39 +536,610 @@ test('does not emit cross-filter when no dimensions and time-based X-axis', asyn
    emitCrossFilters: true,
    setDataMask: setDataMaskMock,
    groupby: [], // No dimensions
+    resolvedTimeGrain: TimeGranularity.DAY,
+    formData: {
+      ...defaultFormData,
+      granularitySqla: 'ds',
+      timeGrainSqla: TimeGranularity.DAY,
+    },
    xAxis: {
-      label: '__timestamp',
-      type: AxisType.Time, // Time-based X-axis (not categorical)
+      label: DTTM_ALIAS,
+      type: AxisType.Time,
    },
  };

  render(<EchartsTimeseries {...propsWithTimeXAxis} />);

-  const lastCall = mockEchart.mock.calls.at(-1);
-  expect(lastCall).toBeDefined();
-  const [props] = lastCall as [EchartsProps];
+  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
+    ({ query }) => query === 'xAxis',
+  )?.handler;
+  expect(labelClickHandler).toBeDefined();
+  labelClickHandler?.({
+    targetType: 'axisLabel',
+    value: '2021-01-01',
+  } as unknown as ECElementEvent);

-  // Simulate a click event
-  const clickHandler = props.eventHandlers?.click;
-  if (clickHandler) {
-    clickHandler({
-      componentType: 'series',
-      seriesName: 'Sales',
-      data: [1609459200000, 100], // Timestamp
-      name: '2021-01-01',
-      dataIndex: 0,
-    });
+  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2021-01-02T00:00:00',
+    },
+  ]);
+});

-    // Wait a bit and verify setDataMask was NOT called
-    await new Promise(resolve => setTimeout(resolve, 400));
-    expect(setDataMaskMock).not.toHaveBeenCalled();
-  }
+test('emits TEMPORAL_RANGE cross-filter from time axis label click on month bucket', () => {
+  const setDataMaskMock = jest.fn();
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      setDataMask={setDataMaskMock}
+      groupby={[]}
+      resolvedTimeGrain={TimeGranularity.MONTH}
+      formData={{
+        ...defaultFormData,
+        granularitySqla: 'ds',
+        timeGrainSqla: TimeGranularity.MONTH,
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
+    ({ query }) => query === 'xAxis',
+  )?.handler;
+  expect(labelClickHandler).toBeDefined();
+  labelClickHandler?.({
+    targetType: 'axisLabel',
+    value: '2021-01-01',
+  } as unknown as ECElementEvent);
+
+  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
+    },
+  ]);
+});
+
+test('emits TEMPORAL_RANGE cross-filter from time axis label click on year bucket', () => {
+  const setDataMaskMock = jest.fn();
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      setDataMask={setDataMaskMock}
+      groupby={[]}
+      resolvedTimeGrain={TimeGranularity.YEAR}
+      formData={{
+        ...defaultFormData,
+        granularitySqla: 'ds',
+        timeGrainSqla: TimeGranularity.YEAR,
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
+    ({ query }) => query === 'xAxis',
+  )?.handler;
+  expect(labelClickHandler).toBeDefined();
+  labelClickHandler?.({
+    targetType: 'axisLabel',
+    value: '2021-01-01',
+  } as unknown as ECElementEvent);
+
+  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2022-01-01T00:00:00',
+    },
+  ]);
+});
+
+test('emits upper-exclusive TEMPORAL_RANGE from time point click on month bucket', () => {
+  jest.useFakeTimers();
+  const setDataMaskMock = jest.fn();
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      setDataMask={setDataMaskMock}
+      groupby={[]}
+      resolvedTimeGrain={TimeGranularity.MONTH}
+      formData={{
+        ...defaultFormData,
+        granularitySqla: 'ds',
+        timeGrainSqla: TimeGranularity.MONTH,
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const clickHandler = getLatestEchartProps().eventHandlers?.click;
+  expect(clickHandler).toBeDefined();
+  clickHandler?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: [Date.UTC(2021, 0, 1), 100],
+    name: '2021-01-01',
+    dataIndex: 0,
+  });
+
+  advanceClickTimer();
+
+  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
+    },
+  ]);
+});
+
+test('emits TEMPORAL_RANGE from string-typed time point click value', () => {
+  jest.useFakeTimers();
+  const setDataMaskMock = jest.fn();
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      setDataMask={setDataMaskMock}
+      groupby={[]}
+      resolvedTimeGrain={TimeGranularity.MONTH}
+      formData={{
+        ...defaultFormData,
+        granularitySqla: 'ds',
+        timeGrainSqla: TimeGranularity.MONTH,
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const clickHandler = getLatestEchartProps().eventHandlers?.click;
+  expect(clickHandler).toBeDefined();
+  clickHandler?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: ['2021-01-01T00:00:00Z', 100],
+    name: '2021-01-01',
+    dataIndex: 0,
+  });
+
+  advanceClickTimer();
+
+  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
+    },
+  ]);
+});
+
+test('uses resolved time grain for temporal point-click cross-filter', () => {
+  jest.useFakeTimers();
+  const setDataMaskMock = jest.fn();
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      setDataMask={setDataMaskMock}
+      groupby={[]}
+      resolvedTimeGrain={TimeGranularity.MONTH}
+      formData={{
+        ...defaultFormData,
+        granularitySqla: 'ds',
+        timeGrainSqla: TimeGranularity.DAY,
+        extraFormData: {
+          time_grain_sqla: TimeGranularity.MONTH,
+        },
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const clickHandler = getLatestEchartProps().eventHandlers?.click;
+  expect(clickHandler).toBeDefined();
+  clickHandler?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: [Date.UTC(2021, 0, 1), 100],
+    name: '2021-01-01',
+    dataIndex: 0,
+  });
+
+  advanceClickTimer();
+
+  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
+    },
+  ]);
+});
+
+test('emits TEMPORAL_RANGE from horizontal time point click using timestamp, not metric', () => {
+  jest.useFakeTimers();
+  const setDataMaskMock = jest.fn();
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      setDataMask={setDataMaskMock}
+      groupby={[]}
+      resolvedTimeGrain={TimeGranularity.MONTH}
+      formData={{
+        ...defaultFormData,
+        orientation: OrientationType.Horizontal,
+        granularitySqla: 'ds',
+        timeGrainSqla: TimeGranularity.MONTH,
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const clickHandler = getLatestEchartProps().eventHandlers?.click;
+  expect(clickHandler).toBeDefined();
+  clickHandler?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: [129, Date.UTC(2021, 0, 1)],
+    name: '2021-01-01',
+    dataIndex: 0,
+  });
+
+  advanceClickTimer();
+
+  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
+    },
+  ]);
+});
+
+test('emits TEMPORAL_RANGE cross-filter from horizontal time axis label click', () => {
+  const setDataMaskMock = jest.fn();
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      setDataMask={setDataMaskMock}
+      groupby={[]}
+      resolvedTimeGrain={TimeGranularity.MONTH}
+      formData={{
+        ...defaultFormData,
+        orientation: OrientationType.Horizontal,
+        granularitySqla: 'ds',
+        timeGrainSqla: TimeGranularity.MONTH,
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
+    ({ query }) => query === 'yAxis',
+  )?.handler;
+  expect(labelClickHandler).toBeDefined();
+  labelClickHandler?.({
+    targetType: 'axisLabel',
+    value: '2021-01-01',
+  } as unknown as ECElementEvent);
+
+  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
+    },
+  ]);
+});
+
+test('warns and skips temporal axis label cross-filter when label value cannot be parsed', () => {
+  const setDataMaskMock = jest.fn();
+  const warn = jest.spyOn(logging, 'warn').mockImplementation();
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      setDataMask={setDataMaskMock}
+      groupby={[]}
+      formData={{
+        ...defaultFormData,
+        granularitySqla: 'ds',
+        timeGrainSqla: TimeGranularity.MONTH,
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
+    ({ query }) => query === 'xAxis',
+  )?.handler;
+  expect(labelClickHandler).toBeDefined();
+  labelClickHandler?.({
+    targetType: 'axisLabel',
+    value: 'not-a-date',
+  } as unknown as ECElementEvent);
+
+  expect(setDataMaskMock).not.toHaveBeenCalled();
+  expect(warn).toHaveBeenCalledWith(
+    'Unable to parse time axis value for cross-filtering',
+    'not-a-date',
+  );
+
+  warn.mockRestore();
+});
+
+test('logs and skips temporal point-click cross-filter when string value cannot be parsed', () => {
+  jest.useFakeTimers();
+  const setDataMaskMock = jest.fn();
+  const warn = jest.spyOn(logging, 'warn').mockImplementation();
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      setDataMask={setDataMaskMock}
+      groupby={[]}
+      resolvedTimeGrain={TimeGranularity.MONTH}
+      formData={{
+        ...defaultFormData,
+        granularitySqla: 'ds',
+        timeGrainSqla: TimeGranularity.MONTH,
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const clickHandler = getLatestEchartProps().eventHandlers?.click;
+  expect(clickHandler).toBeDefined();
+  clickHandler?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: ['not-a-date', 100],
+    name: 'not-a-date',
+    dataIndex: 0,
+  });
+
+  advanceClickTimer();
+
+  expect(setDataMaskMock).not.toHaveBeenCalled();
+  expect(warn).toHaveBeenCalledWith(
+    'Unable to parse time axis value for cross-filtering',
+    'not-a-date',
+  );
+
+  warn.mockRestore();
+});
+
+test('emits empty temporal X-axis data mask when filter grain is missing', () => {
+  jest.useFakeTimers();
+  const setDataMaskMock = jest.fn();
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      setDataMask={setDataMaskMock}
+      groupby={[]}
+      formData={{
+        ...defaultFormData,
+        granularitySqla: 'ds',
+        timeGrainSqla: undefined,
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const clickHandler = getLatestEchartProps().eventHandlers?.click;
+  expect(clickHandler).toBeDefined();
+  clickHandler?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: [Date.UTC(2021, 0, 1), 100],
+    name: '2021-01-01',
+    dataIndex: 0,
+  });
+
+  advanceClickTimer();
+
+  expect(setDataMaskMock.mock.calls[0][0]).toEqual({
+    extraFormData: {
+      filters: [],
+    },
+    filterState: {
+      label: undefined,
+      value: null,
+      selectedValues: null,
+    },
+  });
+});
+
+test('clears temporal X-axis cross-filter when clicking selected bucket again', () => {
+  jest.useFakeTimers();
+  const setDataMaskMock = jest.fn();
+  const selectedRange = '2021-01-01T00:00:00 : 2021-02-01T00:00:00';
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      setDataMask={setDataMaskMock}
+      groupby={[]}
+      selectedValues={{ 0: selectedRange }}
+      resolvedTimeGrain={TimeGranularity.MONTH}
+      formData={{
+        ...defaultFormData,
+        granularitySqla: 'ds',
+        timeGrainSqla: TimeGranularity.MONTH,
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const clickHandler = getLatestEchartProps().eventHandlers?.click;
+  expect(clickHandler).toBeDefined();
+  clickHandler?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: [Date.UTC(2021, 0, 1), 100],
+    name: '2021-01-01',
+    dataIndex: 0,
+  });
+
+  advanceClickTimer();
+
+  expect(setDataMaskMock.mock.calls[0][0]).toEqual({
+    extraFormData: {
+      filters: [],
+    },
+    filterState: {
+      label: undefined,
+      value: null,
+      selectedValues: null,
+    },
+  });
+});
+
+test('does not emit temporal X-axis label cross-filter when dimensions are set', () => {
+  const setDataMaskMock = jest.fn();
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      setDataMask={setDataMaskMock}
+      groupby={['country']}
+      formData={{
+        ...defaultFormData,
+        groupby: ['country'],
+        granularitySqla: 'ds',
+        timeGrainSqla: TimeGranularity.MONTH,
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
+    ({ query }) => query === 'xAxis',
+  )?.handler;
+  expect(labelClickHandler).toBeDefined();
+  labelClickHandler?.({
+    targetType: 'axisLabel',
+    value: '2021-01-01',
+  } as unknown as ECElementEvent);
+
+  expect(setDataMaskMock).not.toHaveBeenCalled();
+});
+
+test('does not emit temporal X-axis cross-filter when dimensions are set', () => {
+  jest.useFakeTimers();
+  const setDataMaskMock = jest.fn();
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      setDataMask={setDataMaskMock}
+      groupby={['country']}
+      labelMap={{
+        Sales: ['US'],
+      }}
+      formData={{
+        ...defaultFormData,
+        groupby: ['country'],
+        granularitySqla: 'ds',
+        timeGrainSqla: TimeGranularity.MONTH,
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const clickHandler = getLatestEchartProps().eventHandlers?.click;
+  expect(clickHandler).toBeDefined();
+  clickHandler?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: [Date.UTC(2021, 0, 1), 100],
+    name: '2021-01-01',
+    dataIndex: 0,
+  });
+
+  advanceClickTimer();
+
+  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
+    {
+      col: 'country',
+      op: 'IN',
+      val: ['US'],
+    },
+  ]);
+  expect(
+    setDataMaskMock.mock.calls[0][0].extraFormData.filters.some(
+      (filter: { op: string }) => filter.op === 'TEMPORAL_RANGE',
+    ),
+  ).toBe(false);
 });

 // Test for issue #41102: horizontal bar cross-filter must use the category
 // value, not the metric. For horizontal bars the data tuple is value-first
 // (e.g. [100, 'Product A']), so relying on data[0] emitted the metric value.
-test('emits cross-filter on the category value for a horizontal categorical bar', async () => {
+test('emits cross-filter on the category value for a horizontal categorical bar', () => {
+  jest.useFakeTimers();
  const setDataMaskMock = jest.fn();

  const propsWithHorizontalXAxis: TimeseriesChartTransformedProps = {
@@ -585,12 +1173,7 @@ test('emits cross-filter on the category value for a horizontal categorical bar'
      dataIndex: 0,
    });

-    await waitFor(
-      () => {
-        expect(setDataMaskMock).toHaveBeenCalled();
-      },
-      { timeout: 500 },
-    );
+    advanceClickTimer();

    // Must filter on the category ('Product A'), not the metric value (100)
    const dataMaskCall = setDataMaskMock.mock.calls[0][0];
@@ -604,6 +1187,55 @@ test('emits cross-filter on the category value for a horizontal categorical bar'
  }
 });

+test('context menu cross-filter is available for a temporal bar point', async () => {
+  const onContextMenuMock = jest.fn();
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      onContextMenu={onContextMenuMock}
+      groupby={[]}
+      resolvedTimeGrain={TimeGranularity.MONTH}
+      formData={{
+        ...defaultFormData,
+        granularitySqla: 'ds',
+        timeGrainSqla: TimeGranularity.DAY,
+        extraFormData: {
+          time_grain_sqla: TimeGranularity.MONTH,
+        },
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const contextMenuHandler = getLatestEchartProps().eventHandlers?.contextmenu;
+  expect(contextMenuHandler).toBeDefined();
+  await contextMenuHandler?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: [Date.UTC(2021, 0, 1), 100],
+    name: '2021-01-01',
+    event: { stop: jest.fn(), event: { clientX: 10, clientY: 20 } },
+  });
+
+  await waitFor(() => {
+    expect(onContextMenuMock).toHaveBeenCalled();
+  });
+
+  const { crossFilter } = onContextMenuMock.mock.calls[0][2];
+  expect(crossFilter.dataMask.extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
+    },
+  ]);
+});
+
 // Test for issue #41102: the context-menu ("Add cross-filter") path must also
 // use the category value, not the metric, for a horizontal categorical bar.
 test('context menu cross-filter uses the category value for a horizontal categorical bar', async () => {
@@ -21,14 +21,17 @@ import {
  DTTM_ALIAS,
  BinaryQueryObjectFilterClause,
  AxisType,
+  type TimeGranularity,
  getTimeFormatter,
  getColumnLabel,
  getNumberFormatter,
  LegendState,
  ensureIsArray,
+  createTimeRangeFromGranularity,
 } from '@superset-ui/core';
 import { useTheme } from '@apache-superset/core/theme';
 import { GenericDataType } from '@apache-superset/core/common';
+import { logging } from '@apache-superset/core/utils';
 import type {
  ECElementEvent,
  ViewRootGroup,
@@ -48,6 +51,29 @@ import { getTemporalXAxisDrillByFilter } from '../utils/xAxisDrillByFilter';
 import { ExtraControls } from '../components/ExtraControls';

 const TIMER_DURATION = 300;
+const getTimestampFromTimeAxisValue = (value: string | number) => {
+  if (typeof value === 'number') {
+    return Number.isFinite(value) ? value : undefined;
+  }
+  const timestamp = Date.parse(value);
+  if (Number.isNaN(timestamp)) {
+    logging.warn('Unable to parse time axis value for cross-filtering', value);
+  }
+  return Number.isNaN(timestamp) ? undefined : timestamp;
+};
+
+// Day, month, and year ranges end at 23:59:59.999, so adding 1ms lands on a
+// whole-second next bucket boundary. The formatter intentionally emits seconds.
+const formatDateTime = (date: Date) =>
+  `${[
+    date.getUTCFullYear(),
+    String(date.getUTCMonth() + 1).padStart(2, '0'),
+    String(date.getUTCDate()).padStart(2, '0'),
+  ].join('-')}T${[
+    String(date.getUTCHours()).padStart(2, '0'),
+    String(date.getUTCMinutes()).padStart(2, '0'),
+    String(date.getUTCSeconds()).padStart(2, '0'),
+  ].join(':')}`;

 // Percent-change draggable baseline handle geometry, in pixels.
 const BASELINE_HANDLE_WIDTH = 8;
@@ -71,6 +97,7 @@ export default function EchartsTimeseries({
  onFocusedSeries,
  xValueFormatter,
  xAxis,
+  resolvedTimeGrain,
  refs,
  emitCrossFilters,
  coltypeMapping,
@@ -363,6 +390,65 @@ export default function EchartsTimeseries({
    [selectedValues, xAxis.label],
  );

