ci: bump setup-python v5 -> v6 in setup-backend to run on Node 24

GitHub forces Actions off Node 20 starting June 16, 2026. The shared
setup-backend composite action still pins actions/setup-python@v5 (Node 20),
which surfaces a deprecation warning on every backend job. Bump to v6 (Node 24),
reusing the same pinned SHA already used in bump-python-package.yml.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -41,8 +41,8 @@ body:
       label: Superset version
       options:
         - master / latest-dev
+        - "6.1.0"
         - "6.0.0"
-        - "5.0.0"
     validations:
       required: true
   - type: dropdown

.github/actions/setup-backend/action.yml

@@ -42,7 +42,7 @@ runs:
         fi
         echo "python-version=$RESOLVED_VERSION" >> "$GITHUB_OUTPUT"
     - name: Set up Python ${{ steps.set-python-version.outputs.python-version }}
-      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
       with:
         python-version: ${{ steps.set-python-version.outputs.python-version }}
         cache: ${{ inputs.cache }}

.github/dependabot.yml

@@ -14,12 +14,6 @@ updates:
 
   - package-ecosystem: "npm"
     ignore:
-      # TODO: remove below entries until React >= 18.0.0
-      - dependency-name: "storybook"
-        update-types: ["version-update:semver-major", "version-update:semver-minor"]
-      - dependency-name: "@storybook*"
-        update-types: ["version-update:semver-major", "version-update:semver-minor"]
-      - dependency-name: "eslint-plugin-storybook"
       - dependency-name: "react-error-boundary"
       - dependency-name: "@rjsf/*"
       # remark-gfm v4+ requires react-markdown v9+, which needs React 18
@@ -42,14 +36,6 @@ updates:
       # and confirm the issue https://github.com/apache/superset/issues/39600 is fixed
       - dependency-name: "react-checkbox-tree"
         update-types: ["version-update:semver-major"]
-    groups:
-      storybook:
-        applies-to: version-updates
-        patterns:
-          - "@storybook*"
-          - "storybook"
-        update-types:
-          - "patch"
     directory: "/superset-frontend/"
     schedule:
       interval: "daily"
@@ -90,21 +76,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/docs/"
     ignore:
-      # TODO: remove below entries until React >= 18.0.0 in superset-frontend
-      - dependency-name: "storybook"
-        update-types: ["version-update:semver-major", "version-update:semver-minor"]
-      - dependency-name: "@storybook*"
-        update-types: ["version-update:semver-major", "version-update:semver-minor"]
-      - dependency-name: "eslint-plugin-storybook"
       - dependency-name: "react-error-boundary"
-    groups:
-      storybook:
-        applies-to: version-updates
-        patterns:
-          - "@storybook*"
-          - "storybook"
-        update-types:
-          - "patch"
     schedule:
       interval: "daily"
     open-pull-requests-limit: 10

.github/workflows/codeql-analysis.yml

@@ -63,7 +63,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -74,6 +74,6 @@ jobs:
           # queries: security-extended,security-and-quality
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/pre-commit.yml

@@ -48,7 +48,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version: "20"
+          node-version-file: "superset-frontend/.nvmrc"
           cache: "npm"
           cache-dependency-path: "superset-frontend/package-lock.json"
 

.github/workflows/superset-extensions-cli.yml

@@ -56,7 +56,7 @@ jobs:
 
       - name: Upload coverage reports to Codecov
         if: steps.check.outputs.superset-extensions-cli
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           file: ./coverage.xml
           flags: superset-extensions-cli

.github/workflows/superset-frontend.yml

@@ -134,7 +134,7 @@ jobs:
         run: npx nyc merge coverage/ merged-output/coverage-summary.json
 
       - name: Upload Code Coverage
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           flags: javascript
           use_oidc: true

.github/workflows/superset-python-integrationtest.yml

@@ -85,7 +85,7 @@ jobs:
         run: |
           ./scripts/python_tests.sh
       - name: Upload code coverage
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           flags: python,mysql
           verbose: true
@@ -173,7 +173,7 @@ jobs:
         run: |
           ./scripts/python_tests.sh
       - name: Upload code coverage
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           flags: python,postgres
           verbose: true
@@ -222,7 +222,7 @@ jobs:
         run: |
           ./scripts/python_tests.sh
       - name: Upload code coverage
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           flags: python,sqlite
           verbose: true

.github/workflows/superset-python-presto-hive.yml

@@ -90,7 +90,7 @@ jobs:
         run: |
           ./scripts/python_tests.sh -m 'chart_data_flow or sql_json_flow'
       - name: Upload code coverage
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           flags: python,presto
           verbose: true
@@ -152,7 +152,7 @@ jobs:
           pip install -e .[hive]
           ./scripts/python_tests.sh -m 'chart_data_flow or sql_json_flow'
       - name: Upload code coverage
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           flags: python,hive
           verbose: true

.github/workflows/superset-python-unittest.yml

@@ -72,7 +72,7 @@ jobs:
           pytest --durations-min=0.5 --cov=superset/sql/ ./tests/unit_tests/sql/ --cache-clear --cov-fail-under=100
           pytest --durations-min=0.5 --cov=superset/semantic_layers/ ./tests/unit_tests/semantic_layers/ --cache-clear --cov-fail-under=100
       - name: Upload code coverage
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           flags: python,unit
           verbose: true

Dockerfile

@@ -29,7 +29,7 @@ ARG BUILD_TRANSLATIONS="false"
 ######################################################################
 # superset-node-ci used as a base for building frontend assets and CI
 ######################################################################
-FROM --platform=${BUILDPLATFORM} node:22-trixie-slim AS superset-node-ci
+FROM --platform=${BUILDPLATFORM} node:24-trixie-slim AS superset-node-ci
 ARG BUILD_TRANSLATIONS
 ENV BUILD_TRANSLATIONS=${BUILD_TRANSLATIONS}
 ARG DEV_MODE="false"           # Skip frontend build in dev mode

UPDATING.md

@@ -24,6 +24,53 @@ assists people when migrating to a new version.
 
 ## Next
 
+### Webhook alerts/reports block private/internal hosts by default
+
+Webhook alert/report dispatch (`WebhookNotification.send`) now validates the target URL's host against the same private/internal-IP block applied to dataset import URLs. If the resolved host is in a loopback, link-local, private (RFC-1918), shared-CGNAT, or multicast range, the webhook is rejected with `NotificationParamException`.
+
+Deployments that intentionally point webhooks at internal targets (chatops bridges, internal automation servers, on-premises Mattermost/Rocket.Chat, etc.) can opt out by setting `ALERT_REPORTS_WEBHOOK_ALLOW_INTERNAL_HOSTS = True` in `superset_config.py`. This mirrors the existing `DATASET_IMPORT_ALLOW_INTERNAL_DATA_URLS` opt-out for dataset imports.
+
+### Impala cancel_query blocks private/internal hosts by default
+
+The Impala engine spec's `cancel_query` issues an HTTP request from the Superset backend to the host configured on the Impala database connection. That host is now validated before the request: if it resolves to a private/internal IP range, the cancel call is refused and a warning is logged. Operators whose Impala cluster runs on an internal network can opt out by setting `IMPALA_CANCEL_QUERY_ALLOW_INTERNAL_HOSTS = True` in `superset_config.py`. This mirrors the dataset-import and webhook opt-out flags.
+### Map chart renderer and OpenStreetMap migration behavior
+
+The MapLibre migration for deck.gl charts preserves saved non-Mapbox styles on
+the MapLibre-compatible path. Saved styles such as OpenStreetMap, `tile://`
+tile templates, generic HTTPS style URLs, and charts without a saved style are
+not reclassified as Mapbox during migration and do not require
+`MAPBOX_API_KEY` only because of the migration.
+
+Saved true Mapbox styles whose value starts with `mapbox://` remain
+Mapbox-backed. If a Superset deployment does not configure `MAPBOX_API_KEY`,
+those saved Mapbox charts keep the existing missing-key message instead of
+silently falling back to MapLibre or another provider. In Explore, deck.gl and
+point-cluster renderer controls preserve saved Mapbox state, but the Mapbox
+choice is not available as a new working renderer without a configured key.
+
+The MapLibre style choices include `Streets (OSM)`, backed by
+`https://tile.openstreetmap.org/{z}/{x}/{y}.png`. This OpenStreetMap tile
+service requires visible `© OpenStreetMap contributors` attribution and should
+be used through normal browser map tile requests and caching; it is not intended
+for bulk prefetch or offline tile downloads.
+
+### Password complexity policy enabled by default
+
+Superset now ships a default password-complexity policy, enforced (via Flask-AppBuilder) across self-registration, the user create/edit/reset forms, and the User REST API. The policy requires a minimum password length of 8 characters and rejects a built-in blocklist of common/guessable passwords.
+
+This is enabled by default (`FAB_PASSWORD_COMPLEXITY_ENABLED = True`), so new or reset passwords that are too short or appear in the blocklist will be rejected where they were previously accepted. Existing stored passwords are unaffected until they are next changed.
+
+Operators can tune or disable the policy via config:
+
+- `AUTH_PASSWORD_MIN_LENGTH` — minimum length (default `8`).
+- `AUTH_PASSWORD_COMMON_BLOCKLIST` — extra passwords to reject, in addition to the built-in list.
+- `FAB_PASSWORD_COMPLEXITY_VALIDATOR` — replace with your own callable for custom rules.
+- `FAB_PASSWORD_COMPLEXITY_ENABLED = False` — disable enforcement entirely.
+
+### Data uploads bounded by UPLOAD_MAX_FILE_SIZE_BYTES
+
+Single data-file uploads (CSV, Excel, columnar) are now bounded by the `UPLOAD_MAX_FILE_SIZE_BYTES` config option, which defaults to `100 * 1024 * 1024` (100 MB). Files larger than this are rejected with a `413` before their contents are buffered into memory. Set `UPLOAD_MAX_FILE_SIZE_BYTES = None` to disable the check and restore unbounded uploads.
+
 ### Duration formatter precision
 
 The `DURATION` number formatter now uses `Intl.DurationFormat` for locale-aware output. By default, sub-second fields are omitted, so values that previously displayed fractional seconds with `pretty-ms`, such as `10500` milliseconds rendering as `10.5s`, now render as `10s`.
@@ -58,6 +105,22 @@ GLOBAL_ASYNC_QUERIES_JWT_SECRET = "<output of: openssl rand -base64 42>"
 
 The check is only active when the relevant feature is enabled, so deployments that do not use global async queries (or embedding) are not affected.
 
+### Guest token revocation (opt-in)
+
+Embedded guest tokens can be coarsely revoked at runtime via a new opt-in mechanism. A new config flag `GUEST_TOKEN_REVOCATION_ENABLED` (default `False`) gates the feature. When enabled, every minted guest token carries a revocation version, and tokens whose version is below the current expected version (stored in the metadata database) are rejected at validation time.
+
+Bump the expected version with the new CLI command to invalidate all outstanding guest tokens:
+
+```bash
+superset revoke-guest-tokens
+```
+
+This change is backward compatible. The feature is off by default, and even when enabled nothing is revoked until an admin explicitly bumps the version: the expected version starts at `0`, and tokens minted before this change (which carry no version claim) are treated as version `0`. No database migration is required.
+
+### Sessions are terminated when an account is disabled
+
+Disabling a user account (setting `active` to `False`, via the admin UI, REST API, or CLI) now terminates that user's outstanding sessions on their next request, instead of relying on a passive check. This works for both client-side cookie sessions and server-side session stores via a per-user invalidation epoch (`user_attribute.sessions_invalidated_at`, added by a migration). The mechanism is inert for users that were never disabled (NULL epoch), so there is no behavior change for active users. Re-enabling an account and logging in again starts a fresh, valid session. The migration backfills the epoch for accounts that are already disabled at upgrade time, so re-enabling such an account does not revive a session that predates this feature.
+
 ### Dataset import validates catalog against the target connection
 
 Importing a dataset now validates the `catalog` field against the target database connection. When the connection has multi-catalog disabled (`allow_multi_catalog` off) and the dataset's catalog is not the connection's default catalog, the import fails instead of silently persisting the non-default catalog. This matches the validation already enforced on the dataset update path and prevents imported datasets from querying an unintended database.
@@ -77,6 +140,36 @@ Both default to empty (no behavior change). They apply to both the `LOCAL_EXTENS
 
 The Dynamic Group By chart customization now orders its display values according to the "Sort display control values" toggle: ascending (A–Z), descending (Z–A), or the dataset's source order when the toggle is unset. Previously the dropdown always sorted alphabetically. Existing dashboards where the toggle was never set will show options in source order instead of A–Z; open the customization and enable the toggle to restore alphabetical ordering.
 
+### Selectable encryption engine for app-encrypted fields (AES-GCM)
+
+App-encrypted fields (database passwords, SSH tunnel credentials, OAuth tokens, etc.) can now use authenticated **AES-GCM** encryption instead of the historical unauthenticated **AES-CBC**. A new config selects the engine for the default adapter:
+
+```python
+# "aes" (AES-CBC, historical default) | "aes-gcm" (authenticated, recommended for new installs)
+SQLALCHEMY_ENCRYPTED_FIELD_ENGINE = "aes"
+```
+
+**No action required / no behavior change:** the default remains `"aes"`, so existing installs are unaffected.
+
+**Opting in on an existing install:** flipping the engine on a populated database without re-encrypting first will make stored secrets undecryptable, because the two ciphertext formats are not compatible. A migrator is provided. Recommended runbook:
+
+1. Take a metadata-DB backup.
+2. Re-encrypt existing secrets into the new engine (the `SECRET_KEY` is unchanged):
+   ```bash
+   superset re-encrypt-secrets --engine aes-gcm
+   ```
+3. Set `SQLALCHEMY_ENCRYPTED_FIELD_ENGINE = "aes-gcm"` in your config.
+4. Restart Superset.
+5. Re-run the migrator once more after the restart:
+   ```bash
+   superset re-encrypt-secrets --engine aes-gcm
+   ```
+   A live instance keeps writing *new* secrets as AES-CBC during the window between step 2 and the restart in step 4; this second pass sweeps those up (it is idempotent, so already-migrated values are skipped).
+
+Schedule the cutover in a quiet window. Runtime reads use only the single configured engine, so in a multi-worker deployment there is an unavoidable brief decrypt-outage between the migration commit and the last worker restarting with the new config — each migrator run is transactional, but the fleet-wide cutover is not zero-downtime.
+
+The migration is transactional (all-or-nothing) and idempotent — it can be safely re-run or resumed. Note that AES-GCM, unlike AES-CBC, does not support querying directly over encrypted columns; audit any code that filters on an encrypted column before switching. See the SIP at `docs/sip/authenticated-encryption-at-rest.md` for details.
+
 ### Granular Export Controls
 
 A new feature flag `GRANULAR_EXPORT_CONTROLS` introduces three fine-grained permissions that replace the legacy `can_csv` permission:

docs/.nvmrc

@@ -1 +1 @@
-v22.22.0
+v24.16.0

docs/package.json

@@ -72,8 +72,8 @@
     "@superset-ui/core": "^0.20.4",
     "@swc/core": "^1.15.40",
     "antd": "^6.4.3",
-    "baseline-browser-mapping": "^2.10.33",
-    "caniuse-lite": "^1.0.30001793",
+    "baseline-browser-mapping": "^2.10.34",
+    "caniuse-lite": "^1.0.30001797",
     "docusaurus-plugin-openapi-docs": "^5.0.2",
     "docusaurus-theme-openapi-docs": "^5.0.2",
     "js-yaml": "^4.2.0",

docs/sip/authenticated-encryption-at-rest.md

@@ -0,0 +1,136 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# SIP: Authenticated encryption (AES-GCM) for app-encrypted fields
+
+## [DRAFT — proposal for discussion]
+
+This document is a draft proposal accompanying the code in this PR. It is
+intended to seed the formal SIP discussion. The code here ships the
+backward-compatible engine selection **and** the re-encryption migrator
+(Phases 1–2 below); both are opt-in and change nothing for existing installs by
+default. Flipping the default for fresh installs (Phase 3) remains future work.
+
+## Motivation
+
+Superset app-encrypts a number of sensitive fields before persisting them to
+the metadata database, including:
+
+- database connection passwords and `encrypted_extra` (`superset/models/core.py`),
+- SSH tunnel credentials — password, private key, private-key password
+  (`superset/databases/ssh_tunnel/models.py`),
+- OAuth2 tokens and other secrets stored via `EncryptedType`.
+
+These fields are encrypted with `sqlalchemy_utils.EncryptedType`, which
+**defaults to `AesEngine` (AES-CBC)**. AES-CBC provides confidentiality but is
+**unauthenticated**: it has no integrity tag. An attacker with write access to
+the ciphertext (e.g. direct metadata-DB access, a backup, or a compromised
+replica) can perform **bit-flipping / chosen-ciphertext manipulation** to
+silently alter the decrypted plaintext of a secret without detection.
+
+`AesGcmEngine` (AES-GCM) is authenticated encryption: tampering causes
+decryption to fail loudly rather than yielding attacker-influenced plaintext.
+Using authenticated encryption for secrets at rest is an ASVS L1 expectation
+(11.3.2 / cryptography best practice).
+
+`config.py` already documents that operators *can* switch to GCM by writing a
+custom `AbstractEncryptedFieldAdapter`, but:
+
+1. it is opt-in, undocumented as a security recommendation, and easy to miss;
+2. there is **no migration path** — flipping the engine on a populated database
+   makes every existing secret undecryptable, because GCM ciphertext is not
+   format-compatible with CBC.
+
+## Proposed change
+
+A three-part change, delivered incrementally so existing deployments are never
+broken:
+
+### Phase 1 — engine selection (this PR)
+
+- Add a `SQLALCHEMY_ENCRYPTED_FIELD_ENGINE` config (`"aes"` | `"aes-gcm"`),
+  **defaulting to `"aes"`** (no behavior change for existing installs).
+- Teach the default `SQLAlchemyUtilsAdapter` to honor it (an explicit `engine`
+  kwarg still wins, so the migrator can pin an engine).
+- This lets **new** deployments choose AES-GCM from day one with a one-line
+  config, instead of writing a custom adapter.
+
+### Phase 2 — CBC→GCM re-encryption migrator (this PR)
+
+The existing `SecretsMigrator` (previously only used for `SECRET_KEY` rotation)
+gains an **engine migration** mode that:
+
+1. discovers every `EncryptedType` column (via `discover_encrypted_fields()`),
+2. decrypts each value with the **source** engine (AES-CBC) under the current
+   `SECRET_KEY`,
+3. re-encrypts with the **target** engine (AES-GCM),
+4. runs transactionally per the existing all-or-nothing semantics, and is
+   idempotent per column (already-migrated values are skipped), so a run can be
+   safely repeated or resumed.
+
+Exposed via a new `--engine` option on the existing CLI command:
+`superset re-encrypt-secrets --engine aes-gcm`, runnable by operators with a DB
+backup in hand. The `SECRET_KEY` is unchanged; an engine change and a key
+rotation can also be combined (pass `--previous_secret_key` as well).
+
+### Phase 3 — flip the default for new installs
+
+Once the migrator and docs are in place, change the default to `"aes-gcm"` for
+**fresh** installs only (e.g. keyed off an empty metadata DB / documented in
+`UPDATING.md`), keeping existing installs on `"aes"` until they run Phase 2.
+
+## New or changed public interfaces
+
+- New config: `SQLALCHEMY_ENCRYPTED_FIELD_ENGINE: Literal["aes", "aes-gcm"]`.
+- New (Phase 2) CLI: `superset re-encrypt-secrets --engine <name>`.
+- No schema changes; ciphertext format changes per migrated column.
+
+## Migration plan and compatibility
+
+- **Backward compatible by default.** Phase 1 changes nothing unless the
+  operator opts in.
+- Switching an existing deployment to `"aes-gcm"` **without** running the Phase
+  2 migrator will make existing secrets undecryptable — this is called out in
+  the config comment and must be in `UPDATING.md`.
+- Recommended operator runbook: take a metadata-DB backup → run
+  `re-encrypt-secrets --engine aes-gcm` → set
+  `SQLALCHEMY_ENCRYPTED_FIELD_ENGINE = "aes-gcm"` → restart → re-run
+  `re-encrypt-secrets --engine aes-gcm` once more to sweep up any secrets a live
+  instance wrote as AES-CBC during the cutover window. The canonical, more
+  detailed version of this runbook lives in `UPDATING.md`; this is a summary.
+- `AesEngine` allows queryability over encrypted fields; AES-GCM does not.
+  Any code that filters/queries on an encrypted column directly must be audited
+  before Phase 3 (none is expected, but it must be verified).
+
+## Rejected alternatives
+
+- **Flip the default immediately.** Rejected: bricks every existing
+  deployment's secrets with no migration path.
+- **Document-only (custom adapter).** Status quo; high friction and no
+  migration tooling — most operators will never do it.
+
+## Open questions
+
+- GCM→CBC rollback (for operators who need queryability) already works via the
+  same command (`re-encrypt-secrets --engine aes`), since the migrator is
+  engine-symmetric. Should rollback be documented as a supported path or
+  discouraged?
+- The migrator already supports a concurrent `SECRET_KEY` rotation + engine
+  change in a single pass (pass `--previous_secret_key` alongside `--engine`).
+  Is that combination worth calling out in the operator docs, or kept advanced?

docs/yarn.lock

@@ -5578,10 +5578,10 @@ base64-js@^1.3.1, base64-js@^1.5.1:
   resolved "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz"
   integrity sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==
 
-baseline-browser-mapping@^2.10.33, baseline-browser-mapping@^2.9.0, baseline-browser-mapping@^2.9.19:
-  version "2.10.33"
-  resolved "https://registry.yarnpkg.com/baseline-browser-mapping/-/baseline-browser-mapping-2.10.33.tgz#27c299b096404978831958d429f48390424c4f9b"
-  integrity sha512-bA6+tcSLpz2tIEdDXZPpPTIuxBcC4+w6SieaYyfigIa4h8GlFxbA17v22Vx3JUtuZQj9SgOsnbK+aTBzyDyEuw==
+baseline-browser-mapping@^2.10.34, baseline-browser-mapping@^2.9.0, baseline-browser-mapping@^2.9.19:
+  version "2.10.34"
+  resolved "https://registry.yarnpkg.com/baseline-browser-mapping/-/baseline-browser-mapping-2.10.34.tgz#dedb606362446777cfe328d30d4ee15056d06303"
+  integrity sha512-IMDedajPifLnHNY0X9n8hKxRTQ6/eTHwr5bDo04WnuqxyKw6LYtQywCuuqPZwhl3aBXMvQpJov42GLCwRRdQzw==
 
 batch@0.6.1:
   version "0.6.1"
@@ -5824,10 +5824,10 @@ caniuse-api@^3.0.0:
     lodash.memoize "^4.1.2"
     lodash.uniq "^4.5.0"
 
