fix: Check python deps CI job

Co-authored-by: Jakub Hrubý <jakub.hruby@orgis.cz>
Co-authored-by: Jezevec <panjzvc@gmail.com>
Co-authored-by: David Kopelent <david.kopelent@saltpay.co>
Co-authored-by: David Kopelent <66686489+davidkopelent@users.noreply.github.com>

.github/dependabot.yml

@@ -37,6 +37,10 @@ updates:
       # `just-handlerbars-helpers` library in plugin-chart-handlebars requires `currencyformatter`` to be < 2
       - dependency-name: "currencyformatter.js"
         update-types: ["version-update:semver-major"]
+      # TODO: remove below clause once https://github.com/pmmmwh/react-refresh-webpack-plugin/pull/940 lands onto a future release
+      # and confirm the issue https://github.com/apache/superset/issues/39600 is fixed
+      - dependency-name: "react-checkbox-tree"
+        update-types: ["version-update:semver-major"]
     groups:
       storybook:
         applies-to: version-updates
@@ -55,15 +59,13 @@ updates:
     versioning-strategy: increase
 
 
-  # NOTE: `uv` support is in beta, more details here:
-  # https://github.com/dependabot/dependabot-core/pull/10040#issuecomment-2696978430
-  - package-ecosystem: "uv"
-    directory: "requirements/"
+  - package-ecosystem: "pip"
+    directory: "/"
     open-pull-requests-limit: 10
     schedule:
       interval: "weekly"
     labels:
-      - uv
+      - pip
       - dependabot
 
   - package-ecosystem: "npm"

.github/labeler.yml

@@ -77,6 +77,11 @@
   - any-glob-to-any-file:
     - 'superset/translations/zh/**'
 
+"i18n:czech":
+- changed-files:
+  - any-glob-to-any-file:
+    - 'superset/translations/cs/**'
+
 "i18n:traditional-chinese":
 - changed-files:
   - any-glob-to-any-file:
@@ -122,6 +127,11 @@
   - any-glob-to-any-file:
     - 'superset/translations/sk/**'
 
+"i18n:latvian":
+- changed-files:
+  - any-glob-to-any-file:
+    - 'superset/translations/lv/**'
+
 "i18n:ukrainian":
 - changed-files:
   - any-glob-to-any-file:

.github/workflows/bashlib.sh

@@ -127,6 +127,20 @@ playwright_testdata() {
   superset load_test_users
   superset load_examples
   superset init
+  # Enable DML on the examples database so Playwright tests can create/drop
+  # temporary tables via SQL Lab without depending on external data sources.
+  superset shell <<'PYEOF'
+import sys
+from superset.extensions import db
+from superset.models.core import Database
+examples_db = db.session.query(Database).filter_by(database_name='examples').first()
+if not examples_db:
+    sys.exit('ERROR: examples database not found. load_examples may have failed.')
+
+examples_db.allow_dml = True
+db.session.commit()
+print('Enabled allow_dml on examples database')
+PYEOF
   say "::endgroup::"
 }
 

.github/workflows/superset-docs-deploy.yml

@@ -70,7 +70,7 @@ jobs:
           yarn install --check-cache
       - name: Download database diagnostics (if triggered by integration tests)
         if: github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success'
-        uses: dawidd6/action-download-artifact@8305c0f1062bb0d184d09ef4493ecb9288447732 # v20
+        uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21
         continue-on-error: true
         with:
           workflow: superset-python-integrationtest.yml
@@ -79,7 +79,7 @@ jobs:
           path: docs/src/data/
       - name: Try to download latest diagnostics (for push/dispatch triggers)
         if: github.event_name != 'workflow_run'
-        uses: dawidd6/action-download-artifact@8305c0f1062bb0d184d09ef4493ecb9288447732 # v20
+        uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21
         continue-on-error: true
         with:
           workflow: superset-python-integrationtest.yml

.github/workflows/superset-docs-verify.yml

@@ -111,7 +111,7 @@ jobs:
         run: |
           yarn install --check-cache
       - name: Download database diagnostics from integration tests
-        uses: dawidd6/action-download-artifact@8305c0f1062bb0d184d09ef4493ecb9288447732 # v20
+        uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21
         with:
           workflow: superset-python-integrationtest.yml
           run_id: ${{ github.event.workflow_run.id }}

Dockerfile

@@ -29,7 +29,7 @@ ARG BUILD_TRANSLATIONS="false"
 ######################################################################
 # superset-node-ci used as a base for building frontend assets and CI
 ######################################################################
-FROM --platform=${BUILDPLATFORM} node:20-trixie-slim AS superset-node-ci
+FROM --platform=${BUILDPLATFORM} node:22-trixie-slim AS superset-node-ci
 ARG BUILD_TRANSLATIONS
 ENV BUILD_TRANSLATIONS=${BUILD_TRANSLATIONS}
 ARG DEV_MODE="false"           # Skip frontend build in dev mode

RESOURCES/INTHEWILD.yaml

@@ -58,6 +58,10 @@ categories:
       url: https://www.ontruck.com/
 
   Financial Services:
+    - name: Aadhar Housing Finance Limited
+      url: https://www.aadharhousing.com
+      contributors: ["@thakerhardiks"]
+
     - name: Aktia Bank plc
       url: https://www.aktia.com
 

docs/admin_docs/configuration/cache.mdx

@@ -138,14 +138,33 @@ THUMBNAIL_CACHE_CONFIG = init_thumbnail_cache
 ```
 
 Using the above example cache keys for dashboards will be `superset_thumb__dashboard__{ID}`. You can
-override the base URL for selenium using:
+override the base URL for Selenium using:
 