+  const getTimeAxisCrossFilterDataMask = useCallback(
+    (clickedTimestamp: number) => {
+      const filterColumn =
+        xAxis.label === DTTM_ALIAS ? formData.granularitySqla : xAxis.label;
+      const grain = resolvedTimeGrain as TimeGranularity | undefined;
+
+      if (!filterColumn || !grain) {
+        return {
+          dataMask: {
+            extraFormData: {
+              filters: [],
+            },
+            filterState: {
+              label: undefined,
+              value: null,
+              selectedValues: null,
+            },
+          },
+          isCurrentValueSelected: false,
+        };
+      }
+
+      const [start, inclusiveEnd] = createTimeRangeFromGranularity(
+        new Date(clickedTimestamp),
+        grain,
+        false,
+      );
+      const exclusiveEnd = new Date(inclusiveEnd.getTime() + 1);
+      const timeRange = `${formatDateTime(start)} : ${formatDateTime(exclusiveEnd)}`;
+      const selected: string[] = Object.values(selectedValues);
+      const isCurrentValueSelected = selected.includes(timeRange);
+      const values = isCurrentValueSelected ? [] : [timeRange];
+
+      return {
+        dataMask: {
+          extraFormData: {
+            filters:
+              values.length === 0
+                ? []
+                : [
+                    {
+                      col: filterColumn,
+                      op: 'TEMPORAL_RANGE' as const,
+                      val: timeRange,
+                    },
+                  ],
+          },
+          filterState: {
+            label: values.length ? values : undefined,
+            value: values.length ? values : null,
+            selectedValues: values.length ? values : null,
+          },
+        },
+        isCurrentValueSelected,
+      };
+    },
+    [formData.granularitySqla, resolvedTimeGrain, selectedValues, xAxis.label],
+  );
+
  const handleChange = useCallback(
    (value: string) => {
      if (!emitCrossFilters) {
@@ -384,15 +470,26 @@ export default function EchartsTimeseries({
    [emitCrossFilters, setDataMask, getXAxisCrossFilterDataMask],
  );

+  const handleTimeAxisChange = useCallback(
+    (clickedTimestamp: number) => {
+      if (!emitCrossFilters) {
+        return;
+      }
+      setDataMask(getTimeAxisCrossFilterDataMask(clickedTimestamp).dataMask);
+    },
+    [emitCrossFilters, setDataMask, getTimeAxisCrossFilterDataMask],
+  );
+
  // Determine if X-axis can be used for cross-filtering (categorical axis without dimensions)
  const canCrossFilterByXAxis =
-    !hasDimensions && xAxis.type === AxisType.Category;
-  const categoryAxisValueIndex =
+    !hasDimensions &&
+    (xAxis.type === AxisType.Category || xAxis.type === AxisType.Time);
+  const xAxisValueIndex =
    formData.orientation === OrientationType.Horizontal ? 1 : 0;
-  const getCategoryAxisValue = useCallback(
+  const getXAxisValue = useCallback(
    (data: unknown, name: unknown) => {
      if (Array.isArray(data)) {
-        const categoryAxisValue = data[categoryAxisValueIndex];
+        const categoryAxisValue = data[xAxisValueIndex];
        if (
          typeof categoryAxisValue === 'string' ||
          typeof categoryAxisValue === 'number'
@@ -405,7 +502,7 @@ export default function EchartsTimeseries({
      }
      return undefined;
    },
-    [categoryAxisValueIndex],
+    [xAxisValueIndex],
  );

  const eventHandlers: EventHandlers = {
@@ -423,15 +520,28 @@ export default function EchartsTimeseries({
          // Cross-filter by dimension (original behavior)
          const { seriesName: name } = props;
          handleChange(name);
-        } else if (canCrossFilterByXAxis && props.componentType === 'series') {
+        } else if (
+          canCrossFilterByXAxis &&
+          xAxis.type === AxisType.Category &&
+          props.componentType === 'series'
+        ) {
          // Cross-filter by X-axis value when no dimensions (issue #25334)
-          const categoryAxisValue = getCategoryAxisValue(
-            props.data,
-            props.name,
-          );
+          const categoryAxisValue = getXAxisValue(props.data, props.name);
          if (categoryAxisValue !== undefined) {
            handleXAxisChange(categoryAxisValue);
          }
+        } else if (
+          canCrossFilterByXAxis &&
+          xAxis.type === AxisType.Time &&
+          props.componentType === 'series'
+        ) {
+          const timeAxisValue = getXAxisValue(props.data, props.name);
+          if (timeAxisValue !== undefined) {
+            const timestamp = getTimestampFromTimeAxisValue(timeAxisValue);
+            if (timestamp !== undefined) {
+              handleTimeAxisChange(timestamp);
+            }
+          }
        }
      }, TIMER_DURATION);
    },
@@ -466,17 +576,20 @@ export default function EchartsTimeseries({
        ];
        const groupBy = ensureIsArray(formData.groupby);
        if (data && xAxis.type === AxisType.Time) {
-          drillToDetailFilters.push({
-            col:
-              // if the xAxis is '__timestamp', granularity_sqla will be the column of filter
-              xAxis.label === DTTM_ALIAS
-                ? formData.granularitySqla
-                : xAxis.label,
-            grain: formData.timeGrainSqla,
-            op: '==',
-            val: data[0],
-            formattedVal: xValueFormatter(data[0]),
-          });
+          const timeAxisValue = getXAxisValue(data, eventParams.name);
+          if (timeAxisValue !== undefined) {
+            drillToDetailFilters.push({
+              col:
+                // if the xAxis is '__timestamp', granularity_sqla will be the column of filter
+                xAxis.label === DTTM_ALIAS
+                  ? formData.granularitySqla
+                  : xAxis.label,
+              grain: resolvedTimeGrain,
+              op: '==',
+              val: timeAxisValue,
+              formattedVal: xValueFormatter(timeAxisValue),
+            });
+          }
        }
        [
          ...(xAxis.type === AxisType.Category && data ? [xAxis.label] : []),
@@ -517,9 +630,7 @@ export default function EchartsTimeseries({
          xAxis.label === DTTM_ALIAS ? formData.granularitySqla : xAxis.label;
        if (data && xAxis.type === AxisType.Time && xAxisCol) {
          // For horizontal orientation the [x, value] pair is swapped
-          const xValue = Array.isArray(data)
-            ? data[categoryAxisValueIndex]
-            : data;
+          const xValue = Array.isArray(data) ? data[xAxisValueIndex] : data;
          const xAxisFilter = getTemporalXAxisDrillByFilter(
            xAxisCol,
            xValue,
@@ -530,10 +641,7 @@ export default function EchartsTimeseries({
            xAxisFilters.push(xAxisFilter);
          }
        } else if (xAxis.type === AxisType.Category && xAxisCol) {
-          const categoryAxisValue = getCategoryAxisValue(
-            data,
-            eventParams.name,
-          );
+          const categoryAxisValue = getXAxisValue(data, eventParams.name);
          if (categoryAxisValue !== undefined) {
            // A category axis can still sit on a temporal column when the
            // axis is forced categorical; filter by time bucket in that case
@@ -564,15 +672,25 @@ export default function EchartsTimeseries({
          crossFilter = getCrossFilterDataMask(seriesName);
        } else if (
          canCrossFilterByXAxis &&
+          xAxis.type === AxisType.Category &&
          eventParams.componentType === 'series'
        ) {
-          const categoryAxisValue = getCategoryAxisValue(
-            data,
-            eventParams.name,
-          );
+          const categoryAxisValue = getXAxisValue(data, eventParams.name);
          if (categoryAxisValue !== undefined) {
            crossFilter = getXAxisCrossFilterDataMask(categoryAxisValue);
          }
+        } else if (
+          canCrossFilterByXAxis &&
+          xAxis.type === AxisType.Time &&
+          eventParams.componentType === 'series'
+        ) {
+          const timeAxisValue = getXAxisValue(data, eventParams.name);
+          if (timeAxisValue !== undefined) {
+            const timestamp = getTimestampFromTimeAxisValue(timeAxisValue);
+            if (timestamp !== undefined) {
+              crossFilter = getTimeAxisCrossFilterDataMask(timestamp);
+            }
+          }
        }

        onContextMenu(pointerEvent.clientX, pointerEvent.clientY, {
@@ -593,26 +711,39 @@ export default function EchartsTimeseries({
      const { value } = event;
      if (
        canCrossFilterByXAxis &&
+        event.targetType === 'axisLabel' &&
        (typeof value === 'string' || typeof value === 'number')
      ) {
-        handleXAxisChange(value);
+        if (xAxis.type === AxisType.Time) {
+          const timestamp = getTimestampFromTimeAxisValue(value);
+          if (timestamp !== undefined) {
+            handleTimeAxisChange(timestamp);
+          }
+        } else {
+          handleXAxisChange(value);
+        }
      }
    },
-    [canCrossFilterByXAxis, handleXAxisChange],
+    [
+      canCrossFilterByXAxis,
+      handleTimeAxisChange,
+      handleXAxisChange,
+      xAxis.type,
+    ],
  );

-  const categoryAxis =
+  const renderedXAxis =
    formData.orientation === OrientationType.Horizontal ? 'yAxis' : 'xAxis';

  const queryEventHandlers = useMemo(
    () => [
      {
        name: 'click',
-        query: `${categoryAxis}.category`,
+        query: renderedXAxis,
        handler: handleXAxisLabelClick,
      },
    ],
-    [categoryAxis, handleXAxisLabelClick],
+    [renderedXAxis, handleXAxisLabelClick],
  );

  const zrEventHandlers: EventHandlers = {
@@ -102,15 +102,18 @@ export default function buildQuery(formData: QueryFormData) {
          1. The resample, rolling, cum, timeCompare operators should be after pivot.
          2. Resample must come before rolling so that imputed values are
             included in the rolling window calculation.
-          3. the flatOperator makes multiIndex Dataframe into flat Dataframe
+          3. Contribution must come before rename because it relies on the
+             `__<time offset>` suffix to compute each time shift separately,
+             and rename strips that suffix.
+          4. the flatOperator makes multiIndex Dataframe into flat Dataframe
        */
        post_processing: [
          pivotOperatorInRuntime,
          resampleOperator(formData, baseQueryObject),
          rollingWindowOperator(formData, baseQueryObject),
          timeCompareOperator(formData, baseQueryObject),
-          renameOperator(formData, baseQueryObject),
          contributionOperator(formData, baseQueryObject, time_offsets),
+          renameOperator(formData, baseQueryObject),
          sortOperator(formData, baseQueryObject),
          flattenOperator(formData, baseQueryObject),
          // todo: move prophet before flatten
@@ -1248,7 +1248,7 @@ export default function transformProps(
    name: xAxisTitle,
    nameGap: convertInteger(xAxisTitleMargin),
    nameLocation: 'middle',
-    ...(xAxisType === AxisType.Category &&
+    ...((xAxisType === AxisType.Category || xAxisType === AxisType.Time) &&
      groupBy.length === 0 && {
        triggerEvent: true,
      }),
@@ -1256,10 +1256,12 @@ export default function transformProps(
      // When rotation is applied on time axes, hideOverlap can
      // aggressively hide the last label. Rotated labels already
      // have less overlap, so disabling hideOverlap is safe.
-      // At 0° rotation, keep hideOverlap to prevent long labels
-      // from overlapping each other, with showMaxLabel to ensure
-      // the last data point label stays visible (#37181).
-      hideOverlap: !(xAxisType === AxisType.Time && xAxisLabelRotation !== 0),
+      // At 0° rotation, also disable hideOverlap when showMaxLabel
+      // is active so the forced boundary label is never suppressed
+      // by ECharts' overlap detection (#39899).
+      hideOverlap: showMaxLabel
+        ? false
+        : !(xAxisType === AxisType.Time && xAxisLabelRotation !== 0),
      formatter: deduplicatedFormatter,
      rotate: xAxisLabelRotation,
      interval: xAxisLabelInterval,
@@ -1598,6 +1600,7 @@ export default function transformProps(
      label: xAxisLabel,
      type: xAxisType,
    },
+    resolvedTimeGrain,
    refs,
    coltypeMapping: dataTypes,
    onLegendScroll,
@@ -122,5 +122,6 @@ export type TimeseriesChartTransformedProps =
        label: string;
        type: AxisType;
      };
+      resolvedTimeGrain?: TimeGranularity;
      onFocusedSeries: (series: string | null) => void;
    };
@@ -28,6 +28,7 @@
 */

 import { z } from 'zod';
+import { sanitizeHtml } from '@superset-ui/core';

 // =============================================================================
 // Common Schemas
@@ -57,6 +58,33 @@ const fontStyleSchema = z.enum(['normal', 'italic', 'oblique']);
 /** Symbol type */
 const symbolTypeSchema = z.string();

+/**
+ * With the ECharts default renderMode 'html', a string tooltip formatter is
+ * assigned to the tooltip DOM element via innerHTML. ECharts formatter
+ * strings commonly rely on inline markup (e.g. '{b}<br/>{c}') for layout, so
+ * rejecting every '<' would break that supported usage; instead the value is
+ * run through the same allowlist sanitizer used for other tooltip HTML,
+ * which keeps presentational tags and strips anything else.
+ */
+const sanitizedFormatterSchema = z
+  .string()
+  .transform(value => sanitizeHtml(value));
+
+/**
+ * ECharts navigates to title.link/sublink on click, so restrict them to
+ * http(s) and same-origin relative paths.
+ */
+const safeLinkSchema = z
+  .string()
+  .refine(
+    value =>
+      /^https?:\/\//i.test(value) ||
+      (value.startsWith('/') && !value.startsWith('//')),
+    {
+      message: 'Only http(s) or same-origin relative URLs are allowed',
+    },
+  );
+
 // =============================================================================
 // Text Style Schema
 // =============================================================================
@@ -168,11 +196,11 @@ export const titleSchema = z.object({
  id: z.string().optional(),
  show: z.boolean().optional(),
  text: z.string().optional(),
-  link: z.string().optional(),
+  link: safeLinkSchema.optional(),
  target: z.enum(['self', 'blank']).optional(),
  textStyle: textStyleSchema.optional(),
  subtext: z.string().optional(),
-  sublink: z.string().optional(),
+  sublink: safeLinkSchema.optional(),
  subtarget: z.enum(['self', 'blank']).optional(),
  subtextStyle: textStyleSchema.optional(),
  textAlign: z.enum(['left', 'center', 'right']).optional(),
@@ -386,7 +414,9 @@ export const tooltipSchema = z.object({
      z.array(z.union([z.number(), z.string()])),
    ])
    .optional(),
-  formatter: z.string().optional(), // Only string formatters
+  // Only string formatters: a string tooltip formatter is rendered via
+  // innerHTML (default renderMode 'html'), so it is sanitized above.
+  formatter: sanitizedFormatterSchema.optional(),
  padding: z.union([z.number(), z.array(z.number())]).optional(),
  backgroundColor: colorSchema.optional(),
  borderColor: colorSchema.optional(),
@@ -397,7 +427,9 @@ export const tooltipSchema = z.object({
  shadowOffsetX: z.number().optional(),
  shadowOffsetY: z.number().optional(),
  textStyle: textStyleSchema.optional(),
-  extraCssText: z.string().optional(),
+  // `extraCssText` is intentionally not accepted; unknown keys are
+  // stripped by the schema, so configs that still carry it keep working
+  // minus the raw CSS.
  order: z
    .enum(['seriesAsc', 'seriesDesc', 'valueAsc', 'valueDesc'])
    .optional(),
@@ -575,6 +607,9 @@ export const seriesSchema = z.object({
  polarIndex: z.number().optional(),
  geoIndex: z.number().optional(),
  calendarIndex: z.number().optional(),
+  // Per-series `tooltip` is intentionally not admitted; the schema
+  // strips unknown keys. If per-series tooltips are ever admitted, reuse
+  // tooltipSchema so the formatter sanitization applies.
  label: labelSchema.optional(),
  labelLine: z
    .object({
@@ -523,3 +523,73 @@ test('EChartOptionsParseError contains validation error details', () => {
    );
  }
 });
+
+// =============================================================================
+// Creator-authored options must not reach the tooltip's innerHTML/
+// navigation sinks unsanitized.
+// =============================================================================
+
+test('sanitizes tooltip string formatters instead of rejecting all markup', () => {
+  const input = `{ tooltip: { formatter: '<img src=x onerror=alert(1)>' } }`;
+  const result = parseEChartOptions(input);
+
+  expect(result.success).toBe(true);
+  expect(result.data?.tooltip).toEqual({ formatter: '<img src>' });
+});
+
+test('keeps presentational tags in tooltip string formatters', () => {
+  const input = `{ tooltip: { formatter: '{b}<br/>{c}' } }`;
+  const result = parseEChartOptions(input);
+
+  expect(result.success).toBe(true);
+  expect(result.data?.tooltip).toEqual({ formatter: '{b}<br />{c}' });
+});
+
+test('strips per-series tooltip config so its formatter never reaches the merge', () => {
+  const result = parseEChartOptions(
+    `{ series: [{ type: 'line', tooltip: { formatter: '<b onpointerover=alert(1)>x</b>' } }] }`,
+  );
+
+  expect(result.success).toBe(true);
+  expect(result.data).toEqual({ series: [{ type: 'line' }] });
+});
+
+test('accepts markup-free tooltip placeholder formatters', () => {
+  const input = `{ tooltip: { formatter: '{b}: {c}' } }`;
+  const result = parseEChartOptions(input);
+
+  expect(result.success).toBe(true);
+  expect(result.data).toEqual({ tooltip: { formatter: '{b}: {c}' } });
+});
+
+test('rejects javascript: URLs in title link and sublink', () => {
+  expect(() =>
+    parseEChartOptions(`{ title: { link: 'javascript:alert(1)' } }`),
+  ).toThrow(EChartOptionsParseError);
+  expect(() =>
+    parseEChartOptions(`{ title: { sublink: 'javascript:alert(1)' } }`),
+  ).toThrow(EChartOptionsParseError);
+  expect(() =>
+    parseEChartOptions(`{ title: { link: '//evil.example/x' } }`),
+  ).toThrow(EChartOptionsParseError);
+});
+
+test('accepts http(s) and same-origin relative title links', () => {
+  const result = parseEChartOptions(
+    `{ title: { link: 'https://superset.apache.org', sublink: '/dashboard/1/' } }`,
+  );
+
+  expect(result.success).toBe(true);
+  expect(result.data).toEqual({
+    title: { link: 'https://superset.apache.org', sublink: '/dashboard/1/' },
+  });
+});
+
+test('strips tooltip extraCssText instead of passing raw CSS through', () => {
+  const result = parseEChartOptions(
+    `{ tooltip: { show: true, extraCssText: 'background:url(//evil.example/x)' } }`,
+  );
+
+  expect(result.success).toBe(true);
+  expect(result.data).toEqual({ tooltip: { show: true } });
+});
@@ -1165,6 +1165,110 @@ test('x-axis dedup keeps the forced min label when the endpoints format identica
  expect(formatter(min)).toBe('May');
 });