-caniuse-lite@^1.0.0, caniuse-lite@^1.0.30001702, caniuse-lite@^1.0.30001759, caniuse-lite@^1.0.30001793:
-  version "1.0.30001793"
-  resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001793.tgz#238887ddf5fcfc8c36d872394d0a78a517312a72"
-  integrity sha512-iwSsYWaCOoh26cV8NwNRViHlrfUvYsHDfRVcbtmw0Kg6PJIZZXwMkj1442FYLBGkeUf1juAsU3DTfxW579mrPA==
+caniuse-lite@^1.0.0, caniuse-lite@^1.0.30001702, caniuse-lite@^1.0.30001759, caniuse-lite@^1.0.30001797:
+  version "1.0.30001797"
+  resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001797.tgz#1332709e1439f01ff92085dd17001e0a45897ec0"
+  integrity sha512-l8xKG+gwAIExZGl9FrF7KUwuOmk6wbEPC9Xoy/RtnWv1XG0Q4LFlagaLpUv3Kiza3W/wm27zy0yWJEieYKAP6w==
 
 ccount@^2.0.0:
   version "2.0.1"
@@ -9300,9 +9300,9 @@ jiti@^1.20.0:
   integrity sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==
 
 joi@^17.9.2:
-  version "17.13.3"
-  resolved "https://registry.npmjs.org/joi/-/joi-17.13.3.tgz"
-  integrity sha512-otDA4ldcIx+ZXsKHWmp0YizCweVRZG96J10b0FevjfuncLO1oX59THoAmHkNubYJ+9gWsYsp5k8v4ib6oDv1fA==
+  version "17.13.4"
+  resolved "https://registry.yarnpkg.com/joi/-/joi-17.13.4.tgz#ad6153d97ce558eb3a3b593e0d43eab51df1c474"
+  integrity sha512-1RuuER6kmt8K8I3nIWvPZKi5RQCb568ZPyY4Pwjlua+yo+63ZTmIwxLZH0heBmiKN4uxjvCiarDrjaeH84xicQ==
   dependencies:
     "@hapi/hoek" "^9.3.0"
     "@hapi/topo" "^5.1.0"

pyproject.toml

@@ -55,7 +55,7 @@ dependencies = [
     "flask-login>=0.6.0, < 1.0",
     "flask-migrate>=3.1.0, <5.0",
     "flask-session>=0.4.0, <1.0",
-    "flask-wtf>=1.1.0, <2.0",
+    "flask-wtf>=1.3.0, <2.0",
     "geopy",
     "greenlet>=3.0.3, <=3.5.0",
     "gunicorn>=25.3.0, <26; sys_platform != 'win32'",
@@ -64,7 +64,7 @@ dependencies = [
     "holidays>=0.45, <1",
     "humanize",
     "isodate",
-    "jsonpath-ng>=1.6.1, <2",
+    "jsonpath-ng>=1.8.0, <2",
     "Mako>=1.2.2",
     "markdown>=3.10.2",
     # marshmallow>=4 has issues: https://github.com/apache/superset/issues/33162
@@ -80,7 +80,7 @@ dependencies = [
     "bottleneck", # recommended performance dependency for pandas, see https://pandas.pydata.org/docs/getting_started/install.html#performance-dependencies-recommended
     # --------------------------
     "parsedatetime",
-    "paramiko>=3.4.0",
+    "paramiko>=3.4.0, <4.0", # 4.0 removed DSSKey, still referenced by sshtunnel
     "pgsanity",
     "Pillow>=11.0.0, <13",
     "polyline>=2.0.0, <3.0",
@@ -94,7 +94,7 @@ dependencies = [
     "PyJWT>=2.4.0, <3.0",
     "redis>=5.0.0, <6.0",
     "rison>=2.0.0, <3.0",
-    "selenium>=4.14.0, <5.0",
+    "selenium>=4.44.0, <5.0",
     "shillelagh[gsheetsapi]>=1.4.4, <2.0",
     "sshtunnel>=0.4.0, <0.5",
     "simplejson>=3.15.0",
@@ -107,7 +107,7 @@ dependencies = [
     "typing-extensions>=4, <5",
     "waitress; sys_platform == 'win32'",
     "watchdog>=6.0.0",
-    "wtforms>=2.3.3, <4",
+    "wtforms>=3.2.2, <4",
     "wtforms-json",
     "xlsxwriter>=3.2.9, <3.3",
 ]
@@ -118,10 +118,10 @@ athena = ["pyathena[pandas]>=2, <4"]
 aurora-data-api = ["preset-sqlalchemy-aurora-data-api>=0.2.8,<0.3"]
 bigquery = [
     "pandas-gbq>=0.19.1",
-    "sqlalchemy-bigquery>=1.15.0",
+    "sqlalchemy-bigquery>=1.17.0",
     "google-cloud-bigquery>=3.10.0",
 ]
-clickhouse = ["clickhouse-connect>=0.13.0, <2.0"]
+clickhouse = ["clickhouse-connect>=1.1.1, <2.0"]
 cockroachdb = ["cockroachdb>=0.3.5, <0.4"]
 crate = ["sqlalchemy-cratedb>=0.41.0, <1"]
 d1 = [
@@ -143,14 +143,14 @@ duckdb = ["duckdb>=1.5.2,<2", "duckdb-engine>=0.17.0"]
 dynamodb = ["pydynamodb>=0.4.2"]
 solr = ["sqlalchemy-solr >= 0.2.0"]
 elasticsearch = ["elasticsearch-dbapi>=0.2.13, <0.3.0"]
-exasol = ["sqlalchemy-exasol >= 2.4.0, < 8.0"]
+exasol = ["sqlalchemy-exasol>=2.4.0, <8.0"]
 excel = ["xlrd>=1.2.0, <1.3"]
 fastmcp = [
     "fastmcp>=3.2.4,<4.0",
     # tiktoken backs the response-size-guard token estimator. Without
     # it, the middleware falls back to a coarser character-based
     # heuristic that under-counts JSON-heavy MCP responses.
-    "tiktoken>=0.7.0,<1.0",
+    "tiktoken>=0.13.0,<1.0",
 ]
 firebird = ["sqlalchemy-firebird>=0.7.0, <2.2"]
 firebolt = ["firebolt-sqlalchemy>=1.0.0, <2"]
@@ -161,13 +161,13 @@ hive = [
     "pyhive[hive]>=0.6.5;python_version<'3.11'",
     "pyhive[hive_pure_sasl]>=0.7.0",
     "tableschema",
-    "thrift>=0.14.1, <1.0.0",
+    "thrift>=0.23.0, <1.0.0",
     "thrift_sasl>=0.4.3, < 1.0.0",
 ]
 impala = ["impyla>0.16.2, <0.23"]
 kusto = ["sqlalchemy-kusto>=3.1.2, <4"]
 kylin = ["kylinpy>=2.8.1, <2.9"]
-mssql = ["pymssql>=2.2.8, <3"]
+mssql = ["pymssql>=2.3.13, <3"]
 # motherduck is an alias for duckdb - MotherDuck works via the duckdb driver
 motherduck = ["apache-superset[duckdb]"]
 mysql = ["mysqlclient>=2.1.0, <3"]
@@ -195,7 +195,7 @@ spark = [
     "pyhive[hive]>=0.6.5;python_version<'3.11'",
     "pyhive[hive_pure_sasl]>=0.7",
     "tableschema",
-    "thrift>=0.14.1, <1",
+    "thrift>=0.23.0, <1",
 ]
 tdengine = [
     "taospy>=2.7.21",
@@ -205,7 +205,7 @@ teradata = ["teradatasql>=16.20.0.23"]
 thumbnails = [] # deprecated, will be removed in 7.0
 vertica = ["sqlalchemy-vertica-python>= 0.6.3, < 0.7"]
 netezza = ["nzalchemy>=11.0.2"]
-starrocks = ["starrocks>=1.0.0"]
+starrocks = ["starrocks>=1.3.3, <2"]
 doris = ["pydoris>=1.0.0, <2.0.0"]
 oceanbase = ["oceanbase_py>=0.0.1.2"]
 ydb = ["ydb-sqlalchemy>=0.1.2", "ydb-sqlglot-plugin>=0.2.5"]
@@ -222,7 +222,7 @@ development = [
     "pip",
     "polib",  # used by scripts/translations/ and their unit tests
     "pre-commit",
-    "progress>=1.5,<2",
+    "progress>=1.6.1,<2",
     "psutil",
     "pyfakefs",
     "pyinstrument>=5.1.2,<6",

requirements/base.txt

@@ -50,7 +50,7 @@ cattrs==25.1.1
     # via requests-cache
 celery==5.5.2
     # via apache-superset (pyproject.toml)
-certifi==2025.6.15
+certifi==2026.5.20
     # via
     #   requests
     #   selenium
@@ -151,7 +151,7 @@ flask-sqlalchemy==2.5.1
     #   flask-migrate
 flask-talisman==1.1.0
     # via apache-superset (pyproject.toml)
-flask-wtf==1.2.2
+flask-wtf==1.3.0
     # via
     #   apache-superset (pyproject.toml)
     #   flask-appbuilder
@@ -194,7 +194,7 @@ jinja2==3.1.6
     # via
     #   flask
     #   flask-babel
-jsonpath-ng==1.7.0
+jsonpath-ng==1.8.0
     # via apache-superset (pyproject.toml)
 jsonschema==4.23.0
     # via
@@ -286,8 +286,6 @@ pillow==12.2.0
     # via apache-superset (pyproject.toml)
 platformdirs==4.3.8
     # via requests-cache
-ply==3.11
-    # via jsonpath-ng
 polyline==2.0.2
     # via apache-superset (pyproject.toml)
 prison==0.2.1
@@ -380,7 +378,7 @@ rpds-py==0.25.0
     #   referencing
 rsa==4.9.1
     # via google-auth
-selenium==4.32.0
+selenium==4.44.0
     # via apache-superset (pyproject.toml)
 setuptools==80.9.0
     # via -r requirements/base.in
@@ -423,7 +421,7 @@ sshtunnel==0.4.0
     # via apache-superset (pyproject.toml)
 tabulate==0.10.0
     # via apache-superset (pyproject.toml)
-trio==0.30.0
+trio==0.33.0
     # via
     #   selenium
     #   trio-websocket
@@ -480,7 +478,7 @@ wrapt==1.17.2
     # via deprecated
 wsproto==1.2.0
     # via trio-websocket
-wtforms==3.2.1
+wtforms==3.2.2
     # via
     #   apache-superset (pyproject.toml)
     #   flask-appbuilder

requirements/development.txt

@@ -112,7 +112,7 @@ celery==5.5.2
     # via
     #   -c requirements/base-constraint.txt
     #   apache-superset
-certifi==2025.6.15
+certifi==2026.5.20
     # via
     #   -c requirements/base-constraint.txt
     #   httpcore
@@ -312,7 +312,7 @@ flask-talisman==1.1.0
     #   apache-superset
 flask-testing==0.8.1
     # via apache-superset
-flask-wtf==1.2.2
+flask-wtf==1.3.0
     # via
     #   -c requirements/base-constraint.txt
     #   apache-superset
@@ -471,7 +471,7 @@ jmespath==1.1.0
     # via
     #   boto3
     #   botocore
-jsonpath-ng==1.7.0
+jsonpath-ng==1.8.0
     # via
     #   -c requirements/base-constraint.txt
     #   apache-superset
@@ -674,10 +674,6 @@ platformdirs==4.3.8
     #   virtualenv
 pluggy==1.5.0
     # via pytest
-ply==3.11
-    # via
-    #   -c requirements/base-constraint.txt
-    #   jsonpath-ng
 polib==1.2.0
     # via apache-superset
 polyline==2.0.2
@@ -690,7 +686,7 @@ prison==0.2.1
     # via
     #   -c requirements/base-constraint.txt
     #   flask-appbuilder
-progress==1.6
+progress==1.6.1
     # via apache-superset
 prompt-toolkit==3.0.51
     # via
@@ -925,7 +921,7 @@ s3transfer==0.16.0
     # via boto3
 secretstorage==3.5.0
     # via keyring
-selenium==4.32.0
+selenium==4.44.0
     # via
     #   -c requirements/base-constraint.txt
     #   apache-superset
@@ -980,7 +976,7 @@ sqlalchemy==1.4.54
     #   shillelagh
     #   sqlalchemy-bigquery
     #   sqlalchemy-utils
-sqlalchemy-bigquery==1.15.0
+sqlalchemy-bigquery==1.17.0
     # via apache-superset
 sqlalchemy-utils==0.42.0
     # via
@@ -1011,7 +1007,7 @@ tabulate==0.10.0
     # via
     #   -c requirements/base-constraint.txt
     #   apache-superset
-tiktoken==0.12.0
+tiktoken==0.13.0
     # via apache-superset
 tomli-w==1.2.0
     # via apache-superset-extensions-cli
@@ -1023,7 +1019,7 @@ tqdm==4.67.1
     #   prophet
 trino==0.330.0
     # via apache-superset
-trio==0.30.0
+trio==0.33.0
     # via
     #   -c requirements/base-constraint.txt
     #   selenium
@@ -1125,7 +1121,7 @@ wsproto==1.2.0
     # via
     #   -c requirements/base-constraint.txt
     #   trio-websocket
-wtforms==3.2.1
+wtforms==3.2.2
     # via
     #   -c requirements/base-constraint.txt
     #   apache-superset

superset-embedded-sdk/.nvmrc

@@ -1 +1 @@
-v22.22.0
+v24.16.0

superset-frontend/.eslintignore

@@ -1,34 +0,0 @@
-#
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-**/*{.,-}min.js
-**/*.sh
-coverage/**
-dist/*
-src/assets/images/*
-node_modules/*
-node_modules*/*
-vendor/*
-docs/*
-src/dashboard/deprecated/*
-src/temp/*
-**/node_modules
-*.d.ts
-coverage/
-esm/
-lib/
-tmp/
-storybook-static/

superset-frontend/.eslintrc.js

@@ -1,523 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-// Register TypeScript require hook so ESLint can load .ts plugin files
-require('tsx/cjs');
-
-const packageConfig = require('./package.json');
-
-const importCoreModules = [];
-Object.entries(packageConfig.dependencies).forEach(([pkg]) => {
-  if (/@superset-ui/.test(pkg)) {
-    importCoreModules.push(pkg);
-  }
-});
-
-// ignore files in production mode
-let ignorePatterns = [];
-if (process.env.NODE_ENV === 'production') {
-  ignorePatterns = [
-    '*.test.{js,ts,jsx,tsx}',
-    'plugins/**/test/**/*',
-    'packages/**/test/**/*',
-    'packages/generator-superset/**/*',
-  ];
-}
-
-const restrictedImportsRules = {
-  'no-design-icons': {
-    name: '@ant-design/icons',
-    message:
-      'Avoid importing icons directly from @ant-design/icons. Use the src/components/Icons component instead.',
-  },
-  'no-moment': {
-    name: 'moment',
-    message:
-      'Please use the dayjs library instead of moment.js. See https://day.js.org',
-  },
-  'no-lodash-memoize': {
-    name: 'lodash/memoize',
-    message: 'Lodash Memoize is unsafe! Please use memoize-one instead',
-  },
-  'no-testing-library-react': {
-    name: '@superset-ui/core/spec',
-    message: 'Please use spec/helpers/testing-library instead',
-  },
-  'no-testing-library-react-dom-utils': {
-    name: '@testing-library/react-dom-utils',
-    message: 'Please use spec/helpers/testing-library instead',
-  },
-  'no-antd': {
-    name: 'antd',
-    message: 'Please import Ant components from the index of src/components',
-  },
-  'no-superset-theme': {
-    name: '@superset-ui/core',
-    importNames: ['supersetTheme'],
-    message:
-      'Please use the theme directly from the ThemeProvider rather than importing supersetTheme.',
-  },
-  'no-query-string': {
-    name: 'query-string',
-    message: 'Please use the URLSearchParams API instead of query-string.',
-  },
-  'no-jest-mock-console': {
-    name: 'jest-mock-console',
-    message: 'Please use native Jest spies, i.e. jest.spyOn(console, "warn")',
-  },
-};
-
-module.exports = {
-  extends: [
-    'eslint:recommended',
-    'plugin:import/recommended',
-    'plugin:react-prefer-function-component/recommended',
-    'plugin:storybook/recommended',
-    'prettier',
-  ],
-  parser: '@babel/eslint-parser',
-  parserOptions: {
-    ecmaVersion: 2020,
-    sourceType: 'module',
-    ecmaFeatures: {
-      jsx: true,
-    },
-    requireConfigFile: false,
-    babelOptions: {
-      presets: ['@babel/preset-react', '@babel/preset-env'],
-    },
-  },
-  env: {
-    browser: true,
-    node: true,
-    es2020: true,
-  },
-  settings: {
-    'import/resolver': {
-      node: {
-        extensions: ['.js', '.jsx', '.ts', '.tsx', '.json'],
-        moduleDirectory: ['node_modules', '.'],
-      },
-      typescript: {
-        alwaysTryTypes: true,
-        project: [
-          './tsconfig.json',
-          './packages/superset-ui-core/tsconfig.json',
-          './packages/superset-ui-chart-controls/',
-          './plugins/*/tsconfig.json',
-        ],
-      },
-    },
-    'import/core-modules': importCoreModules,
-    react: {
-      version: 'detect',
-    },
-  },
-  plugins: [
-    'import',
-    'lodash',
-    'theme-colors',
-    'icons',
-    'i18n-strings',
-    'react-prefer-function-component',
-    'react-you-might-not-need-an-effect',
-    'prettier',
-  ],
-  rules: {
-    // === Essential Superset customizations ===
-
-    // Prettier integration
-    'prettier/prettier': 'error',
-
-    // Custom Superset rules
-    'theme-colors/no-literal-colors': 'error',
-    'icons/no-fa-icons-usage': 'error',
-    'i18n-strings/no-template-vars': 'error',
-
-    // Core ESLint overrides for Superset
-    'no-console': 'warn',
-    'no-unused-vars': 'off', // TypeScript handles this
-    camelcase: [
-      'error',
-      {
-        allow: ['^UNSAFE_', '__REDUX_DEVTOOLS_EXTENSION_COMPOSE__'],
-        properties: 'never',
-      },
-    ],
-    'prefer-destructuring': ['error', { object: true, array: false }],
-    'no-prototype-builtins': 0,
-    curly: 'off',
-
-    // Import plugin overrides
-    'import/extensions': [
-      'error',
-      'ignorePackages',
-      {
-        js: 'never',
-        jsx: 'never',
-        ts: 'never',
-        tsx: 'never',
-      },
-    ],
-    'import/no-cycle': 0,
-    'import/prefer-default-export': 0,
-    'import/no-named-as-default-member': 0,
-    'import/no-extraneous-dependencies': [
-      'error',
-      {
-        devDependencies: [
-          'test/**',
-          'tests/**',
-          'spec/**',
-          '**/__tests__/**',
-          '**/__mocks__/**',
-          '*.test.{js,jsx,ts,tsx}',
-          '*.spec.{js,jsx,ts,tsx}',
-          '**/*.test.{js,jsx,ts,tsx}',
-          '**/*.spec.{js,jsx,ts,tsx}',
-          '**/jest.config.js',
-          '**/jest.setup.js',
-          '**/webpack.config.js',
-          '**/webpack.config.*.js',
-          '**/.eslintrc*.js',
-        ],
-        optionalDependencies: false,
-      },
-    ],
-
-    // React plugin overrides
-    'react-prefer-function-component/react-prefer-function-component': 1,
-
-    // React effect best practices
-    'react-you-might-not-need-an-effect/no-empty-effect': 'error',
-    'react-you-might-not-need-an-effect/no-pass-live-state-to-parent': 'error',
-    'react-you-might-not-need-an-effect/no-initialize-state': 'error',
-
-    // Lodash
-    'lodash/import-scope': [2, 'member'],
-
-    // React effect best practices
-    'react-you-might-not-need-an-effect/no-reset-all-state-on-prop-change':
-      'error',
-    'react-you-might-not-need-an-effect/no-chain-state-updates': 'error',
-    'react-you-might-not-need-an-effect/no-event-handler': 'error',
-    'react-you-might-not-need-an-effect/no-derived-state': 'error',
-
-    // Storybook
-    'storybook/prefer-pascal-case': 'error',
-
-    // File progress
-    'file-progress/activate': 1,
-
-    // React effect rules
-    'react-you-might-not-need-an-effect/no-adjust-state-on-prop-change':
-      'error',
-    'react-you-might-not-need-an-effect/no-pass-data-to-parent': 'error',
-
-    // Restricted imports
-    'no-restricted-imports': [
-      'error',
-      {
-        paths: Object.values(restrictedImportsRules).filter(Boolean),
-        patterns: ['antd/*'],
-      },
-    ],
-
-    // Temporarily disabled for migration
-    'no-unsafe-optional-chaining': 0,
-    'no-import-assign': 0,
-    'import/no-relative-packages': 0,
-    'no-promise-executor-return': 0,
-    'import/no-import-module-exports': 0,
-
-    // Restrict certain syntax patterns
-    'no-restricted-syntax': [
-      'error',
-      {
-        selector:
-          "ImportDeclaration[source.value='react'] :matches(ImportDefaultSpecifier, ImportNamespaceSpecifier)",
-        message:
-          'Default React import is not required due to automatic JSX runtime in React 16.4',
-      },
-      {
-        selector: 'ImportNamespaceSpecifier[parent.source.value!=/^(\\.|src)/]',
-        message: 'Wildcard imports are not allowed',
-      },
-    ],
-  },
-  overrides: [
-    // Ban JavaScript files in src/ - all new code must be TypeScript
-    {
-      files: ['src/**/*.js', 'src/**/*.jsx'],
-      rules: {
-        'no-restricted-syntax': [
-          'error',
-          {
-            selector: 'Program',
-            message:
-              'JavaScript files are not allowed in src/. Please use TypeScript (.ts/.tsx) instead.',
-          },
-        ],
-      },
-    },
-    // Ban JavaScript files in plugins/ - all plugin source code must be TypeScript
-    {
-      files: ['plugins/**/src/**/*.js', 'plugins/**/src/**/*.jsx'],
-      rules: {
-        'no-restricted-syntax': [
-          'error',
-          {
-            selector: 'Program',
-            message:
-              'JavaScript files are not allowed in plugins/. Please use TypeScript (.ts/.tsx) instead.',
-          },
-        ],
-      },
-    },
-    // Ban JavaScript files in packages/ - with exceptions for config files and generators
-    {
-      files: ['packages/**/src/**/*.js', 'packages/**/src/**/*.jsx'],
-      excludedFiles: [
-        'packages/generator-superset/**/*', // Yeoman generator templates run via Node
-        'packages/**/__mocks__/**/*', // Test mocks
-      ],
-      rules: {
-        'no-restricted-syntax': [
-          'error',
-          {
-            selector: 'Program',
-            message:
-              'JavaScript files are not allowed in packages/. Please use TypeScript (.ts/.tsx) instead.',
-          },
-        ],
-      },
-    },
-    {
-      files: ['*.ts', '*.tsx'],
-      parser: '@typescript-eslint/parser',
-      parserOptions: {
-        ecmaFeatures: {
-          jsx: true,
-        },
-        tsconfigRootDir: __dirname,
-        project: ['./tsconfig.json'],
-      },
-      extends: ['plugin:@typescript-eslint/recommended', 'prettier'],
-      plugins: ['@typescript-eslint/eslint-plugin'],
-      rules: {
-        // TypeScript-specific rule overrides
-        '@typescript-eslint/ban-ts-ignore': 0,
-        '@typescript-eslint/ban-ts-comment': 0,
-        '@typescript-eslint/ban-types': 0,
-        '@typescript-eslint/naming-convention': [
-          'error',
-          {
-            selector: 'enum',
-            format: ['PascalCase'],
-          },
-          {
-            selector: 'enumMember',
-            format: ['PascalCase'],
-          },
-        ],
-        '@typescript-eslint/no-empty-function': 0,
-        '@typescript-eslint/no-explicit-any': 0,
-        '@typescript-eslint/no-use-before-define': 'error',
-        '@typescript-eslint/no-non-null-assertion': 0,
-        '@typescript-eslint/explicit-function-return-type': 0,
-        '@typescript-eslint/explicit-module-boundary-types': 0,
-        '@typescript-eslint/no-unused-vars': 'warn',
-        '@typescript-eslint/prefer-optional-chain': 'error',
-
-        // Disable base rules that conflict with TS versions
-        'no-unused-vars': 'off',
-        'no-use-before-define': 'off',
-        'no-shadow': 'off',
-
-        // Import overrides for TypeScript
-        'import/extensions': [
-          'error',
-          'ignorePackages',
-          {
-            js: 'never',
-            jsx: 'never',
-            ts: 'never',
-            tsx: 'never',
-          },
-        ],
-      },
-      settings: {
-        'import/resolver': {
-          typescript: {},
-        },
-      },
-    },
-    {
-      files: ['packages/**'],
-      rules: {
-        'import/no-extraneous-dependencies': [
-          'error',
-          { devDependencies: true },
-        ],
-        'no-restricted-imports': [
-          'error',
-          {
-            paths: [
-              restrictedImportsRules['no-moment'],
-              restrictedImportsRules['no-lodash-memoize'],
-              restrictedImportsRules['no-superset-theme'],
-            ],
-            patterns: [],
-          },
-        ],
-      },
-    },
-    {
-      files: ['plugins/**'],
-      rules: {
-        'no-restricted-imports': [
-          'error',
-          {
-            paths: [
-              restrictedImportsRules['no-moment'],
-              restrictedImportsRules['no-lodash-memoize'],
-            ],
-            patterns: [],
-          },
-        ],
-      },
-    },
-    {
-      files: ['src/components/**', 'src/theme/**'],
-      rules: {
-        'no-restricted-imports': [
-          'error',
-          {
-            paths: Object.values(restrictedImportsRules).filter(
-              r => r.name !== 'antd',
-            ),
-            patterns: [],
-          },
-        ],
-      },
-    },
-    {
-      files: [
-        '*.test.ts',
-        '*.test.tsx',
-        '*.test.js',
-        '*.test.jsx',
-        '*.stories.tsx',
-        '*.stories.jsx',
-        'fixtures.*',
-        '**/test/**/*',
-        '**/tests/**/*',
-        'spec/**/*',
-        '**/fixtures/**/*',
-        '**/__mocks__/**/*',
-        '**/spec/**/*',
-      ],
-      excludedFiles: 'cypress-base/cypress/**/*',
-      plugins: ['jest-dom', 'no-only-tests', 'testing-library'],
-      extends: ['plugin:jest-dom/recommended', 'plugin:testing-library/react'],
-      rules: {
-        'import/no-extraneous-dependencies': [
-          'error',
-          { devDependencies: true },
-        ],
-        'prefer-promise-reject-errors': 0,
-        'max-classes-per-file': 0,
-
-        // Temporary for migration
-        'testing-library/await-async-queries': 0,
-        'testing-library/await-async-utils': 0,
-        'testing-library/no-await-sync-events': 0,
-        'testing-library/no-render-in-lifecycle': 0,
-        'testing-library/no-unnecessary-act': 0,
-        'testing-library/no-wait-for-multiple-assertions': 0,
-        'testing-library/prefer-screen-queries': 0,
-        'testing-library/await-async-events': 0,
-        'testing-library/no-node-access': 0,
-        'testing-library/no-wait-for-side-effects': 0,
-        'testing-library/prefer-presence-queries': 0,
-        'testing-library/render-result-naming-convention': 0,
-        'testing-library/no-container': 0,
-        'testing-library/prefer-find-by': 0,
-        'testing-library/no-manual-cleanup': 0,
-
-        'no-restricted-syntax': [
-          'error',
-          {
-            selector:
-              "ImportDeclaration[source.value='react'] :matches(ImportDefaultSpecifier, ImportNamespaceSpecifier)",
-            message:
-              'Default React import is not required due to automatic JSX runtime in React 16.4',
-          },
-        ],
-        'no-restricted-imports': 0,
-      },
-    },
-    {
-      files: [
-        '*.test.ts',
-        '*.test.tsx',
-        '*.test.js',
-        '*.test.jsx',
-        '*.stories.tsx',
-        '*.stories.jsx',
-        'fixtures.*',
-        '**/test/**/*',
-        '**/tests/**/*',
-        'spec/**/*',
-        '**/fixtures/**/*',
-        '**/__mocks__/**/*',
-        '**/spec/**/*',
-        'cypress-base/cypress/**/*',
-        'Stories.tsx',
-        'packages/superset-ui-core/src/theme/index.tsx',
-      ],
-      rules: {
-        'theme-colors/no-literal-colors': 0,
-        'icons/no-fa-icons-usage': 0,
-        'i18n-strings/no-template-vars': 0,
-        'no-restricted-imports': 0,
-      },
-    },
-    {
-      files: [
-        'packages/**/*.stories.*',
-        'packages/**/*.overview.*',
-        'packages/**/fixtures.*',
-      ],
-      rules: {
-        'import/no-extraneous-dependencies': 'off',
-      },
-    },
-    {
-      files: ['playwright/**/*.ts', 'playwright/**/*.js'],
-      rules: {
-        'import/no-extraneous-dependencies': [
-          'error',
-          { devDependencies: true },
-        ],
-      },
-    },
-  ],
-  ignorePatterns,
-};