 ```
 WEBDRIVER_BASEURL = "https://superset.company.com"
 ```
 
-Additional selenium web drive configuration can be set using `WEBDRIVER_CONFIGURATION`. You can
-implement a custom function to authenticate selenium. The default function uses the `flask-login`
+To control which user account is used for rendering thumbnails and warming up caches, configure
+`THUMBNAIL_EXECUTORS` and `CACHE_WARMUP_EXECUTORS`. Each accepts a list of executor types (which
+resolve to an owner, creator, modifier, or the currently-logged-in user) and/or a `FixedExecutor`
+pinned to a specific username. By default, thumbnails render as the current user
+(`ExecutorType.CURRENT_USER`) and cache warmup runs as the chart/dashboard owner
+(`ExecutorType.OWNER`).
+
+To force both to run as a dedicated service account (`admin` in this example):
+
+```python
+from superset.tasks.types import ExecutorType, FixedExecutor
+
+THUMBNAIL_EXECUTORS = [FixedExecutor("admin")]
+CACHE_WARMUP_EXECUTORS = [FixedExecutor("admin")]
+```
+
+Use a dedicated read-only service account here rather than a personal admin account, so that
+thumbnail rendering and cache warmup tasks don't fail if a specific user's credentials change.
+
+Additional Selenium WebDriver configuration can be set using `WEBDRIVER_CONFIGURATION`. You can
+implement a custom function to authenticate Selenium. The default function uses the `flask-login`
 session cookie. Here's an example of a custom function signature:
 
 ```python
@@ -159,6 +178,20 @@ Then on configuration:
 WEBDRIVER_AUTH_FUNC = auth_driver
 ```
 
+## ETag Support for Thumbnails
+
+Thumbnail and screenshot endpoints return `ETag` response headers based on the cached content digest. Clients can use conditional requests to avoid downloading unchanged images:
+
+```
+GET /api/v1/chart/42/thumbnail/
+If-None-Match: "abc123..."
+
+→ 304 Not Modified  (if unchanged)
+→ 200 OK            (with new image if changed)
+```
+
+This is particularly useful for embedded dashboards and external integrations that periodically poll for updated screenshots — unchanged thumbnails return immediately with no payload.
+
 ## Distributed Coordination Backend
 
 Superset supports an optional distributed coordination (`DISTRIBUTED_COORDINATION_CONFIG`) for

docs/admin_docs/configuration/configuring-superset.mdx

@@ -372,6 +372,26 @@ CUSTOM_SECURITY_MANAGER = CustomSsoSecurityManager
   ]
   ```
 
+### PKCE Support
+
+For public OAuth2 clients that cannot securely store a client secret, enable Proof Key for Code Exchange (PKCE) by adding `code_challenge_method` to the `remote_app` configuration:
+
+```python
+OAUTH_PROVIDERS = [
+    {
+        'name': 'myProvider',
+        'remote_app': {
+            'client_id': 'myClientId',
+            'client_secret': 'mySecret',  # may be empty for pure public clients
+            'code_challenge_method': 'S256',  # enables PKCE
+            'server_metadata_url': 'https://myAuthorizationServer/.well-known/openid-configuration'
+        }
+    }
+]
+```
+
+PKCE (`S256`) is recommended for all OAuth2 flows, even when a client secret is present, as it protects against authorization code interception attacks.
+
 ## LDAP Authentication
 
 FAB supports authenticating user credentials against an LDAP server.