+test('#39899 - x-axis dates do not overlap and last label stays visible at 0° rotation (mixed)', () => {
+  // When showMaxLabel is active on a time axis with 0° rotation,
+  // hideOverlap must be off so ECharts cannot suppress the forced
+  // max label (the end-of-axis date).
+  const chartProps = createEchartsTimeseriesTestChartProps<
+    EchartsMixedTimeseriesFormData,
+    EchartsMixedTimeseriesProps
+  >({
+    ...MIXED_TIMESERIES_CHART_PROPS_DEFAULTS,
+    defaultQueriesData: [
+      createTestQueryData(
+        [
+          {
+            __timestamp: Date.UTC(2026, 0, 1),
+            sum__num: 100,
+          },
+          {
+            __timestamp: Date.UTC(2026, 6, 1),
+            sum__num: 200,
+          },
+        ],
+        {
+          colnames: ['__timestamp', 'sum__num'],
+          coltypes: [GenericDataType.Temporal, GenericDataType.Numeric],
+          label_map: { __timestamp: ['__timestamp'], sum__num: ['sum__num'] },
+        },
+      ),
+      createTestQueryData(
+        [
+          {
+            __timestamp: Date.UTC(2026, 0, 1),
+            sum__num: 100,
+          },
+          {
+            __timestamp: Date.UTC(2026, 6, 1),
+            sum__num: 200,
+          },
+        ],
+        {
+          colnames: ['__timestamp', 'sum__num'],
+          coltypes: [GenericDataType.Temporal, GenericDataType.Numeric],
+          label_map: { __timestamp: ['__timestamp'], sum__num: ['sum__num'] },
+        },
+      ),
+    ],
+    formData: {
+      ...formData,
+      x_axis: '__timestamp',
+      metrics: ['sum__num'],
+      metricsB: ['sum__num'],
+      groupby: [],
+      groupbyB: [],
+      xAxisLabelRotation: 0,
+      // showMaxLabel (and therefore hideOverlap: false) only activates when
+      // a time grain resolves, so this needs one set to actually exercise
+      // the #39899 fix rather than silently no-op.
+      timeGrainSqla: TimeGranularity.MONTH,
+    },
+    queriesData: [
+      createTestQueryData(
+        [
+          {
+            __timestamp: Date.UTC(2026, 0, 1),
+            sum__num: 100,
+          },
+          {
+            __timestamp: Date.UTC(2026, 6, 1),
+            sum__num: 200,
+          },
+        ],
+        {
+          colnames: ['__timestamp', 'sum__num'],
+          coltypes: [GenericDataType.Temporal, GenericDataType.Numeric],
+          label_map: { __timestamp: ['__timestamp'], sum__num: ['sum__num'] },
+        },
+      ),
+      createTestQueryData(
+        [
+          {
+            __timestamp: Date.UTC(2026, 0, 1),
+            sum__num: 100,
+          },
+          {
+            __timestamp: Date.UTC(2026, 6, 1),
+            sum__num: 200,
+          },
+        ],
+        {
+          colnames: ['__timestamp', 'sum__num'],
+          coltypes: [GenericDataType.Temporal, GenericDataType.Numeric],
+          label_map: { __timestamp: ['__timestamp'], sum__num: ['sum__num'] },
+        },
+      ),
+    ],
+  });
+
+  const { echartOptions } = transformProps(chartProps);
+  const { axisLabel } = echartOptions.xAxis as Record<string, any>;
+
+  expect(axisLabel.showMaxLabel).toBe(true);
+  expect(axisLabel.alignMaxLabel).toBe('right');
+  expect(axisLabel.hideOverlap).toBe(false);
+});
+
 test('regression #37921: multi-metric Query A with groupby does not duplicate first metric in series names', () => {
  // Regression test for https://github.com/apache/superset/issues/37921
  // ("Residual" follow-up to #37055).
@@ -70,4 +70,42 @@ describe('renderNormalizedTooltip', () => {
    expect(tooltip).toContain('N/A');
    expect(tooltip).not.toContain('NaN');
  });
+
+  test('should HTML-escape series names from query data', () => {
+    // Regression test: the tooltip is rendered via innerHTML, so markup
+    // in query-result values must not become live DOM.
+    const tooltip = renderNormalizedTooltip(
+      { ...params, name: '<img src=x onerror=alert(1)>' },
+      metrics,
+      mockGetDenormalizedValue,
+      metricsWithCustomBounds,
+    );
+    expect(tooltip).not.toContain('<img');
+    expect(tooltip).toContain('&lt;img');
+  });
+
+  test('should HTML-escape metric labels', () => {
+    const tooltip = renderNormalizedTooltip(
+      params,
+      ['<svg onload=alert(1)>', 'metric2'],
+      mockGetDenormalizedValue,
+      metricsWithCustomBounds,
+    );
+    expect(tooltip).not.toContain('<svg');
+    expect(tooltip).toContain('&lt;svg');
+  });
+
+  test('should HTML-escape the series color used for the tooltip color dot', () => {
+    // Regression test: `color` is interpolated into a style attribute
+    // unquoted, so an unescaped quote could break out of the attribute
+    // and inject markup.
+    const tooltip = renderNormalizedTooltip(
+      { ...params, color: 'red" onmouseover="alert(1)' },
+      metrics,
+      mockGetDenormalizedValue,
+      metricsWithCustomBounds,
+    );
+    expect(tooltip).not.toContain('" onmouseover="alert(1)"');
+    expect(tooltip).toContain('&quot; onmouseover=&quot;alert(1)');
+  });
 });
@@ -16,11 +16,17 @@
 * specific language governing permissions and limitations
 * under the License.
 */
-import { render } from '@testing-library/react';
-import { AxisType } from '@superset-ui/core';
+import { render, waitFor } from '@testing-library/react';
+import { AxisType, DTTM_ALIAS, TimeGranularity } from '@superset-ui/core';
 import { supersetTheme, ThemeProvider } from '@apache-superset/core/theme';
+import { logging } from '@apache-superset/core/utils';
+import type { ECElementEvent } from 'echarts/types/src/util/types';
 import EchartsTimeseries from '../../src/Timeseries/EchartsTimeseries';
-import { TimeseriesChartTransformedProps } from '../../src/Timeseries/types';
+import {
+  OrientationType,
+  TimeseriesChartTransformedProps,
+} from '../../src/Timeseries/types';
+import type { EchartsProps } from '../../src/types';

 // Percent-change draggable baseline: this is the one piece of the ECharts
 // rebuilds with zero prior test coverage despite six separate production
@@ -40,12 +46,14 @@ let mockChart: {
  convertFromPixel: jest.Mock;
  getModel: jest.Mock;
 };
+const mockEchart = jest.fn();

 jest.mock('../../src/components/Echart', () => {
  const { forwardRef, useImperativeHandle } = jest.requireActual('react');
  return {
    __esModule: true,
-    default: forwardRef((_props: unknown, ref: unknown) => {
+    default: forwardRef((props: unknown, ref: unknown) => {
+      mockEchart(props);
      useImperativeHandle(ref, () => ({
        getEchartInstance: () => mockChart,
      }));
@@ -115,6 +123,17 @@ function renderTimeseries(
  );
 }

+function getLatestEchartProps() {
+  const lastCall = mockEchart.mock.calls.at(-1);
+  expect(lastCall).toBeDefined();
+  const [props] = lastCall as [EchartsProps];
+  return props;
+}
+
+function advanceClickTimer() {
+  jest.advanceTimersByTime(300);
+}
+
 // Pulls the graphic descriptor for the draggable baseline handle out of the
 // most recent setOption call, mirroring how ECharts itself would read it.
 function getBaselineGraphic() {
@@ -126,6 +145,7 @@ function getBaselineGraphic() {

 beforeEach(() => {
  jest.clearAllMocks();
+  mockEchart.mockReset();
  setupChartMock();
  jest.spyOn(window, 'requestAnimationFrame').mockImplementation(cb => {
    cb(0);
@@ -134,6 +154,7 @@ beforeEach(() => {
 });

 afterEach(() => {
+  jest.useRealTimers();
  jest.restoreAllMocks();
 });

@@ -245,3 +266,400 @@ test('does not touch the chart instance when rebase is disabled', () => {

  expect(mockChart.setOption).not.toHaveBeenCalled();
 });
+
+test('emits TEMPORAL_RANGE cross-filter from time axis label click on day bucket', () => {
+  const setDataMask = jest.fn();
+
+  renderTimeseries({
+    emitCrossFilters: true,
+    setDataMask,
+    groupby: [],
+    resolvedTimeGrain: TimeGranularity.DAY,
+    formData: {
+      granularitySqla: 'ds',
+      timeGrainSqla: TimeGranularity.DAY,
+      vizType: 'echarts_timeseries_line',
+    } as any,
+    xAxis: {
+      label: DTTM_ALIAS,
+      type: AxisType.Time,
+    },
+  });
+
+  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
+    ({ query }) => query === 'xAxis',
+  )?.handler;
+  expect(labelClickHandler).toBeDefined();
+  labelClickHandler?.({
+    targetType: 'axisLabel',
+    value: '2021-01-01',
+  } as unknown as ECElementEvent);
+
+  expect(setDataMask.mock.calls[0][0]).toEqual({
+    extraFormData: {
+      filters: [
+        {
+          col: 'ds',
+          op: 'TEMPORAL_RANGE',
+          val: '2021-01-01T00:00:00 : 2021-01-02T00:00:00',
+        },
+      ],
+    },
+    filterState: {
+      label: ['2021-01-01T00:00:00 : 2021-01-02T00:00:00'],
+      value: ['2021-01-01T00:00:00 : 2021-01-02T00:00:00'],
+      selectedValues: ['2021-01-01T00:00:00 : 2021-01-02T00:00:00'],
+    },
+  });
+});
+
+test('emits upper-exclusive TEMPORAL_RANGE from time point click on month bucket', () => {
+  jest.useFakeTimers();
+  const setDataMask = jest.fn();
+
+  renderTimeseries({
+    emitCrossFilters: true,
+    setDataMask,
+    groupby: [],
+    resolvedTimeGrain: TimeGranularity.MONTH,
+    formData: {
+      granularitySqla: 'ds',
+      timeGrainSqla: TimeGranularity.MONTH,
+      vizType: 'echarts_timeseries_line',
+    } as any,
+    xAxis: {
+      label: DTTM_ALIAS,
+      type: AxisType.Time,
+    },
+  });
+
+  getLatestEchartProps().eventHandlers?.click?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: [Date.UTC(2021, 0, 1), 100],
+    name: '2021-01-01',
+    dataIndex: 0,
+  });
+  advanceClickTimer();
+
+  expect(setDataMask.mock.calls[0][0].extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
+    },
+  ]);
+});
+
+test('uses resolved time grain for temporal point-click cross-filter', () => {
+  jest.useFakeTimers();
+  const setDataMask = jest.fn();
+
+  renderTimeseries({
+    emitCrossFilters: true,
+    setDataMask,
+    groupby: [],
+    resolvedTimeGrain: TimeGranularity.MONTH,
+    formData: {
+      granularitySqla: 'ds',
+      timeGrainSqla: TimeGranularity.DAY,
+      extraFormData: {
+        time_grain_sqla: TimeGranularity.MONTH,
+      },
+      vizType: 'echarts_timeseries_line',
+    } as any,
+    xAxis: {
+      label: DTTM_ALIAS,
+      type: AxisType.Time,
+    },
+  });
+
+  getLatestEchartProps().eventHandlers?.click?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: [Date.UTC(2021, 0, 1), 100],
+    name: '2021-01-01',
+    dataIndex: 0,
+  });
+  advanceClickTimer();
+
+  expect(setDataMask.mock.calls[0][0].extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
+    },
+  ]);
+});
+
+test('emits TEMPORAL_RANGE from string-typed time point click value', () => {
+  jest.useFakeTimers();
+  const setDataMask = jest.fn();
+
+  renderTimeseries({
+    emitCrossFilters: true,
+    setDataMask,
+    groupby: [],
+    resolvedTimeGrain: TimeGranularity.MONTH,
+    formData: {
+      granularitySqla: 'ds',
+      timeGrainSqla: TimeGranularity.MONTH,
+      vizType: 'echarts_timeseries_line',
+    } as any,
+    xAxis: {
+      label: DTTM_ALIAS,
+      type: AxisType.Time,
+    },
+  });
+
+  getLatestEchartProps().eventHandlers?.click?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: ['2021-01-01T00:00:00Z', 100],
+    name: '2021-01-01',
+    dataIndex: 0,
+  });
+  advanceClickTimer();
+
+  expect(setDataMask.mock.calls[0][0].extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
+    },
+  ]);
+});
+
+test('emits TEMPORAL_RANGE from horizontal time point click using timestamp, not metric', () => {
+  jest.useFakeTimers();
+  const setDataMask = jest.fn();
+
+  renderTimeseries({
+    emitCrossFilters: true,
+    setDataMask,
+    groupby: [],
+    resolvedTimeGrain: TimeGranularity.MONTH,
+    formData: {
+      orientation: OrientationType.Horizontal,
+      granularitySqla: 'ds',
+      timeGrainSqla: TimeGranularity.MONTH,
+      vizType: 'echarts_timeseries_line',
+    } as any,
+    xAxis: {
+      label: DTTM_ALIAS,
+      type: AxisType.Time,
+    },
+  });
+
+  getLatestEchartProps().eventHandlers?.click?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: [129, Date.UTC(2021, 0, 1)],
+    name: '2021-01-01',
+    dataIndex: 0,
+  });
+  advanceClickTimer();
+
+  expect(setDataMask.mock.calls[0][0].extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
+    },
+  ]);
+});
+
+test('clears temporal X-axis cross-filter when clicking selected bucket again', () => {
+  jest.useFakeTimers();
+  const setDataMask = jest.fn();
+  const selectedRange = '2021-01-01T00:00:00 : 2021-02-01T00:00:00';
+
+  renderTimeseries({
+    emitCrossFilters: true,
+    setDataMask,
+    groupby: [],
+    selectedValues: { 0: selectedRange },
+    resolvedTimeGrain: TimeGranularity.MONTH,
+    formData: {
+      granularitySqla: 'ds',
+      timeGrainSqla: TimeGranularity.MONTH,
+      vizType: 'echarts_timeseries_line',
+    } as any,
+    xAxis: {
+      label: DTTM_ALIAS,
+      type: AxisType.Time,
+    },
+  });
+
+  getLatestEchartProps().eventHandlers?.click?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: [Date.UTC(2021, 0, 1), 100],
+    name: '2021-01-01',
+    dataIndex: 0,
+  });
+  advanceClickTimer();
+
+  expect(setDataMask.mock.calls[0][0]).toEqual({
+    extraFormData: {
+      filters: [],
+    },
+    filterState: {
+      label: undefined,
+      value: null,
+      selectedValues: null,
+    },
+  });
+});
+
+test('emits empty temporal X-axis data mask when filter grain is missing', () => {
+  jest.useFakeTimers();
+  const setDataMask = jest.fn();
+
+  renderTimeseries({
+    emitCrossFilters: true,
+    setDataMask,
+    groupby: [],
+    formData: {
+      granularitySqla: 'ds',
+      timeGrainSqla: undefined,
+      vizType: 'echarts_timeseries_line',
+    } as any,
+    xAxis: {
+      label: DTTM_ALIAS,
+      type: AxisType.Time,
+    },
+  });
+
+  getLatestEchartProps().eventHandlers?.click?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: [Date.UTC(2021, 0, 1), 100],
+    name: '2021-01-01',
+    dataIndex: 0,
+  });
+  advanceClickTimer();
+
+  expect(setDataMask.mock.calls[0][0]).toEqual({
+    extraFormData: {
+      filters: [],
+    },
+    filterState: {
+      label: undefined,
+      value: null,
+      selectedValues: null,
+    },
+  });
+});
+
+test('warns and skips temporal cross-filter when string value cannot be parsed', () => {
+  jest.useFakeTimers();
+  const setDataMask = jest.fn();
+  const warn = jest.spyOn(logging, 'warn').mockImplementation();
+
+  renderTimeseries({
+    emitCrossFilters: true,
+    setDataMask,
+    groupby: [],
+    resolvedTimeGrain: TimeGranularity.MONTH,
+    formData: {
+      granularitySqla: 'ds',
+      timeGrainSqla: TimeGranularity.MONTH,
+      vizType: 'echarts_timeseries_line',
+    } as any,
+    xAxis: {
+      label: DTTM_ALIAS,
+      type: AxisType.Time,
+    },
+  });
+
+  getLatestEchartProps().eventHandlers?.click?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: ['not-a-date', 100],
+    name: 'not-a-date',
+    dataIndex: 0,
+  });
+  advanceClickTimer();
+
+  expect(setDataMask).not.toHaveBeenCalled();
+  expect(warn).toHaveBeenCalledWith(
+    'Unable to parse time axis value for cross-filtering',
+    'not-a-date',
+  );
+});
+
+test('does not emit temporal X-axis label cross-filter when dimensions are set', () => {
+  const setDataMask = jest.fn();
+
+  renderTimeseries({
+    emitCrossFilters: true,
+    setDataMask,
+    groupby: ['country'],
+    formData: {
+      groupby: ['country'],
+      granularitySqla: 'ds',
+      timeGrainSqla: TimeGranularity.MONTH,
+      vizType: 'echarts_timeseries_line',
+    } as any,
+    xAxis: {
+      label: DTTM_ALIAS,
+      type: AxisType.Time,
+    },
+  });
+
+  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
+    ({ query }) => query === 'xAxis',
+  )?.handler;
+  expect(labelClickHandler).toBeDefined();
+  labelClickHandler?.({
+    targetType: 'axisLabel',
+    value: '2021-01-01',
+  } as unknown as ECElementEvent);
+
+  expect(setDataMask).not.toHaveBeenCalled();
+});
+
+test('context menu cross-filter is available for a temporal bar point', async () => {
+  const onContextMenu = jest.fn();
+
+  renderTimeseries({
+    emitCrossFilters: true,
+    onContextMenu,
+    groupby: [],
+    resolvedTimeGrain: TimeGranularity.MONTH,
+    formData: {
+      granularitySqla: 'ds',
+      timeGrainSqla: TimeGranularity.DAY,
+      extraFormData: {
+        time_grain_sqla: TimeGranularity.MONTH,
+      },
+      vizType: 'echarts_timeseries_line',
+    } as any,
+    xAxis: {
+      label: DTTM_ALIAS,
+      type: AxisType.Time,
+    },
+  });
+
+  await getLatestEchartProps().eventHandlers?.contextmenu?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: [Date.UTC(2021, 0, 1), 100],
+    name: '2021-01-01',
+    event: { stop: jest.fn(), event: { clientX: 10, clientY: 20 } },
+  });
+
+  await waitFor(() => {
+    expect(onContextMenu).toHaveBeenCalled();
+  });
+
+  const { crossFilter } = onContextMenu.mock.calls[0][2];
+  expect(crossFilter.dataMask.extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
+    },
+  ]);
+});
@@ -64,6 +64,28 @@ describe('Timeseries buildQuery', () => {
    expect(query.metrics).toEqual(['bar', 'baz']);
  });