superset-frontend/.eslintrc.minimal.js

@@ -1,124 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-// Register TypeScript require hook so ESLint can load .ts plugin files
-require('tsx/cjs');
-
-/**
- * MINIMAL ESLint config - ONLY for rules OXC doesn't support
- * This config is designed to be run alongside OXC linter
- *
- * Only covers:
- * - Custom Superset plugins (theme-colors, icons, i18n)
- * - Prettier formatting
- * - File progress indicator
- */
-
-module.exports = {
-  root: true,
-  // Don't report on eslint-disable comments for rules we don't have
-  reportUnusedDisableDirectives: false,
-  // Simple parser - no TypeScript needed since OXC handles that
-  parser: '@babel/eslint-parser',
-  parserOptions: {
-    ecmaVersion: 2020,
-    sourceType: 'module',
-    ecmaFeatures: {
-      jsx: true,
-    },
-    requireConfigFile: false,
-    babelOptions: {
-      presets: ['@babel/preset-react', '@babel/preset-env'],
-    },
-  },
-  env: {
-    browser: true,
-    node: true,
-    es2020: true,
-  },
-  plugins: [
-    // ONLY custom Superset plugins that OXC doesn't support
-    'theme-colors',
-    'icons',
-    'i18n-strings',
-    'file-progress',
-    'prettier',
-  ],
-  rules: {
-    // === ONLY rules that OXC cannot handle ===
-
-    // Prettier integration (formatting)
-    'prettier/prettier': 'error',
-
-    // Custom Superset plugins
-    'theme-colors/no-literal-colors': 'error',
-    'icons/no-fa-icons-usage': 'error',
-    'i18n-strings/no-template-vars': 'error',
-    'file-progress/activate': 1,
-
-    // Explicitly turn off all other rules to avoid conflicts
-    // when the config gets merged with other configs
-    'import/no-unresolved': 'off',
-    'import/extensions': 'off',
-    '@typescript-eslint/naming-convention': 'off',
-  },
-  overrides: [
-    {
-      // Disable custom rules in test/story files
-      files: [
-        '**/*.test.*',
-        '**/*.spec.*',
-        '**/*.stories.*',
-        '**/test/**',
-        '**/tests/**',
-        '**/spec/**',
-        '**/__tests__/**',
-        '**/__mocks__/**',
-        'cypress-base/**',
-        'packages/superset-ui-core/src/theme/index.tsx',
-      ],
-      rules: {
-        'theme-colors/no-literal-colors': 0,
-        'icons/no-fa-icons-usage': 0,
-        'i18n-strings/no-template-vars': 0,
-        'file-progress/activate': 0,
-      },
-    },
-  ],
-  // Only check src/ files where theme/icon rules matter
-  ignorePatterns: [
-    'node_modules',
-    'dist',
-    'build',
-    '.next',
-    'coverage',
-    '*.min.js',
-    'vendor',
-    // Skip packages/plugins since they have different theming rules
-    'packages/**',
-    'plugins/**',
-    // Skip generated/external files
-    '*.generated.*',
-    '*.config.js',
-    'webpack.*',
-    // Temporary analysis files
-    '*.js', // Skip all standalone JS files in root
-    '*.json',
-  ],
-};

superset-frontend/.nvmrc

@@ -1 +1 @@
-v22.22.0
+v24.16.0

superset-frontend/.storybook/main.mjs

@@ -1,4 +1,3 @@
-import { dirname, join } from 'path';
 /**
  * Licensed to the Apache Software Foundation (ASF) under one
  * or more contributor license agreements.  See the NOTICE file
@@ -17,8 +16,16 @@ import { dirname, join } from 'path';
  * specific language governing permissions and limitations
  * under the License.
  */
+
+// This file has been automatically migrated to valid ESM format by Storybook.
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
 // Superset's webpack.config.js
-const customConfig = require('../webpack.config.js');
+import customConfig from '../webpack.config.js';
+
+const require = createRequire(import.meta.url);
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
 // Filter out plugins that shouldn't be included in Storybook's static build
 // ReactRefreshWebpackPlugin adds Fast Refresh code that requires a dev server runtime,
@@ -76,7 +83,7 @@ const disableDevModeInRules = rules =>
     };
   });
 
-module.exports = {
+export default {
   stories: [
     '../src/**/*.stories.tsx',
     '../packages/superset-ui-core/src/**/*.stories.tsx',
@@ -84,11 +91,8 @@ module.exports = {
   ],
 
   addons: [
-    getAbsolutePath('@storybook/addon-essentials'),
-    getAbsolutePath('@storybook/addon-links'),
-    '@mihkeleidast/storybook-addon-source',
-    getAbsolutePath('@storybook/addon-controls'),
-    getAbsolutePath('@storybook/addon-mdx-gfm'),
+    "@storybook/addon-links",
+    "@storybook/addon-docs"
   ],
 
   staticDirs: ['../src/assets/images'],
@@ -105,11 +109,13 @@ module.exports = {
       alias: {
         ...config.resolve?.alias,
         ...customConfig.resolve?.alias,
-        // Fix for Storybook 8.6.x with React 17 - resolve ESM module paths
-        'react-dom/test-utils': require.resolve('react-dom/test-utils'),
         // Shared storybook utilities
-        '@storybook-shared': join(__dirname, 'shared'),
+        '@storybook-shared': path.join(__dirname, 'shared'),
       },
+      fallback: {
+        tty: false,
+        vm: require.resolve('vm-browserify')
+      }
     },
     plugins: [...config.plugins, ...filteredPlugins],
   }),
@@ -119,15 +125,11 @@ module.exports = {
   },
 
   framework: {
-    name: getAbsolutePath('@storybook/react-webpack5'),
+    name: getAbsolutePath("@storybook/react-webpack5"),
     options: {},
-  },
-
-  docs: {
-    autodocs: false,
-  },
+  }
 };
 
 function getAbsolutePath(value) {
-  return dirname(require.resolve(join(value, 'package.json')));
+  return path.dirname(require.resolve(path.join(value, 'package.json')));
 }

superset-frontend/.storybook/preview.jsx

@@ -16,7 +16,6 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { withJsx } from '@mihkeleidast/storybook-addon-source';
 import { themeObject, css, exampleThemes } from '@apache-superset/core/theme';
 import { combineReducers, createStore, applyMiddleware, compose } from 'redux';
 import thunk from 'redux-thunk';
@@ -114,9 +113,12 @@ const providerDecorator = Story => (
   </Provider>
 );
 
-export const decorators = [withJsx, themeDecorator, providerDecorator];
+export const decorators = [themeDecorator, providerDecorator];
 
 export const parameters = {
+  docs: {
+    codePanel: true,
+  },
   paddings: {
     values: [
       { name: 'None', value: '0px' },

superset-frontend/.storybook/shared/ResizableChartDemo.tsx

@@ -19,7 +19,7 @@
 
 import { useState, ReactNode, SyntheticEvent } from 'react';
 import { styled } from '@apache-superset/core/theme';
-import type { Decorator } from '@storybook/react';
+import type { Decorator } from '@storybook/react-webpack5';
 import { ResizeCallbackData } from 'react-resizable';
 import ResizablePanel, { Size } from './ResizablePanel';
 

superset-frontend/babel.config.js

@@ -48,6 +48,7 @@ module.exports = {
     '@babel/plugin-syntax-dynamic-import',
     '@babel/plugin-transform-export-namespace-from',
     ['@babel/plugin-transform-class-properties', { loose: true }],
+    '@babel/plugin-transform-class-static-block',
     ['@babel/plugin-transform-optional-chaining', { loose: true }],
     ['@babel/plugin-transform-private-methods', { loose: true }],
     ['@babel/plugin-transform-nullish-coalescing-operator', { loose: true }],

superset-frontend/cypress-base/package-lock.json

@@ -2058,6 +2058,24 @@
         "node": ">=8"
       }
     },
+    "node_modules/@istanbuljs/load-nyc-config/node_modules/argparse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+      "license": "Python-2.0"
+    },
+    "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
+      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^2.0.1"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
     "node_modules/@istanbuljs/schema": {
       "version": "0.1.2",
       "resolved": "https://registry.npmjs.org/@istanbuljs/schema/-/schema-0.1.2.tgz",
@@ -2934,6 +2952,8 @@
       "version": "1.0.10",
       "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
       "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
+      "dev": true,
+      "peer": true,
       "dependencies": {
         "sprintf-js": "~1.0.2"
       }
@@ -4353,6 +4373,8 @@
       "version": "4.0.1",
       "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz",
       "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==",
+      "dev": true,
+      "peer": true,
       "bin": {
         "esparse": "bin/esparse.js",
         "esvalidate": "bin/esvalidate.js"
@@ -5594,7 +5616,9 @@
       "version": "3.14.2",
       "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
       "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
+      "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "argparse": "^1.0.7",
         "esprima": "^4.0.0"
@@ -7756,7 +7780,9 @@
     "node_modules/sprintf-js": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz",
-      "integrity": "sha1-BOaSb2YolTVPPdAVIDYzuFcpfiw="
+      "integrity": "sha1-BOaSb2YolTVPPdAVIDYzuFcpfiw=",
+      "dev": true,
+      "peer": true
     },
     "node_modules/sshpk": {
       "version": "1.18.0",
@@ -10202,8 +10228,23 @@
         "camelcase": "^5.3.1",
         "find-up": "^4.1.0",
         "get-package-type": "^0.1.0",
-        "js-yaml": "^3.13.1",
+        "js-yaml": "4.1.1",
         "resolve-from": "^5.0.0"
+      },
+      "dependencies": {
+        "argparse": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+          "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q=="
+        },
+        "js-yaml": {
+          "version": "4.1.1",
+          "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
+          "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
+          "requires": {
+            "argparse": "^2.0.1"
+          }
+        }
       }
     },
     "@istanbuljs/schema": {
@@ -11006,6 +11047,8 @@
       "version": "1.0.10",
       "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
       "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
+      "dev": true,
+      "peer": true,
       "requires": {
         "sprintf-js": "~1.0.2"
       }
@@ -12051,7 +12094,9 @@
     "esprima": {
       "version": "4.0.1",
       "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz",
-      "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A=="
+      "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==",
+      "dev": true,
+      "peer": true
     },
     "esquery": {
       "version": "1.4.0",
@@ -12953,6 +12998,8 @@
       "version": "3.14.2",
       "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
       "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
+      "dev": true,
+      "peer": true,
       "requires": {
         "argparse": "^1.0.7",
         "esprima": "^4.0.0"
@@ -14463,7 +14510,9 @@
     "sprintf-js": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz",
-      "integrity": "sha1-BOaSb2YolTVPPdAVIDYzuFcpfiw="
+      "integrity": "sha1-BOaSb2YolTVPPdAVIDYzuFcpfiw=",
+      "dev": true,
+      "peer": true
     },
     "sshpk": {
       "version": "1.18.0",

superset-frontend/eslint-rules/eslint-plugin-i18n-strings/index.ts

@@ -65,6 +65,86 @@ const plugin: { rules: Record<string, Rule.RuleModule> } = {
         };
       },
     },
+    'no-eager-t-in-config': {
+      meta: {
+        type: 'problem',
+        fixable: 'code',
+        docs: {
+          description:
+            'Disallow eager t()/tn() calls for `label` and `description` in config objects evaluated at module load (e.g., controlPanel files). The translation is captured at module-evaluation time, before i18n has loaded, and never updates when the user switches language. Wrap the call in an arrow function so it is evaluated at render time.',
+        },
+        schema: [
+          {
+            type: 'object',
+            properties: {
+              properties: {
+                type: 'array',
+                items: { type: 'string' },
+              },
+            },
+            additionalProperties: false,
+          },
+        ],
+        messages: {
+          eager:
+            'Eager `{{property}}: {{fn}}(...)` is evaluated at module load, before i18n is initialized. Wrap in an arrow function: `{{property}}: () => {{fn}}(...)`.',
+        },
+      },
+      create(context: Rule.RuleContext): Rule.RuleListener {
+        const watchedProps: string[] = context.options[0]?.properties ?? [
+          'label',
+          'description',
+        ];
+        const TRANSLATE_FNS = new Set(['t', 'tn']);
+
+        function handler(node: Node): void {
+          const prop = node as Node & {
+            key: { type: string; name?: string; value?: string };
+            value: Node & {
+              type: string;
+              callee?: { type: string; name?: string };
+            };
+            shorthand?: boolean;
+            computed?: boolean;
+          };
+          if (prop.shorthand || prop.computed) return;
+
+          const keyName =
+            prop.key.type === 'Identifier'
+              ? prop.key.name
+              : prop.key.type === 'Literal'
+                ? prop.key.value
+                : undefined;
+          if (typeof keyName !== 'string' || !watchedProps.includes(keyName)) {
+            return;
+          }
+
+          const callee = prop.value;
+          if (
+            callee.type !== 'CallExpression' ||
+            callee.callee?.type !== 'Identifier' ||
+            !callee.callee.name ||
+            !TRANSLATE_FNS.has(callee.callee.name)
+          ) {
+            return;
+          }
+
+          context.report({
+            node: prop.value,
+            messageId: 'eager',
+            data: { property: keyName, fn: callee.callee.name },
+            fix(fixer) {
+              const source = context.getSourceCode().getText(prop.value);
+              return fixer.replaceText(prop.value, `() => ${source}`);
+            },
+          });
+        }
+
+        return {
+          Property: handler,
+        };
+      },
+    },
     'sentence-case-buttons': {
       meta: {
         type: 'suggestion',

superset-frontend/eslint-rules/eslint-plugin-i18n-strings/no-eager-t-in-config.test.ts

@@ -0,0 +1,86 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import type { Rule } from 'eslint';
+
+const { RuleTester } = require('eslint');
+const plugin: { rules: Record<string, Rule.RuleModule> } = require('.');
+
+const ruleTester = new RuleTester({
+  parserOptions: { ecmaVersion: 2020, sourceType: 'module' },
+});
+const rule: Rule.RuleModule = plugin.rules['no-eager-t-in-config'];
+
+ruleTester.run('no-eager-t-in-config', rule, {
+  valid: [
+    // Lazy form — the recommended pattern
+    "const c = { label: () => t('Foo') };",
+    "const c = { description: () => t('Foo') };",
+    "const c = { label: () => tn('one', 'many', n) };",
+    // Static strings — no translation, no issue
+    "const c = { label: 'Foo' };",
+    // Other property names — unaffected
+    "const c = { name: t('Foo') };",
+    "const c = { title: t('Foo') };",
+    // Computed keys are too dynamic to lint usefully
+    "const c = { [labelKey]: t('Foo') };",
+    // Shorthand: `{ label }` — no value to inspect
+    'const label = t("Foo"); const c = { label };',
+    // t() called inside a function body — already lazy
+    "const c = { label: state => t('Foo') };",
+    // Non-t() call expressions are fine
+    "const c = { label: someOtherFn('Foo') };",
+  ],
+  invalid: [
+    {
+      code: "const c = { label: t('Foo') };",
+      output: "const c = { label: () => t('Foo') };",
+      errors: [{ messageId: 'eager' }],
+    },
+    {
+      code: "const c = { description: t('Foo bar') };",
+      output: "const c = { description: () => t('Foo bar') };",
+      errors: [{ messageId: 'eager' }],
+    },
+    {
+      code: "const c = { label: tn('one', 'many', 2) };",
+      output: "const c = { label: () => tn('one', 'many', 2) };",
+      errors: [{ messageId: 'eager' }],
+    },
+    // String-literal keys are equivalent to identifier keys
+    {
+      code: "const c = { 'label': t('Foo') };",
+      output: "const c = { 'label': () => t('Foo') };",
+      errors: [{ messageId: 'eager' }],
+    },
+    // Custom watched-property list via rule option
+    {
+      code: "const c = { headerTitle: t('Foo') };",
+      output: "const c = { headerTitle: () => t('Foo') };",
+      options: [{ properties: ['headerTitle'] }],
+      errors: [{ messageId: 'eager' }],
+    },
+    // Nested config — fires per occurrence
+    {
+      code: "const c = { foo: { label: t('A'), description: t('B') } };",
+      output:
+        "const c = { foo: { label: () => t('A'), description: () => t('B') } };",
+      errors: [{ messageId: 'eager' }, { messageId: 'eager' }],
+    },
+  ],
+});

superset-frontend/eslint-rules/eslint-plugin-i18n-strings/no-template-vars.test.ts

@@ -31,12 +31,13 @@ const plugin: { rules: Record<string, Rule.RuleModule> } = require('.');
 // Tests
 //------------------------------------------------------------------------------
 
-const ruleTester = new RuleTester({ parserOptions: { ecmaVersion: 6 } });
+const ruleTester = new RuleTester({ languageOptions: { ecmaVersion: 6 } });
 const rule: Rule.RuleModule = plugin.rules['no-template-vars'];
 