docs/admin_docs/configuration/importing-exporting-datasources.mdx

@@ -30,6 +30,10 @@ Superset's ZIP-based import/export also covers **dashboards**, **charts**, and *
 |  └── ... (more databases)
 ```
 
+:::note
+When you export a database connection, the `masked_encrypted_extra` field (used for sensitive connection parameters such as service account JSON, OAuth tokens, and other encrypted credentials) is included in the export. When importing on another instance, these values are decrypted and re-encrypted using the destination instance's `SECRET_KEY`. Ensure the receiving instance has a valid `SECRET_KEY` configured before importing.
+:::
+
 ## Exporting Datasources to YAML
 
 You can print your current datasources to stdout by running:

docs/admin_docs/configuration/mcp-server.mdx

@@ -501,7 +501,7 @@ All MCP settings go in `superset_config.py`. Defaults are defined in `superset/m
 | `MCP_SERVICE_URL` | `None` | Public base URL for MCP-generated links (set this when behind a reverse proxy) |
 | `MCP_DEBUG` | `False` | Enable debug logging |
 | `MCP_DEV_USERNAME` | -- | Superset username for development mode (no auth) |
-| `MCP_PARSE_REQUEST_ENABLED` | `True` | Pre-parse MCP tool inputs from JSON strings into objects. Set to `False` for clients (Claude Desktop, LangChain) that do not double-serialize arguments — this produces cleaner tool schemas for those clients |
+| `MCP_RBAC_ENABLED` | `True` | Enforce Superset's role-based access control on MCP tool calls. When `True`, each tool checks that the authenticated user has the required FAB permission before executing. Disable only for testing or trusted-network deployments. |
 
 ### Authentication
 
@@ -517,6 +517,7 @@ All MCP settings go in `superset_config.py`. Defaults are defined in `superset/m
 | `MCP_REQUIRED_SCOPES` | `[]` | Required JWT scopes |
 | `MCP_JWT_DEBUG_ERRORS` | `False` | Log detailed JWT errors server-side (never exposed in HTTP responses per RFC 6750) |
 | `MCP_AUTH_FACTORY` | `None` | Custom auth provider factory `(flask_app) -> auth_provider`. Takes precedence over built-in JWT |
+| `MCP_USER_RESOLVER` | `None` | Custom function `(app, access_token) -> username` to extract a Superset username from a validated JWT token. When `None`, the default resolver checks `preferred_username`, `username`, `email`, and `sub` claims in that order. |
 
 ### Response Size Guard
 
@@ -600,6 +601,43 @@ MCP_STORE_CONFIG = {
 | `event_store_max_events` | `100` | Maximum events retained per session |
 | `event_store_ttl` | `3600` | Event TTL in seconds |
 
+### Tool Search
+
+By default the MCP server exposes a lightweight tool-search interface instead of advertising every tool at once. This reduces the initial context sent to the LLM by ~70%, which lowers cost and latency. The AI client discovers tools on demand by calling `search_tools` and then invokes them via `call_tool`.
+
+```python
+MCP_TOOL_SEARCH_CONFIG = {
+    "enabled": True,
+    "strategy": "bm25",        # "bm25" (natural language) or "regex"
+    "max_results": 5,
+    "always_visible": [        # Tools always listed (pinned)
+        "health_check",
+        "get_instance_info",
+    ],
+    "search_tool_name": "search_tools",
+    "call_tool_name": "call_tool",
+    "include_schemas": False,  # False=summary mode (name + parameters_hint)
+    "compact_schemas": True,   # Strip $defs (only applies when include_schemas=True)
+    "max_description_length": 300,
+}
+```
+
+| Key | Default | Description |
+|-----|---------|-------------|
+| `enabled` | `True` | Enable tool search. When `False`, all tools are listed upfront |
+| `strategy` | `"bm25"` | Search ranking algorithm. `"bm25"` supports natural language; `"regex"` supports pattern matching |
+| `max_results` | `5` | Maximum tools returned per search query |
+| `always_visible` | See above | Tools that always appear in `list_tools`, regardless of search |
+| `include_schemas` | `False` | When `False` (default, "summary mode"), search results omit `inputSchema` entirely and include a lightweight `parameters_hint` listing top-level parameter names. Set to `True` to include the full `inputSchema` in search results. Full schemas are always used when a tool is actually invoked via `call_tool`. |
+| `compact_schemas` | `True` | Strip `$defs` / `$ref` and replace with `{"type": "object"}` in search results to reduce token cost. Only takes effect when `include_schemas=True` — ignored in summary mode. |
+| `max_description_length` | `300` | Truncate tool descriptions in search results (0 = no truncation). Applies in both summary and full-schema modes. |
+
+:::tip
+Set `enabled: False` to revert to the traditional "show all tools at once" behavior, which some clients or workflows may prefer.
+:::
+
+Tool search reduces the initial token cost from ~15–20K tokens (full catalog) down to ~4–5K tokens (pinned tools + search interface) — roughly 85% savings at the start of each conversation.
+
 ### Session & CSRF
 
 These values are flat-merged into the Flask app config used by the MCP server process:
@@ -621,6 +659,102 @@ MCP_CSRF_CONFIG = {
 
 ---
 
+## Access Control
+
+### RBAC Enforcement
+
+The MCP server respects Superset's full role-based access control (RBAC). Every authenticated user can only access the data and operations their Superset roles permit — the same rules that apply in the Superset UI apply through MCP.
+
+Each tool declares one or more required FAB permissions. The table below maps tool groups to their permission requirements:
+
+| Tool group | Required FAB permission |
+|------------|------------------------|
+| `list_charts`, `get_chart_info`, `get_chart_data`, `get_chart_preview`, `generate_chart`, `update_chart` | `can_read` on `Chart` (read), `can_write` on `Chart` (mutate) |