+  test('should apply contribution before rename with time comparison', () => {
+    // rename strips the `__<offset>` suffix that contribution relies on to
+    // compute each time shift separately
+    const queryContext = buildQuery({
+      ...formData,
+      metrics: ['bar'],
+      x_axis: 'ds',
+      groupby: ['col1'],
+      contributionMode: 'row',
+      comparison_type: 'values',
+      time_compare: ['1 week ago'],
+    });
+    const [query] = queryContext.queries;
+    const operations = (query.post_processing || []).map(
+      operator => operator?.operation,
+    );
+    expect(operations).toContain('contribution');
+    expect(operations.indexOf('contribution')).toBeLessThan(
+      operations.indexOf('rename'),
+    );
+  });
+
  test('should not order by timeseries limit if orderby provided', () => {
    const queryContext = buildQuery({
      ...formData,
@@ -2083,6 +2083,39 @@ test('xAxisForceCategorical forces Category axis regardless of Numeric coltype',
  expect(xAxis.triggerEvent).toBe(true);
 });

+test('temporal x-axis enables trigger events when no dimensions are set', () => {
+  const ts1 = 1745784000000;
+  const ts2 = 1745870400000;
+  const chartProps = createTestChartProps({
+    formData: {
+      metrics: ['metric'],
+      granularity_sqla: 'ds',
+      x_axis: '__timestamp',
+    },
+    queriesData: [
+      createTestQueryData(
+        [
+          { __timestamp: ts1, metric: 10 },
+          { __timestamp: ts2, metric: 20 },
+        ],
+        {
+          colnames: ['__timestamp', 'metric'],
+          coltypes: [GenericDataType.Temporal, GenericDataType.Numeric],
+        },
+      ),
+    ],
+  });
+
+  const { echartOptions } = transformProps(chartProps);
+  const xAxis = echartOptions.xAxis as {
+    triggerEvent?: boolean;
+    type: string;
+  };
+
+  expect(xAxis.type).toBe(AxisType.Time);
+  expect(xAxis.triggerEvent).toBe(true);
+});
+
 test('temporal x coltype forced categorical yields a Category axis with date labels', () => {
  // Issue #28204: with a temporal x-axis (e.g. weekly grain) the default Time
  // scale places ticks at "nice" intervals that don't line up with the buckets.
@@ -2330,6 +2363,7 @@ test('tooltip time grain wiring: dashboard-level extraFormData time grain overri
  });

  const transformedProps = transformProps(chartProps);
+  expect(transformedProps.resolvedTimeGrain).toBe(TimeGranularity.MONTH);
  const tooltipFormatter = (
    transformedProps.echartOptions as unknown as TooltipFormatterOptions
  ).tooltip.formatter;
@@ -2363,6 +2397,7 @@ test('tooltip time grain wiring: chart-level time grain drives the tooltip when
  });

  const transformedProps = transformProps(chartProps);
+  expect(transformedProps.resolvedTimeGrain).toBe(TimeGranularity.YEAR);
  const tooltipFormatter = (
    transformedProps.echartOptions as unknown as TooltipFormatterOptions
  ).tooltip.formatter;
@@ -341,15 +341,15 @@ test('should configure time axis labels to show max label for last month visibil
  );
 });

-test('x-axis dates do not overlap and last label stays visible at 0° rotation', () => {
+test('#39899 - x-axis dates do not overlap and last label stays visible at 0° rotation', () => {
  const result = transformProps(buildTimeseriesChartProps());
  const { axisLabel } = result.echartOptions.xAxis as Record<string, any>;

-  expect(axisLabel.hideOverlap).toBe(true);
-  // showMaxLabel forces the last data point label to render even
-  // when hideOverlap is active, preventing the #37181 regression.
+  // showMaxLabel forces the last data point label to render
  expect(axisLabel.showMaxLabel).toBe(true);
  expect(axisLabel.alignMaxLabel).toBe('right');
+  // hideOverlap must be OFF so ECharts cannot suppress the forced max label
+  expect(axisLabel.hideOverlap).toBe(false);
 });

 test('last x-axis date is visible and not cut off when rotated -45°', () => {
@@ -38,7 +38,7 @@ export default function transformProps(chartProps: ChartProps) {
    includeSeries,
    isDarkMode: isThemeDark(theme),
    linearColorScheme,
-    metrics: metrics.map((m: { label?: string } | string) =>
+    metrics: (metrics ?? []).map((m: { label?: string } | string) =>
      typeof m === 'string' ? m : m.label || m,
    ),
    colorMetric: secondaryMetric?.label || secondaryMetric,
@@ -0,0 +1,41 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { ChartProps } from '@superset-ui/core';
+import transformProps from '../src/transformProps';
+
+const createProps = () =>
+  ({
+    width: 800,
+    height: 600,
+    formData: {
+      includeSeries: false,
+      linearColorScheme: 'superset_seq_1',
+      metrics: undefined,
+      secondaryMetric: 'sum__SP_POP_TOTL',
+      series: 'country_name',
+      showDatatable: false,
+    },
+    queriesData: [{ data: [{ country_id: 'FRA', metric: 10 }] }],
+    theme: {},
+  }) as unknown as ChartProps;
+
+test('do not crash on undefined metrics', () => {
+  expect(() => transformProps(createProps())).not.toThrow();
+});
@@ -1069,10 +1069,10 @@ export default function TableChart<D extends DataRecord = DataRecord>(
          const originKey = column.key.substring(column.label.length).trim();
          if (!hasColumnColorFormatters && hasBasicColorFormatters) {
            backgroundColor =
-              basicColorFormatters[row.index][originKey]?.backgroundColor;
+              basicColorFormatters[row.index]?.[originKey]?.backgroundColor;
            arrow =
              column.label === comparisonLabels[0]
-                ? basicColorFormatters[row.index][originKey]?.mainArrow
+                ? basicColorFormatters[row.index]?.[originKey]?.mainArrow
                : '';
          }

@@ -1134,11 +1134,11 @@ export default function TableChart<D extends DataRecord = DataRecord>(
            basicColorColumnFormatters?.length > 0
          ) {
            backgroundColor =
-              basicColorColumnFormatters[row.index][column.key]
+              basicColorColumnFormatters[row.index]?.[column.key]
                ?.backgroundColor || backgroundColor;
            arrow =
              column.label === comparisonLabels[0]
-                ? basicColorColumnFormatters[row.index][column.key]?.mainArrow
+                ? basicColorColumnFormatters[row.index]?.[column.key]?.mainArrow
                : '';
          }
          const rowSurfaceColor =
@@ -1197,7 +1197,7 @@ export default function TableChart<D extends DataRecord = DataRecord>(
          let arrowStyles = css`
            color: ${
              basicColorFormatters &&
-              basicColorFormatters[row.index][originKey]?.arrowColor ===
+              basicColorFormatters[row.index]?.[originKey]?.arrowColor ===
                ColorSchemeEnum.Green
                ? theme.colorSuccess
                : theme.colorError
@@ -1211,7 +1211,7 @@ export default function TableChart<D extends DataRecord = DataRecord>(
          ) {
            arrowStyles = css`
              color: ${
-                basicColorColumnFormatters[row.index][column.key]
+                basicColorColumnFormatters[row.index]?.[column.key]
                  ?.arrowColor === ColorSchemeEnum.Green
                  ? theme.colorSuccess
                  : theme.colorError
@@ -20,6 +20,7 @@ import '@testing-library/jest-dom';
 import {
  getTextColorForBackground,
  ObjectFormattingEnum,
+  ColorSchemeEnum,
 } from '@superset-ui/chart-controls';
 import { supersetTheme } from '@apache-superset/core/theme';
 import {
@@ -2075,6 +2076,59 @@ describe('plugin-chart-table', () => {
        });
      });

+      test('does not crash when a comparison-color-formatter array has no entry for a rendered row', () => {
+        // Regression test: the per-cell comparison-color lookups in the Cell
+        // renderer (`basicColorFormatters`/`basicColorColumnFormatters`,
+        // indexed by `row.index`) must stay safe even if those arrays ever
+        // end up with fewer entries than the number of rendered rows -- e.g.
+        // when "Show summary" is combined with time comparison and a
+        // comparison-based conditional color scheme ("Green for increase,
+        // red for decrease") applied to a Time Comparison column. Without
+        // the `?.` guard on the array-index lookup, this throws
+        // `TypeError: Cannot read properties of undefined (reading 'Main
+        // metric_1')`.
+        const propsInput = {
+          ...testData.comparison,
+          rawFormData: {
+            ...testData.comparison.rawFormData,
+            conditional_formatting: [
+              { column: 'Main metric_1', colorScheme: ColorSchemeEnum.Green },
+            ],
+          },
+        };
+        const transformedProps = transformProps(propsInput);
+        expect(transformedProps.data).toHaveLength(2);
+        expect(transformedProps.basicColorColumnFormatters).toHaveLength(2);
+
+        // Simulate the row-count mismatch: the formatter array has an entry
+        // for only the first row, matching the shape of the bug (an entry
+        // missing for one of the rendered rows).
+        const propsWithMissingFormatterEntry = {
+          ...transformedProps,
+          basicColorColumnFormatters:
+            transformedProps.basicColorColumnFormatters!.slice(0, 1),
+        };
+
+        expect(() =>
+          render(
+            <TableChart {...propsWithMissingFormatterEntry} sticky={false} />,
+          ),
+        ).not.toThrow();
+
+        // the row that still has a formatter entry keeps its comparison
+        // background color and arrow: the "Main metric_1" cell for the
+        // first row (value 100) renders before the derived "△ metric_1"
+        // cell that happens to share the same value and aria label.
+        const [styledCell] = screen.getAllByTitle('100');
+        expect(styledCell).toHaveTextContent('↑100');
+        expect(getComputedStyle(styledCell).background).toContain(
+          'rgba(0, 150, 0, 0.2)',
+        );
+
+        // the row missing a formatter entry still renders its raw value
+        expect(screen.getAllByTitle('110').length).toBeGreaterThan(0);
+      });
+
      test('preserves client-side search text across temporal table rerenders', async () => {
        const formDataWithSearch = {
          ...testData.basic.formData,
@@ -80,6 +80,19 @@ interface DatamapSource {
  country?: string;
 }

+/**
+ * Escape HTML special characters to prevent XSS attacks. Popup templates are
+ * assigned to the hover element via innerHTML by the datamaps library, and
+ * formatter output can echo a creator-controlled format string verbatim
+ * (see createD3NumberFormatter's invalid-format fallback), so both the name
+ * and the formatted value must be treated as untrusted text.
+ */
+function escapeHtml(text: string): string {
+  const div = document.createElement('div');
+  div.textContent = text;
+  return div.innerHTML;
+}
+
 const propTypes = {
  data: PropTypes.arrayOf(
    PropTypes.shape({
@@ -279,9 +292,9 @@ function WorldMap(element: HTMLElement, props: WorldMapProps): void {
      highlightBorderWidth: 1,
      popupTemplate: (geo, d) =>
        d &&
-        `<div class="hoverinfo"><strong>${d.name}</strong><br>${formatter(
-          d.m1,
-        )}</div>`,
+        `<div class="hoverinfo"><strong>${escapeHtml(
+          d.name,
+        )}</strong><br>${escapeHtml(String(formatter(d.m1)))}</div>`,
    },
    bubblesConfig: {
      borderWidth: 1,
@@ -290,9 +303,9 @@ function WorldMap(element: HTMLElement, props: WorldMapProps): void {
      popupOnHover: !inContextMenu,
      radius: null,
      popupTemplate: (geo, d) =>
-        `<div class="hoverinfo"><strong>${d.name}</strong><br>${formatter(
-          d.m2,
-        )}</div>`,
+        `<div class="hoverinfo"><strong>${escapeHtml(
+          d.name,
+        )}</strong><br>${escapeHtml(String(formatter(d.m2)))}</div>`,
      fillOpacity: 0.5,
      animate: true,
      highlightOnHover: !inContextMenu,
@@ -180,6 +180,33 @@ test('disables Datamaps highlightOnHover while the context menu is open', () =>
  expect(geographyConfig?.highlightOnHover).toBe(false);
 });

+test('escapes markup in hover popup templates', () => {
+  // Regression test for stored XSS via the number-formatter fallback: an
+  // invalid Y Axis Format string is echoed verbatim by the formatter
+  // (createD3NumberFormatter's catch branch), so the popup templates must
+  // HTML-escape formatter output before datamaps assigns it via innerHTML.
+  const maliciousFormatter = getNumberFormatter('<img src=x onerror=alert(1)>');
+  WorldMap(container, { ...baseProps, formatter: maliciousFormatter });
+
+  const geographyConfig = lastDatamapConfig?.geographyConfig as {
+    popupTemplate: (geo: unknown, d: unknown) => string;
+  };
+  const bubblesConfig = lastDatamapConfig?.bubblesConfig as {
+    popupTemplate: (geo: unknown, d: unknown) => string;
+  };
+  const entry = { name: '<b>United States</b>', m1: 100, m2: 200 };
+
+  const geoPopup = geographyConfig.popupTemplate({}, entry);
+  const bubblePopup = bubblesConfig.popupTemplate({}, entry);
+
+  [geoPopup, bubblePopup].forEach(popup => {
+    expect(popup).not.toContain('<img');
+    expect(popup).not.toContain('<b>');
+    expect(popup).toContain('&lt;img src=x onerror=alert(1)&gt;');
+    expect(popup).toContain('&lt;b&gt;United States&lt;/b&gt;');
+  });
+});
+
 test('does not throw error when onContextMenu is undefined', () => {
  const propsWithoutContextMenu = {
    ...baseProps,
@@ -1524,7 +1524,9 @@ export function popPermalink(key: string): SqlLabThunkAction<Promise<unknown>> {
            dbId: json.dbId ? parseInt(json.dbId, 10) : undefined,
            catalog: json.catalog ?? null,
            schema: json.schema ?? undefined,
-            autorun: json.autorun ? json.autorun : false,
+            // The recipient must review the prefilled query and press
+            // Run; a permalink payload never auto-runs.
+            autorun: false,
            sql: json.sql ? json.sql : 'SELECT ...',
            templateParams: json.templateParams,
          }),
@@ -1548,7 +1550,9 @@ export function popStoredQuery(
            dbId: json.dbId ? parseInt(json.dbId, 10) : undefined,
            catalog: json.catalog ?? null,
            schema: json.schema ?? undefined,
-            autorun: json.autorun ? json.autorun : false,
+            // Same rule as popPermalink above — stored payloads never
+            // auto-run.
+            autorun: false,
            sql: json.sql ? json.sql : 'SELECT ...',
            templateParams: json.templateParams,
          }),
@@ -1627,7 +1631,9 @@ export function popDatasourceQuery(
            name: `${QUERY_TEXT} ${json.result.name}`,
            dbId: json.result.database.id,
            schema: json.result.schema,
-            autorun: sql !== undefined,
+            // `sql` here can come straight from the URL, so its mere
+            // presence must never imply auto-execution.
+            autorun: false,
            sql: sql || json.result.select_star,
          }),
        ),
@@ -719,7 +719,7 @@ const ResultSet = ({
    if (data && data.length > 0) {
      const allowHTML = getItem(
        LocalStorageKeys.SqllabIsRenderHtmlEnabled,
-        true,
+        false,
      );

      const tableProps = {
@@ -284,7 +284,7 @@ const SqlEditor: FC<Props> = ({
    getItem(LocalStorageKeys.SqllabIsAutocompleteEnabled, true),
  );
  const [renderHTMLEnabled, setRenderHTMLEnabled] = useState(
-    getItem(LocalStorageKeys.SqllabIsRenderHtmlEnabled, true),
+    getItem(LocalStorageKeys.SqllabIsRenderHtmlEnabled, false),
  );
  const [showCreateAsModal, setShowCreateAsModal] = useState(false);
  const [createAs, setCreateAs] = useState('');
@@ -196,6 +196,54 @@ interface DatasourceObject {
  folders?: DatasourceFolder[];
 }