-const errors: Array<{ type: string }> = [
+const errors: Array<{ message: string }> = [
   {
-    type: 'CallExpression',
+    message:
+      "Don't use variables in translation string templates. Flask-babel is a static translation service, so it can't handle strings that include variables",
   },
 ];
 

superset-frontend/eslint-rules/eslint-plugin-icons/no-fontawesome.test.ts

@@ -31,7 +31,10 @@ const plugin: { rules: Record<string, Rule.RuleModule> } = require('.');
 // Tests
 //------------------------------------------------------------------------------
 const ruleTester = new RuleTester({
-  parserOptions: { ecmaVersion: 6, ecmaFeatures: { jsx: true } },
+  languageOptions: {
+    ecmaVersion: 6,
+    parserOptions: { ecmaFeatures: { jsx: true } },
+  },
 });
 const rule: Rule.RuleModule = plugin.rules['no-fa-icons-usage'];
 

superset-frontend/eslint.config.minimal.js

@@ -0,0 +1,137 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * MINIMAL ESLint flat config - ONLY for rules OXC doesn't support.
+ *
+ * This config is run alongside the OXC (oxlint) linter, which handles the
+ * bulk of linting. ESLint here only covers the custom Superset plugins and
+ * Prettier formatting that oxlint cannot express. It is consumed by
+ * `scripts/oxlint-metrics-uploader.js` (`npm run lint-stats`).
+ *
+ * Migrated from the legacy `.eslintrc.minimal.js` (eslintrc) format to flat
+ * config for ESLint v9+/v10, where eslintrc is no longer supported.
+ *
+ * Only covers:
+ * - Custom Superset plugins (theme-colors, icons, i18n-strings)
+ * - Prettier formatting
+ */
+
+// Register the TypeScript require hook so ESLint can load the .ts plugin files
+// from eslint-rules/*.
+require('tsx/cjs');
+
+const tsParser = require('@typescript-eslint/parser');
+const prettierPlugin = require('eslint-plugin-prettier');
+const themeColorsPlugin = require('eslint-plugin-theme-colors');
+const iconsPlugin = require('eslint-plugin-icons');
+const i18nStringsPlugin = require('eslint-plugin-i18n-strings');
+
+module.exports = [
+  // Files this config applies to. Flat config has no `--ext`; globs live here.
+  // Only check src/ files where the theme/icon/i18n rules matter.
+  {
+    ignores: [
+      'node_modules/**',
+      'dist/**',
+      'build/**',
+      '.next/**',
+      'coverage/**',
+      '**/*.min.js',
+      'vendor/**',
+      // Skip packages/plugins since they have different theming rules
+      'packages/**',
+      'plugins/**',
+      // Skip generated/external/config files
+      '**/*.generated.*',
+      '**/*.config.js',
+      '**/webpack.*',
+      '*.json',
+    ],
+  },
+  {
+    files: ['**/*.{js,jsx,ts,tsx}'],
+    languageOptions: {
+      ecmaVersion: 2020,
+      sourceType: 'module',
+      // The @typescript-eslint parser handles both TS/TSX and plain JS/JSX and
+      // is compatible with ESLint v10's scope manager. (The legacy
+      // @babel/eslint-parser does not support ESLint v10.) The custom rules
+      // here are pure AST visitors and do not require type information, so no
+      // `project` is configured — this keeps parsing fast.
+      parser: tsParser,
+      parserOptions: {
+        ecmaFeatures: {
+          jsx: true,
+        },
+      },
+    },
+    // Don't report on eslint-disable comments for rules we don't have.
+    linterOptions: {
+      reportUnusedDisableDirectives: false,
+    },
+    plugins: {
+      prettier: prettierPlugin,
+      'theme-colors': themeColorsPlugin,
+      icons: iconsPlugin,
+      'i18n-strings': i18nStringsPlugin,
+    },
+    rules: {
+      // Prettier integration (formatting)
+      'prettier/prettier': 'error',
+
+      // Custom Superset plugins
+      'theme-colors/no-literal-colors': 'error',
+      'icons/no-fa-icons-usage': 'error',
+      'i18n-strings/no-template-vars': 'error',
+      // Enabled only for controlPanel files via the override below.
+      'i18n-strings/no-eager-t-in-config': 'off',
+    },
+  },
+  {
+    // Eager t()/tn() in `label`/`description` config props is captured at
+    // module-load time, before i18n initializes — labels stay in the fallback
+    // language even after the user switches. Surfaced as a warning (with
+    // autofix to `() => t(...)`) wherever this is a real foot-gun:
+    // controlPanel files. Promote to `'error'` once the codebase is clean.
+    files: ['**/controlPanel.{ts,tsx,js,jsx}'],
+    rules: {
+      'i18n-strings/no-eager-t-in-config': 'warn',
+    },
+  },
+  {
+    // Disable custom rules in test/story files
+    files: [
+      '**/*.test.*',
+      '**/*.spec.*',
+      '**/*.stories.*',
+      '**/test/**',
+      '**/tests/**',
+      '**/spec/**',
+      '**/__tests__/**',
+      '**/__mocks__/**',
+      'cypress-base/**',
+    ],
+    rules: {
+      'theme-colors/no-literal-colors': 'off',
+      'icons/no-fa-icons-usage': 'off',
+      'i18n-strings/no-template-vars': 'off',
+    },
+  },
+];

superset-frontend/jest.config.js

@@ -69,7 +69,7 @@ module.exports = {
   ],
   coverageReporters: ['lcov', 'json-summary', 'html', 'text'],
   transformIgnorePatterns: [
-    'node_modules/(?!@formatjs/.*|d3-(array|interpolate|color|time|scale|time-format|format)|internmap|@mapbox/tiny-sdf|remark-gfm|(?!@ngrx|(?!deck.gl)|d3-scale)|markdown-table|micromark-*.|decode-named-character-reference|character-entities|mdast-util-*.|unist-util-*.|ccount|escape-string-regexp|nanoid|uuid|@rjsf/*.|echarts|zrender|fetch-mock|pretty-ms|parse-ms|ol|@babel/runtime|@emotion|cheerio|cheerio/lib|parse5|dom-serializer|entities|htmlparser2|rehype-sanitize|hast-util-sanitize|unified|unist-.*|hast-.*|rehype-.*|remark-.*|mdast-.*|micromark-.*|parse-entities|property-information|space-separated-tokens|comma-separated-tokens|bail|devlop|zwitch|longest-streak|geostyler|geostyler-.*|(?!geostyler)lodash|react-error-boundary|react-json-tree|react-base16-styling|lodash-es|rbush|quickselect|react-diff-viewer-continued)',
+    'node_modules/(?!@formatjs/.*|d3-(array|interpolate|color|time|scale|time-format|format)|internmap|@mapbox/tiny-sdf|remark-gfm|(?!@ngrx|(?!deck.gl)|d3-scale)|markdown-table|micromark-*.|decode-named-character-reference|character-entities|mdast-util-*.|unist-util-*.|ccount|escape-string-regexp|nanoid|uuid|@rjsf/*.|echarts|zrender|fetch-mock|pretty-ms|parse-ms|ol|@babel/runtime|@emotion|cheerio|cheerio/lib|parse5|dom-serializer|entities|htmlparser2|rehype-sanitize|hast-util-sanitize|unified|unist-.*|hast-.*|rehype-.*|remark-.*|mdast-.*|micromark-.*|parse-entities|property-information|space-separated-tokens|comma-separated-tokens|bail|devlop|zwitch|longest-streak|geostyler|geostyler-.*|(?!geostyler)lodash|react-error-boundary|react-json-tree|react-base16-styling|lodash-es|rbush|quickselect|react-diff-viewer-continued|storybook/*.)',
   ],
   preset: 'ts-jest',
   transform: {

superset-frontend/oxlint.json

@@ -287,13 +287,15 @@
   "ignorePatterns": [
     "packages/generator-superset/**/*",
     "cypress-base/**",
-    "node_modules/**",
+    "**/node_modules/**",
     "build/**",
-    "dist/**",
-    "lib/**",
-    "esm/**",
-    "*.min.js",
+    "**/dist/**",
+    "**/lib/**",
+    "**/esm/**",
+    "**/*.min.js",
+    "**/*.d.ts",
     "coverage/**",
+    "storybook-static/**",
     ".git/**",
     "**/*.config.js",
     "**/*.config.ts"

superset-frontend/package.json

@@ -164,8 +164,8 @@
     "@visx/scale": "^3.5.0",
     "@visx/tooltip": "^3.0.0",
     "@visx/xychart": "^3.5.1",
-    "ag-grid-community": "35.3.0",
-    "ag-grid-react": "35.3.0",
+    "ag-grid-community": "35.3.1",
+    "ag-grid-react": "35.3.1",
     "antd": "^5.26.0",
     "chrono-node": "^2.9.1",
     "classnames": "^2.2.5",
@@ -178,7 +178,7 @@
     "echarts": "^5.6.0",
     "fast-glob": "^3.3.2",
     "fs-extra": "^11.3.5",
-    "fuse.js": "^7.3.0",
+    "fuse.js": "^7.4.1",
     "geolib": "^3.3.14",
     "geostyler": "^18.6.0",
     "geostyler-data": "^1.1.0",
@@ -204,7 +204,7 @@
     "query-string": "9.4.0",
     "re-resizable": "^6.11.2",
     "react": "^18.2.0",
-    "react-arborist": "^3.8.0",
+    "react-arborist": "^3.10.1",
     "react-checkbox-tree": "^1.8.0",
     "react-diff-viewer-continued": "^4.2.2",
     "react-dnd": "^11.1.3",
@@ -261,22 +261,14 @@
     "@babel/types": "^7.29.7",
     "@emotion/babel-plugin": "^11.13.5",
     "@emotion/jest": "^11.14.2",
-    "@formatjs/intl-durationformat": "^0.10.3",
+    "@formatjs/intl-durationformat": "^0.10.13",
     "@istanbuljs/nyc-config-typescript": "^1.0.1",
-    "@mihkeleidast/storybook-addon-source": "^1.0.1",
     "@playwright/test": "^1.60.0",
     "@pmmmwh/react-refresh-webpack-plugin": "^0.6.2",
-    "@storybook/addon-actions": "^8.6.18",
-    "@storybook/addon-controls": "^8.6.18",
-    "@storybook/addon-essentials": "^8.6.18",
-    "@storybook/addon-links": "^8.6.18",
-    "@storybook/addon-mdx-gfm": "^8.6.18",
-    "@storybook/components": "^8.6.18",
-    "@storybook/preview-api": "^8.6.18",
-    "@storybook/react": "^8.6.18",
-    "@storybook/react-webpack5": "^8.6.18",
-    "@storybook/test": "^8.6.18",
-    "@storybook/test-runner": "^0.17.0",
+    "@storybook/addon-docs": "10.4.2",
+    "@storybook/addon-links": "10.4.2",
+    "@storybook/react-webpack5": "10.4.2",
+    "@storybook/test-runner": "0.24.4",
     "@svgr/webpack": "^8.1.0",
     "@swc/core": "^1.15.40",
     "@swc/plugin-emotion": "^14.12.0",
@@ -288,16 +280,15 @@
     "@types/content-disposition": "^0.5.9",
     "@types/dom-to-image": "^2.6.7",
     "@types/jest": "^30.0.0",
-    "@types/jquery": "^4.0.0",
+    "@types/jquery": "^4.0.1",
     "@types/js-levenshtein": "^1.1.3",
     "@types/json-bigint": "^1.0.4",
     "@types/mousetrap": "^1.6.15",
-    "@types/node": "^25.9.1",
+    "@types/node": "^25.9.2",
     "@types/react": "^18.2.0",
     "@types/react-dom": "^18.2.0",
     "@types/react-loadable": "^5.5.11",
     "@types/react-redux": "^7.1.10",
-    "@types/react-resizable": "^4.0.0",
     "@types/react-router-dom": "^5.3.3",
     "@types/react-transition-group": "^4.4.12",
     "@types/react-window": "^1.8.8",
@@ -306,22 +297,22 @@
     "@types/rison": "0.1.0",
     "@types/tinycolor2": "^1.4.3",
     "@types/unzipper": "^0.10.11",
-    "@typescript-eslint/eslint-plugin": "^8.60.1",
-    "@typescript-eslint/parser": "^8.59.4",
+    "@typescript-eslint/eslint-plugin": "^8.61.0",
+    "@typescript-eslint/parser": "^8.61.0",
     "babel-jest": "^30.4.1",
     "babel-loader": "^10.1.1",
     "babel-plugin-dynamic-import-node": "^2.3.3",
     "babel-plugin-jsx-remove-data-test-id": "^3.0.0",
     "babel-plugin-lodash": "^3.3.4",
-    "baseline-browser-mapping": "^2.10.33",
+    "baseline-browser-mapping": "^2.10.34",
     "cheerio": "1.2.0",
     "concurrently": "^10.0.3",
     "copy-webpack-plugin": "^14.0.0",
     "cross-env": "^10.1.0",
     "css-loader": "^7.1.4",
     "css-minimizer-webpack-plugin": "^8.0.0",
-    "eslint": "^8.56.0",
-    "eslint-config-prettier": "^7.2.0",
+    "eslint": "^10.4.1",
+    "eslint-config-prettier": "^10.1.8",
     "eslint-import-resolver-alias": "^1.1.2",
     "eslint-import-resolver-typescript": "^4.4.5",
     "eslint-plugin-cypress": "^3.6.0",
@@ -329,12 +320,12 @@
     "eslint-plugin-icons": "file:eslint-rules/eslint-plugin-icons",
     "eslint-plugin-import": "^2.32.0",
     "eslint-plugin-jest-dom": "^5.5.0",
-    "eslint-plugin-lodash": "^7.4.0",
+    "eslint-plugin-lodash": "^8.0.0",
     "eslint-plugin-no-only-tests": "^3.4.0",
     "eslint-plugin-prettier": "^5.5.6",
     "eslint-plugin-react-prefer-function-component": "^5.0.0",
-    "eslint-plugin-react-you-might-not-need-an-effect": "^0.10.4",
-    "eslint-plugin-storybook": "^0.8.0",
+    "eslint-plugin-react-you-might-not-need-an-effect": "^1.0.0",
+    "eslint-plugin-storybook": "10.4.2",
     "eslint-plugin-testing-library": "^7.16.2",
     "eslint-plugin-theme-colors": "file:eslint-rules/eslint-plugin-theme-colors",
     "fetch-mock": "^12.6.0",
@@ -364,7 +355,7 @@
     "source-map": "^0.7.6",
     "source-map-support": "^0.5.21",
     "speed-measure-webpack-plugin": "^1.6.0",
-    "storybook": "8.6.18",
+    "storybook": "10.4.2",
     "style-loader": "^4.0.0",
     "swc-loader": "^0.2.7",
     "terser-webpack-plugin": "^5.6.1",
@@ -377,9 +368,9 @@
     "wait-on": "^9.0.10",
     "webpack": "^5.107.2",
     "webpack-bundle-analyzer": "^5.3.0",
-    "webpack-cli": "^6.0.1",
+    "webpack-cli": "^7.0.3",
     "webpack-dev-server": "^5.2.4",
-    "webpack-manifest-plugin": "^5.0.1",
+    "webpack-manifest-plugin": "^6.0.1",
     "webpack-sources": "^3.5.0",
     "webpack-visualizer-plugin2": "^2.0.0"
   },
@@ -391,8 +382,8 @@
     "regenerator-runtime": "^0.14.1"
   },
   "engines": {
-    "node": "^22.22.0",
-    "npm": "^10.8.1"
+    "node": "^24.16.0",
+    "npm": "^11.13.0"
   },
   "overrides": {
     "uuid": "$uuid",
@@ -423,7 +414,16 @@
     "@jest/types": "^30.4.0",
     "jest-util": "^30.4.0",
     "jest-circus": "^30.4.0",
-    "jest-environment-node": "^30.4.0"
+    "jest-environment-node": "^30.4.0",
+    "@babel/eslint-parser": {
+      "eslint": "$eslint"
+    },
+    "eslint-plugin-import": {
+      "eslint": "$eslint"
+    },
+    "eslint-plugin-jest-dom": {
+      "eslint": "$eslint"
+    }
   },
   "readme": "ERROR: No README data found!",
   "scarfSettings": {

superset-frontend/packages/superset-core/src/menus/index.ts

@@ -37,7 +37,7 @@
  * ```
  */
 
-import { Disposable } from '../common';
+import { Disposable, Event } from '../common';
 
 /**
  * Represents a menu item that links a view to a command.
@@ -102,3 +102,37 @@ export declare function registerMenuItem(
  * ```
  */
 export declare function getMenu(location: string): Menu | undefined;
+
+/**
+ * Event fired when a menu item is registered.
+ */
+export interface MenuItemRegisteredEvent {
+  /** The menu item that was registered. */
+  item: MenuItem;
+  /** The location where the item was registered. */
+  location: string;
+  /** The group the item was placed in. */
+  group: 'primary' | 'secondary' | 'context';
+}
+
+/**
+ * Event fired when a menu item is unregistered.
+ */
+export interface MenuItemUnregisteredEvent {
+  /** The menu item that was unregistered. */
+  item: MenuItem;
+  /** The location where the item was registered. */
+  location: string;
+  /** The group the item was placed in. */
+  group: 'primary' | 'secondary' | 'context';
+}
+
+/**
+ * Event fired when a menu item is registered.
+ */
+export declare const onDidRegisterMenuItem: Event<MenuItemRegisteredEvent>;
+
+/**
+ * Event fired when a menu item is unregistered.
+ */
+export declare const onDidUnregisterMenuItem: Event<MenuItemUnregisteredEvent>;

superset-frontend/packages/superset-core/src/translation/TranslatorSingleton.test.ts

@@ -26,7 +26,7 @@ test('t() warns and creates a default translator when called before configure',
     const { t } = require('./TranslatorSingleton');
     const result = t('hello');
     expect(consoleSpy).toHaveBeenCalledWith(
-      'You should call configure(...) before calling other methods',
+      expect.stringMatching(/was called before configure\(\)/),
     );
     expect(result).toBe('hello');
     consoleSpy.mockRestore();
@@ -54,7 +54,7 @@ test('resetTranslation resets the configured singleton', () => {
     // After reset, calling t() should warn again
     t('hello');
     expect(consoleSpy).toHaveBeenCalledWith(
-      'You should call configure(...) before calling other methods',
+      expect.stringMatching(/was called before configure\(\)/),
     );
     consoleSpy.mockRestore();
   });
@@ -96,6 +96,69 @@ test('tn() calls translateWithNumber on the singleton', () => {
   });
 });
 
+test('pre-configure warning fires once per unique key', () => {
+  jest.isolateModules(() => {
+    const consoleSpy = jest.spyOn(console, 'warn').mockImplementation(() => {});
+    const { t } = require('./TranslatorSingleton');
+    t('apple');
+    t('apple');
+    t('apple');
+    t('banana');
+    expect(consoleSpy).toHaveBeenCalledTimes(2);
+    expect(consoleSpy).toHaveBeenNthCalledWith(
+      1,
+      expect.stringContaining('"apple"'),
+    );
+    expect(consoleSpy).toHaveBeenNthCalledWith(
+      2,
+      expect.stringContaining('"banana"'),
+    );
+    consoleSpy.mockRestore();
+  });
+});
+
+test('pre-configure warning suggests the lazy-function fix', () => {
+  jest.isolateModules(() => {
+    const consoleSpy = jest.spyOn(console, 'warn').mockImplementation(() => {});
+    const { t } = require('./TranslatorSingleton');
+    t('Sort ascending');
+    expect(consoleSpy).toHaveBeenCalledWith(
+      expect.stringContaining('() => t("Sort ascending")'),
+    );
+    consoleSpy.mockRestore();
+  });
+});
+
+test('pre-configure warning is suppressed in production', () => {
+  jest.isolateModules(() => {
+    const originalEnv = process.env.NODE_ENV;
+    process.env.NODE_ENV = 'production';
+    const consoleSpy = jest.spyOn(console, 'warn').mockImplementation(() => {});
+    const { t } = require('./TranslatorSingleton');
+    t('hello');
+    expect(consoleSpy).not.toHaveBeenCalled();
+    consoleSpy.mockRestore();
+    if (originalEnv !== undefined) {
+      process.env.NODE_ENV = originalEnv;
+    } else {
+      delete process.env.NODE_ENV;
+    }
+  });
+});
+
+test('resetTranslation clears the warned-keys dedupe set', () => {
+  jest.isolateModules(() => {
+    const consoleSpy = jest.spyOn(console, 'warn').mockImplementation(() => {});
+    const { t, resetTranslation } = require('./TranslatorSingleton');
+    t('hello');
+    expect(consoleSpy).toHaveBeenCalledTimes(1);
+    resetTranslation();
+    t('hello');
+    expect(consoleSpy).toHaveBeenCalledTimes(2);
+    consoleSpy.mockRestore();
+  });
+});
+
 test('resetTranslation does nothing when not yet configured', () => {
   jest.isolateModules(() => {
     const consoleSpy = jest.spyOn(console, 'warn').mockImplementation(() => {});
@@ -105,7 +168,7 @@ test('resetTranslation does nothing when not yet configured', () => {
     // The singleton is still unconfigured, so t() warns
     t('hello');
     expect(consoleSpy).toHaveBeenCalledWith(
-      'You should call configure(...) before calling other methods',
+      expect.stringMatching(/was called before configure\(\)/),
     );
     consoleSpy.mockRestore();
   });

superset-frontend/packages/superset-core/src/translation/TranslatorSingleton.ts

@@ -25,6 +25,10 @@ import { TranslatorConfig, Translations, LocaleData } from './types';
 let singleton: Translator | undefined;
 let isConfigured = false;
 
+// Tracks which keys have already triggered a pre-configure warning so the
+// logs don't drown in repeated calls from large module-load fan-outs.
+const warnedPreConfigureKeys = new Set<string>();
+
 function configure(config?: TranslatorConfig) {
   singleton = new Translator(config);
   isConfigured = true;
@@ -33,10 +37,6 @@ function configure(config?: TranslatorConfig) {
 }
 
 function getInstance() {
-  if (!isConfigured) {
-    console.warn('You should call configure(...) before calling other methods');
-  }
-
   if (typeof singleton === 'undefined') {
     singleton = new Translator();
   }
@@ -44,11 +44,32 @@ function getInstance() {
   return singleton;
 }
 
+function warnPreConfigure(fn: 't' | 'tn', key: string) {
+  // Only warn in non-production builds — production callers may legitimately
+  // tolerate the fallback, and the noise isn't useful at runtime.
+  if (
+    typeof process !== 'undefined' &&
+    process.env?.NODE_ENV === 'production'
+  ) {
+    return;
+  }
+  if (warnedPreConfigureKeys.has(key)) return;
+  warnedPreConfigureKeys.add(key);
+  console.warn(
+    `[i18n] ${fn}(${JSON.stringify(key)}) was called before configure() — ` +
+      `the result is the fallback language and will not update when the ` +
+      `user switches language. If this call is at module load (e.g., a ` +
+      `controlPanel \`label\`/\`description\`), wrap it in an arrow ` +
+      `function: \`() => ${fn}(${JSON.stringify(key)})\`.`,
+  );
+}
+
 function resetTranslation() {
   if (isConfigured) {
     isConfigured = false;
     singleton = undefined;
   }
+  warnedPreConfigureKeys.clear();
 }
 
 function addTranslation(key: string, translations: string[]) {
@@ -64,10 +85,12 @@ function addLocaleData(data: LocaleData) {
 }
 
 function t(input: string, ...args: unknown[]) {
+  if (!isConfigured) warnPreConfigure('t', input);
   return getInstance().translate(input, ...args);
 }
 
 function tn(key: string, ...args: unknown[]) {
+  if (!isConfigured) warnPreConfigure('tn', key);
   return getInstance().translateWithNumber(key, ...args);
 }
 

superset-frontend/packages/superset-core/src/views/index.ts

@@ -36,7 +36,7 @@
  */
 
 import { ReactElement } from 'react';
-import { Disposable } from '../common';
+import { Disposable, Event } from '../common';
 