+| `list_dashboards`, `get_dashboard_info`, `generate_dashboard`, `add_chart_to_existing_dashboard` | `can_read` on `Dashboard` (read), `can_write` on `Dashboard` (mutate) |
+| `list_datasets`, `get_dataset_info`, `create_virtual_dataset` | `can_read` on `Dataset` (read), `can_write` on `Dataset` (mutate) |
+| `list_databases`, `get_database_info` | `can_read` on `Database` |
+| `execute_sql` | `can_execute_sql_query` on `SQLLab` |
+| `open_sql_lab_with_context` | `can_read` on `SQLLab` |
+| `save_sql_query` | `can_write` on `SavedQuery` |
+| `health_check` | None (public) |
+
+To disable RBAC checking globally (for trusted-network deployments or testing), set:
+
+```python
+# superset_config.py
+MCP_RBAC_ENABLED = False
+```
+
+:::warning
+Disabling RBAC removes all permission checks from MCP tool calls. Only do this on isolated, internal deployments where all MCP users are trusted admins.
+:::
+
+### Audit Log
+
+All MCP tool calls are recorded in Superset's action log. You can view them at **Settings → Action Log** (admin only). Each log entry records:
+
+- The tool name (e.g., `mcp.generate_chart.db_write`)
+- The authenticated user
+- A timestamp
+
+This makes MCP activity fully auditable alongside regular Superset activity. The action log uses the same event logger as the rest of Superset, so existing log ingestion pipelines (e.g., sending logs to Elasticsearch or a SIEM) capture MCP events automatically.
+
+### Middleware Pipeline
+
+Every MCP request passes through a middleware stack before reaching the tool function. The default stack (assembled in `build_middleware_list()` in `server.py`) is:
+
+| Middleware | Purpose | Default |
+|------------|---------|---------|
+| `StructuredContentStripperMiddleware` | Strips `structuredContent` from responses for Claude.ai bridge compatibility | Enabled |
+| `LoggingMiddleware` | Logs each tool call with user, parameters, and duration | Enabled |
+| `GlobalErrorHandlerMiddleware` | Catches unhandled exceptions and sanitizes sensitive data before it reaches the client | Enabled |
+| `ResponseSizeGuardMiddleware` | Estimates token count, warns at 80% of limit, blocks at limit | Enabled (configurable via `MCP_RESPONSE_SIZE_CONFIG`) |
+| `ResponseCachingMiddleware` | Caches read-heavy tool responses (in-memory or Redis) | Disabled (enable via `MCP_CACHE_CONFIG`) |
+
+Additional middleware classes (`RateLimitMiddleware`, `FieldPermissionsMiddleware`, `PrivateToolMiddleware`) are implemented in `superset/mcp_service/middleware.py` but are not added to the default pipeline. They are available for operators who want to layer them in via a custom startup path.
+
+### Error Sanitization
+
+The `GlobalErrorHandlerMiddleware` automatically redacts sensitive information from all error messages before they reach the LLM client. The following are replaced with generic messages:
+
+- **Database connection strings** — replaced with a generic connection error message
+- **API keys and tokens** — redacted from error traces
+- **File system paths** — stripped to prevent information disclosure
+- **IP addresses** — removed from error context
+
+This ensures that a misconfigured database connection or an unexpected exception never leaks credentials or internal topology to the LLM or its users. All regex patterns used for redaction are bounded to prevent ReDoS attacks.
+
+---
+
+## Performance
+
+### Connection Pooling
+
+Each MCP server process maintains its own SQLAlchemy connection pool to the database. For multi-worker deployments, total open connections = **workers × pool size**.
+
+```python
+# superset_config.py
+SQLALCHEMY_POOL_SIZE = 5
+SQLALCHEMY_MAX_OVERFLOW = 10
+SQLALCHEMY_POOL_TIMEOUT = 30
+SQLALCHEMY_POOL_RECYCLE = 3600  # Recycle connections after 1 hour
+```
+
+For a 3-pod Kubernetes deployment with the defaults above, expect up to 3 × (5 + 10) = 45 connections. Size your database's `max_connections` accordingly.
+
+### Response Caching
+
+Enable response caching for read-heavy workloads (dashboards/datasets that don't change frequently). With the in-memory backend (default when `MCP_STORE_CONFIG` is disabled), caching is per-process. Use Redis-backed caching for consistent cache hits across multiple pods:
+
+```python
+MCP_CACHE_CONFIG = {"enabled": True, "call_tool_ttl": 3600}
+MCP_STORE_CONFIG = {"enabled": True, "CACHE_REDIS_URL": "redis://redis:6379/0"}
+```
+
+Mutating tools (`generate_chart`, `update_chart`, `execute_sql`, `generate_dashboard`) are always excluded from caching regardless of this setting.
+
+---
+
 ## Troubleshooting
 
 ### Server won't start

docs/admin_docs/configuration/networking-settings.mdx

@@ -64,7 +64,7 @@ There are two approaches to making dashboards publicly accessible:
 3. Edit each dashboard's properties and add the "Public" role
 4. Only dashboards with the Public role explicitly assigned are visible to anonymous users
 
-See the [Public role documentation](/admin-docs/security/security#public) for more details.
+See the [Public role documentation](/admin-docs/security/#public) for more details.
 
 #### Embedding a Public Dashboard
 
@@ -111,7 +111,7 @@ FEATURE_FLAGS = {
 This flag only hides the logout button when Superset detects it is running inside an iframe. Users accessing Superset directly (not embedded) will still see the logout button regardless of this setting.
 
 :::note
-When embedding with SSO, also set `SESSION_COOKIE_SAMESITE = 'None'` and `SESSION_COOKIE_SECURE = True`. See [Security documentation](/docs/security/securing_superset) for details.
+When embedding with SSO, also set `SESSION_COOKIE_SAMESITE = 'None'` and `SESSION_COOKIE_SECURE = True`. See [Security documentation](/admin-docs/security/securing_superset) for details.
 :::
 
 ## CSRF settings

docs/admin_docs/configuration/theming.mdx

@@ -84,6 +84,35 @@ THEME_DARK = {
 # - OS preference detection is automatically enabled
 ```
 