+/**
+ * Lift the certification and warning fields a metric keeps inside its `extra`
+ * JSON blob onto the metric itself, which is the shape the editor's fields bind
+ * to.
+ *
+ * Two entry points feed the editor two different metric shapes: the dataset
+ * list hands over the API payload, where `extra` is still a JSON string, while
+ * Explore hands over its bootstrap payload, where `SqlMetric.data` has already
+ * flattened `extra` into `warning_markdown` and dropped the raw string. The
+ * parsed blob is therefore only authoritative when `extra` is actually present;
+ * otherwise the already-flattened value stands, instead of being reset to an
+ * empty field.
+ *
+ * A malformed `extra` string is treated the same as an absent one (falls
+ * through to the already-flattened value) rather than throwing, mirroring
+ * the backend's own tolerance for bad `extra` JSON in
+ * `CertificationMixin.get_extra_dict()`.
+ */
+export function hydrateMetricExtra(metric: Metric): Metric {
+  const {
+    certified_by: certifiedByMetric,
+    certification_details: certificationDetails,
+  } = metric;
+  let parsedExtra;
+  if (metric.extra) {
+    try {
+      parsedExtra = JSON.parse(metric.extra) || {};
+    } catch {
+      parsedExtra = undefined;
+    }
+  }
+  const {
+    certification: {
+      details = undefined,
+      certified_by: certifiedBy = undefined,
+    } = {},
+  } = parsedExtra || {};
+  const warningMarkdown = parsedExtra
+    ? parsedExtra.warning_markdown
+    : metric.warning_markdown;
+  return {
+    ...metric,
+    certification_details: certificationDetails || details,
+    warning_markdown: warningMarkdown || '',
+    certified_by: certifiedBy || certifiedByMetric,
+  };
+}
+
 interface DatasourceEditorOwnProps {
  datasource: DatasourceObject;
  onChange?: (datasource: DatasourceObject, errors: string[]) => void;
@@ -852,25 +900,7 @@ function DatasourceEditor({
  const [datasource, setDatasource] = useState<DatasourceObject>(() => ({
    ...propsDatasource,
    editors: normalizeSubjectsToPickerValues(propsDatasource.editors || []),
-    metrics: propsDatasource.metrics?.map(metric => {
-      const {
-        certified_by: certifiedByMetric,
-        certification_details: certificationDetails,
-      } = metric;
-      const {
-        certification: {
-          details = undefined,
-          certified_by: certifiedBy = undefined,
-        } = {},
-        warning_markdown: warningMarkdown,
-      } = JSON.parse(metric.extra || '{}') || {};
-      return {
-        ...metric,
-        certification_details: certificationDetails || details,
-        warning_markdown: warningMarkdown || metric.warning_markdown || '',
-        certified_by: certifiedBy || certifiedByMetric,
-      };
-    }),
+    metrics: propsDatasource.metrics?.map(hydrateMetricExtra),
  }));

  const [errors, setErrors] = useState<string[]>([]);
@@ -1993,7 +2023,6 @@ function DatasourceEditor({
                          col => col.column_name,
                        )}
                        height={300}
-                        allowHTML
                      />
                    </>
                  )}
@@ -0,0 +1,96 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { hydrateMetricExtra } from '../DatasourceEditor';
+
+const metric = { metric_name: 'sum__num', expression: 'SUM(num)' };
+
+test('lifts the warning and certification out of the extra JSON string', () => {
+  expect(
+    hydrateMetricExtra({
+      ...metric,
+      extra: JSON.stringify({
+        warning_markdown: 'Handle with care',
+        certification: { certified_by: 'Data team', details: 'Reviewed' },
+      }),
+    }),
+  ).toMatchObject({
+    warning_markdown: 'Handle with care',
+    certified_by: 'Data team',
+    certification_details: 'Reviewed',
+  });
+});
+
+test('keeps an already-flattened warning when the metric carries no extra (#42704)', () => {
+  // Explore's bootstrap payload flattens `extra` into `warning_markdown` and
+  // drops the raw string, so the flattened value is all there is to go on.
+  expect(
+    hydrateMetricExtra({ ...metric, warning_markdown: 'Handle with care' })
+      .warning_markdown,
+  ).toBe('Handle with care');
+});
+
+test('lets an empty warning in extra clear the flattened value', () => {
+  expect(
+    hydrateMetricExtra({
+      ...metric,
+      warning_markdown: 'stale',
+      extra: '{}',
+    }).warning_markdown,
+  ).toBe('');
+});
+
+test('normalizes a missing warning to an empty string', () => {
+  expect(hydrateMetricExtra(metric).warning_markdown).toBe('');
+});
+
+test('resolves certification conflicts between the metric and its extra blob', () => {
+  expect(
+    hydrateMetricExtra({
+      ...metric,
+      certified_by: 'Analytics',
+      certification_details: 'Owned by Analytics',
+      extra: JSON.stringify({
+        certification: { certified_by: 'Data team', details: 'Reviewed' },
+      }),
+    }),
+  ).toMatchObject({
+    // extra wins for the certifier, while the metric's own details field wins
+    // for the description — the certification form writes both back into extra
+    // on save, so the two settle on the same source afterwards
+    certified_by: 'Data team',
+    certification_details: 'Owned by Analytics',
+  });
+});
+
+test('does not throw on malformed extra, falling back like an absent extra', () => {
+  expect(() =>
+    hydrateMetricExtra({
+      ...metric,
+      warning_markdown: 'Handle with care',
+      extra: '{not valid json',
+    }),
+  ).not.toThrow();
+  expect(
+    hydrateMetricExtra({
+      ...metric,
+      warning_markdown: 'Handle with care',
+      extra: '{not valid json',
+    }).warning_markdown,
+  ).toBe('Handle with care');
+});
@@ -63,7 +63,7 @@ export const FilterableTable = ({
  height,
  filterText = '',
  expandedColumns = [],
-  allowHTML = true,
+  allowHTML = false,
  striped,
  themeOverrides,
 }: FilterableTableProps) => {
@@ -64,6 +64,35 @@ test('should render cellData value for default cell data', () => {
  expect(container).toHaveTextContent('regular_text');
 });

+test('should render HTML cell data as inert text by default', () => {
+  const { container } = render(
+    <>
+      {renderResultCell({
+        cellData: '<img src="https://attacker.example/beacon.gif" />link',
+        columnKey: 'a',
+      })}
+    </>,
+  );
+  expect(container.querySelector('img')).not.toBeInTheDocument();
+  expect(container).toHaveTextContent(
+    '<img src="https://attacker.example/beacon.gif" />link',
+  );
+});
+
+test('should render sanitized HTML only when allowHTML is explicitly enabled', () => {
+  const { container } = render(
+    <>
+      {renderResultCell({
+        cellData: '<b>bold</b>',
+        columnKey: 'a',
+        allowHTML: true,
+      })}
+    </>,
+  );
+  expect(container.querySelector('b')).toBeInTheDocument();
+  expect(container).toHaveTextContent('bold');
+});
+
 test('should transform cell data by getCellContent for the regular text', () => {
  const { container } = render(
    <>
@@ -32,11 +32,15 @@ type Params = CellParams & {
  getCellContent?: (args: CellParams) => string;
 };

+// Result cells carry untrusted warehouse data, so HTML rendering is opt-in:
+// even sanitized markup keeps active capabilities (img/video fetch beacons,
+// phishing anchors), which must not activate by default for data the viewer
+// did not author.
 export const renderResultCell = ({
  cellData,
  getCellContent,
  columnKey,
-  allowHTML = true,
+  allowHTML = false,
 }: Params) => {
  const cellNode =
    getCellContent?.({ cellData, columnKey }) ?? String(cellData);
@@ -0,0 +1,31 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import {
+  URL_PARAMS,
+  RESERVED_CHART_URL_PARAMS,
+  RESERVED_DASHBOARD_URL_PARAMS,
+} from 'src/constants';
+
+test('permalinkKey is reserved on both the chart and dashboard URL param lists', () => {
+  // Dashboard and explore permalinks resolve against different backend
+  // KV resources/salts, so a key from one must never leak into the other's
+  // URL via the reserved-params passthrough logic.
+  expect(RESERVED_DASHBOARD_URL_PARAMS).toContain(URL_PARAMS.permalinkKey.name);
+  expect(RESERVED_CHART_URL_PARAMS).toContain(URL_PARAMS.permalinkKey.name);
+});
@@ -123,6 +123,7 @@ export const RESERVED_CHART_URL_PARAMS: string[] = [
  URL_PARAMS.datasourceId.name,
  URL_PARAMS.datasourceType.name,
  URL_PARAMS.datasetId.name,
+  URL_PARAMS.permalinkKey.name,
  URL_PARAMS.versionHistory.name,
 ];
 export const RESERVED_DASHBOARD_URL_PARAMS: string[] = [
@@ -259,6 +259,21 @@ describe('isUserEditorOrAdmin', () => {
  test('returns false when editors is omitted', () => {
    expect(isUserEditorOrAdmin(outsiderUser)).toEqual(false);
  });
+
+  test('returns true when the user is granted editorship only through extra_editors', () => {
+    expect(isUserEditorOrAdmin(editorUser, [], [10])).toEqual(true);
+  });
+
+  test('unions editors and extra_editors rather than preferring one', () => {
+    const nonMatchingSubject: Subject = { id: 999, label: 'Other', type: 1 };
+    expect(isUserEditorOrAdmin(editorUser, [nonMatchingSubject], [10])).toEqual(
+      true,
+    );
+  });
+
+  test('returns false when extra_editors names other subjects', () => {
+    expect(isUserEditorOrAdmin(editorUser, [], [999])).toEqual(false);
+  });
 });

 // eslint-disable-next-line no-restricted-globals -- TODO: Migrate from describe blocks
@@ -55,9 +55,6 @@ export const isUserInSubjects = (
  );
 };

-const isUserInEditors = (editors: Subject[] = []): boolean =>
-  isUserInSubjects(editors);
-
 export const isUserAdmin = (
  user?: UserWithPermissionsAndRoles | UndefinedUser,
 ) =>
@@ -66,10 +63,12 @@ export const isUserAdmin = (
    role => role.toLowerCase() === ADMIN_ROLE_NAME.toLowerCase(),
  );

+/** `extraEditors` is editorship granted via a deployment's EXTRA_EDITORS_RESOLVER. */
 export const isUserEditorOrAdmin = (
  user?: UserWithPermissionsAndRoles | UndefinedUser,
  editors: Subject[] = [],
-): boolean => isUserInEditors(editors) || isUserAdmin(user);
+  extraEditors?: SubjectRef[] | null,
+): boolean => isUserInSubjects(editors, extraEditors) || isUserAdmin(user);

 /**
 * Editorship of *dashboard*, matching the server's `is_editor`: the explicit
@@ -17,10 +17,20 @@
 * under the License.
 */

-import { VizType } from '@superset-ui/core';
+import { isFeatureEnabled, VizType } from '@superset-ui/core';
+import { HYDRATE_CHART_NORMALIZATION } from 'src/features/versionHistory/reducer';
 import { hydrateExplore, HYDRATE_EXPLORE } from './hydrateExplore';
 import { exploreInitialData } from '../fixtures';

+jest.mock('@superset-ui/core', () => ({
+  ...jest.requireActual('@superset-ui/core'),
+  isFeatureEnabled: jest.fn(),
+}));
+
+const mockedIsFeatureEnabled = isFeatureEnabled as jest.Mock;
+
+beforeEach(() => mockedIsFeatureEnabled.mockReturnValue(false));
+
 afterEach(() => {
  window.history.pushState({}, '', '/');
 });
@@ -343,3 +353,67 @@ test('extracts currency formats from metrics in dataset', () => {
    }),
  );
 });
+
+test('seeds only guarded matching-input hydration transitions', () => {
+  mockedIsFeatureEnabled.mockReturnValue(true);
+  const dispatch = jest.fn();
+  const getState = jest.fn(() => ({
+    user: {},
+    charts: {},
+    datasources: {},
+    common: { conf: { DEFAULT_TIME_FILTER: 'Last year' } },
+    explore: {},
+  }));
+  const persisted = {
+    ...exploreInitialData.form_data,
+  };
+  delete persisted.time_range;
+  const initialData = {
+    ...exploreInitialData,
+    form_data: { ...persisted },
+    slice: {
+      ...exploreInitialData.slice!,
+      form_data: { ...persisted },
+    },
+  };
+
+  // @ts-expect-error focused hydration fixture
+  hydrateExplore(initialData)(dispatch, getState);
+
+  expect(dispatch).toHaveBeenCalledWith(
+    expect.objectContaining({
+      type: HYDRATE_CHART_NORMALIZATION,
+      tracking: expect.objectContaining({
+        chartId: 371,
+        transitions: expect.objectContaining({
+          time_range: {
+            control: 'time_range',
+            from_present: false,
+            to_present: true,
+            to_value: 'Last year',
+          },
+        }),
+      }),
+    }),
+  );
+});
+
+test('does not seed normalization metadata for dashboard overrides', () => {
+  mockedIsFeatureEnabled.mockReturnValue(true);
+  window.history.pushState({}, '', '/explore/?dashboard_id=12');
+  const dispatch = jest.fn();
+  const getState = jest.fn(() => ({
+    user: {},
+    charts: {},
+    datasources: {},
+    common: {},
+    explore: {},
+  }));
+
+  // @ts-expect-error focused hydration fixture
+  hydrateExplore(exploreInitialData)(dispatch, getState);
+
+  expect(dispatch).not.toHaveBeenCalledWith(
+    expect.objectContaining({ type: HYDRATE_CHART_NORMALIZATION }),
+  );
+});
@@ -49,6 +49,10 @@ import { getUrlParam } from 'src/utils/urlUtils';
 import { URL_PARAMS } from 'src/constants';
 import { findPermission } from 'src/utils/findPermission';
 import getBootstrapData from 'src/utils/getBootstrapData';
+import { nanoid } from 'nanoid';
+import cloneDeep from 'lodash-es/cloneDeep';
+import { hydrateChartNormalization } from 'src/features/versionHistory/reducer';
+import { automaticNormalizationTransitions } from 'src/features/versionHistory/normalization';

 enum ColorSchemeType {
  CATEGORICAL = 'CATEGORICAL',
@@ -78,6 +82,8 @@ export const hydrateExplore =
    const fallbackSlice = sliceId ? sliceEntities?.slices?.[sliceId] : null;
    const initialSlice = slice ?? fallbackSlice;
    const initialFormData = form_data ?? initialSlice?.form_data;
+    const persistedFormData = cloneDeep(initialSlice?.form_data ?? {});
+    const preHydrationFormData = cloneDeep(initialFormData ?? {});
    const isCachedFormData = getUrlParam(URL_PARAMS.formDataKey) !== null;
    const [primarySliceNameSource, fallbackSliceNameSource] = isCachedFormData
      ? [initialFormData, initialSlice]
@@ -213,6 +219,10 @@ export const hydrateExplore =
        exploreState,
      );
    });
+    const hydratedFormData = {
+      ...initialFormData,
+      ...getFormDataFromControls(exploreState.controls),
+    };
    const sliceFormData = initialSlice
      ? getFormDataFromControls(initialControls)
      : null;
@@ -233,7 +243,7 @@ export const hydrateExplore =
      lastRendered: 0,
    };

-    return dispatch({
+    const result = dispatch({
      type: HYDRATE_EXPLORE,
      data: {
        charts: {
@@ -253,6 +263,28 @@ export const hydrateExplore =
        dataMask,
      },
    });
+    if (
+      isFeatureEnabled(FeatureFlag.VersionHistory) &&
+      initialSlice?.slice_id &&
+      !isCachedFormData &&
+      !dashboardId &&
+      getUrlParam(URL_PARAMS.vizType) === null
+    ) {
+      dispatch(
+        hydrateChartNormalization({
+          chartId: initialSlice.slice_id,
+          hydrationSessionId: nanoid(),
+          transitions: automaticNormalizationTransitions(
+            persistedFormData,
+            preHydrationFormData,
+            hydratedFormData,
+          ),
+          invalidatedControls: {},
+          saveAttemptId: null,
+        }),
+      );
+    }
+    return result;
  };

 export type HydrateExplore = {
@@ -21,6 +21,7 @@ import { Dispatch } from 'redux';
 import { ADD_TOAST } from 'src/components/MessageToasts/actions';
 import {
  DatasourceType,
+  isFeatureEnabled,
  QueryFormData,
  SimpleAdhocFilter,
  VizType,
@@ -37,6 +38,13 @@ import {
 } from './saveModalActions';
 import { Operators } from '../constants';

+jest.mock('@superset-ui/core', () => ({
+  ...jest.requireActual('@superset-ui/core'),
+  isFeatureEnabled: jest.fn(),
+}));
+
+const mockedIsFeatureEnabled = isFeatureEnabled as jest.Mock;
+
 // Define test constants and mock data using imported types
 const sliceId = 10;
 const sliceName = 'New chart';
@@ -92,17 +100,159 @@ const sliceResponsePayload: Partial<PayloadSlice> = {
 };

 const sampleError = new Error('sampleError');
+const updateSliceEndpoint = `glob:*/api/v1/chart/${sliceId}`;

 jest.mock('../exploreUtils', () => ({
  buildV1ChartDataPayload: jest.fn(() => queryContext),
 }));