 /**
  * Represents a contributed view in the application.
@@ -88,3 +88,33 @@ export declare function registerView(
  * ```
  */
 export declare function getViews(location: string): View[] | undefined;
+
+/**
+ * Event fired when a view is registered.
+ */
+export interface ViewRegisteredEvent {
+  /** The descriptor of the view that was registered. */
+  view: View;
+  /** The location where the view was registered. */
+  location: string;
+}
+
+/**
+ * Event fired when a view is unregistered.
+ */
+export interface ViewUnregisteredEvent {
+  /** The descriptor of the view that was unregistered. */
+  view: View;
+  /** The location where the view was registered. */
+  location: string;
+}
+
+/**
+ * Event fired when a view is registered.
+ */
+export declare const onDidRegisterView: Event<ViewRegisteredEvent>;
+
+/**
+ * Event fired when a view is unregistered.
+ */
+export declare const onDidUnregisterView: Event<ViewUnregisteredEvent>;

superset-frontend/packages/superset-ui-chart-controls/src/types.ts

@@ -204,8 +204,14 @@ export type TabOverride = 'data' | 'customize' | 'matrixify' | boolean;
  * these configs will be passed to the UI component for control as props.
  *
  * - type: the control type, referencing a React component of the same name
- * - label: the label as shown in the control's header
- * - description: shown in the info tooltip of the control's header
+ * - label: the label as shown in the control's header. When the value involves
+ *   `t()`/`tn()`, prefer the arrow-function form (`label: () => t('Foo')`) so
+ *   the lookup runs at render time rather than at module load — eager
+ *   `label: t('Foo')` captures the fallback language before i18n initializes
+ *   and does not update on runtime language change. The
+ *   `i18n-strings/no-eager-t-in-config` lint rule autofixes this.
+ * - description: shown in the info tooltip of the control's header. Same
+ *   lazy-form guidance as `label`.
  * - default: the default value when opening a new chart, or changing visualization type
  * - renderTrigger: a bool that defines whether the visualization should be re-rendered
  *    when changed. This should `true` for controls that only affect the rendering (client side)

superset-frontend/packages/superset-ui-core/package.json

@@ -31,8 +31,8 @@
     "@types/json-bigint": "^1.0.4",
     "@visx/responsive": "^3.12.0",
     "ace-builds": "^1.44.0",
-    "ag-grid-community": "35.3.0",
-    "ag-grid-react": "35.3.0",
+    "ag-grid-community": "35.3.1",
+    "ag-grid-react": "35.3.1",
     "brace": "^0.11.1",
     "classnames": "^2.5.1",
     "core-js": "^3.49.0",
@@ -43,7 +43,7 @@
     "d3-time": "^3.1.0",
     "d3-time-format": "^4.1.0",
     "dayjs": "^1.11.21",
-    "dompurify": "^3.4.7",
+    "dompurify": "^3.4.8",
     "fetch-retry": "^6.0.0",
     "handlebars": "^4.7.9",
     "jed": "^1.1.1",
@@ -75,9 +75,9 @@
     "@types/d3-scale": "^2.1.1",
     "@types/d3-time": "^3.0.4",
     "@types/d3-time-format": "^4.0.3",
-    "@types/jquery": "^4.0.0",
+    "@types/jquery": "^4.0.1",
     "@types/lodash": "^4.17.24",
-    "@types/node": "^25.9.1",
+    "@types/node": "^25.9.2",
     "@types/prop-types": "^15.7.15",
     "@types/react-syntax-highlighter": "^15.5.13",
     "@types/react-table": "^7.7.20",

superset-frontend/packages/superset-ui-core/src/chart/components/Matrixify/MatrixifyGridGenerator.test.ts

@@ -72,6 +72,7 @@ test('should generate a 2x2 grid for metrics mode', () => {
     createAdhocMetric('Revenue'),
     createSqlMetric('Q1', 'SUM(CASE WHEN quarter = 1 THEN value END)'),
   ]);
+  expect(firstCell!.formData.metric).toEqual(createAdhocMetric('Revenue'));
 });
 
 test('should generate grid for dimensions mode', () => {
@@ -213,6 +214,9 @@ test('should skip missing column metrics when generating cell form data', () =>
   expect(grid!.cells[0][0]!.formData.metrics).toEqual([
     createAdhocMetric('Revenue'),
   ]);
+  expect(grid!.cells[0][0]!.formData.metric).toEqual(
+    createAdhocMetric('Revenue'),
+  );
 });
 
 test('should not escape HTML entities in cell titles', () => {
@@ -471,6 +475,51 @@ test('should handle metrics without labels', () => {
   expect(grid!.colHeaders).toEqual(['count']);
 });
 
+test('should set singular metric for singular-metric chart types like Pie', () => {
+  const rowMetricFormData: TestFormData = {
+    viz_type: 'pie',
+    datasource: '1__table',
+    matrixify_enable: true,
+    matrixify_mode_rows: 'metrics',
+    matrixify_rows: [createAdhocMetric('Revenue'), createAdhocMetric('Profit')],
+  };
+
+  const grid = generateMatrixifyGrid(rowMetricFormData);
+
+  expect(grid).not.toBeNull();
+  expect(grid!.cells[0][0]!.formData.metrics).toEqual([
+    createAdhocMetric('Revenue'),
+  ]);
+  expect(grid!.cells[0][0]!.formData.metric).toEqual(
+    createAdhocMetric('Revenue'),
+  );
+  expect(grid!.cells[1][0]!.formData.metrics).toEqual([
+    createAdhocMetric('Profit'),
+  ]);
+  expect(grid!.cells[1][0]!.formData.metric).toEqual(
+    createAdhocMetric('Profit'),
+  );
+});
+
+test('should not overwrite singular metric in dimension-only mode', () => {
+  const dimensionFormData: TestFormData = {
+    viz_type: 'pie',
+    datasource: '1__table',
+    matrixify_enable: true,
+    matrixify_mode_rows: 'dimensions',
+    matrixify_dimension_rows: {
+      dimension: 'country',
+      values: ['USA', 'Canada'],
+    },
+    metric: 'existing_metric',
+  };
+
+  const grid = generateMatrixifyGrid(dimensionFormData);
+
+  expect(grid).not.toBeNull();
+  expect(grid!.cells[0][0]!.formData.metric).toBe('existing_metric');
+});
+
 test('should preserve slice_id and dashboardId for embedded dashboard permissions', () => {
   const formDataWithDashboardContext: TestFormData = {
     ...baseFormData,

superset-frontend/packages/superset-ui-core/src/chart/components/Matrixify/MatrixifyGridGenerator.ts

@@ -197,6 +197,7 @@ function generateCellFormData(
   // If we have metrics from the matrix, use them; otherwise keep original
   if (metrics.length > 0) {
     cellFormData.metrics = metrics;
+    cellFormData.metric = metrics[0];
   }
 
   return cellFormData;

superset-frontend/packages/superset-ui-core/src/components/AsyncAceEditor/AsyncAceEditor.test.tsx

@@ -18,6 +18,7 @@
  */
 import { createRef } from 'react';
 import { render, screen, waitFor } from '@superset-ui/core/spec';
+import { supersetTheme } from '@apache-superset/core/theme';
 import type AceEditor from 'react-ace';
 import {
   AsyncAceEditor,
@@ -28,6 +29,7 @@ import {
   CssEditor,
   JsonEditor,
   ConfigEditor,
+  aceCompletionHighlightStyles,
 } from '.';
 
 import type { AceModule, AsyncAceEditorOptions } from './types';
@@ -42,6 +44,17 @@ test('renders SQLEditor', async () => {
   });
 });
 
+test('themes the autocomplete completion highlight from the theme', () => {
+  // Ace ships a hardcoded `color: #000` for the matched-prefix highlight, which
+  // is invisible on the dark autocomplete popup. The shared editor overrides it
+  // from the theme so every Ace editor (SQL Lab, Explore Custom SQL, ...) stays
+  // consistent.
+  const { styles } = aceCompletionHighlightStyles(supersetTheme);
+
+  expect(styles).toContain('.ace_completion-highlight');
+  expect(styles).toContain(supersetTheme.colorPrimaryText);
+});
+
 test('SQLEditor uses fontFamilyCode from theme', async () => {
   const ref = createRef<AceEditor>();
   const { container } = render(<SQLEditor ref={ref as React.Ref<never>} />);

superset-frontend/packages/superset-ui-core/src/components/AsyncAceEditor/index.tsx

@@ -32,7 +32,7 @@ import {
   AsyncEsmComponent,
   PlaceholderProps,
 } from '@superset-ui/core/components/AsyncEsmComponent';
-import { useTheme, css } from '@apache-superset/core/theme';
+import { useTheme, css, type SupersetTheme } from '@apache-superset/core/theme';
 import { Global } from '@emotion/react';
 
 export { getTooltipHTML } from './Tooltip';
@@ -105,6 +105,19 @@ export type AsyncAceEditorOptions = {
   > | null;
 };
 
+/**
+ * Theme-aware styling for the matched-prefix highlight in the autocomplete
+ * popup. Ace ships a hardcoded `color: #000` that is invisible on the dark
+ * popup, so the override needs `!important` to win. Lives in the shared editor
+ * so every Ace editor (SQL Lab, Explore Custom SQL, ...) stays consistent.
+ */
+export const aceCompletionHighlightStyles = (token: SupersetTheme) => css`
+  .ace_completion-highlight {
+    color: ${token.colorPrimaryText} !important;
+    background-color: ${token.colorPrimaryBgHover};
+  }
+`;
+
 /**
  * Get an async AceEditor with automatical loading of specified ace modules.
  */
@@ -370,6 +383,8 @@ export function AsyncAceEditor(
                   display: flex !important;
                 }
 
+                ${aceCompletionHighlightStyles(token)}
+
                 &&& .tooltip-detail {
                   display: flex;
                   justify-content: center;

superset-frontend/packages/superset-ui-core/src/components/AutoComplete/AutoComplete.stories.tsx

@@ -17,7 +17,7 @@
  * under the License.
  */
 import { useState } from 'react';
-import type { Meta, StoryObj } from '@storybook/react';
+import type { Meta, StoryObj } from '@storybook/react-webpack5';
 import { AutoComplete } from '.';
 import type { AutoCompleteProps } from './types';
 

superset-frontend/packages/superset-ui-core/src/components/Breadcrumb/Breadcrumb.stories.tsx

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import type { Meta, StoryObj } from '@storybook/react';
+import type { Meta, StoryObj } from '@storybook/react-webpack5';
 import { Breadcrumb } from '.';
 import type { BreadcrumbProps } from './types';
 

superset-frontend/packages/superset-ui-core/src/components/CachedLabel/CachedLabel.stories.tsx

@@ -16,8 +16,8 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { action } from '@storybook/addon-actions';
-import { Meta, StoryFn } from '@storybook/react';
+import { action } from 'storybook/actions';
+import { Meta, StoryFn } from '@storybook/react-webpack5';
 import { CachedLabel } from '.';
 import type { CacheLabelProps } from './types';
 

superset-frontend/packages/superset-ui-core/src/components/Checkbox/Checkbox.stories.tsx

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { useArgs } from '@storybook/preview-api';
+import { useArgs } from 'storybook/preview-api';
 import { useState } from 'react';
 import { Checkbox } from '.';
 import type { CheckboxProps, CheckboxChangeEvent } from './types';

superset-frontend/packages/superset-ui-core/src/components/DynamicEditableTitle/DynamicEditableTitle.regression.test.tsx

@@ -70,11 +70,46 @@ test('a change event that arrives before isEditing flips is not dropped', () =>
 });
 
 test('prop changes mid-edit do not clobber unsaved typing', async () => {
-  const { rerender } = render(<Harness initialTitle="Foo" />);
+  // Rerender DynamicEditableTitle directly with a changed title prop so the
+  // sync effect actually runs. Going through Harness would not exercise the
+  // bug because Harness owns its own state and only reads initialTitle once.
+  const onSave = jest.fn();
+  const props = {
+    placeholder: 'placeholder',
+    canEdit: true,
+    label: 'Title',
+    onSave,
+  };
+  const { rerender } = render(<DynamicEditableTitle {...props} title="Foo" />);
   const input = screen.getByRole('textbox') as HTMLInputElement;
   userEvent.click(input);
   await userEvent.type(input, 'X', { delay: 1 });
   expect(input.value).toBe('FooX');
-  rerender(<Harness initialTitle="Foo" />);
+  rerender(<DynamicEditableTitle {...props} title="Bar" />);
   expect(input.value).toBe('FooX');
+  // Locks in commit semantics: blur after a real edit must persist the
+  // user's typed value, even when a competing parent-driven title arrived
+  // mid-edit.
+  fireEvent.blur(input);
+  expect(onSave).toHaveBeenCalledWith('FooX');
+});
+
+test('passive focus then parent-driven title change then blur does not revert', () => {
+  // Phantom-revert scenario: user clicks the input but does not type, the
+  // parent autosaves a new title from elsewhere, then the user blurs. The
+  // component must NOT call onSave with the stale local value, otherwise it
+  // would silently overwrite the parent's update.
+  const onSave = jest.fn();
+  const props = {
+    placeholder: 'placeholder',
+    canEdit: true,
+    label: 'Title',
+    onSave,
+  };
+  const { rerender } = render(<DynamicEditableTitle {...props} title="Foo" />);
+  const input = screen.getByRole('textbox') as HTMLInputElement;
+  userEvent.click(input);
+  rerender(<DynamicEditableTitle {...props} title="Bar" />);
+  fireEvent.blur(input);
+  expect(onSave).not.toHaveBeenCalled();
 });

superset-frontend/packages/superset-ui-core/src/components/DynamicEditableTitle/index.tsx

@@ -81,12 +81,25 @@ export const DynamicEditableTitle = memo(
 
     const sizerRef = useRef<HTMLSpanElement>(null);
     const inputRef = useRef<InputRef>(null);
+    // Tracks whether the user has actually typed since entering edit mode.
+    // Gates onSave so that passive focus (click without typing) followed by a
+    // parent-driven title change and blur does not silently revert the
+    // parent's update with our stale currentTitle.
+    const dirtyRef = useRef(false);
     const { width: containerWidth, ref: containerRef } = useResizeDetector({
       refreshMode: 'debounce',
     });
 
     useEffect(() => {
-      setCurrentTitle(title);
+      // Don't overwrite in-flight user input when the parent re-renders with a
+      // new title prop mid-edit. handleBlur already syncs currentTitle on commit;
+      // re-running this effect when isEditing flips would resync to a stale
+      // title prop, so isEditing is intentionally read via closure rather than
+      // listed as a dep.
+      if (!isEditing) {
+        setCurrentTitle(title);
+      }
+      // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [title]);
     useEffect(() => {
       if (isEditing) {
@@ -138,10 +151,19 @@ export const DynamicEditableTitle = memo(
         return;
       }
       const formattedTitle = currentTitle.trim();
-      setCurrentTitle(formattedTitle);
-      if (title !== formattedTitle) {
+      // Only commit when the user actually typed. Passive focus must not
+      // overwrite a parent-driven title change that landed mid-edit.
+      if (dirtyRef.current && title !== formattedTitle) {
+        setCurrentTitle(formattedTitle);
         onSave(formattedTitle);
+      } else if (!dirtyRef.current) {
+        // Drop any stale local state and resync to the latest title prop so a
+        // subsequent edit starts from the current parent value.
+        setCurrentTitle(title);
+      } else {
+        setCurrentTitle(formattedTitle);
       }
+      dirtyRef.current = false;
       setIsEditing(false);
     }, [canEdit, currentTitle, onSave, title]);
 
@@ -158,6 +180,7 @@ export const DynamicEditableTitle = memo(
         if (!isEditing) {
           setIsEditing(true);
         }
+        dirtyRef.current = true;
         setCurrentTitle(ev.target.value);
       },
       [canEdit, isEditing],

superset-frontend/packages/superset-ui-core/src/components/EmptyState/EmptyState.stories.tsx

@@ -17,7 +17,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { Meta, StoryFn } from '@storybook/react';
+import { Meta, StoryFn } from '@storybook/react-webpack5';
 import { Row, Col } from '@superset-ui/core/components';
 import { EmptyState, imageMap } from '.';
 

superset-frontend/packages/superset-ui-core/src/components/FaveStar/FaveStar.stories.tsx

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import type { Meta, StoryObj } from '@storybook/react';
+import type { Meta, StoryObj } from '@storybook/react-webpack5';
 import { FaveStar } from '.';
 
 export default {

superset-frontend/packages/superset-ui-core/src/components/Grid/Grid.stories.tsx

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { Meta, StoryObj } from '@storybook/react';
+import { Meta, StoryObj } from '@storybook/react-webpack5';
 import Slider from '@superset-ui/core/components/Slider/index';
 import { useState } from 'react';
 import { Row, Col } from '.';

superset-frontend/packages/superset-ui-core/src/components/IconButton/IconButton.stories.tsx

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { Meta, StoryObj } from '@storybook/react';
+import { Meta, StoryObj } from '@storybook/react-webpack5';
 import { IconButton } from '.';
 
 export default {

superset-frontend/packages/superset-ui-core/src/components/Input/Input.stories.tsx

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import type { StoryObj } from '@storybook/react';
+import type { StoryObj } from '@storybook/react-webpack5';
 import { Input, InputNumber } from '.';
 import type { InputProps, InputNumberProps, TextAreaProps } from './types';
 

superset-frontend/packages/superset-ui-core/src/components/Label/Label.stories.tsx

@@ -16,8 +16,8 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { action } from '@storybook/addon-actions';
-import { Meta, StoryFn } from '@storybook/react';
+import { action } from 'storybook/actions';
+import { Meta, StoryFn } from '@storybook/react-webpack5';
 import type { LabelType } from './types';
 import { Label, DatasetTypeLabel, PublishedLabel } from '.';
 

superset-frontend/packages/superset-ui-core/src/components/Layout/Layout.stories.tsx

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { Meta, StoryObj } from '@storybook/react';
+import { Meta, StoryObj } from '@storybook/react-webpack5';
 import { Icons } from '@superset-ui/core/components/Icons';
 import { Menu } from '../Menu';
 import type { LayoutProps, SiderProps } from './types';

superset-frontend/packages/superset-ui-core/src/components/ListViewCard/ListViewCard.stories.tsx

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import type { Meta, StoryObj } from '@storybook/react';
+import type { Meta, StoryObj } from '@storybook/react-webpack5';
 import { ListViewCard } from '.';
 
 export default {

superset-frontend/packages/superset-ui-core/src/components/Radio/Radio.stories.tsx

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import type { StoryObj } from '@storybook/react';
+import type { StoryObj } from '@storybook/react-webpack5';
 import { css } from '@apache-superset/core/theme';
 import { Icons } from '@superset-ui/core/components/Icons';
 import { Space } from '../Space';

superset-frontend/packages/superset-ui-core/src/components/SafeMarkdown/SafeMarkdown.stories.tsx

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { Meta, StoryFn } from '@storybook/react';
+import { Meta, StoryFn } from '@storybook/react-webpack5';
 import { SafeMarkdown } from './SafeMarkdown';
 
 export default {

superset-frontend/packages/superset-ui-core/src/components/Skeleton/Skeleton.stories.tsx

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import type { Meta, StoryObj } from '@storybook/react';
+import type { Meta, StoryObj } from '@storybook/react-webpack5';
 import { Space } from '../Space';
 import { Skeleton, type SkeletonProps } from '.';
 

superset-frontend/packages/superset-ui-core/src/components/Switch/Switch.stories.tsx

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { useArgs } from '@storybook/preview-api';
+import { useArgs } from 'storybook/preview-api';
 import { Switch, type SwitchProps } from '.';
 
 export default {

superset-frontend/packages/superset-ui-core/src/components/Table/Table.stories.tsx

@@ -18,8 +18,8 @@
  */
 import { useState, DragEvent } from 'react';
 
-import type { Meta, StoryFn } from '@storybook/react';
-import { action } from '@storybook/addon-actions';
+import type { Meta, StoryFn } from '@storybook/react-webpack5';
+import { action } from 'storybook/actions';
 import {
   ColumnsType,
   ETableAction,

superset-frontend/packages/superset-ui-core/src/components/Table/cell-renderers/ActionCell/ActionCell.stories.tsx

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { StoryFn, Meta } from '@storybook/react';
+import { StoryFn, Meta } from '@storybook/react-webpack5';
 import ActionCell from './index';
 import { exampleMenuOptions, exampleRow } from './fixtures';
 

superset-frontend/packages/superset-ui-core/src/components/Table/cell-renderers/ActionCell/fixtures.ts

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { action } from '@storybook/addon-actions';
+import { action } from 'storybook/actions';
 import { ActionMenuItem } from './index';
 
 export const exampleMenuOptions: ActionMenuItem[] = [

superset-frontend/packages/superset-ui-core/src/components/Table/cell-renderers/BooleanCell/BooleanCell.stories.tsx

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { StoryFn, Meta } from '@storybook/react';
+import { StoryFn, Meta } from '@storybook/react-webpack5';
 import BooleanCell from '.';
 
 export default {

superset-frontend/packages/superset-ui-core/src/components/Table/cell-renderers/ButtonCell/ButtonCell.stories.tsx

@@ -16,8 +16,8 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { StoryFn, Meta } from '@storybook/react';
-import { action } from '@storybook/addon-actions';
+import { StoryFn, Meta } from '@storybook/react-webpack5';
+import { action } from 'storybook/actions';
 import { ButtonCell } from './index';
 
 export default {

superset-frontend/packages/superset-ui-core/src/components/Table/cell-renderers/NullCell/NullCell.stories.tsx

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { StoryFn, Meta } from '@storybook/react';
+import { StoryFn, Meta } from '@storybook/react-webpack5';
 import NullCell from '.';
 
 export default {

superset-frontend/packages/superset-ui-core/src/components/Table/cell-renderers/NumericCell/NumericCell.stories.tsx

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { StoryFn, Meta } from '@storybook/react';
+import { StoryFn, Meta } from '@storybook/react-webpack5';
 import { CurrencyCode, NumericCell, LocaleCode, Style } from './index';
 
 export default {