+### App Branding
+
+The application name shown in the browser title bar and navigation can be
+set via the `brandAppName` theme token:
+
+```python
+THEME_DEFAULT = {
+    "token": {
+        "brandAppName": "Acme Analytics",
+        # ... other tokens
+    }
+}
+```
+
+Or in the theme CRUD UI JSON editor:
+
+```json
+{
+  "token": {
+    "brandAppName": "Acme Analytics"
+  }
+}
+```
+
+The existing `APP_NAME` Python config key continues to work for backward compatibility.
+`brandAppName` takes precedence when both are set, and allows different themes to carry different brand names.
+Email and alert/report notification subjects are driven by backend settings such as
+`EMAIL_REPORTS_SUBJECT_PREFIX` and `APP_NAME`, not by this theme token.
+
 ### Migration from Configuration to UI
 
 When `ENABLE_UI_THEME_ADMINISTRATION = True`:
@@ -312,11 +341,25 @@ Available chart types for `echartsOptionsOverridesByChartType`:
 - `echarts_heatmap` - Heatmaps
 - `echarts_mixed_timeseries` - Mixed time series
 
+### Array Property Overrides
+
+Array properties (such as color palettes) are fully supported in overrides. Arrays are **replaced entirely** rather than merged, so specify the complete array:
+
+```python
+THEME_DEFAULT = {
+    "token": { ... },
+    "echartsOptionsOverrides": {
+        # Replace the default color palette for all ECharts visualizations
+        "color": ["#1f77b4", "#ff7f0e", "#2ca02c", "#d62728", "#9467bd", "#8c564b"]
+    }
+}
+```
+
 ### Best Practices
 
 1. **Start with global overrides** for consistent styling across all charts
 2. **Use chart-specific overrides** for unique requirements per visualization type
-3. **Test thoroughly** as overrides use deep merge - nested objects are combined, but arrays are completely replaced
+3. **Test thoroughly** as overrides use deep merge for objects, but arrays are completely replaced — always specify the full array value
 4. **Document your overrides** to help team members understand custom styling
 5. **Consider performance** - complex overrides may impact chart rendering speed
 

docs/admin_docs/configuration/timezones.mdx

@@ -20,7 +20,7 @@ To help make the problem somewhat tractable—given that Apache Superset has no
 
 To strive for data consistency (regardless of the timezone of the client) the Apache Superset backend tries to ensure that any timestamp sent to the client has an explicit (or semi-explicit as in the case with [Epoch time](https://en.wikipedia.org/wiki/Unix_time) which is always in reference to UTC) timezone encoded within.
 
-The challenge however lies with the slew of [database engines](/admin-docs/databases#installing-drivers-in-docker) which Apache Superset supports and various inconsistencies between their [Python Database API (DB-API)](https://www.python.org/dev/peps/pep-0249/) implementations combined with the fact that we use [Pandas](https://pandas.pydata.org/) to read SQL into a DataFrame prior to serializing to JSON. Regrettably Pandas ignores the DB-API [type_code](https://www.python.org/dev/peps/pep-0249/#type-objects) relying by default on the underlying Python type returned by the DB-API. Currently only a subset of the supported database engines work correctly with Pandas, i.e., ensuring timestamps without an explicit timestamp are serializd to JSON with the server timezone, thus guaranteeing the client will display timestamps in a consistent manner irrespective of the client's timezone.
+The challenge however lies with the slew of [database engines](/user-docs/databases#installing-drivers-in-docker) which Apache Superset supports and various inconsistencies between their [Python Database API (DB-API)](https://www.python.org/dev/peps/pep-0249/) implementations combined with the fact that we use [Pandas](https://pandas.pydata.org/) to read SQL into a DataFrame prior to serializing to JSON. Regrettably Pandas ignores the DB-API [type_code](https://www.python.org/dev/peps/pep-0249/#type-objects) relying by default on the underlying Python type returned by the DB-API. Currently only a subset of the supported database engines work correctly with Pandas, i.e., ensuring timestamps without an explicit timestamp are serialized to JSON with the server timezone, thus guaranteeing the client will display timestamps in a consistent manner irrespective of the client's timezone.
 
 For example the following is a comparison of MySQL and Presto,
 

docs/admin_docs/installation/kubernetes.mdx

@@ -149,7 +149,7 @@ For production clusters it's recommended to build own image with this step done
 Superset requires a Python DB-API database driver and a SQLAlchemy
 dialect to be installed for each datastore you want to connect to.
 
-See [Install Database Drivers](/admin-docs/databases#installing-database-drivers) for more information.
+See [Install Database Drivers](/user-docs/databases#installing-database-drivers) for more information.
 It is recommended that you refer to versions listed in
 [pyproject.toml](https://github.com/apache/superset/blob/master/pyproject.toml)
 instead of hard-coding them in your bootstrap script, as seen below.

docs/admin_docs/security/security.mdx

@@ -52,6 +52,15 @@ only see the objects that they have access to.
 The **sql_lab** role grants access to SQL Lab. Note that while **Admin** users have access
 to all databases by default, both **Alpha** and **Gamma** users need to be given access on a per database basis.
 
+Beyond the base `sql_lab` role, two additional SQL Lab permissions must be explicitly granted for users who need these capabilities:
+
+| Permission | Feature |
+|------------|---------|
+| `can_estimate_query_cost` on `SQLLab` | Estimate query cost before running |
+| `can_format_sql` on `SQLLab` | Format SQL using the database's dialect |
+
+Grant these in **Security → List Roles** by adding the permissions to the relevant role.
+
 ### Public
 
 The **Public** role is the most restrictive built-in role, designed specifically for anonymous/unauthenticated
@@ -182,6 +191,8 @@ However, it is crucial to understand the following:
 
 By combining Superset's configurable safeguards with strong database-level security practices, you can achieve a more robust and layered security posture.
 