-beforeEach(() => fetchMock.clearHistory().removeRoutes());
+beforeEach(() => {
+  fetchMock.clearHistory().removeRoutes();
+  mockedIsFeatureEnabled.mockReturnValue(false);
+});
+
+test('existing-chart overwrite sends only still-matching normalization metadata', async () => {
+  mockedIsFeatureEnabled.mockReturnValue(true);
+  fetchMock.put(updateSliceEndpoint, sliceResponsePayload, {
+    name: updateSliceEndpoint,
+  });
+  const dispatch = jest.fn();
+  const getState = () => ({
+    explore: {
+      form_data: {
+        datasource: `${datasourceId}__${datasourceType}`,
+        viz_type: vizType,
+        row_limit: 10000,
+        show_legend: true,
+        object_control: { a: 1, b: 2 },
+      },
+    },
+    versionHistory: {
+      chartNormalization: {
+        chartId: sliceId,
+        hydrationSessionId: 'hydration-a',
+        saveAttemptId: null,
+        invalidatedControls: { show_legend: true as const },
+        transitions: {
+          row_limit: {
+            control: 'row_limit',
+            from_present: true as const,
+            from_value: null,
+            to_present: true as const,
+            to_value: 10000,
+          },
+          show_legend: {
+            control: 'show_legend',
+            from_present: false as const,
+            to_present: true as const,
+            to_value: true,
+          },
+          object_control: {
+            control: 'object_control',
+            from_present: false as const,
+            to_present: true as const,
+            to_value: { b: 2, a: 1 },
+          },
+        },
+      },
+    },
+  });
+
+  await updateSlice(
+    { ...sliceResponsePayload, slice_id: sliceId } as never,
+    sliceName,
+    [],
+  )(dispatch, getState);
+
+  const request = fetchMock.callHistory.lastCall(updateSliceEndpoint);
+  const body = JSON.parse(request?.options.body as string);
+  expect(body.normalization_changes).toEqual([
+    {
+      control: 'row_limit',
+      from_present: true,
+      from_value: null,
+      to_present: true,
+      to_value: 10000,
+    },
+    {
+      control: 'object_control',
+      from_present: false,
+      to_present: true,
+      to_value: { b: 2, a: 1 },
+    },
+  ]);
+  expect(dispatch).toHaveBeenCalledWith(
+    expect.objectContaining({ type: 'BEGIN_CHART_NORMALIZATION_SAVE' }),
+  );
+  expect(dispatch).toHaveBeenCalledWith(
+    expect.objectContaining({ type: 'COMPLETE_CHART_NORMALIZATION_SAVE' }),
+  );
+});
+
+test('matches normalization metadata against finalized payload filters', async () => {
+  mockedIsFeatureEnabled.mockReturnValue(true);
+  fetchMock.put(updateSliceEndpoint, sliceResponsePayload, {
+    name: updateSliceEndpoint,
+  });
+  const extraTemporalFilter = {
+    expressionType: 'SIMPLE',
+    clause: 'WHERE',
+    subject: 'ds',
+    operator: Operators.TemporalRange,
+    comparator: '',
+    isExtra: true,
+  } as SimpleAdhocFilter;
+  const savedTemporalFilter = {
+    ...extraTemporalFilter,
+    comparator: 'No filter',
+    isExtra: false,
+  };
+  const dispatch = jest.fn();
+  const getState = () => ({
+    explore: {
+      form_data: {
+        datasource: `${datasourceId}__${datasourceType}`,
+        viz_type: vizType,
+        adhoc_filters: [extraTemporalFilter],
+      },
+    },
+    versionHistory: {
+      chartNormalization: {
+        chartId: sliceId,
+        hydrationSessionId: 'hydration-a',
+        saveAttemptId: null,
+        invalidatedControls: {},
+        transitions: {
+          adhoc_filters: {
+            control: 'adhoc_filters',
+            from_present: false as const,
+            to_present: true as const,
+            to_value: [savedTemporalFilter],
+          },
+        },
+      },
+    },
+  });
+
+  await updateSlice(
+    { ...sliceResponsePayload, slice_id: sliceId } as never,
+    sliceName,
+    [],
+  )(dispatch, getState);
+
+  const request = fetchMock.callHistory.lastCall(updateSliceEndpoint);
+  const body = JSON.parse(request?.options.body as string);
+  expect(body.normalization_changes).toEqual([
+    expect.objectContaining({
+      control: 'adhoc_filters',
+      to_value: [savedTemporalFilter],
+    }),
+  ]);
+});

 /**
 * Tests updateSlice action
 */
-const updateSliceEndpoint = `glob:*/api/v1/chart/${sliceId}`;
 test('updateSlice handles success', async () => {
  fetchMock.put(updateSliceEndpoint, sliceResponsePayload, {
    name: updateSliceEndpoint,
@@ -734,3 +884,97 @@ describe('getSlicePayload', () => {
    });
  });
 });
+
+test('existing-chart overwrite covers stash-removed keys as drop transitions', async () => {
+  mockedIsFeatureEnabled.mockReturnValue(true);
+  fetchMock.put(updateSliceEndpoint, sliceResponsePayload, {
+    name: updateSliceEndpoint,
+  });
+  const dispatch = jest.fn();
+  const getState = () => ({
+    explore: {
+      // The stash removed order_desc from active form data...
+      form_data: {
+        datasource: `${datasourceId}__${datasourceType}`,
+        viz_type: vizType,
+        row_limit: 10000,
+      },
+      // ...and holds it with the value it had when hidden.
+      hiddenFormData: { order_desc: true },
+    },
+    versionHistory: {
+      chartNormalization: {
+        chartId: sliceId,
+        hydrationSessionId: 'hydration-drop',
+        saveAttemptId: null,
+        invalidatedControls: {},
+        transitions: {},
+      },
+    },
+  });
+
+  await updateSlice(
+    {
+      ...sliceResponsePayload,
+      slice_id: sliceId,
+      // Persisted params carry the key the stash removed, same value.
+      form_data: { ...formData, order_desc: true },
+    } as never,
+    sliceName,
+    [],
+  )(dispatch, getState);
+
+  const request = fetchMock.callHistory.lastCall(updateSliceEndpoint);
+  const body = JSON.parse(request?.options.body as string);
+  expect(body.normalization_changes).toEqual([
+    {
+      control: 'order_desc',
+      from_present: true,
+      from_value: true,
+      to_present: false,
+    },
+  ]);
+});
+
+test('a stashed value the user changed before hiding is not covered', async () => {
+  mockedIsFeatureEnabled.mockReturnValue(true);
+  fetchMock.put(updateSliceEndpoint, sliceResponsePayload, {
+    name: updateSliceEndpoint,
+  });
+  const dispatch = jest.fn();
+  const getState = () => ({
+    explore: {
+      form_data: {
+        datasource: `${datasourceId}__${datasourceType}`,
+        viz_type: vizType,
+        row_limit: 10000,
+      },
+      // Stash holds a USER-edited value; persisted differs, so the removal
+      // stays recorded.
+      hiddenFormData: { order_desc: false },
+    },
+    versionHistory: {
+      chartNormalization: {
+        chartId: sliceId,
+        hydrationSessionId: 'hydration-drop-2',
+        saveAttemptId: null,
+        invalidatedControls: {},
+        transitions: {},
+      },
+    },
+  });
+
+  await updateSlice(
+    {
+      ...sliceResponsePayload,
+      slice_id: sliceId,
+      form_data: { ...formData, order_desc: true },
+    } as never,
+    sliceName,
+    [],
+  )(dispatch, getState);
+
+  const request = fetchMock.callHistory.lastCall(updateSliceEndpoint);
+  const body = JSON.parse(request?.options.body as string);
+  expect(body.normalization_changes).toBeUndefined();
+});
@@ -21,6 +21,8 @@ import { Dispatch } from 'redux';
 import { t } from '@apache-superset/core/translation';
 import {
  DatasourceType,
+  FeatureFlag,
+  isFeatureEnabled,
  type QueryFormData,
  SimpleAdhocFilter,
  SupersetClient,
@@ -30,11 +32,25 @@ import { isEmpty } from 'lodash-es';
 import { Slice } from 'src/dashboard/types';
 import { Operators } from '../constants';
 import { buildV1ChartDataPayload } from '../exploreUtils';
+import { nanoid } from 'nanoid';
+import {
+  beginChartNormalizationSave,
+  completeChartNormalizationSave,
+} from 'src/features/versionHistory/reducer';
+import type {
+  AutomaticNormalizationTransitions,
+  ChartNormalizationTrackingState,
+} from 'src/features/versionHistory/types';
+import {
+  matchingAutomaticNormalizationTransitions,
+  stashDropNormalizationTransitions,
+} from 'src/features/versionHistory/normalization';

 export interface PayloadSlice extends Slice {
  params: string;
  dashboards: number[];
  query_context: string;
+  normalization_changes?: AutomaticNormalizationTransitions[string][];
 }
 const ADHOC_FILTER_REGEX = /^adhoc_filters/;

@@ -233,21 +249,84 @@ export const updateSlice =
      new?: boolean;
    },
  ) =>
-  async (dispatch: Dispatch, getState: () => Partial<QueryFormData>) => {
+  async (
+    dispatch: Dispatch,
+    getState: () => Partial<QueryFormData> & {
+      versionHistory?: {
+        chartNormalization?: ChartNormalizationTrackingState | null;
+      };
+      explore?: {
+        form_data?: QueryFormData;
+        hiddenFormData?: Record<string, unknown>;
+      };
+    },
+  ) => {
    const { slice_id: sliceId, editors, form_data: formDataFromSlice } = slice;
-    const formData = getState().explore?.form_data;
+    const initialState = getState();
+    const formData = JSON.parse(
+      JSON.stringify(initialState.explore?.form_data ?? {}),
+    ) as QueryFormData;
+    const tracking = initialState.versionHistory?.chartNormalization;
+    const saveAttemptId = nanoid();
+    const shouldAttachNormalization =
+      isFeatureEnabled(FeatureFlag.VersionHistory) &&
+      tracking?.chartId === sliceId;
+    if (shouldAttachNormalization) {
+      dispatch(
+        beginChartNormalizationSave(
+          sliceId,
+          tracking.hydrationSessionId,
+          saveAttemptId,
+        ),
+      );
+    }
    try {
+      const payload = await getSlicePayload(
+        sliceName,
+        formData,
+        dashboards,
+        editors as [],
+        formDataFromSlice,
+      );
+      const savedFormData = JSON.parse(payload.params ?? '{}') as QueryFormData;
+      // Hydration-time transitions that still hold, plus save-time drops of
+      // keys the stash removed (mutually exclusive per control: a surviving
+      // hydration transition implies the key is present in the payload, a
+      // stash drop implies it is absent).
+      const matchingTransitions = shouldAttachNormalization
+        ? {
+            ...matchingAutomaticNormalizationTransitions(
+              tracking,
+              savedFormData,
+            ),
+            ...stashDropNormalizationTransitions(
+              (formDataFromSlice ?? {}) as Record<string, unknown>,
+              initialState.explore?.hiddenFormData,
+              savedFormData,
+            ),
+          }
+        : {};
+      if (
+        shouldAttachNormalization &&
+        Object.keys(matchingTransitions).length
+      ) {
+        payload.normalization_changes = Object.values(matchingTransitions);
+      }
      const response = await SupersetClient.put({
        endpoint: `/api/v1/chart/${sliceId}`,
-        jsonPayload: await getSlicePayload(
-          sliceName,
-          formData,
-          dashboards,
-          editors as [],
-          formDataFromSlice,
-        ),
+        jsonPayload: payload,
      });

+      if (shouldAttachNormalization) {
+        dispatch(
+          completeChartNormalizationSave(
+            sliceId,
+            tracking.hydrationSessionId,
+            saveAttemptId,
+            {},
+          ),
+        );
+      }
      dispatch(saveSliceSuccess(response.json));
      addToasts(false, sliceName, addedToDashboard).map(dispatch);
      return response.json;
@@ -19,7 +19,6 @@
 import { useMemo, useCallback, useRef, useState } from 'react';
 import {
  getTimeFormatter,
-  safeHtmlSpan,
  TimeFormats,
  getMetricLabel,
  QueryFormMetric,
@@ -92,8 +91,11 @@ export function useGridColumns(
                  ) {
                    return timeFormatter(value);
                  }
+                  // Render string cells as plain text: this grid shows raw
+                  // query results (untrusted warehouse data) to any viewer,
+                  // so HTML must stay inert here even after sanitization.
                  if (typeof value === 'string') {
-                    return safeHtmlSpan(value);
+                    return value;
                  }
                  return String(value);
                },
@@ -112,6 +112,31 @@ describe('ColorBreakpointOption', () => {
    expect(colorPreview).toBeInTheDocument();
  });

+  test('should coerce non-numeric color channels instead of injecting CSS', async () => {
+    // Stored form_data is opaque JSON, so a saved chart can carry a string
+    // channel crafted to break out of the styled-component declaration.
+    const maliciousBreakpoint = {
+      id: 3,
+      color: {
+        r: '0,0,0,1); } body { display: none } .x { background: rgba(0' as unknown as number,
+        g: 0,
+        b: 0,
+        a: 1,
+      },
+      minValue: 0,
+      maxValue: 100,
+    };
+
+    renderComponent({ breakpoint: maliciousBreakpoint });
+
+    const colorPreview = await screen.findByTestId('color-preview');
+    expect(colorPreview).toBeInTheDocument();
+    // The malicious string is coerced to a safe numeric channel (0), so the
+    // rendered rule is a plain rgba() value with no injected CSS.
+    expect(colorPreview).toHaveStyle({ background: 'rgba(0, 0, 0, 1)' });
+    expect(document.body).toBeVisible();
+  });
+
  test('should handle decimal values', async () => {
    const decimalBreakpoint: ColorBreakpointType = {
      id: 2,
@@ -31,6 +31,19 @@ const BreakpointColorPreview = styled.div`
  margin-right: ${({ theme }) => theme.sizeUnit}px;
 `;

+// Chart params are stored server-side as opaque JSON, so breakpoint color
+// channels can arrive as arbitrary strings despite the compile-time numeric
+// type. The formatted color is interpolated into a styled-component template
+// (a stylesheet, not a per-property style assignment), so each channel must
+// be coerced to a plain number to keep attacker-controlled strings from
+// injecting CSS rules.
+const toRgbChannel = (channel: unknown): number => {
+  const value = Number(channel);
+  return Number.isFinite(value)
+    ? Math.min(255, Math.max(0, Math.round(value)))
+    : 0;
+};
+
 const ColorBreakpointOption = ({
  breakpoint,
  colorBreakpoints,
@@ -41,7 +54,9 @@ const ColorBreakpointOption = ({
  const { color, minValue, maxValue } = breakpoint;

  const formattedColor = color
-    ? `rgba(${color.r}, ${color.g}, ${color.b}, 1)`
+    ? `rgba(${toRgbChannel(color.r)}, ${toRgbChannel(color.g)}, ${toRgbChannel(
+        color.b,
+      )}, 1)`
    : '';

  return (
@@ -60,7 +60,7 @@ export default function DndAdhocFilterOption({
      <OptionWrapper
        key={index}
        index={index}
-        label={actualTimeRange ?? adhocFilter.getDefaultLabel()}
+        label={actualTimeRange ?? adhocFilter.getDefaultLabel(options)}
        tooltipTitle={title ?? adhocFilter.getTooltipTitle()}
        clickClose={onClickClose}
        onShiftOptions={onShiftOptions}
@@ -43,7 +43,7 @@ import {
  DndFilterSelectProps,
 } from 'src/explore/components/controls/DndColumnSelectControl/DndFilterSelect';
 import { PLACEHOLDER_DATASOURCE } from 'src/dashboard/constants';
-import { ExpressionTypes } from '../FilterControl/types';
+import { Clauses, ExpressionTypes } from '../FilterControl/types';
 import { DndItemType } from '../../DndItemType';
 import { Datasource } from '../../../types';
 import {
@@ -137,6 +137,35 @@ test('renders with value', async () => {
  expect(await screen.findByText('COUNT(*)')).toBeInTheDocument();
 });

+test('renders the pill using the column verbose_name when one is set', async () => {
+  const value = new AdhocFilter({
+    expressionType: ExpressionTypes.Simple,
+    subject: 'num',
+    operator: '>',
+    comparator: '500',
+    clause: Clauses.Where,
+  });
+  render(
+    setup({
+      value,
+      columns: [
+        {
+          id: 1,
+          type: 'BIGINT',
+          type_generic: GenericDataType.Numeric,
+          column_name: 'num',
+          verbose_name: 'total_count',
+        },
+      ],
+    }),
+    {
+      useDndKit: true,
+      store,
+    },
+  );
+  expect(await screen.findByText('total_count > 500')).toBeInTheDocument();
+});
+
 test('renders options with saved metric', async () => {
  render(
    setup({
@@ -370,4 +370,32 @@ describe('AdhocFilter', () => {
    });
    expect(adhocFilter.getDefaultLabel()).toBe('');
  });
+  test('uses the column verbose_name in the label when one is given', () => {
+    const adhocFilter = new AdhocFilter({
+      expressionType: ExpressionTypes.Simple,
+      subject: 'num',
+      operator: '>',
+      comparator: '500',
+      clause: Clauses.Where,
+    });
+    expect(
+      adhocFilter.getDefaultLabel([
+        { column_name: 'num', verbose_name: 'total_count' },
+      ]),
+    ).toBe('total_count > 500');
+  });
+  test('falls back to the column_name when no verbose_name is set', () => {
+    const adhocFilter = new AdhocFilter({
+      expressionType: ExpressionTypes.Simple,
+      subject: 'num',
+      operator: '>',
+      comparator: '500',
+      clause: Clauses.Where,
+    });
+    expect(
+      adhocFilter.getDefaultLabel([{ column_name: 'num', verbose_name: '' }]),
+    ).toBe('num > 500');
+    expect(adhocFilter.getDefaultLabel([])).toBe('num > 500');
+    expect(adhocFilter.getDefaultLabel()).toBe('num > 500');
+  });
 });
@@ -23,7 +23,7 @@ import {
  OPERATOR_ENUM_TO_OPERATOR_TYPE,
  Operators,
 } from 'src/explore/constants';
-import { translateToSql } from '../utils/translateToSQL';
+import { translateToSql, VerboseColumn } from '../utils/translateToSQL';
 import { Clauses, ExpressionTypes } from '../types';

 const CUSTOM_OPERATIONS = [...CUSTOM_OPERATORS].map(
@@ -193,8 +193,8 @@ export default class AdhocFilter {
    );
  }