superset-frontend/packages/superset-ui-core/src/components/Table/cell-renderers/TimeCell/TimeCell.stories.tsx

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { StoryFn, Meta } from '@storybook/react';
+import { StoryFn, Meta } from '@storybook/react-webpack5';
 import { TimeFormats } from '@superset-ui/core';
 import TimeCell from '.';
 

superset-frontend/packages/superset-ui-core/src/components/TableCollection/TableCollection.stories.tsx

@@ -17,7 +17,7 @@
  * under the License.
  */
 import { useMemo, useState, useCallback } from 'react';
-import { Meta, StoryFn } from '@storybook/react';
+import { Meta, StoryFn } from '@storybook/react-webpack5';
 import {
   useTable,
   useSortBy,

superset-frontend/packages/superset-ui-core/src/components/TimezoneSelector/TimezoneSelector.stories.tsx

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { useArgs } from '@storybook/preview-api';
+import { useArgs } from 'storybook/preview-api';
 import TimezoneSelector, { TimezoneSelectorProps } from './index';
 
 export default {

superset-frontend/packages/superset-ui-core/src/components/Tree/Tree.stories.tsx

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { StoryObj } from '@storybook/react';
+import { StoryObj } from '@storybook/react-webpack5';
 import { Icons } from '@superset-ui/core/components/Icons';
 import Tree, { TreeProps, type TreeDataNode } from './index';
 

superset-frontend/packages/superset-ui-core/src/components/TreeSelect/TreeSelect.stories.tsx

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { Meta, StoryObj } from '@storybook/react';
+import { Meta, StoryObj } from '@storybook/react-webpack5';
 import { TreeSelect, type TreeSelectProps } from '.';
 
 export default {

superset-frontend/packages/superset-ui-core/src/components/Typography/Typography.stories.tsx

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import type { Meta, StoryObj } from '@storybook/react';
+import type { Meta, StoryObj } from '@storybook/react-webpack5';
 import { Typography } from '.';
 
 export default {

superset-frontend/packages/superset-ui-core/src/components/Upload/Upload.stories.tsx

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import type { StoryObj } from '@storybook/react';
+import type { StoryObj } from '@storybook/react-webpack5';
 import { Icons } from '../Icons';
 import { Button } from '../Button';
 import { Upload } from '.';

superset-frontend/packages/superset-ui-core/src/utils/index.ts

@@ -35,3 +35,4 @@ export * from './typedMemo';
 export * from './html';
 export * from './tooltip';
 export * from './merge';
+export * from './mapStyles';

superset-frontend/packages/superset-ui-core/src/utils/mapStyles.test.ts

@@ -0,0 +1,295 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import {
+  getBootstrapDataFromDocument,
+  getDefaultMapRenderer,
+  getMapProviderMapStyle,
+  getMapboxApiKeyFromBootstrap,
+  getMapRendererOptions,
+  hasMapboxApiKey,
+  isRasterTileTemplate,
+  OSM_TILE_ATTRIBUTION,
+  OSM_TILE_STYLE_URL,
+  resolveMapStyle,
+} from './mapStyles';
+
+test('OSM style metadata uses the approved URL and attribution', () => {
+  expect(OSM_TILE_STYLE_URL).toBe(
+    'https://tile.openstreetmap.org/{z}/{x}/{y}.png',
+  );
+  expect(OSM_TILE_ATTRIBUTION).toBe('© OpenStreetMap contributors');
+});
+
+test('Mapbox key helpers report absence and presence from bootstrap data', () => {
+  expect(getMapboxApiKeyFromBootstrap({ common: { conf: {} } })).toBe('');
+  expect(hasMapboxApiKey({ common: { conf: {} } })).toBe(false);
+  expect(
+    getMapboxApiKeyFromBootstrap({
+      common: { conf: { MAPBOX_API_KEY: 'pk.test' } },
+    }),
+  ).toBe('pk.test');
+  expect(
+    getMapboxApiKeyFromBootstrap({
+      common: { conf: { MAPBOX_API_KEY: '  pk.test  ' } },
+    }),
+  ).toBe('pk.test');
+  expect(hasMapboxApiKey({ common: { conf: { MAPBOX_API_KEY: '   ' } } })).toBe(
+    false,
+  );
+  expect(
+    hasMapboxApiKey({ common: { conf: { MAPBOX_API_KEY: 'pk.test' } } }),
+  ).toBe(true);
+});
+
+test('bootstrap data helper parses document data safely', () => {
+  document.body.innerHTML = `<div id="app" data-bootstrap='${JSON.stringify({
+    common: { conf: { MAPBOX_API_KEY: 'pk.document' } },
+  })}'></div>`;
+
+  expect(getBootstrapDataFromDocument()).toEqual({
+    common: { conf: { MAPBOX_API_KEY: 'pk.document' } },
+  });
+
+  document.body.innerHTML = `<div id="app" data-bootstrap='not-json'></div>`;
+  expect(getBootstrapDataFromDocument()).toBeUndefined();
+
+  document.body.innerHTML = '';
+  expect(getBootstrapDataFromDocument()).toBeUndefined();
+});
+
+test('bootstrap data helper returns undefined without a document', () => {
+  // jsdom defines `document` as a non-configurable global, so the SSR guard
+  // cannot be exercised by deleting it. Instead, re-evaluate the function's
+  // own source in a scope where `document` is shadowed with undefined. When
+  // running under coverage, the source is istanbul-instrumented and references
+  // its module-scoped counter, so the counter is injected to keep the guard's
+  // execution attributed to mapStyles.ts.
+  const source = getBootstrapDataFromDocument.toString();
+  const counterName = source.match(/cov_\w+/)?.[0] ?? 'unusedCoverageCounter';
+  const coverage = (globalThis as { __coverage__?: Record<string, unknown> })
+    .__coverage__;
+  const coverageEntry =
+    coverage?.[
+      Object.keys(coverage).find(file => file.endsWith('mapStyles.ts')) ?? ''
+    ];
+  // eslint-disable-next-line no-new-func
+  const callWithoutDocument = new Function(
+    counterName,
+    'document',
+    `return (${source})();`,
+  );
+  expect(callWithoutDocument(() => coverageEntry, undefined)).toBeUndefined();
+});
+
+test('renderer options enable Mapbox only when a key is available', () => {
+  expect(getMapRendererOptions({ hasMapboxKey: true })).toEqual([
+    { value: 'maplibre' },
+    { value: 'mapbox' },
+  ]);
+  expect(getMapRendererOptions({ hasMapboxKey: false })).toEqual([
+    { value: 'maplibre' },
+  ]);
+});
+
+test('renderer options preserve saved Mapbox without API-key labels', () => {
+  expect(
+    getMapRendererOptions({ hasMapboxKey: false, currentValue: 'mapbox' }),
+  ).toEqual([{ value: 'maplibre' }, { value: 'mapbox', disabled: true }]);
+});
+
+test('map provider style helper preserves legacy non-Mapbox styles for MapLibre', () => {
+  expect(
+    getMapProviderMapStyle({
+      mapProvider: 'maplibre',
+      maplibreStyle: undefined,
+      mapboxStyle: OSM_TILE_STYLE_URL,
+      legacyMapStyle: 'https://example.com/fallback-style.json',
+    }),
+  ).toEqual({
+    mapProvider: 'maplibre',
+    mapStyle: OSM_TILE_STYLE_URL,
+  });
+});
+
+test('map provider style helper does not send Mapbox URLs to MapLibre', () => {
+  expect(
+    getMapProviderMapStyle({
+      mapProvider: 'maplibre',
+      mapboxStyle: 'mapbox://styles/mapbox/dark-v11',
+      legacyMapStyle: 'https://example.com/fallback-style.json',
+    }),
+  ).toEqual({
+    mapProvider: 'maplibre',
+    mapStyle: 'https://example.com/fallback-style.json',
+  });
+});
+
+test('map provider style helper uses Mapbox style when Mapbox is selected', () => {
+  expect(
+    getMapProviderMapStyle({
+      mapProvider: 'mapbox',
+      mapboxStyle: 'mapbox://styles/mapbox/dark-v11',
+      legacyMapStyle: 'https://example.com/fallback-style.json',
+    }),
+  ).toEqual({
+    mapProvider: 'mapbox',
+    mapStyle: 'mapbox://styles/mapbox/dark-v11',
+  });
+});
+
+test('default renderer uses configured Mapbox only when a key is available', () => {
+  expect(
+    getDefaultMapRenderer({
+      common: {
+        conf: {
+          DEFAULT_MAP_RENDERER: 'mapbox',
+          MAPBOX_API_KEY: 'pk.test',
+        },
+      },
+    }),
+  ).toBe('mapbox');
+  expect(
+    getDefaultMapRenderer({
+      common: { conf: { DEFAULT_MAP_RENDERER: 'mapbox' } },
+    }),
+  ).toBe('maplibre');
+  expect(
+    getDefaultMapRenderer({
+      common: {
+        conf: {
+          DEFAULT_MAP_RENDERER: 'invalid',
+          MAPBOX_API_KEY: 'pk.test',
+        },
+      },
+    }),
+  ).toBe('maplibre');
+});
+
+test('raster tile templates resolve to MapLibre raster style objects with attribution', () => {
+  const style = resolveMapStyle(OSM_TILE_STYLE_URL, 'default-style.json');
+
+  expect(style).toEqual({
+    version: 8,
+    sources: {
+      'osm-raster-tiles': {
+        type: 'raster',
+        tiles: [OSM_TILE_STYLE_URL],
+        tileSize: 256,
+        attribution: OSM_TILE_ATTRIBUTION,
+      },
+    },
+    layers: [
+      {
+        id: 'osm-raster-layer',
+        type: 'raster',
+        source: 'osm-raster-tiles',
+        minzoom: 0,
+        maxzoom: 22,
+      },
+    ],
+  });
+});
+
+test('tile protocol raster templates are unwrapped before style resolution', () => {
+  const style = resolveMapStyle(
+    `tile://${OSM_TILE_STYLE_URL}`,
+    'default-style.json',
+  );
+
+  expect(typeof style).toBe('object');
+  if (typeof style !== 'string') {
+    expect(style.sources['osm-raster-tiles'].tiles).toEqual([
+      OSM_TILE_STYLE_URL,
+    ]);
+    expect(style.sources['osm-raster-tiles'].attribution).toBe(
+      OSM_TILE_ATTRIBUTION,
+    );
+  }
+});
+
+test('OpenStreetMap subdomain raster templates receive OSM attribution', () => {
+  const osmSubdomainTileUrl =
+    'https://c.tile.openstreetmap.org/{z}/{x}/{y}.png';
+  const style = resolveMapStyle(
+    `tile://${osmSubdomainTileUrl}`,
+    'default-style.json',
+  );
+
+  expect(typeof style).toBe('object');
+  if (typeof style !== 'string') {
+    expect(style.sources['osm-raster-tiles'].tiles).toEqual([
+      osmSubdomainTileUrl,
+    ]);
+    expect(style.sources['osm-raster-tiles'].attribution).toBe(
+      OSM_TILE_ATTRIBUTION,
+    );
+  }
+});
+
+test('custom raster tile templates do not receive OSM attribution', () => {
+  const customTileUrl = 'https://tiles.example.com/{z}/{x}/{y}.png';
+  const style = resolveMapStyle(
+    `tile://${customTileUrl}`,
+    'default-style.json',
+  );
+
+  expect(typeof style).toBe('object');
+  if (typeof style !== 'string') {
+    expect(style.sources['osm-raster-tiles'].tiles).toEqual([customTileUrl]);
+    expect(style.sources['osm-raster-tiles']).not.toHaveProperty('attribution');
+  }
+});
+
+test('relative raster tile templates do not receive OSM attribution', () => {
+  const relativeTileUrl = '/tiles/{z}/{x}/{y}.png';
+  const style = resolveMapStyle(relativeTileUrl, 'default-style.json');
+
+  expect(typeof style).toBe('object');
+  if (typeof style !== 'string') {
+    expect(style.sources['osm-raster-tiles'].tiles).toEqual([relativeTileUrl]);
+    expect(style.sources['osm-raster-tiles']).not.toHaveProperty('attribution');
+  }
+});
+
+test('lookalike OpenStreetMap hostnames do not receive OSM attribution', () => {
+  const lookalikeTileUrl =
+    'https://openstreetmap.org.example.com/{z}/{x}/{y}.png';
+  const style = resolveMapStyle(
+    `tile://${lookalikeTileUrl}`,
+    'default-style.json',
+  );
+
+  expect(typeof style).toBe('object');
+  if (typeof style !== 'string') {
+    expect(style.sources['osm-raster-tiles'].tiles).toEqual([lookalikeTileUrl]);
+    expect(style.sources['osm-raster-tiles']).not.toHaveProperty('attribution');
+  }
+});
+
+test('style JSON URLs pass through without raster wrapping', () => {
+  const styleUrl = 'https://example.com/styles/custom-style.json';
+
+  expect(isRasterTileTemplate(undefined)).toBe(false);
+  expect(isRasterTileTemplate(styleUrl)).toBe(false);
+  expect(resolveMapStyle(styleUrl, 'default-style.json')).toBe(styleUrl);
+  expect(resolveMapStyle(undefined, 'default-style.json')).toBe(
+    'default-style.json',
+  );
+});

superset-frontend/packages/superset-ui-core/src/utils/mapStyles.ts

@@ -0,0 +1,251 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+export type MapProvider = 'maplibre' | 'mapbox';
+
+export type MapRendererOption = {
+  value: MapProvider;
+  disabled?: boolean;
+};
+
+export type MapProviderMapStyle = {
+  mapProvider?: unknown;
+  maplibreStyle?: unknown;
+  mapboxStyle?: unknown;
+  legacyMapStyle?: unknown;
+};
+
+export type SelectedMapProviderMapStyle = {
+  mapProvider: MapProvider;
+  mapStyle?: string;
+};
+
+export type RasterTileMapStyle = {
+  version: 8;
+  sources: {
+    [sourceId: string]: {
+      type: 'raster';
+      tiles: string[];
+      tileSize: 256;
+      attribution?: string;
+    };
+  };
+  layers: [
+    {
+      id: string;
+      type: 'raster';
+      source: string;
+      minzoom: 0;
+      maxzoom: 22;
+    },
+  ];
+};
+
+export type ResolvedMapStyle = string | RasterTileMapStyle;
+
+export const OSM_TILE_STYLE_URL =
+  'https://tile.openstreetmap.org/{z}/{x}/{y}.png';
+export const OSM_TILE_ATTRIBUTION = '© OpenStreetMap contributors';
+
+export const MAPLIBRE_RENDERER_OPTION: MapRendererOption = {
+  value: 'maplibre',
+};
+export const MAPBOX_RENDERER_OPTION: MapRendererOption = {
+  value: 'mapbox',
+};
+export const DISABLED_MAPBOX_RENDERER_OPTION: MapRendererOption = {
+  ...MAPBOX_RENDERER_OPTION,
+  disabled: true,
+};
+
+const TILE_PROTOCOL = 'tile://';
+const RASTER_SOURCE_ID = 'osm-raster-tiles';
+const RASTER_LAYER_ID = 'osm-raster-layer';
+
+type BootstrapData = {
+  common?: {
+    conf?: {
+      DEFAULT_MAP_RENDERER?: unknown;
+      MAPBOX_API_KEY?: unknown;
+    };
+  };
+};
+
+export function getBootstrapDataFromDocument(): unknown {
+  if (typeof document === 'undefined') {
+    return undefined;
+  }
+
+  try {
+    const appContainer = document.getElementById('app');
+    const dataBootstrap = appContainer?.getAttribute('data-bootstrap');
+    return dataBootstrap ? JSON.parse(dataBootstrap) : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+export function getMapboxApiKeyFromBootstrap(
+  bootstrapData: unknown = getBootstrapDataFromDocument(),
+): string {
+  const mapboxApiKey = (bootstrapData as BootstrapData | undefined)?.common
+    ?.conf?.MAPBOX_API_KEY;
+  return typeof mapboxApiKey === 'string' ? mapboxApiKey.trim() : '';
+}
+
+export function hasMapboxApiKey(
+  bootstrapData: unknown = getBootstrapDataFromDocument(),
+): boolean {
+  return getMapboxApiKeyFromBootstrap(bootstrapData).trim().length > 0;
+}
+
+export function getDefaultMapRenderer(
+  bootstrapData: unknown = getBootstrapDataFromDocument(),
+): MapProvider {
+  const conf = (bootstrapData as BootstrapData | undefined)?.common?.conf;
+  const defaultRenderer = conf?.DEFAULT_MAP_RENDERER;
+
+  if (defaultRenderer === 'mapbox' && hasMapboxApiKey(bootstrapData)) {
+    return 'mapbox';
+  }
+
+  return 'maplibre';
+}
+
+export function getMapRendererOptions({
+  hasMapboxKey,
+  currentValue,
+}: {
+  hasMapboxKey: boolean;
+  currentValue?: MapProvider;
+}): MapRendererOption[] {
+  if (!hasMapboxKey && currentValue !== 'mapbox') {
+    return [MAPLIBRE_RENDERER_OPTION];
+  }
+
+  return [
+    MAPLIBRE_RENDERER_OPTION,
+    hasMapboxKey ? MAPBOX_RENDERER_OPTION : DISABLED_MAPBOX_RENDERER_OPTION,
+  ];
+}
+
+function getNonEmptyString(value: unknown): string | undefined {
+  return typeof value === 'string' && value.trim().length > 0
+    ? value
+    : undefined;
+}
+
+function isMapboxStyle(value: unknown): boolean {
+  return getNonEmptyString(value)?.startsWith('mapbox://') ?? false;
+}
+
+export function getMapProviderMapStyle({
+  mapProvider,
+  maplibreStyle,
+  mapboxStyle,
+  legacyMapStyle,
+}: MapProviderMapStyle): SelectedMapProviderMapStyle {
+  const selectedMapProvider: MapProvider =
+    mapProvider === 'mapbox' ? 'mapbox' : 'maplibre';
+  const maplibreStyleValue = getNonEmptyString(maplibreStyle);
+  const mapboxStyleValue = getNonEmptyString(mapboxStyle);
+  const legacyMapStyleValue = getNonEmptyString(legacyMapStyle);
+
+  if (selectedMapProvider === 'mapbox') {
+    return {
+      mapProvider: selectedMapProvider,
+      mapStyle: mapboxStyleValue ?? legacyMapStyleValue,
+    };
+  }
+
+  return {
+    mapProvider: selectedMapProvider,
+    mapStyle:
+      maplibreStyleValue ??
+      (isMapboxStyle(mapboxStyleValue) ? undefined : mapboxStyleValue) ??
+      legacyMapStyleValue,
+  };
+}
+
+function unwrapTileProtocol(value: string): string {
+  return value.startsWith(TILE_PROTOCOL)
+    ? value.slice(TILE_PROTOCOL.length)
+    : value;
+}
+
+export function isRasterTileTemplate(value: unknown): value is string {
+  if (typeof value !== 'string') {
+    return false;
+  }
+  const tileUrl = unwrapTileProtocol(value);
+  return ['{z}', '{x}', '{y}'].every(templateParam =>
+    tileUrl.includes(templateParam),
+  );
+}
+
+function isOpenStreetMapTileUrl(value: string): boolean {
+  try {
+    const hostname = new URL(value).hostname.toLowerCase();
+    return (
+      hostname === 'openstreetmap.org' ||
+      hostname.endsWith('.openstreetmap.org')
+    );
+  } catch {
+    return false;
+  }
+}
+
+export function buildRasterTileMapStyle(value: string): RasterTileMapStyle {
+  const tileUrl = unwrapTileProtocol(value);
+  const attribution = isOpenStreetMapTileUrl(tileUrl)
+    ? { attribution: OSM_TILE_ATTRIBUTION }
+    : {};
+
+  return {
+    version: 8,
+    sources: {
+      [RASTER_SOURCE_ID]: {
+        type: 'raster',
+        tiles: [tileUrl],
+        tileSize: 256,
+        ...attribution,
+      },
+    },
+    layers: [
+      {
+        id: RASTER_LAYER_ID,
+        type: 'raster',
+        source: RASTER_SOURCE_ID,
+        minzoom: 0,
+        maxzoom: 22,
+      },
+    ],
+  };
+}
+
+export function resolveMapStyle(
+  value: string | undefined,
+  defaultStyle: string,
+): ResolvedMapStyle {
+  if (!value) {
+    return defaultStyle;
+  }
+
+  return isRasterTileTemplate(value) ? buildRasterTileMapStyle(value) : value;
+}

superset-frontend/packages/superset-ui-core/test/number-format/factories/createDurationFormatter.test.ts

@@ -35,7 +35,7 @@ test('format milliseconds in human readable format with default options', () =>
 });
 test('format seconds in human readable format with default options', () => {
   const formatter = createDurationFormatter({ multiplier: 1000 });
-  expect(formatter(-0.5)).toBe('-0s');
+  expect(formatter(-0.5)).toBe('0s');
   expect(formatter(0.5)).toBe('0s');
   expect(formatter(1)).toBe('1s');
   expect(formatter(30)).toBe('30s');

superset-frontend/playwright/pages/ExplorePage.ts

@@ -29,12 +29,33 @@ export class ExplorePage {
   private static readonly SELECTORS = {
     DATASOURCE_CONTROL: '[data-test="datasource-control"]',
     VIZ_SWITCHER: '[data-test="fast-viz-switcher"]',
+    CHART_CONTAINER: '[data-test="chart-container"]',
   } as const;
 
   constructor(page: Page) {
     this.page = page;
   }
 
+  /**
+   * Navigates to the Explore page for a given chart and waits for it to load.
+   *
+   * @param chartId - ID of the chart (slice) to open
+   * @param options - Optional wait options
+   */
+  async goto(chartId: number, options?: { timeout?: number }): Promise<void> {
+    await this.page.goto(`explore/?slice_id=${chartId}`);
+    await this.waitForPageLoad(options);
+  }
+
+  /**
+   * Gets the chart container locator (where the rendered viz appears).
+   *
+   * @returns Locator for the chart container
+   */
+  getChartContainer(): Locator {
+    return this.page.locator(ExplorePage.SELECTORS.CHART_CONTAINER);
+  }
+
   /**
    * Waits for the Explore page to load.
    * Validates URL contains /explore/ and datasource control is visible.

superset-frontend/playwright/tests/chart/handlebars-format-date.spec.ts

@@ -0,0 +1,104 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * Regression for #32960: the `formatDate` Handlebars helper (provided by
+ * just-handlebars-helpers) stopped working after 4.1.2, rendering
+ * "i is not a function" (minified) / "moment is not a function" (dev) instead
+ * of the formatted date. The library helper resolves `moment` lazily via
+ * `global.moment` / `require('moment/min/moment-with-locales')`, which the
+ * bundled HandlebarsViewer no longer satisfies (it switched to dayjs).
+ *
+ * The fix registers a dayjs-backed `formatDate` override in HandlebarsViewer
+ * (superset-frontend/plugins/plugin-chart-handlebars). This spec guards it: it
+ * creates a Handlebars chart whose template uses `{{formatDate 'DD.MM.YYYY' ds}}`
+ * and asserts the chart renders a real formatted date rather than the helper
+ * error. Because the failure was a bundling/minification artifact (moment
+ * resolves fine under Jest's Node `require`), an E2E test is required to cover it.
+ */
+import { testWithAssets, expect } from '../../helpers/fixtures';
+import { apiPostChart } from '../../helpers/api/chart';
+import { getDatasetByName } from '../../helpers/api/dataset';
+import { ExplorePage } from '../../pages/ExplorePage';
+import { TIMEOUT } from '../../utils/constants';
+
+const DATASET_NAME = 'birth_names';
+
+testWithAssets(
+  'Handlebars formatDate helper renders a formatted date (#32960)',
+  async ({ page, testAssets }) => {
+    testWithAssets.setTimeout(TIMEOUT.SLOW_TEST);
+
+    const dataset = await getDatasetByName(page, DATASET_NAME);
+    if (!dataset) {
+      throw new Error(`Dataset ${DATASET_NAME} not found`);
+    }
+    const datasetId = dataset.id;
+
+    const params = {
+      datasource: `${datasetId}__table`,
+      viz_type: 'handlebars',
+      query_mode: 'aggregate',
+      groupby: ['ds'],
+      metrics: ['count'],
+      adhoc_filters: [],
+      row_limit: 5,
+      // Note: HTML_SANITIZATION (on by default) strips non-allowlisted
+      // attributes such as `class`, so the rendered markup is plain
+      // <ul>/<li> elements. The assertions below target `li` directly.
+      handlebarsTemplate:
+        '<ul>{{#each data}}' +
+        "<li>{{formatDate 'DD.MM.YYYY' ds}}</li>" +
+        '{{/each}}</ul>',
+      styleTemplate: '',
+    };
+
+    const chartResp = await apiPostChart(page, {
+      slice_name: `handlebars_format_date_${Date.now()}`,
+      viz_type: 'handlebars',
+      datasource_id: datasetId,