+**Dataset Sample Access**: The `get_samples()` endpoint now enforces datasource-level access control. Users can only fetch sample rows from datasets they have been explicitly granted access to — the same permission check applied when running chart queries. This closes a prior gap where unauthenticated or under-privileged access could retrieve sample data.
+
 ### REST API for user & role management
 
 Flask-AppBuilder supports a REST API for user CRUD,
@@ -239,26 +250,143 @@ based on the roles and permissions that were attributed.
 ### Row Level Security
 
 Using Row Level Security filters (under the **Security** menu) you can create filters
-that are assigned to a particular table, as well as a set of roles.
+that are assigned to a particular dataset, as well as a set of roles.
 If you want members of the Finance team to only have access to
 rows where `department = "finance"`, you could:
 
 - Create a Row Level Security filter with that clause (`department = "finance"`)
-- Then assign the clause to the **Finance** role and the table it applies to
+- Then assign the clause to the **Finance** role and the dataset it applies to
 
 The **clause** field, which can contain arbitrary text, is then added to the generated
-SQL statement’s WHERE clause. So you could even do something like create a filter
+SQL statement's WHERE clause. So you could even do something like create a filter
 for the last 30 days and apply it to a specific role, with a clause
 like `date_field > DATE_SUB(NOW(), INTERVAL 30 DAY)`. It can also support
 multiple conditions: `client_id = 6` AND `advertiser="foo"`, etc.
 
-All relevant Row level security filters will be combined together (under the hood,
-the different SQL clauses are combined using AND statements). This means it's
-possible to create a situation where two roles conflict in such a way as to limit a table subset to empty.
+RLS clauses also support **Jinja templating** when `ENABLE_TEMPLATE_PROCESSING` is enabled, so you can write dynamic filters such as
+`user_id = '{{ current_username() }}'` to restrict rows based on the logged-in user.
 
-For example, the filters `client_id=4` and `client_id=5`, applied to a role,
-will result in users of that role having `client_id=4` AND `client_id=5`
-added to their query, which can never be true.
+#### Filter Types
+
+There are two types of RLS filters:
+
+- **Regular** — The filter clause is applied when the querying user belongs to one of the
+  roles assigned to the filter. Use this to restrict what specific roles can see.
+- **Base** — The filter clause is applied to **all** users _except_ those in the assigned
+  roles. Use this to define a default restriction that privileged roles (e.g. Admin) are
+  exempt from. For example, a Base filter with clause `1 = 0` and the Admin role would
+  hide all rows from everyone except Admin — useful as a deny-by-default baseline.
+
+#### Group Keys and Filter Combination
+
+All applicable RLS filters are combined before being added to the query. The combination
+rules are:
+
+- Filters that share the **same group key** are combined with **OR** (any match within
+  the group is sufficient).
+- Different filter groups (different group keys, or no group key) are combined with
+  **AND** (all groups must match).
+- Filters with **no group key** are each treated as their own group and are always AND'd.
+
+For example, if a dataset has three filters:
+
+| Filter | Clause | Group Key |
+|--------|--------|-----------|
+| F1 | `department = 'Finance'` | `department` |
+| F2 | `department = 'Marketing'` | `department` |
+| F3 | `region = 'Europe'` | `region` |
+
+The resulting WHERE clause would be:
+
+```sql
+(department = 'Finance' OR department = 'Marketing') AND (region = 'Europe')
+```
+
+:::caution Conflicting filters
+It is possible to create filters that conflict and produce an empty result set. For
+example, the filters `client_id = 4` and `client_id = 5` **without a shared group key**
+will be AND'd together, producing `client_id = 4 AND client_id = 5`, which can never
+be true.
+
+If you intend for these to be alternatives, assign them the **same group key** so they
+are OR'd instead.
+:::
+
+#### RLS and Virtual (SQL-Based) Datasets
+
+RLS filters are assigned to **datasets**, not to underlying database tables directly. This
+has important implications when working with virtual (SQL-based) datasets:
+
+- **Physical datasets** (backed directly by a table or view) — RLS filters assigned to
+  the dataset are added as WHERE clauses to the query.
+- **Virtual datasets** (defined by a custom SQL query) — RLS filters assigned directly to
+  the virtual dataset are applied to the _outer_ query that wraps the dataset's SQL.
+  Additionally, RLS filters on the **underlying physical datasets** referenced by the
+  virtual dataset's SQL are injected into the inner subquery for each referenced table.
+
+For example, if you have:
+
+1. A physical dataset `orders` with RLS filter `region = 'US'`
+2. A virtual dataset defined as `SELECT * FROM orders WHERE status = 'active'`
+
+A user affected by the RLS filter will effectively see:
+
+```sql
+SELECT * FROM (
+  SELECT * FROM orders WHERE (region = 'US') AND status = 'active'
+) ...
+```
+
+**Key considerations for virtual datasets:**
+
+- You generally do **not** need to duplicate RLS filters on both the physical and virtual
+  dataset — filters on the physical dataset are applied automatically at query time.
+- If you assign an RLS filter directly to a virtual dataset, the clause must reference
+  columns available in the virtual dataset's _output_, not necessarily the underlying
+  table's columns.
+- In **SQL Lab**, RLS is enforced only when the `RLS_IN_SQLLAB` feature flag is enabled:
+  queries run against tables that have associated datasets with RLS filters will then have
+  the appropriate predicates injected automatically.
+
+#### Checking RLS Filters via the API
+
+You can use the RLS REST API to audit which filters are configured and which datasets
+they affect. This requires the `can_read` permission on the `Row Level Security` resource.
+
+**List all RLS rules:**
+
+```
+GET /api/v1/rowlevelsecurity/
+```
+
+**Filter RLS rules for a specific dataset** (using [Rison](https://github.com/Nanonid/rison) query syntax):
+
+```
+GET /api/v1/rowlevelsecurity/?q=(filters:!((col:tables,opr:rel_m_m,value:<dataset_id>)))
+```
+
+**Filter RLS rules by role:**
+
+```
+GET /api/v1/rowlevelsecurity/?q=(filters:!((col:roles,opr:rel_m_m,value:<role_id>)))
+```
+
+**View details of a specific rule** (including clause, assigned datasets, and roles):
+
+```
+GET /api/v1/rowlevelsecurity/<id>
+```
+
+The response includes the filter's `name`, `filter_type` (Regular or Base), `clause`,
+`group_key`, assigned `tables` (with id, schema, and table\_name), and assigned `roles`
+(with id and name).
+
+:::tip Auditing RLS for virtual datasets
+To find all RLS rules that could affect a particular virtual dataset, query the list
+endpoint filtered by that dataset's ID for any directly-assigned rules. Then also check
+the physical datasets referenced in the virtual dataset's SQL, since their RLS filters
+are applied at query time too.
+:::
 