-  getDefaultLabel(): string {
-    const label = this.translateToSql();
+  getDefaultLabel(columns?: VerboseColumn[]): string {
+    const label = this.translateToSql({ columns });
    return label.length < 43 ? label : `${label.substring(0, 40)}...`;
  }

@@ -202,8 +202,8 @@ export default class AdhocFilter {
    return this.translateToSql();
  }

-  translateToSql(): string {
-    return translateToSql(this as unknown as CoreAdhocFilter);
+  translateToSql(params: { columns?: VerboseColumn[] } = {}): string {
+    return translateToSql(this as unknown as CoreAdhocFilter, params);
  }
 }

@@ -23,6 +23,7 @@ import {
  screen,
  userEvent,
  waitFor,
+  within,
 } from 'spec/helpers/testing-library';
 import thunk from 'redux-thunk';
 import configureStore from 'redux-mock-store';
@@ -914,3 +915,39 @@ test('dropdown should remain open when clicked after filter is configured', asyn

  expect(operatorDropdown).toHaveAttribute('aria-expanded', 'true');
 });
+
+test('filters the subject select by column verbose_name as well as column_name', async () => {
+  setup({
+    options: [
+      {
+        type: 'BIGINT',
+        column_name: 'num',
+        verbose_name: 'total_count',
+        id: 1,
+      },
+      {
+        type: 'VARCHAR(255)',
+        column_name: 'name',
+        verbose_name: 'Full Name',
+        id: 2,
+      },
+    ],
+  });
+
+  const combobox = screen.getByRole('combobox', { name: 'Select subject' });
+  userEvent.click(combobox);
+
+  await userEvent.type(combobox, 'total');
+
+  const dropdown = document.querySelector(
+    '.ant-select-dropdown-list',
+  ) as HTMLElement;
+  expect(within(dropdown).getByText('total_count')).toBeInTheDocument();
+  expect(within(dropdown).queryByText('Full Name')).not.toBeInTheDocument();
+
+  await userEvent.clear(combobox);
+  await userEvent.type(combobox, 'num');
+
+  expect(within(dropdown).getByText('total_count')).toBeInTheDocument();
+  expect(within(dropdown).queryByText('Full Name')).not.toBeInTheDocument();
+});
@@ -639,7 +639,11 @@ const AdhocFilterEditPopoverSimpleTabContent: FC<Props> = props => {
          ('optionName' in column && column.optionName) ||
          undefined,
        label: renderSubjectOptionLabel(column),
+        column_name: 'column_name' in column ? column.column_name : undefined,
+        verbose_name:
+          'verbose_name' in column ? column.verbose_name : undefined,
      }))}
+      optionFilterProps={['column_name', 'verbose_name']}
      {...subjectSelectProps}
    />
  );
@@ -71,6 +71,24 @@ test('should render the control label', async () => {
  expect(await screen.findByText('value > 10')).toBeInTheDocument();
 });

+test('should render the control label using the column verbose_name when one is set', async () => {
+  render(
+    setup({
+      ...mockedProps,
+      options: [
+        {
+          type: 'DOUBLE',
+          column_name: 'value',
+          verbose_name: 'total_count',
+          id: 3,
+        },
+      ],
+    }),
+    { useDnd: true, useRedux: true },
+  );
+  expect(await screen.findByText('total_count > 10')).toBeInTheDocument();
+});
+
 test('should render the remove button', async () => {
  render(setup(mockedProps), { useDnd: true, useRedux: true });
  const removeBtn = await screen.findByTestId('remove-control-button');
@@ -65,7 +65,7 @@ export default function AdhocFilterOption({
      partitionColumn={partitionColumn ?? undefined}
    >
      <OptionControlLabel
-        label={actualTimeRange ?? adhocFilter.getDefaultLabel()}
+        label={actualTimeRange ?? adhocFilter.getDefaultLabel(options)}
        tooltipTitle={title ?? adhocFilter.getTooltipTitle()}
        onRemove={() =>
          onRemoveFilter({
@@ -63,9 +63,35 @@ export const OPERATORS_TO_SQL = {
    `= '{{ presto.latest_partition('${datasource.schema}.${datasource.datasource_name}') }}'`,
 };

+export interface VerboseColumn {
+  column_name?: string;
+  verbose_name?: string | null;
+}
+
+// Resolves the display label for a filter's subject: the verbose_name of the
+// matching column when one is supplied, falling back to the technical
+// subject used for SQL generation.
+const getDisplaySubject = (
+  subject: string | { column_name?: string } | null | undefined,
+  columns?: VerboseColumn[],
+) => {
+  if (!columns) {
+    return subject ?? undefined;
+  }
+  const columnName =
+    typeof subject === 'object' ? subject?.column_name : subject;
+  const verboseName = columns.find(
+    column => column.column_name === columnName,
+  )?.verbose_name;
+  return verboseName || (subject ?? undefined);
+};
+
 export const translateToSql = (
  adhocFilter: AdhocFilter,
-  { useSimple }: { useSimple: boolean } = { useSimple: false },
+  {
+    useSimple,
+    columns,
+  }: { useSimple?: boolean; columns?: VerboseColumn[] } = {},
 ) => {
  if (isSimpleAdhocFilter(adhocFilter) || useSimple) {
    const { subject, operator } = adhocFilter as SimpleAdhocFilter;
@@ -81,7 +107,11 @@ export const translateToSql = (
          OPERATORS_TO_SQL[operator](adhocFilter)
        : // @ts-expect-error TODO: fix missing operator type `NOT LIKE` and `TEMPORAL RANGE`.
          OPERATORS_TO_SQL[operator];
-    return getSimpleSQLExpression(subject, op, comparator);
+    return getSimpleSQLExpression(
+      getDisplaySubject(subject, columns),
+      op,
+      comparator,
+    );
  }
  if (isFreeFormAdhocFilter(adhocFilter)) {
    return adhocFilter.sqlExpression;
@@ -22,10 +22,11 @@ import FixedOrMetricControl from '.';
 jest.mock(
  '@superset-ui/core/components/Icons/AsyncIcon',
  () =>
-    ({ fileName }: { fileName: string }) => (
-      // eslint-disable-next-line jsx-a11y/prefer-tag-over-role -- mirrors AsyncIcon's real span+role="img" shape
-      <span role="img" aria-label={fileName.replace('_', '-')} />
-    ),
+    ({ fileName }: { fileName: string }) =>
+      (
+        // eslint-disable-next-line jsx-a11y/prefer-tag-over-role -- mirrors AsyncIcon's real span+role="img" shape
+        <span role="img" aria-label={fileName.replace('_', '-')} />
+      ),
 );

 const createProps = () => ({
@@ -278,6 +278,24 @@ describe('VizTypeControl', () => {
    ).not.toBeInTheDocument();
  });

+  test('Thumbnail labels expose the full chart name via a title tooltip', async () => {
+    // Labels are clamped to a fixed two-line block so every tile is the same
+    // height; the full (possibly truncated) name must stay discoverable through
+    // the title attribute.
+    await waitForRenderWrapper();
+    userEvent.click(screen.getByRole('tab', { name: 'All charts' }));
+
+    const visualizations = screen.getByTestId(getTestId('viz-row'));
+    const labels = await within(visualizations).findAllByTestId(
+      getTestId('viztype-label'),
+    );
+
+    expect(labels.length).toBeGreaterThan(0);
+    labels.forEach(label => {
+      expect(label).toHaveAttribute('title', label.textContent ?? '');
+    });
+  });
+
  test('Submit on viz type double-click', async () => {
    await waitForRenderWrapper();
    userEvent.click(screen.getByRole('tab', { name: 'All charts' }));
@@ -214,6 +214,9 @@ const IconsPane = styled.div`
  justify-content: space-evenly;
  grid-gap: ${({ theme }) => theme.sizeUnit * 2}px;
  justify-items: center;
+  /* top-align every tile so a longer chart name never pushes the thumbnails
+     of the other tiles in the same row upward */
+  align-items: start;
  /* for some reason this padding doesn't seem to apply at the bottom of the container. Why is a mystery. */
  padding: ${({ theme }) => theme.sizeUnit * 2}px;
 `;
@@ -274,7 +277,6 @@ const thumbnailContainerCss = (theme: SupersetTheme) => css`
  font: inherit;
  cursor: pointer;
  width: ${theme.sizeUnit * THUMBNAIL_GRID_UNITS}px;
-  position: relative;
  outline: none; /* Remove focus outline to show only selected state */

  img {
@@ -297,6 +299,16 @@ const thumbnailContainerCss = (theme: SupersetTheme) => css`
  .viztype-label {
    margin-top: ${theme.sizeUnit * 2}px;
    text-align: center;
+    /* reserve a fixed two-line block so every tile is the same height,
+       regardless of how long the chart name is. Longer names are clamped
+       with an ellipsis; the full name stays available via the title tooltip. */
+    line-height: ${theme.sizeUnit * 4}px;
+    height: ${theme.sizeUnit * 8}px;
+    display: -webkit-box;
+    -webkit-line-clamp: 2;
+    -webkit-box-orient: vertical;
+    overflow: hidden;
+    word-break: break-word;
  }
 `;

@@ -320,10 +332,19 @@ const HighlightLabel = styled.div`
  `}
 `;

+// Wraps the thumbnail image so the "Featured" badge can be anchored to the
+// image itself rather than to the whole tile (whose height varies with the
+// chart-name length). line-height: 0 removes the inline-image descender gap.
+const ThumbnailImageWrapper = styled.div`
+  position: relative;
+  width: ${({ theme }) => theme.sizeUnit * THUMBNAIL_GRID_UNITS}px;
+  line-height: 0;
+`;
+
 const ThumbnailLabelWrapper = styled.div`
  position: absolute;
  right: ${({ theme }) => theme.sizeUnit}px;
-  top: ${({ theme }) => theme.sizeUnit * 19}px;
+  top: ${({ theme }) => theme.sizeUnit}px;
 `;

 const TitleLabelWrapper = styled.div`
@@ -367,27 +388,32 @@ const Thumbnail: FC<ThumbnailProps> = ({
      onFocus={handleFocus}
      data-test="viztype-selector-container"
    >
-      <img
-        alt={type.name}
-        width="100%"
-        className={`viztype-selector ${isSelected ? 'selected' : ''}`}
-        src={
-          isDarkMode && type.thumbnailDark ? type.thumbnailDark : type.thumbnail
-        }
-      />
+      <ThumbnailImageWrapper>
+        <img
+          alt={type.name}
+          width="100%"
+          className={`viztype-selector ${isSelected ? 'selected' : ''}`}
+          src={
+            isDarkMode && type.thumbnailDark
+              ? type.thumbnailDark
+              : type.thumbnail
+          }
+        />
+        {type.label && (
+          <ThumbnailLabelWrapper>
+            <HighlightLabel>
+              <div>{t(type.label)}</div>
+            </HighlightLabel>
+          </ThumbnailLabelWrapper>
+        )}
+      </ThumbnailImageWrapper>
      <div
        className="viztype-label"
        data-test={`${VIZ_TYPE_CONTROL_TEST_ID}__viztype-label`}
+        title={type.name}
      >
        {type.name}
      </div>
-      {type.label && (
-        <ThumbnailLabelWrapper>
-          <HighlightLabel>
-            <div>{t(type.label)}</div>
-          </HighlightLabel>
-        </ThumbnailLabelWrapper>
-      )}
    </button>
  );
 };
@@ -78,6 +78,37 @@ import { useExploreDataExport } from './useExploreDataExport';

 export const SEARCH_THRESHOLD = 10;

+/**
+ * Escape a single CSV cell value.
+ *
+ * Mirrors the server-side chokepoint (superset/utils/csv.py escape_value):
+ * values starting with a spreadsheet formula prefix (=, +, -, @, |, %, or a
+ * leading tab/carriage return, optionally behind leading whitespace) are
+ * neutralized with a leading single quote so exported cells cannot execute
+ * as formulas when opened in Excel/LibreOffice/Google Sheets. Plain negative
+ * numbers are left untouched. RFC-4180 quoting is applied afterwards.
+ */
+export const escapeCsvValue = (v: unknown): string => {
+  if (v === null || v === undefined) return '';
+  let s = String(v);
+  if (s.length > 0) {
+    const stripped = s.replace(/^\s+/, '');
+    const startsLikeFormula =
+      s[0] === '\t' ||
+      s[0] === '\r' ||
+      (stripped.length > 0 && '-@+|=%'.includes(stripped[0]));
+    const isNegativeNumber = s.length > 1 && /^-[0-9.]+$/.test(s);
+    if (startsLikeFormula && !isNegativeNumber) {
+      // Escape pipe to be extra safe (DDE payloads), then prefix with a
+      // single quote to prevent formula evaluation. Existing backslashes
+      // must be escaped first so the resulting `\|`/`\\` sequences are
+      // unambiguous to a downstream unescaper.
+      s = `'${s.replace(/\\/g, '\\\\').replace(/\|/g, '\\|')}`;
+    }
+  }
+  return /[",\r\n]/.test(s) ? `"${s.replace(/"/g, '""')}"` : s;
+};
+
 const MENU_KEYS = {
  EDIT_PROPERTIES: 'edit_properties',
  DASHBOARDS_ADDED_TO: 'dashboards_added_to',
@@ -488,15 +519,11 @@ export const useExploreAdditionalActionsMenu = (
    filename: string,
  ) => {
    if (!rows?.length || !columns?.length) return;
-    const esc = (v: unknown): string => {
-      if (v === null || v === undefined) return '';
-      const s = String(v);
-      const wrapped = /[",\n]/.test(s) ? `"${s.replace(/"/g, '""')}"` : s;
-      return wrapped;
-    };
-    const header = columns.map(c => esc(c.label ?? c.key ?? '')).join(',');
+    const header = columns
+      .map(c => escapeCsvValue(c.label ?? c.key ?? ''))
+      .join(',');
    const body = rows
-      .map(r => columns.map(c => esc(r[c.key])).join(','))
+      .map(r => columns.map(c => escapeCsvValue(r[c.key])).join(','))
      .join('\n');
    const csv = `${header}\n${body}`;
    const blob = new Blob([csv], { type: 'text/csv;charset=utf-8;' });
@@ -25,6 +25,7 @@ import downloadAsPdf from 'src/utils/downloadAsPdf';
 import {
  useExploreAdditionalActionsMenu,
  getExportScreenshotMenuItems,
+  escapeCsvValue,
 } from './index';
 import * as exploreUtils from 'src/explore/exploreUtils';
 import { Slice } from 'src/types/Chart';
@@ -180,6 +181,45 @@ test('hides Edit chart properties from a chart editor lacking chart write permis
  expect(screen.queryByText('Edit chart properties')).not.toBeInTheDocument();
 });

+test('escapeCsvValue neutralizes spreadsheet formula prefixes', () => {
+  // Mirrors superset/utils/csv.py escape_value so the client-built
+  // "Current View" CSV cannot ship live formulas (CSV injection).
+  expect(escapeCsvValue('=HYPERLINK("https://attacker.example")')).toBe(
+    `"'=HYPERLINK(""https://attacker.example"")"`,
+  );
+  expect(escapeCsvValue('@SUM(1+1)')).toBe(`'@SUM(1+1)`);
+  expect(escapeCsvValue('+cmd')).toBe(`'+cmd`);
+  expect(escapeCsvValue('%x')).toBe(`'%x`);
+  expect(escapeCsvValue('\t=1+1')).toBe(`'\t=1+1`);
+  expect(escapeCsvValue('  =1+1')).toBe(`'  =1+1`);
+  expect(escapeCsvValue('=cmd|calc')).toBe(`'=cmd\\|calc`);
+});
+
+test('escapeCsvValue escapes pre-existing backslashes before escaping pipes', () => {
+  // A literal backslash sitting next to a pipe must not be left as-is: if it
+  // were, the escaped output (`\|`) would be indistinguishable from an
+  // escaped pipe, so a downstream unescaper couldn't recover the original
+  // value. Escaping backslashes first keeps the two cases unambiguous.
+  expect(escapeCsvValue('=cmd\\|calc')).toBe(`'=cmd\\\\\\|calc`);
+});
+
+test('escapeCsvValue RFC-4180-quotes a value containing a bare carriage return', () => {
+  // A raw \r inside a cell can be read as a record separator by some CSV
+  // consumers, so it must trigger outer quoting the same way \n does, even
+  // when it also triggered the formula-prefix guard above.
+  expect(escapeCsvValue('\r=1+1')).toBe(`"'\r=1+1"`);
+});
+
+test('escapeCsvValue keeps ordinary values intact', () => {
+  expect(escapeCsvValue('regular text')).toBe('regular text');
+  expect(escapeCsvValue('-12.5')).toBe('-12.5');
+  expect(escapeCsvValue(42)).toBe('42');
+  expect(escapeCsvValue(null)).toBe('');
+  expect(escapeCsvValue(undefined)).toBe('');
+  expect(escapeCsvValue('a,b')).toBe(`"a,b"`);
+  expect(escapeCsvValue('say "hi"')).toBe(`"say ""hi"""`);
+});
+
 test('shows 413 error toast when exportCSV fails with 413', async () => {
  mockExportChart.mockRejectedValue({ status: 413 });