+      datasource_type: 'table',
+      params: JSON.stringify(params),
+    });
+    expect(chartResp.ok()).toBe(true);
+    // The chart API may return either a top-level `{ id }` or a wrapped
+    // `{ result: { id } }` shape; handle both and fail explicitly otherwise.
+    const chartBody = await chartResp.json();
+    const chartId: number = chartBody.result?.id ?? chartBody.id;
+    expect(chartId, 'chart creation should return an id').toBeTruthy();
+    testAssets.trackChart(chartId);
+
+    const explorePage = new ExplorePage(page);
+    await explorePage.goto(chartId);
+
+    const panel = explorePage.getChartContainer();
+    await panel.waitFor({ state: 'visible', timeout: TIMEOUT.PAGE_LOAD });
+
+    // The helper error surfaces as a "... is not a function" message rendered
+    // in place of the chart content.
+    await expect(panel).not.toContainText('is not a function', {
+      timeout: TIMEOUT.API_RESPONSE,
+    });
+
+    // At least one list item should contain a DD.MM.YYYY formatted date.
+    await expect(panel.locator('li').first()).toHaveText(/\d{2}\.\d{2}\.\d{4}/, {
+      timeout: TIMEOUT.API_RESPONSE,
+    });
+  },
+);

superset-frontend/playwright/tests/dashboard/gauge-interval-colors.spec.ts

@@ -0,0 +1,202 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * Regression for #28766: a Gauge chart configured with interval bounds and
+ * interval colors (mapped to a categorical color scheme) sometimes renders the
+ * wrong interval colors when first loaded on a dashboard — a refresh fixes it.
+ *
+ * The gauge renders to a <canvas>, so this test reads pixels back from the
+ * rendered gauge and asserts the configured interval colors are present in the
+ * correct mapping. With `color_scheme: supersetColors` and
+ * `interval_color_indices: '1,2'`, the gauge axis must paint the scheme's 1st
+ * and 2nd colors (#1FA8C9 and #454E7C) and must NOT paint the 3rd (#5AC189),
+ * which would indicate a shifted / fallback palette.
+ *
+ * CI green => the gauge paints the configured interval colors on first load;
+ *             merging closes #28766 and guards against regressions.
+ * CI red   => the interval colors are wrong on first load; the bug is live in
+ *             plugin-chart-echarts/src/Gauge (color-scheme resolution).
+ */
+import { testWithAssets, expect } from '../../helpers/fixtures';
+import { apiPostChart, apiPutChart } from '../../helpers/api/chart';
+import { apiPostDashboard } from '../../helpers/api/dashboard';
+import { getDatasetByName } from '../../helpers/api/dataset';
+import { DashboardPage } from '../../pages/DashboardPage';
+
+const DATASET_NAME = 'birth_names';
+
+// supersetColors palette (1-based, matching interval_color_indices):
+// index 1 = #1FA8C9, index 2 = #454E7C, index 3 = #5AC189
+const COLOR_INTERVAL_1: [number, number, number] = [31, 168, 201];
+const COLOR_INTERVAL_2: [number, number, number] = [69, 78, 124];
+const COLOR_UNUSED_3: [number, number, number] = [90, 193, 137];
+
+testWithAssets(
+  'Gauge renders configured interval colors on a dashboard (#28766)',
+  async ({ page, testAssets }) => {
+    const dataset = await getDatasetByName(page, DATASET_NAME);
+    if (!dataset) {
+      throw new Error(`Dataset ${DATASET_NAME} not found`);
+    }
+    const datasetId = dataset.id;
+
+    const sliceName = `gauge_interval_colors_${Date.now()}`;
+    const chartParams = {
+      datasource: `${datasetId}__table`,
+      viz_type: 'gauge_chart',
+      metric: 'count',
+      adhoc_filters: [],
+      row_limit: 10,
+      color_scheme: 'supersetColors',
+      min_val: 0,
+      max_val: 100,
+      start_angle: 225,
+      end_angle: -45,
+      intervals: '50,100',
+      interval_color_indices: '1,2',
+      show_pointer: true,
+      number_format: 'SMART_NUMBER',
+      value_formatter: '{value}',
+    };
+    const chartResp = await apiPostChart(page, {
+      slice_name: sliceName,
+      viz_type: 'gauge_chart',
+      datasource_id: datasetId,
+      datasource_type: 'table',
+      params: JSON.stringify(chartParams),
+    });
+    expect(chartResp.ok()).toBe(true);
+    const chartBody = await chartResp.json();
+    // Normalize: API may return id at top level or inside result.
+    const chartId: number = chartBody.result?.id ?? chartBody.id;
+    if (!chartId) {
+      throw new Error(
+        `Chart creation returned no id. Response: ${JSON.stringify(chartBody)}`,
+      );
+    }
+    testAssets.trackChart(chartId);
+
+    const chartLayoutKey = `CHART-${chartId}`;
+    const positionJson = {
+      DASHBOARD_VERSION_KEY: 'v2',
+      ROOT_ID: { type: 'ROOT', id: 'ROOT_ID', children: ['GRID_ID'] },
+      GRID_ID: {
+        type: 'GRID',
+        id: 'GRID_ID',
+        children: ['ROW-1'],
+        parents: ['ROOT_ID'],
+      },
+      'ROW-1': {
+        type: 'ROW',
+        id: 'ROW-1',
+        children: [chartLayoutKey],
+        parents: ['ROOT_ID', 'GRID_ID'],
+        meta: { background: 'BACKGROUND_TRANSPARENT' },
+      },
+      [chartLayoutKey]: {
+        type: 'CHART',
+        id: chartLayoutKey,
+        children: [],
+        parents: ['ROOT_ID', 'GRID_ID', 'ROW-1'],
+        meta: {
+          chartId,
+          width: 6,
+          height: 60,
+          sliceName,
+        },
+      },
+    };
+    const dashResp = await apiPostDashboard(page, {
+      dashboard_title: `gauge_interval_colors_${Date.now()}`,
+      published: true,
+      position_json: JSON.stringify(positionJson),
+      json_metadata: JSON.stringify({ color_scheme: 'supersetColors' }),
+    });
+    expect(dashResp.ok()).toBe(true);
+    const dashBody = await dashResp.json();
+    const dashboardId: number = dashBody.result?.id ?? dashBody.id;
+    testAssets.trackDashboard(dashboardId);
+
+    await apiPutChart(page, chartId, { dashboards: [dashboardId] });
+
+    const dashboardPage = new DashboardPage(page);
+    await dashboardPage.gotoById(dashboardId);
+    await dashboardPage.waitForLoad();
+    await dashboardPage.waitForChartsToLoad();
+
+    const canvas = page.locator('[data-test="chart-container"] canvas').first();
+    await canvas.waitFor({ state: 'visible', timeout: 30_000 });
+
+    // Read the configured interval colors back from the rendered canvas.
+    // Poll because the gauge paints shortly after the chart container appears.
+    const countColors = () =>
+      canvas.evaluate(
+        (el: HTMLCanvasElement, targets: Array<[number, number, number]>) => {
+          const ctx = el.getContext('2d');
+          if (!ctx) return targets.map(() => 0);
+          const { data } = ctx.getImageData(0, 0, el.width, el.height);
+          const counts = targets.map(() => 0);
+          for (let i = 0; i < data.length; i += 4) {
+            if (data[i + 3] < 200) continue;
+            for (let t = 0; t < targets.length; t += 1) {
+              const [r, g, b] = targets[t];
+              if (
+                Math.abs(data[i] - r) < 12 &&
+                Math.abs(data[i + 1] - g) < 12 &&
+                Math.abs(data[i + 2] - b) < 12
+              ) {
+                counts[t] += 1;
+              }
+            }
+          }
+          return counts;
+        },
+        [COLOR_INTERVAL_1, COLOR_INTERVAL_2, COLOR_UNUSED_3],
+      );
+
+    // Capture the counts inside the poll so the assertions below run against the
+    // exact paint snapshot that satisfied the poll, not a second canvas read.
+    let counts: number[] = [0, 0, 0];
+    await expect
+      .poll(
+        async () => {
+          counts = await countColors();
+          return counts[0];
+        },
+        { timeout: 20_000 },
+      )
+      .toBeGreaterThan(50);
+
+    const [interval1, interval2, unused3] = counts;
+
+    expect(
+      interval1,
+      'Gauge should paint the 1st interval color (#1FA8C9)',
+    ).toBeGreaterThan(50);
+    expect(
+      interval2,
+      'Gauge should paint the 2nd interval color (#454E7C)',
+    ).toBeGreaterThan(50);
+    expect(
+      unused3,
+      'Gauge must not paint the 3rd palette color (#5AC189) — indicates a shifted/fallback palette (#28766)',
+    ).toBe(0);
+  },
+);

superset-frontend/playwright/tests/embedded/pivot-collapse-state.spec.ts

@@ -0,0 +1,309 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * Regression for #33406: in a Pivot Table (v2) with nested rows, collapsing a
+ * row group with the [-] toggle should stay collapsed after the collapsed rows
+ * scroll out of the viewport and back. The bug reproduces specifically when the
+ * dashboard is embedded via an iframe — the collapse/expand state lives in the
+ * pivot renderer's local React state (`collapsedRows` initialised to `{}`), so
+ * anything that remounts the chart resets it and the rows re-expand.
+ *
+ * This spec runs on the embedded harness (the only place the bug is reported to
+ * reproduce). It collapses a top-level row, scrolls the embedded dashboard so
+ * the pivot leaves and re-enters the viewport, and asserts the row is still
+ * collapsed.
+ *
+ * CI green => collapse state survives the scroll round-trip; merging closes
+ *             #33406 and guards against regressions.
+ * CI red   => the rows re-expanded; the bug is live and the fix belongs in
+ *             plugin-chart-pivot-table (lift collapse state out of transient
+ *             component state, e.g. persist `collapsedRows`/`collapsedCols`).
+ *
+ * NOTE: the embedded suite only runs when the embedded SDK bundle is built and
+ * INCLUDE_EMBEDDED=true (CI sets both). It is skipped otherwise.
+ */
+import { test, expect, Browser, BrowserContext, Page } from '@playwright/test';
+import { createServer, IncomingMessage, ServerResponse, Server } from 'http';
+import { AddressInfo, Socket } from 'net';
+import { readFileSync, existsSync } from 'fs';
+import { join } from 'path';
+import {
+  apiEnableEmbedding,
+  getAccessToken,
+  getGuestToken,
+} from '../../helpers/api/embedded';
+import { apiPost, apiPut } from '../../helpers/api/requests';
+import { apiPostDashboard, apiDeleteDashboard } from '../../helpers/api/dashboard';
+import { apiDeleteChart } from '../../helpers/api/chart';
+import { EmbeddedPage } from '../../pages/EmbeddedPage';
+import { EMBEDDED } from '../../utils/constants';
+
+const SUPERSET_DOMAIN = (() => {
+  const url = process.env.PLAYWRIGHT_BASE_URL || 'http://localhost:8088';
+  return url.replace(/\/+$/, '');
+})();
+const SUPERSET_BASE_URL = SUPERSET_DOMAIN.endsWith('/')
+  ? SUPERSET_DOMAIN
+  : `${SUPERSET_DOMAIN}/`;
+
+const SDK_BUNDLE_PATH = join(
+  __dirname,
+  '../../../../superset-embedded-sdk/bundle/index.js',
+);
+const EMBED_APP_DIR = join(__dirname, '../../embedded-app');
+const INDEX_HTML_PATH = join(EMBED_APP_DIR, 'index.html');
+const DATASET_NAME = 'birth_names';
+
+interface EmbedAppServer {
+  server: Server;
+  url: string;
+  close: () => Promise<void>;
+}
+
+async function startEmbedAppServer(): Promise<EmbedAppServer> {
+  const sockets = new Set<Socket>();
+  const server = createServer((req: IncomingMessage, res: ServerResponse) => {
+    const urlPath = req.url?.split('?')[0] || '/';
+    if (urlPath === '/sdk/index.js') {
+      if (!existsSync(SDK_BUNDLE_PATH)) {
+        res.writeHead(404);
+        res.end(
+          'SDK bundle not found. Run: cd superset-embedded-sdk && npm ci && npm run build',
+        );
+        return;
+      }
+      res.writeHead(200, { 'Content-Type': 'text/javascript' });
+      res.end(readFileSync(SDK_BUNDLE_PATH));
+      return;
+    }
+    if (urlPath === '/' || urlPath === '/index.html') {
+      res.writeHead(200, { 'Content-Type': 'text/html' });
+      res.end(readFileSync(INDEX_HTML_PATH));
+      return;
+    }
+    res.writeHead(404);
+    res.end('Not found');
+  });
+  server.on('connection', socket => {
+    sockets.add(socket);
+    socket.once('close', () => sockets.delete(socket));
+  });
+  await new Promise<void>((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', () => {
+      server.removeListener('error', reject);
+      resolve();
+    });
+  });
+  const address = server.address() as AddressInfo;
+  return {
+    server,
+    url: `http://127.0.0.1:${address.port}`,
+    close: () =>
+      new Promise<void>(resolve => {
+        for (const socket of sockets) socket.destroy();
+        sockets.clear();
+        server.close(() => resolve());
+      }),
+  };
+}
+
+function createAdminContext(browser: Browser): Promise<BrowserContext> {
+  return browser.newContext({
+    storageState: 'playwright/.auth/user.json',
+    baseURL: SUPERSET_BASE_URL,
+  });
+}
+
+async function findDatasetIdByName(page: Page, name: string): Promise<number> {
+  const query = `(filters:!((col:table_name,opr:eq,value:'${name}')))`;
+  const resp = await page.request.get(`api/v1/dataset/?q=${query}`);
+  const body = await resp.json();
+  if (!body.result?.length) {
+    throw new Error(`Dataset ${name} not found`);
+  }
+  return body.result[0].id;
+}
+
+test.describe('Embedded Pivot Table collapse state (#33406)', () => {
+  test.describe.configure({ mode: 'serial' });
+  test.setTimeout(90000);
+
+  let appServer: EmbedAppServer;
+  let accessToken: string;
+  let embedUuid: string;
+  let dashboardId: number;
+  let chartId: number;
+
+  test.beforeAll(async ({ browser }) => {
+    test.skip(
+      !existsSync(SDK_BUNDLE_PATH),
+      'Embedded SDK bundle not found. Build it with: cd superset-embedded-sdk && npm ci && npm run build',
+    );
+
+    appServer = await startEmbedAppServer();
+    const context = await createAdminContext(browser);
+    const setupPage = await context.newPage();
+    try {
+      const datasetId = await findDatasetIdByName(setupPage, DATASET_NAME);
+
+      const params = {
+        datasource: `${datasetId}__table`,
+        viz_type: 'pivot_table_v2',
+        groupbyRows: ['state', 'name'],
+        groupbyColumns: [],
+        metrics: ['count'],
+        metricsLayout: 'COLUMNS',
+        aggregateFunction: 'Count',
+        rowSubTotals: true,
+        rowTotals: true,
+        valueFormat: 'SMART_NUMBER',
+        row_limit: 1000,
+        order_desc: true,
+      };
+      const chartResp = await apiPost(setupPage, 'api/v1/chart/', {
+        slice_name: `pivot_collapse_repro_${Date.now()}`,
+        viz_type: 'pivot_table_v2',
+        datasource_id: datasetId,
+        datasource_type: 'table',
+        params: JSON.stringify(params),
+      });
+      chartId = (await chartResp.json()).id;
+
+      const chartLayoutKey = `CHART-${chartId}`;
+      const positionJson = {
+        DASHBOARD_VERSION_KEY: 'v2',
+        ROOT_ID: { type: 'ROOT', id: 'ROOT_ID', children: ['GRID_ID'] },
+        GRID_ID: {
+          type: 'GRID',
+          id: 'GRID_ID',
+          children: ['ROW-1'],
+          parents: ['ROOT_ID'],
+        },
+        'ROW-1': {
+          type: 'ROW',
+          id: 'ROW-1',
+          children: [chartLayoutKey],
+          parents: ['ROOT_ID', 'GRID_ID'],
+          meta: { background: 'BACKGROUND_TRANSPARENT' },
+        },
+        [chartLayoutKey]: {
+          type: 'CHART',
+          id: chartLayoutKey,
+          children: [],
+          parents: ['ROOT_ID', 'GRID_ID', 'ROW-1'],
+          meta: {
+            chartId,
+            width: 6,
+            height: 80,
+            sliceName: 'pivot_collapse_repro',
+          },
+        },
+      };
+      const dashResp = await apiPostDashboard(setupPage, {
+        dashboard_title: `pivot_collapse_repro_${Date.now()}`,
+        published: true,
+        position_json: JSON.stringify(positionJson),
+      });
+      const dashBody = await dashResp.json();
+      dashboardId = dashBody.id;
+      await apiPut(setupPage, `api/v1/chart/${chartId}`, {
+        dashboards: [dashboardId],
+      });
+
+      const embedded = await apiEnableEmbedding(setupPage, dashboardId);
+      embedUuid = embedded.uuid;
+      accessToken = await getAccessToken(setupPage);
+    } finally {
+      await context.close();
+    }
+  });
+
+  test.afterAll(async ({ browser }) => {
+    const context = await createAdminContext(browser);
+    try {
+      const cleanupPage = await context.newPage();
+      if (dashboardId !== undefined) {
+        await apiDeleteDashboard(cleanupPage, dashboardId, {
+          failOnStatusCode: false,
+        });
+      }
+      if (chartId !== undefined) {
+        await apiDeleteChart(cleanupPage, chartId, { failOnStatusCode: false });
+      }
+    } catch (err) {
+      // eslint-disable-next-line no-console
+      console.error('[pivot-collapse teardown] cleanup failed:', err);
+    } finally {
+      await context.close();
+    }
+    if (appServer) await appServer.close();
+  });
+
+  test('collapsed rows stay collapsed after a scroll round-trip', async ({
+    page,
+  }) => {
+    const embeddedPage = new EmbeddedPage(page);
+    await embeddedPage.exposeTokenFetcher(async () =>
+      getGuestToken(page, dashboardId, { accessToken }),
+    );
+    await embeddedPage.goto({
+      appUrl: appServer.url,
+      uuid: embedUuid,
+      supersetDomain: SUPERSET_DOMAIN,
+    });
+    await embeddedPage.waitForIframe();
+    await embeddedPage.waitForDashboardContent();
+    await embeddedPage.waitForChartRendered();
+
+    const rowLabels = embeddedPage.iframe.locator('.pvtRowLabel');
+    await expect
+      .poll(() => rowLabels.count(), { timeout: EMBEDDED.CHART_RENDER })
+      .toBeGreaterThan(1);
+    const expandedCount = await rowLabels.count();
+
+    // Collapse the first top-level row group via its [-] toggle. Scope to
+    // `.pvtTable` so we never match a stray `toggle` class elsewhere in the DOM.
+    await embeddedPage.iframe.locator('.pvtTable .toggle').first().click();
+    await expect
+      .poll(() => embeddedPage.iframe.locator('.pvtRowLabel').count(), {
+        timeout: EMBEDDED.CHART_RENDER,
+      })
+      .toBeLessThan(expandedCount);
+    const collapsedCount = await embeddedPage.iframe
+      .locator('.pvtRowLabel')
+      .count();
+
+    // Scroll the embedded dashboard so the pivot leaves the viewport, then back.
+    await embeddedPage.iframe.locator('body').evaluate(() => {
+      window.scrollTo(0, document.body.scrollHeight);
+    });
+    await page.waitForTimeout(800);
+    await embeddedPage.iframe.locator('body').evaluate(() => {
+      window.scrollTo(0, 0);
+    });
+    await page.waitForTimeout(1200);
+
+    // The collapsed group must remain collapsed (row-label count unchanged).
+    await expect(embeddedPage.iframe.locator('.pvtRowLabel')).toHaveCount(
+      collapsedCount,
+    );
+  });
+});

superset-frontend/plugins/legacy-plugin-chart-country-map/src/CountryMap.ts

@@ -165,6 +165,16 @@ function CountryMap(element: HTMLElement, props: CountryMapProps) {
     return '';
   };
 
+  const updatePopupPosition = () => {
+    const svgHeight = svg.node().getBoundingClientRect().height;
+    const [x, y] = d3.mouse(svg.node());
+    hoverPopup
+      .style('display', 'block')
+      .style('top', `${y + 30}px`)
+      .style('left', `${x}px`)
+      .classed('popup-at-bottom', y > (svgHeight * 2) / 3);
+  };
+
   const mouseenter = function mouseenter(this: SVGPathElement, d: GeoFeature) {
     // Darken color
     let c: string = colorFn(d);
@@ -177,21 +187,14 @@ function CountryMap(element: HTMLElement, props: CountryMapProps) {
       region => region.country_id === d.properties.ISO,
     );
 
-    const position = d3.mouse(svg.node());
-    hoverPopup
-      .style('display', 'block')
-      .style('top', `${position[1] + 30}px`)
-      .style('left', `${position[0]}px`)
-      .html(
-        `<div><strong>${getNameOfRegion(d)}</strong><br>${result.length > 0 ? formatter(result[0].metric) : ''}</div>`,
-      );
+    hoverPopup.style('display', 'block').html(
+      `<div><strong>${getNameOfRegion(d)}</strong><br>${result.length > 0 ? formatter(result[0].metric) : ''}</div>`,
+    );
+    updatePopupPosition();
   };
 
   const mousemove = function mousemove() {
-    const position = d3.mouse(svg.node());
-    hoverPopup
-      .style('top', `${position[1] + 30}px`)
-      .style('left', `${position[0]}px`);
+    updatePopupPosition();
   };
 
   const mouseout = function mouseout(this: SVGPathElement) {

superset-frontend/plugins/legacy-plugin-chart-country-map/src/ReactCountryMap.tsx

@@ -86,5 +86,10 @@ export default styled(CountryMap)`
       cursor: pointer;
       stroke: ${theme.colorSplit};
     }
+
+    .superset-legacy-chart-country-map .hover-popup.popup-at-bottom {
+      transform: translateY(-150%);
+    }
+
   `}
 `;

superset-frontend/plugins/legacy-preset-chart-nvd3/package.json

@@ -34,7 +34,7 @@
     "fast-safe-stringify": "^2.1.1",
     "lodash": "^4.18.1",
     "nvd3-fork": "^2.0.5",
-    "dompurify": "^3.4.7",
+    "dompurify": "^3.4.8",
     "prop-types": "^15.8.1",
     "urijs": "^1.19.11"
   },

superset-frontend/plugins/plugin-chart-echarts/src/Radar/transformProps.ts

@@ -126,7 +126,7 @@ export default function transformProps(
     ...DEFAULT_RADAR_FORM_DATA,
     ...formData,
   };
-  const { setDataMask = () => {}, onContextMenu } = hooks;
+  const { setDataMask = () => {}, onContextMenu } = hooks ?? {};
   const colorFn = CategoricalColorNamespace.getScale(colorScheme as string);
   const numberFormatter = getNumberFormatter(numberFormat);
   const denormalizedSeriesValues: SeriesNormalizedMap = {};
@@ -140,7 +140,7 @@ export default function transformProps(
 
   const metricLabels = metrics.map(getMetricLabel);
 
-  const metricsWithCustomBounds = new Set(
+  const metricsWithCustomBounds = new Set<string>(
     metricLabels.filter(metricLabel => {
       const config = columnConfig?.[metricLabel];
       const hasMax = !!isDefined(config?.radarMetricMaxValue);
@@ -358,6 +358,7 @@ export default function transformProps(
       metricLabels,
       getDenormalizedSeriesValue,
       metricsWithCustomBounds,
+      numberFormatter,
     );
 
   const echartOptions: EChartsCoreOption = {