 ### User Sessions
 

docs/developer_docs/api.mdx

@@ -59,7 +59,7 @@ curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
 #### Core Resources
 
 <details>
-<summary><strong>Dashboards</strong> (26 endpoints) — Create, read, update, and delete dashboards.</summary>
+<summary><strong>Dashboards</strong> (28 endpoints) — Create, read, update, and delete dashboards.</summary>
 
 | Method | Endpoint | Description |
 |--------|----------|-------------|
@@ -68,23 +68,25 @@ curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
 | `POST` | [Create a new dashboard](/developer-docs/api/create-a-new-dashboard) | `/api/v1/dashboard/` |
 | `GET` | [Get metadata information about this API resource (dashboard--info)](/developer-docs/api/get-metadata-information-about-this-api-resource-dashboard-info) | `/api/v1/dashboard/_info` |
 | `GET` | [Get a dashboard detail information](/developer-docs/api/get-a-dashboard-detail-information) | `/api/v1/dashboard/{id_or_slug}` |
-| `GET` | [Get a dashboard's chart definitions.](/developer-docs/api/get-a-dashboard-s-chart-definitions) | `/api/v1/dashboard/{id_or_slug}/charts` |
+| `GET` | [Get a dashboard's chart definitions.](/developer-docs/api/get-a-dashboards-chart-definitions) | `/api/v1/dashboard/{id_or_slug}/charts` |
 | `POST` | [Create a copy of an existing dashboard](/developer-docs/api/create-a-copy-of-an-existing-dashboard) | `/api/v1/dashboard/{id_or_slug}/copy/` |
-| `GET` | [Get dashboard's datasets](/developer-docs/api/get-dashboard-s-datasets) | `/api/v1/dashboard/{id_or_slug}/datasets` |
-| `DELETE` | [Delete a dashboard's embedded configuration](/developer-docs/api/delete-a-dashboard-s-embedded-configuration) | `/api/v1/dashboard/{id_or_slug}/embedded` |
-| `GET` | [Get the dashboard's embedded configuration](/developer-docs/api/get-the-dashboard-s-embedded-configuration) | `/api/v1/dashboard/{id_or_slug}/embedded` |
-| `POST` | [Set a dashboard's embedded configuration](/developer-docs/api/set-a-dashboard-s-embedded-configuration) | `/api/v1/dashboard/{id_or_slug}/embedded` |
+| `GET` | [Get dashboard's datasets](/developer-docs/api/get-dashboards-datasets) | `/api/v1/dashboard/{id_or_slug}/datasets` |
+| `DELETE` | [Delete a dashboard's embedded configuration](/developer-docs/api/delete-a-dashboards-embedded-configuration) | `/api/v1/dashboard/{id_or_slug}/embedded` |
+| `GET` | [Get the dashboard's embedded configuration](/developer-docs/api/get-the-dashboards-embedded-configuration) | `/api/v1/dashboard/{id_or_slug}/embedded` |
+| `POST` | [Set a dashboard's embedded configuration](/developer-docs/api/set-a-dashboards-embedded-configuration) | `/api/v1/dashboard/{id_or_slug}/embedded` |
 | `PUT` | [Update dashboard by id_or_slug embedded](/developer-docs/api/update-dashboard-by-id-or-slug-embedded) | `/api/v1/dashboard/{id_or_slug}/embedded` |
-| `GET` | [Get dashboard's tabs](/developer-docs/api/get-dashboard-s-tabs) | `/api/v1/dashboard/{id_or_slug}/tabs` |
+| `GET` | [Get dashboard's tabs](/developer-docs/api/get-dashboards-tabs) | `/api/v1/dashboard/{id_or_slug}/tabs` |
 | `DELETE` | [Delete a dashboard](/developer-docs/api/delete-a-dashboard) | `/api/v1/dashboard/{pk}` |
 | `PUT` | [Update a dashboard](/developer-docs/api/update-a-dashboard) | `/api/v1/dashboard/{pk}` |
 | `POST` | [Compute and cache a screenshot (dashboard-pk-cache-dashboard-screenshot)](/developer-docs/api/compute-and-cache-a-screenshot-dashboard-pk-cache-dashboard-screenshot) | `/api/v1/dashboard/{pk}/cache_dashboard_screenshot/` |
+| `PUT` | [Update chart customizations configuration for a dashboard.](/developer-docs/api/update-chart-customizations-configuration-for-a-dashboard) | `/api/v1/dashboard/{pk}/chart_customizations` |
 | `PUT` | [Update colors configuration for a dashboard.](/developer-docs/api/update-colors-configuration-for-a-dashboard) | `/api/v1/dashboard/{pk}/colors` |
+| `GET` | [Export dashboard as example bundle](/developer-docs/api/export-dashboard-as-example-bundle) | `/api/v1/dashboard/{pk}/export_as_example/` |
 | `DELETE` | [Remove the dashboard from the user favorite list](/developer-docs/api/remove-the-dashboard-from-the-user-favorite-list) | `/api/v1/dashboard/{pk}/favorites/` |
 | `POST` | [Mark the dashboard as favorite for the current user](/developer-docs/api/mark-the-dashboard-as-favorite-for-the-current-user) | `/api/v1/dashboard/{pk}/favorites/` |
 | `PUT` | [Update native filters configuration for a dashboard.](/developer-docs/api/update-native-filters-configuration-for-a-dashboard) | `/api/v1/dashboard/{pk}/filters` |
 | `GET` | [Get a computed screenshot from cache (dashboard-pk-screenshot-digest)](/developer-docs/api/get-a-computed-screenshot-from-cache-dashboard-pk-screenshot-digest) | `/api/v1/dashboard/{pk}/screenshot/{digest}/` |
-| `GET` | [Get dashboard's thumbnail](/developer-docs/api/get-dashboard-s-thumbnail) | `/api/v1/dashboard/{pk}/thumbnail/{digest}/` |
+| `GET` | [Get dashboard's thumbnail](/developer-docs/api/get-dashboards-thumbnail) | `/api/v1/dashboard/{pk}/thumbnail/{digest}/` |
 | `GET` | [Download multiple dashboards as YAML files](/developer-docs/api/download-multiple-dashboards-as-yaml-files) | `/api/v1/dashboard/export/` |
 | `GET` | [Check favorited dashboards for current user](/developer-docs/api/check-favorited-dashboards-for-current-user) | `/api/v1/dashboard/favorite_status/` |
 | `POST` | [Import dashboard(s) with associated charts/datasets/databases](/developer-docs/api/import-dashboard-s-with-associated-charts-datasets-databases) | `/api/v1/dashboard/import/` |
@@ -101,8 +103,8 @@ curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
 | `GET` | [Get a list of charts](/developer-docs/api/get-a-list-of-charts) | `/api/v1/chart/` |
 | `POST` | [Create a new chart](/developer-docs/api/create-a-new-chart) | `/api/v1/chart/` |
 | `GET` | [Get metadata information about this API resource (chart--info)](/developer-docs/api/get-metadata-information-about-this-api-resource-chart-info) | `/api/v1/chart/_info` |
+| `GET` | [Get a chart detail information](/developer-docs/api/get-a-chart-detail-information) | `/api/v1/chart/{id_or_uuid}` |
 | `DELETE` | [Delete a chart](/developer-docs/api/delete-a-chart) | `/api/v1/chart/{pk}` |
-| `GET` | [Get a chart detail information](/developer-docs/api/get-a-chart-detail-information) | `/api/v1/chart/{pk}` |
 | `PUT` | [Update a chart](/developer-docs/api/update-a-chart) | `/api/v1/chart/{pk}` |
 | `GET` | [Compute and cache a screenshot (chart-pk-cache-screenshot)](/developer-docs/api/compute-and-cache-a-screenshot-chart-pk-cache-screenshot) | `/api/v1/chart/{pk}/cache_screenshot/` |
 | `GET` | [Return payload data response for a chart](/developer-docs/api/return-payload-data-response-for-a-chart) | `/api/v1/chart/{pk}/data/` |
@@ -121,7 +123,7 @@ curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
 </details>
 