@@ -17,9 +17,11 @@
 * under the License.
 */

-import exploreReducer, { ExploreState } from './exploreReducer';
-import { setStashFormData } from '../actions/exploreActions';
 import { QueryFormData } from '@superset-ui/core';
+import { sections, CustomControlItem } from '@superset-ui/chart-controls';
+import { getControlStateFromControlConfig } from 'src/explore/controlUtils';
+import exploreReducer, { ExploreState } from './exploreReducer';
+import { setControlValue, setStashFormData } from '../actions/exploreActions';

 test('reset hiddenFormData on SET_STASH_FORM_DATA', () => {
  const initialState: ExploreState = {
@@ -52,3 +54,72 @@ test('skips updates when the field is already updated on SET_STASH_FORM_DATA', (
  const newState = exploreReducer(initialState, restoreAction);
  expect(newState).toBe(initialState);
 });
+
+// Regression guard for the shared Time Comparison section (used by the Table
+// chart, among others): selecting "Custom date" for Time shift and then
+// clearing "Shift start date" raises a required-date validation error. When the
+// user then switches Time shift to a non-custom preset the error must clear.
+// Because `start_date_offset` did not declare `validationDependencies` on
+// `time_compare`, SET_FIELD_VALUE never re-ran its mapStateToProps and the stale
+// error survived in Redux, blocking further chart updates until a page refresh.
+test('SET_FIELD_VALUE clears the custom-shift date error when time_compare leaves "custom"', () => {
+  const REQUIRED_DATE_ERROR = 'A date is required when using custom date shift';
+  const timeComparisonSection = sections.timeComparisonControls({
+    multi: false,
+    showCalculationType: false,
+    showFullChoices: false,
+  });
+  const timeCompareConfig = (
+    timeComparisonSection.controlSetRows[0][0] as CustomControlItem
+  ).config;
+  const startDateOffsetConfig = (
+    timeComparisonSection.controlSetRows[1][0] as CustomControlItem
+  ).config;
+
+  const form_data = {
+    time_compare: 'custom',
+    start_date_offset: '2021-01-01',
+  } as unknown as QueryFormData;
+
+  // Build the control states the way the explore store does so they carry the
+  // real mapStateToProps / validationDependencies from the control config.
+  const controlPanelState = { controls: {}, form_data };
+  const initialState: ExploreState = {
+    form_data,
+    controls: {
+      time_compare: getControlStateFromControlConfig(
+        timeCompareConfig,
+        controlPanelState,
+        'custom',
+      )!,
+      start_date_offset: getControlStateFromControlConfig(
+        startDateOffsetConfig,
+        controlPanelState,
+        '2021-01-01',
+      )!,
+    },
+  };
+
+  // A valid custom date starts without a validation error.
+  expect(initialState.controls.start_date_offset.validationErrors).toEqual([]);
+
+  // 1) Clearing "Shift start date" raises the required-date error (expected).
+  const afterClear = exploreReducer(
+    initialState,
+    setControlValue('start_date_offset', '') as Parameters<
+      typeof exploreReducer
+    >[1],
+  );
+  expect(afterClear.controls.start_date_offset.validationErrors).toEqual([
+    REQUIRED_DATE_ERROR,
+  ]);
+
+  // 2) Switching Time shift to a non-custom preset must clear the stale error.
+  const afterSwitch = exploreReducer(
+    afterClear,
+    setControlValue('time_compare', '1 week ago') as Parameters<
+      typeof exploreReducer
+    >[1],
+  );
+  expect(afterSwitch.controls.start_date_offset.validationErrors).toEqual([]);
+});
@@ -96,7 +96,11 @@ export default function ChartCard({
  const canEdit = hasPerm('can_write');
  const canDelete = hasPerm('can_write');
  const canExport = hasPerm('can_export');
-  const allowEdit = isUserEditorOrAdmin(user, chart.editors);
+  const allowEdit = isUserEditorOrAdmin(
+    user,
+    chart.editors,
+    chart.extra_editors,
+  );
  const menuItems: MenuItem[] = [];

  if (canEdit) {
@@ -83,7 +83,11 @@ function DashboardCard({
  const canEdit = hasPerm('can_write');
  const canDelete = hasPerm('can_write');
  const canExport = hasPerm('can_export');
-  const allowEdit = isUserEditorOrAdmin(user, dashboard.editors);
+  const allowEdit = isUserEditorOrAdmin(
+    user,
+    dashboard.editors,
+    dashboard.extra_editors,
+  );
  const digest = dashboard.changed_on_utc || dashboard.changed_on;
  const thumbnailUrl =
    isFeatureEnabled(FeatureFlag.Thumbnails) && dashboard.id && digest
@@ -136,6 +136,7 @@ describe('DatabaseModal', () => {
                format: 'int32',
                maximum: 65536,
                minimum: 0,
+                nullable: true,
                type: 'integer',
              },
              query: {
@@ -153,7 +154,7 @@ describe('DatabaseModal', () => {
                type: 'string',
              },
            },
-            required: ['database', 'host', 'port', 'username'],
+            required: ['database', 'host', 'username'],
            type: 'object',
          },
          preferred: true,
@@ -38,10 +38,11 @@ import {
 jest.mock(
  '@superset-ui/core/components/Icons/AsyncIcon',
  () =>
-    ({ fileName }: { fileName: string }) => (
-      // eslint-disable-next-line jsx-a11y/prefer-tag-over-role -- mirrors AsyncIcon's real span+role="img" shape
-      <span role="img" aria-label={fileName.replace('_', '-')} />
-    ),
+    ({ fileName }: { fileName: string }) =>
+      (
+        // eslint-disable-next-line jsx-a11y/prefer-tag-over-role -- mirrors AsyncIcon's real span+role="img" shape
+        <span role="img" aria-label={fileName.replace('_', '-')} />
+      ),
 );

 // eslint-disable-next-line no-restricted-globals -- TODO: Migrate from describe blocks
@@ -29,10 +29,11 @@ import DatasetPanelWrapper from 'src/features/datasets/AddDataset/DatasetPanel';
 jest.mock(
  '@superset-ui/core/components/Icons/AsyncIcon',
  () =>
-    ({ fileName }: { fileName: string }) => (
-      // eslint-disable-next-line jsx-a11y/prefer-tag-over-role -- mirrors AsyncIcon's real span+role="img" shape
-      <span role="img" aria-label={fileName.replace('_', '-')} />
-    ),
+    ({ fileName }: { fileName: string }) =>
+      (
+        // eslint-disable-next-line jsx-a11y/prefer-tag-over-role -- mirrors AsyncIcon's real span+role="img" shape
+        <span role="img" aria-label={fileName.replace('_', '-')} />
+      ),
 );

 const errorMessageRegistry = getErrorMessageComponentRegistry();
@@ -72,6 +72,12 @@ export const PermissionsField = ({
            .replace(/_/g, ' ')
            .includes(input.toLowerCase().replace(/_/g, ' '))
        }
+        // Permission labels are long ("all datasource access on all_datasource_access",
+        // "can write on DashboardFilterStateRestApi"), and the dropdown otherwise
+        // inherits the trigger's width inside the modal, so every option was truncated
+        // to the point of being indistinguishable. Let the popup size to its content
+        // instead. See #40430.
+        popupMatchSelectWidth={false}
        getPopupContainer={trigger => trigger.closest('.ant-modal-container')}
        data-test="permissions-select"
      />
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Vitor Avila	93ddafa6b5	fix(OAuth2): Support creating OAuth2 connections via SQLAlchemy URI	2026-08-24 18:10:14 -03:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	dfd057b920	chore(deps-dev): update clickhouse-connect requirement from <2.0,>=1.6.0 to >=1.7.1,<2.0 (#43419 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-24 13:54:23 -07:00
dependabot[bot]dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Đỗ Trọng Hải	52571a5b8b	chore(deps): bump the rjsf group in /superset-frontend with 3 updates (#43440 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Đỗ Trọng Hải <41283691+hainenber@users.noreply.github.com>	2026-08-24 13:54:19 -07:00
Joe Li	ca3d7670b7	fix(ci): restore scheduled CI checks (#43266 )	2026-08-24 12:31:50 -07:00
Joe Li	94855e9626	fix(frontend): ignore stale list responses (#43306 )	2026-08-24 12:13:34 -07:00
Joe LiandClaude	7dbf71a379	fix(query-object): reject malformed ad-hoc metrics (#43353 ) Co-authored-by: Claude <noreply@anthropic.com>	2026-08-24 12:12:25 -07:00
Joe LiandClaude Sonnet 5	24b95f9ca7	fix(gsheets): correctly format Date-column filter literals (#43355 ) Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-24 12:12:04 -07:00
Joe Li	c635d0754f	fix(explore): honor column Label in filter search and pill (#43404 )	2026-08-24 12:11:52 -07:00
Joe Li	31f06c0ee6	fix(dataset): correct Hours Offset filter bounds and grain-truncation order (#43173 )	2026-08-24 11:47:16 -07:00
Joe LiandClaude Opus 4.8	27ec80c07b	fix(explore): clear stale custom time-shift date error (#43146 ) Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-08-24 11:46:48 -07:00
Joe Li	a8a8b51afb	fix(plugin-chart-table): guard row-indexed comparison-color lookups against undefined entries (#43139 )	2026-08-24 11:45:25 -07:00
Joe Li Jean Massucatto Claude	6ab21b381a	fix(mysql): resolve wire-protocol column types and mutate rows from immutable results (#42821 ) Co-authored-by: Jean Massucatto <massucattoj@gmail.com> Co-authored-by: Claude <noreply@anthropic.com>	2026-08-24 11:45:15 -07:00
Đỗ Trọng Hải	b0962ba5ed	fix(plugin/chart/parallel-coordinate): prevent frontend crash with empty/undefined metrics when moving between pages quickly (#42392 ) Signed-off-by: hainenber <dotronghai96@gmail.com>	2026-08-24 11:44:50 -07:00
Joe LiandClaude Opus 4.8	bf5f3a9e6b	test(dashboard): migrate drill-to-detail E2E from Cypress to Playwright (#41437 ) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-08-24 11:44:35 -07:00
Evan Rusackas Superset Dev Claude Sonnet 5	c980b3a361	fix(mcp): tighten auth and request validation edge cases (#43388 ) Co-authored-by: Superset Dev <dev@superset.apache.org> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-24 10:58:59 -07:00
Bikash bikashJMV Claude Opus 5 Evan Rusackas	dc436c76f7	fix(datasets): keep a metric's warning text when editing from Explore (#43177 ) Co-authored-by: bikashJMV <bikash@jmv.co.in> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Evan Rusackas <evan@rusackas.com>	2026-08-24 10:47:45 -07:00
Bikash bikashJMV Claude Opus 5 Evan Rusackas Copilot Autofix powered by AI Evan Rusackas	6eced8e919	fix(roles): let the permissions dropdown size to its content (#43196 ) Co-authored-by: bikashJMV <bikash@jmv.co.in> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Evan Rusackas <evan@preset.io> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Evan Rusackas <evan@rusackas.com>	2026-08-24 10:46:03 -07:00
dependabot[bot]dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	1bde62f997	chore(deps-dev): bump gevent from 26.7.0 to 26.8.0 (#43411 ) Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-08-24 10:21:06 -07:00
dependabot[bot]dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	f1f6347885	chore(deps-dev): bump prophet from 1.3.0 to 1.4.0 (#43412 ) Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-08-24 10:21:02 -07:00
dependabot[bot]dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	8591f52ced	chore(deps): bump pyarrow from 25.0.0 to 25.0.1 (#43414 ) Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-08-24 10:20:59 -07:00
dependabot[bot]dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	ceb75b9350	chore(deps): bump sqlalchemy from 2.0.51 to 2.0.52 (#43415 ) Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-08-24 10:20:55 -07:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	db539288ac	chore(deps-dev): update teradatasql requirement from >=20.0.0.64 to >=20.0.0.65 (#43416 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-24 10:20:51 -07:00
dependabot[bot]dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	a392e8b102	chore(deps): bump marshmallow from 4.3.0 to 4.3.1 (#43417 ) Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-08-24 10:20:48 -07:00
dependabot[bot]dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	e450acf1c7	chore(deps): bump sqlglot from 30.16.0 to 30.17.0 (#43418 ) Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-08-24 10:20:44 -07:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2c02965f2b	chore(deps): bump @swc/core from 1.15.47 to 1.16.0 in /docs (#43443 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-24 10:20:38 -07:00
Evan Rusackas	f3142e7b15	fix(tags): fix broken import in daos/tag.py (#43466 )	2026-08-24 10:15:08 -07:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	649c062825	chore(deps): bump baseline-browser-mapping from 2.11.13 to 2.11.15 in /docs (#43444 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-24 09:52:03 -07:00
Mike Bridge Mike Bridge Claude Fable 5	3f10d8b1cc	fix(versioning): suppress automatic chart normalization changes (#43350 ) Co-authored-by: Mike Bridge <michael.bridge@ext.preset.io> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-24 09:09:20 -07:00
Mehmet Salih Yavuz	15b98aa6da	fix(plugin-chart-echarts): apply contribution before rename with time comparison (#43384 )	2026-08-24 19:08:08 +03:00
Evan Rusackas Superset Dev Claude Sonnet 5	7f1b41444c	fix: add missing access checks to semantic-layer and theme endpoints (#43389 ) Co-authored-by: Superset Dev <dev@superset.apache.org> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-24 08:52:45 -07:00
Evan Rusackas Superset Dev Claude Sonnet 5	8a32324184	fix: add missing ownership checks to tag, report-log, and dataset-schema endpoints (#43390 ) Co-authored-by: Superset Dev <dev@superset.apache.org> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-24 08:44:22 -07:00
Joe Li	4623d9219a	fix: update in the wild link on community page (#43403 )	2026-08-24 22:28:19 +07:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	dcac129b51	chore(deps): bump js-yaml from 5.2.3 to 5.3.0 in /docs (#43442 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-24 22:17:39 +07:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	7196ce8a0c	chore(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 (#43445 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-24 22:16:57 +07:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	e7756aeef9	chore(deps): bump immer from 11.1.16 to 11.1.17 in /superset-frontend (#43448 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-24 22:16:27 +07:00
DanielSwift1992	af859717a7	chore: remove two stale codecov ignore paths (#43438 )	2026-08-24 22:15:57 +07:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	8fa48d73f6	chore(deps-dev): bump concurrently from 10.0.4 to 10.0.5 in /superset-frontend (#43449 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-24 22:04:38 +07:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	90a3d93002	chore(deps): bump dayjs from 1.11.21 to 1.11.22 in /superset-frontend (#43450 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-24 22:04:09 +07:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	5ffb72151e	chore(deps): bump react-error-boundary from 6.1.2 to 6.1.3 in /superset-frontend (#43451 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-24 22:03:04 +07:00
Enzo Martellucci	c3ed8b312d	fix(security): surface extra_editors in dashboard/chart lists (#43392 )	2026-08-24 11:49:29 +02:00
Elizabeth Thompson	9f505eb0cb	fix(examples): replace deprecated timeseries_limit_metric with series_limit_metric (#43422 )	2026-08-22 15:02:20 -07:00
Joe LiandClaude Sonnet 5	f2610e9dca	fix(sqllab): default PostgreSQL port to 5432 in the dynamic connection form (#43351 ) Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-21 15:59:33 -07:00
abdullah revehaandAbdullah Sahin	09bd8c98de	feat(chart): enable cross-filter on temporal x-axis (bar/label click) (#42792 ) Co-authored-by: Abdullah Sahin <you@example.comclear>	2026-08-21 15:45:06 -07:00
Aurimas Navardauskas	5812c0eab5	fix(mcp): fail closed when MCP_AUTH_FACTORY raises (#43329 )	2026-08-21 15:43:51 -07:00
Mike BridgeandClaude Fable 5	5f3e34908c	fix(charts): surface blocking alerts/reports when archiving a chart (#43402 ) Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-21 19:33:32 -03:00
Evan RusackasandSuperset Dev	9781254363	fix(export): escape formula-triggering values consistently and bound post-processing inputs (#43396 ) Co-authored-by: Superset Dev <dev@superset.apache.org>	2026-08-21 12:37:33 -07:00
Evan Rusackas Superset Dev Claude Sonnet 5	65893113fe	fix(import): tighten ownership and validation checks across asset importers (#43393 ) Co-authored-by: Superset Dev <dev@superset.apache.org> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-21 12:35:33 -07:00
Evan Rusackas Superset Dev Claude Sonnet 5	04017f3956	fix(sqllab): re-validate access against rendered SQL and tighten cache/permalink scoping (#43394 ) Co-authored-by: Superset Dev <dev@superset.apache.org> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-21 12:35:06 -07:00
Evan Rusackas Superset Dev Claude Sonnet 5	2b6044b624	fix: tighten SSRF validation, executor resolution, and cache scoping across reports/thumbnails (#43395 ) Co-authored-by: Superset Dev <dev@superset.apache.org> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-21 12:34:37 -07:00
Evan RusackasandSuperset Dev	aee98b527d	fix(charts): escape untrusted strings before rendering into chart tooltips and popups (#43397 ) Co-authored-by: Superset Dev <dev@superset.apache.org>	2026-08-21 12:31:31 -07:00
Evan Rusackas Superset Dev Claude Sonnet 5	edda9d1bbb	fix(frontend): tighten SQL Lab autorun scoping and HTML-rendering defaults (#43398 ) Co-authored-by: Superset Dev <dev@superset.apache.org> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-21 12:31:08 -07:00
Joe LiandClaude Sonnet 5	03eac279e5	fix(explore): exclude permalink_key from chart URL params (#43354 ) Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-21 11:43:18 -07:00
yousophandClaude Opus 4.8	fd7095df9a	fix(explore): align viz type gallery thumbnails and Featured tag (#43373 ) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-08-21 10:40:37 -07:00
PRATHAMESH HUKKERI Prathamesh Hukkeri Claude Code Evan Rusackas	d422f5b4b6	fix: last date label hidden on time series x-axis (#39899 ) (#42299 ) Co-authored-by: Prathamesh Hukkeri <prathamesh04@users.noreply.github.com> Co-authored-by: Claude Code <noreply@anthropic.com> Co-authored-by: Evan Rusackas <evan@preset.io>	2026-08-21 09:59:06 -07:00