superset-frontend/plugins/plugin-chart-echarts/src/Radar/utils.ts

@@ -16,6 +16,8 @@
  * specific language governing permissions and limitations
  * under the License.
  */
+import { NumberFormatter } from '@superset-ui/core';
+
 /*
  function for finding the max metric values among all series data for Radar Chart
 */
@@ -47,7 +49,7 @@ interface TooltipParams {
 
 interface TooltipMetricValue {
   metric: string;
-  value: number;
+  value: number | string;
 }
 
 export const renderNormalizedTooltip = (
@@ -55,6 +57,7 @@ export const renderNormalizedTooltip = (
   metrics: string[],
   getDenormalizedValue: (seriesName: string, value: string) => number,
   metricsWithCustomBounds: Set<string>,
+  formatter?: NumberFormatter,
 ): string => {
   const { color, name = '', value: values } = params;
   const seriesName = name || 'series0';
@@ -70,7 +73,7 @@ export const renderNormalizedTooltip = (
 
     return {
       metric,
-      value: originalValue,
+      value: formatter ? formatter(originalValue) : originalValue,
     };
   });
 

superset-frontend/plugins/plugin-chart-echarts/src/utils/tooltip.test.tsx

@@ -0,0 +1,87 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/** @jest-environment jsdom */
+import '@testing-library/jest-dom';
+import React from 'react';
+import { getDefaultTooltip } from './tooltip';
+import type { Refs } from '../types';
+
+test('getDefaultTooltip computes height and sets scroll styles', () => {
+  const div = document.createElement('div');
+  jest.spyOn(div, 'getBoundingClientRect').mockReturnValue({
+    x: 0,
+    y: 0,
+    width: 100,
+    height: 100,
+    top: 0,
+    right: 100,
+    bottom: 100,
+    left: 0,
+    toJSON: () => ({}),
+  } as DOMRect);
+
+  const divRef = React.createRef<HTMLDivElement>();
+  Object.defineProperty(divRef, 'current', { value: div });
+
+  const refs: Refs = { divRef };
+
+  // Set viewport dimensions
+  Object.defineProperty(document.documentElement, 'clientWidth', {
+    value: 1200,
+    configurable: true,
+  });
+  Object.defineProperty(document.documentElement, 'clientHeight', {
+    value: 1000,
+    configurable: true,
+  });
+
+  const tooltip = getDefaultTooltip(refs);
+
+  // Test behavioral properties
+  expect(tooltip.enterable).toBe(true);
+  expect(tooltip.confine).toBe(true);
+  expect(tooltip.hideDelay).toBe(50);
+
+  // Test that position function exists and is callable
+  expect(typeof tooltip.position).toBe('function');
+
+  // Test position function behavior - returns coordinates
+  const tooltipDom = document.createElement('div');
+  const result = tooltip.position(
+    [200, 300],
+    {} as any,
+    tooltipDom,
+    {} as any,
+    { contentSize: [300, 600], viewSize: [1200, 1000] },
+  );
+
+  // Verify the actual computed position, not just its shape. The cursor sits
+  // in the right half of the chart, so the tooltip is placed to its left;
+  // that pushes it past the left edge, so it clamps to the overflow margin.
+  // Vertically it would overflow the top, so it flips to just below the cursor.
+  expect(result).toEqual([5, 310]);
+
+  const computedMaxHeight = parseInt(tooltipDom.style.maxHeight, 10);
+  const viewportHeight = 1000;
+  const expectedMaxHeight = Math.min(800, viewportHeight * 0.8);
+
+  expect(computedMaxHeight).toBe(expectedMaxHeight);
+  expect(tooltipDom).toHaveStyle({ overflow: 'auto' });
+});

superset-frontend/plugins/plugin-chart-echarts/src/utils/tooltip.ts

@@ -34,6 +34,12 @@ export function getDefaultTooltip(refs: Refs) {
     borderColor: 'transparent',
     // CSS hack applied on this class to resolve https://github.com/apache/superset/issues/30058
     className: 'echarts-tooltip',
+    // allow scrolling inside tooltip without re-triggering the chart
+    enterable: true,
+    // keep within viewport and above header; enable internal scroll
+    confine: true,
+    // optional: reduce flicker when moving in/out of tooltip
+    hideDelay: 50,
     position: (
       canvasMousePos: [number, number],
       params: CallbackDataParams,
@@ -41,43 +47,76 @@ export function getDefaultTooltip(refs: Refs) {
       rect: any,
       sizes: { contentSize: [number, number]; viewSize: [number, number] },
     ) => {
-      // algorithm partially based on this snippet:
+      // Algorithm partially based on this snippet:
       // https://github.com/apache/echarts/issues/5004#issuecomment-559668309
 
-      // The chart canvas position
       const divRect = refs.divRef?.current?.getBoundingClientRect();
-
-      // The mouse coordinates relative to the whole window
-      // The first parameter to the position function is the mouse position relative to the canvas
       const mouseX = canvasMousePos[0] + (divRect?.x || 0);
       const mouseY = canvasMousePos[1] + (divRect?.y || 0);
-
-      // The width and height of the tooltip dom element
+      const viewportWidth = document.documentElement.clientWidth;
+      const viewportHeight = document.documentElement.clientHeight;
       const tooltipWidth = sizes.contentSize[0];
       const tooltipHeight = sizes.contentSize[1];
 
-      // Start by placing the tooltip top and right relative to the mouse position
-      let xPos = mouseX + TOOLTIP_POINTER_MARGIN;
-      let yPos = mouseY - TOOLTIP_POINTER_MARGIN - tooltipHeight;
+      // Cap tooltip height to reduce blocking adjacent elements
+      const maxAllowedHeight = Math.min(800, Math.floor(viewportHeight * 0.8));
+      const needsScrolling = tooltipHeight > maxAllowedHeight;
 
-      // The tooltip is overflowing past the right edge of the window
-      if (xPos + tooltipWidth >= document.documentElement.clientWidth) {
-        // Attempt to place the tooltip to the left of the mouse position
-        xPos = mouseX - TOOLTIP_POINTER_MARGIN - tooltipWidth;
-
-        // The tooltip is overflowing past the left edge of the window
-        if (xPos <= 0)
-          // Place the tooltip a fixed distance from the left edge of the window
-          xPos = TOOLTIP_OVERFLOW_MARGIN;
+      if (tooltipDom) {
+        tooltipDom.style.maxHeight = `${maxAllowedHeight}px`;
+        tooltipDom.style.overflow = 'auto';
+        // Only enable pointer events when tooltip is scrollable
+        // This prevents blocking adjacent chart elements when scrolling isn't needed
+        tooltipDom.style.pointerEvents = needsScrolling ? 'auto' : 'none';
       }
 
+      const effectiveTooltipHeight = Math.min(tooltipHeight, maxAllowedHeight);
+      let xPos: number;
+      let yPos: number;
+
+      // For scrollable tooltips, position further away horizontally to avoid blocking chart navigation
+      const horizontalMargin = needsScrolling
+        ? TOOLTIP_POINTER_MARGIN * 3
+        : TOOLTIP_POINTER_MARGIN;
+
+      // Determine if cursor is in the right half of the chart to intelligently position tooltip
+      const chartWidth = divRect?.width || viewportWidth;
+      const cursorXInChart = canvasMousePos[0];
+      const isInRightHalfOfChart = cursorXInChart > chartWidth / 2;
+
+      // Position tooltip on the left when in right half, right when in left half
+      // This prevents blocking chart navigation
+      if (isInRightHalfOfChart) {
+        xPos = mouseX - horizontalMargin - tooltipWidth;
+
+        // If tooltip would go off left edge of viewport, push it back in
+        if (xPos <= 0) {
+          xPos = TOOLTIP_OVERFLOW_MARGIN;
+        }
+      } else {
+        xPos = mouseX + horizontalMargin;
+
+        // If tooltip would go off right edge of viewport, position on left instead
+        if (xPos + tooltipWidth >= viewportWidth) {
+          xPos = mouseX - horizontalMargin - tooltipWidth;
+
+          // If still overflowing left edge, clamp to margin
+          if (xPos <= 0) {
+            xPos = TOOLTIP_OVERFLOW_MARGIN;
+          }
+        }
+      }
+
+      // Position tooltip above cursor, or below if no space
+      yPos = mouseY - TOOLTIP_POINTER_MARGIN - effectiveTooltipHeight;
+
       // The tooltip is overflowing past the top edge of the window
       if (yPos <= 0) {
         // Attempt to place the tooltip to the bottom of the mouse position
         yPos = mouseY + TOOLTIP_POINTER_MARGIN;
 
         // The tooltip is overflowing past the bottom edge of the window
-        if (yPos + tooltipHeight >= document.documentElement.clientHeight)
+        if (yPos + effectiveTooltipHeight >= viewportHeight)
           // Place the tooltip a fixed distance from the top edge of the window
           yPos = TOOLTIP_OVERFLOW_MARGIN;
       }

superset-frontend/plugins/plugin-chart-echarts/test/Pie/transformProps.test.ts

@@ -86,6 +86,49 @@ describe('Pie transformProps', () => {
     );
   });
 
+  test('renders every slice when a NULL group value is mixed with named ones', () => {
+    // Regression guard for https://github.com/apache/superset/issues/33174:
+    // a Pie chart whose groupby dimension contains a NULL/empty value alongside
+    // named values reportedly dropped the named slices (or rendered only the
+    // NULL one). This asserts the transform keeps one slice per row, mapping the
+    // NULL group to the `<NULL>` placeholder and preserving every other slice.
+    const nullMixedChartProps = new ChartProps({
+      formData: {
+        colorScheme: 'bnbColors',
+        datasource: '3__table',
+        granularity_sqla: 'ds',
+        metric: 'sum__num',
+        groupby: ['region'],
+        viz_type: 'pie',
+      } as SqlaFormData,
+      width: 800,
+      height: 600,
+      queriesData: [
+        {
+          data: [
+            { region: '국내', sum__num: 817280006121 },
+            { region: '해외', sum__num: 118777753521 },
+            { region: null, sum__num: 20596314924 },
+          ],
+        },
+      ],
+      theme: supersetTheme,
+    });
+
+    const series = (
+      transformProps(nullMixedChartProps as EchartsPieChartProps).echartOptions
+        .series as PieSeriesOption[]
+    )[0];
+    const data = series.data as PieChartDataItem[];
+
+    // every input row must still produce a slice -- none are dropped
+    expect(data).toHaveLength(3);
+    expect(data.map(d => d.name)).toEqual(['국내', '해외', '<NULL>']);
+    expect(data.map(d => d.value)).toEqual([
+      817280006121, 118777753521, 20596314924,
+    ]);
+  });
+
   test('falls back to scroll for plain legends with overlong labels', () => {
     const longLegendChartProps = new ChartProps({
       formData: {

superset-frontend/plugins/plugin-chart-echarts/test/Radar/utils.test.ts

@@ -0,0 +1,55 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { getNumberFormatter } from '@superset-ui/core';
+import { renderNormalizedTooltip } from '../../src/Radar/utils';
+
+describe('renderNormalizedTooltip', () => {
+  const mockGetDenormalizedValue = jest.fn((_, value) => Number(value));
+  const metrics = ['metric1', 'metric2'];
+  const params = {
+    color: 'red',
+    name: 'series1',
+    value: [100, 200],
+  };
+  const metricsWithCustomBounds = new Set<string>();
+
+  test('should render tooltip with formatted values when formatter is provided', () => {
+    const formatter = getNumberFormatter(',.2f');
+    const tooltip = renderNormalizedTooltip(
+      params,
+      metrics,
+      mockGetDenormalizedValue,
+      metricsWithCustomBounds,
+      formatter,
+    );
+    expect(tooltip).toContain(formatter(100));
+    expect(tooltip).toContain(formatter(200));
+  });
+
+  test('should render tooltip with raw values when formatter is not provided', () => {
+    const tooltip = renderNormalizedTooltip(
+      params,
+      metrics,
+      mockGetDenormalizedValue,
+      metricsWithCustomBounds,
+    );
+    expect(tooltip).toContain('100');
+    expect(tooltip).toContain('200');
+  });
+});

superset-frontend/plugins/plugin-chart-handlebars/src/components/Handlebars/HandlebarsViewer.tsx

@@ -116,3 +116,22 @@ Handlebars.registerHelper('parseJson', (jsonString: string) => {
 
 Helpers.registerHelpers(Handlebars);
 HandlebarsGroupBy.register(Handlebars);
+
+// `just-handlebars-helpers` registers a `formatDate` helper that lazily
+// resolves `moment` via `global.moment` / `require('moment/min/moment-with-locales')`.
+// The bundled viewer switched to dayjs and never satisfies that lookup, so the
+// original helper throws "... is not a function" (see #32960). Re-register a
+// dayjs-backed `formatDate` with the same `{{formatDate formatString date [locale]}}`
+// signature so existing templates keep rendering.
+Handlebars.registerHelper('formatDate', (formatString, date, localeString) => {
+  const format = typeof formatString === 'string' ? formatString : '';
+  const instance = dayjs(date ?? new Date());
+  // Handlebars always passes its options object as the final argument, so a
+  // locale is only present when the caller supplied an explicit string.
+  // Note: `extendedDayjs` only loads the `en` locale, so passing a non-English
+  // locale here quietly falls back to English unless that locale bundle has
+  // been imported elsewhere; dayjs's instance `.locale()` is a no-op otherwise.
+  return typeof localeString === 'string'
+    ? instance.locale(localeString).format(format)
+    : instance.format(format);
+});

superset-frontend/plugins/plugin-chart-handlebars/test/components/formatDateHelper.test.ts

@@ -0,0 +1,70 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import Handlebars from 'handlebars';
+
+// Importing the viewer registers the dayjs-backed `formatDate` override (#32960).
+// The end-to-end behavior (the bundling/minification regression) is covered by a
+// Playwright spec; these unit tests guard the helper's edge cases, which run fine
+// under Jest's Node environment without a browser.
+import '../../src/components/Handlebars/HandlebarsViewer';
+
+// Handlebars passes its options object as the trailing argument, so callers that
+// omit the optional locale still get a non-string final arg. Mimic that here.
+const options = {} as unknown as string;
+
+const formatDate = (
+  format: string,
+  date: unknown,
+  locale: string = options,
+): string =>
+  (Handlebars.helpers.formatDate as (...args: unknown[]) => string)(
+    format,
+    date,
+    locale,
+  );
+
+test('formats a valid date string with the supplied format', () => {
+  expect(formatDate('DD.MM.YYYY', '2024-06-14')).toBe('14.06.2024');
+});
+
+test('renders "Invalid date" for an unparseable date string', () => {
+  expect(formatDate('DD.MM.YYYY', 'not-a-date')).toBe('Invalid date');
+});
+
+test('coerces a non-string format to dayjs default output without throwing', () => {
+  // The helper guards against a non-string format by passing '' to dayjs,
+  // which renders its default ISO 8601 representation rather than throwing.
+  expect(() =>
+    formatDate(undefined as unknown as string, '2024-06-14'),
+  ).not.toThrow();
+  expect(formatDate(undefined as unknown as string, '2024-06-14')).toContain(
+    '2024-06-14',
+  );
+});
+
+test('preserves the epoch-0 timestamp instead of falling back to now', () => {
+  // 1970-01-01 in UTC, which is 1969 or 1970 locally depending on tz offset;
+  // the point is it is NOT coerced to the current date.
+  expect(formatDate('YYYY', 0)).toMatch(/^(1969|1970)$/);
+});
+
+test('silently falls back to English for a locale that is not loaded', () => {
+  // extendedDayjs only loads the `en` locale, so a non-English locale no-ops.
+  expect(formatDate('MMMM', '2024-06-14', 'fr')).toBe('June');
+});

superset-frontend/plugins/plugin-chart-pivot-table/src/react-pivottable/utilities.ts

@@ -92,6 +92,29 @@ const numberFormat = function (optsIn?: NumberFormatOptions): Formatter {
   };
 };
 
+/**
+ * Safely converts any value to a number for aggregation purposes
+ * Handles null/undefined, strings, and non-numeric values
+ */
+function toAggregationNumber(value: unknown): number {
+  if (value == null) return 0;
+  if (typeof value === 'number') {
+    return Number.isNaN(value) ? 0 : value;
+  }
+  if (typeof value === 'string') {
+    const num = parseFloat(value.trim());
+    return Number.isNaN(num) ? 0 : num;
+  }
+  return 0;
+}
+
+type DataFunction = (key: string[], context: never[]) => unknown;
+
+interface GroupNode {
+  auto_agg_sum: number;
+  [childKey: string]: GroupNode | number;
+}
+
 const rx = /(\d+)|(\D+)/g;
 const rd = /\d/;
 const rz = /^0/;
@@ -167,6 +190,125 @@ const naturalSort: SortFunction = (as, bs) => {
   return aArr.length - bArr.length;
 };
 
+/**
+ * Precomputes aggregate sums for all group levels using safe numeric conversion
+ */
+function buildGroupAggregates(
+  keys: string[][],
+  dataFunc: DataFunction,
+): GroupNode {
+  const root: GroupNode = { auto_agg_sum: 0 } as GroupNode;
+
+  const terminalKeys = keys.filter(
+    key =>
+      !keys.some(
+        ancestorKey =>
+          ancestorKey.length > key.length &&
+          key.every((segment, idx) => ancestorKey[idx] === segment),
+      ),
+  );
+  for (const key of terminalKeys) {
+    let current: GroupNode = root;
+
+    for (let i = 0; i < key.length - 1; i += 1) {
+      const segment = key[i];
+
+      if (!current[segment]) {
+        current[segment] = { auto_agg_sum: 0 } as GroupNode;
+      }
+
+      const childNode = current[segment] as GroupNode;
+      childNode.auto_agg_sum += toAggregationNumber(dataFunc(key, []));
+      current = childNode;
+    }
+  }
+
+  return root;
+}
+
+/**
+ * Creates a comparator function for hierarchical keys with subtotal awareness
+ */
+function createHierarchicalComparator(
+  groups: GroupNode,
+  top: boolean | undefined,
+  asc: boolean,
+  dataFunc: DataFunction,
+): (a: string[], b: string[]) => number {
+  const hierarchyMultiplier = top ? 1 : -1;
+  const valueMultiplier = asc ? 1 : -1;
+
+  return (a: string[], b: string[]) => {
+    const minLen = Math.min(a.length, b.length);
+    let currentGroup: GroupNode = groups;
+    let diffIndex = -1;
+
+    for (let i = 0; i < minLen; i += 1) {
+      if (a[i] !== b[i]) {
+        diffIndex = i;
+        break;
+      }
+      currentGroup = currentGroup[a[i]] as GroupNode;
+    }
+
+    if (diffIndex === -1 && a.length !== b.length) {
+      return (a.length < b.length ? -1 : 1) * hierarchyMultiplier;
+    }
+
+    const isLastLevelComparison =
+      diffIndex === -1 ||
+      (diffIndex === a.length - 1 && diffIndex === b.length - 1);
+
+    if (isLastLevelComparison) {
+      const valA = dataFunc(a, []) as string | number | null;
+      const valB = dataFunc(b, []) as string | number | null;
+
+      const result = naturalSort(valA, valB) * valueMultiplier;
+
+      if (result === 0) {
+        const lastA = a[a.length - 1] ?? '';
+        const lastB = b[b.length - 1] ?? '';
+        return lastA.localeCompare(lastB) * valueMultiplier;
+      }
+      return result;
+    }
+
+    const segmentA = a[diffIndex];
+    const segmentB = b[diffIndex];
+
+    const nodeA = currentGroup[segmentA] as GroupNode | undefined;
+    const nodeB = currentGroup[segmentB] as GroupNode | undefined;
+
+    const sumA = nodeA?.auto_agg_sum ?? 0;
+    const sumB = nodeB?.auto_agg_sum ?? 0;
+
+    if (sumA === sumB) {
+      return segmentA.localeCompare(segmentB) * valueMultiplier;
+    }
+    return (sumA > sumB ? 1 : -1) * valueMultiplier;
+  };
+}
+
+/**
+ * @param keys Hierarchical keys to sort ([[row1, row2], [row1, row3], ...])
+ * @param dataFunc Function to retrieve aggregate value (may return string/number/null)
+ * @param top true = subtotals at top/left, false = subtotals at bottom/right
+ * @param asc true = ascending sort, false = descending sort
+ *
+ * @see https://github.com/apache/superset/issues/20564
+ */
+export function groupingValueSort(
+  keys: string[][],
+  dataFunc: DataFunction,
+  top: boolean | undefined,
+  asc: boolean,
+): void {
+  const groups = buildGroupAggregates(keys, dataFunc);
+
+  const comparator = createHierarchicalComparator(groups, top, asc, dataFunc);
+  keys.sort(comparator);
+}
+
 const sortAs = function (order: (string | number)[]): SortFunction {
   const mapping: Record<string | number, number> = {};
 
@@ -897,7 +1039,8 @@ class PivotData {
       this.sorted = true;
       const rows = this.props.rows as string[];
       const cols = this.props.cols as string[];
-      const v = (r: string[], c: string[]) => this.getAggregator(r, c).value();
+      const vr = (r: string[], c: string[]) => this.getAggregator(r, c).value();
+      const vc = (c: string[], r: string[]) => this.getAggregator(r, c).value();
       switch (this.props.rowOrder) {
         case 'key_z_to_a':
           this.rowKeys.sort(
@@ -905,10 +1048,20 @@ class PivotData {
           );
           break;
         case 'value_a_to_z':
-          this.rowKeys.sort((a, b) => naturalSort(v(a, []), v(b, [])));
+          groupingValueSort(
+            this.rowKeys,
+            vr,
+            this.subtotals.rowPartialOnTop,
+            true,
+          );
           break;
         case 'value_z_to_a':
-          this.rowKeys.sort((a, b) => -naturalSort(v(a, []), v(b, [])));
+          groupingValueSort(
+            this.rowKeys,
+            vr,
+            this.subtotals.rowPartialOnTop,
+            false,
+          );
           break;
         default:
           this.rowKeys.sort(this.arrSort(rows, this.subtotals.rowPartialOnTop));
@@ -920,10 +1073,20 @@ class PivotData {
           );
           break;
         case 'value_a_to_z':
-          this.colKeys.sort((a, b) => naturalSort(v([], a), v([], b)));
+          groupingValueSort(
+            this.colKeys,
+            vc,
+            this.subtotals.colPartialOnTop,
+            true,
+          );
           break;
         case 'value_z_to_a':
-          this.colKeys.sort((a, b) => -naturalSort(v([], a), v([], b)));
+          groupingValueSort(
+            this.colKeys,
+            vc,
+            this.subtotals.colPartialOnTop,
+            false,
+          );
           break;
         default:
           this.colKeys.sort(this.arrSort(cols, this.subtotals.colPartialOnTop));