 <details>
-<summary><strong>Datasets</strong> (18 endpoints) — Manage datasets (tables) used for building charts.</summary>
+<summary><strong>Datasets</strong> (19 endpoints) — Manage datasets (tables) used for building charts.</summary>
 
 | Method | Endpoint | Description |
 |--------|----------|-------------|
@@ -129,13 +131,14 @@ curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
 | `GET` | [Get a list of datasets](/developer-docs/api/get-a-list-of-datasets) | `/api/v1/dataset/` |
 | `POST` | [Create a new dataset](/developer-docs/api/create-a-new-dataset) | `/api/v1/dataset/` |
 | `GET` | [Get metadata information about this API resource (dataset--info)](/developer-docs/api/get-metadata-information-about-this-api-resource-dataset-info) | `/api/v1/dataset/_info` |
+| `GET` | [Get a dataset](/developer-docs/api/get-a-dataset) | `/api/v1/dataset/{id_or_uuid}` |
+| `GET` | [Get charts and dashboards count associated to a dataset](/developer-docs/api/get-charts-and-dashboards-count-associated-to-a-dataset) | `/api/v1/dataset/{id_or_uuid}/related_objects` |
 | `DELETE` | [Delete a dataset](/developer-docs/api/delete-a-dataset) | `/api/v1/dataset/{pk}` |
-| `GET` | [Get a dataset](/developer-docs/api/get-a-dataset) | `/api/v1/dataset/{pk}` |
 | `PUT` | [Update a dataset](/developer-docs/api/update-a-dataset) | `/api/v1/dataset/{pk}` |
 | `DELETE` | [Delete a dataset column](/developer-docs/api/delete-a-dataset-column) | `/api/v1/dataset/{pk}/column/{column_id}` |
+| `GET` | [Get dataset drill info](/developer-docs/api/get-dataset-drill-info) | `/api/v1/dataset/{pk}/drill_info/` |
 | `DELETE` | [Delete a dataset metric](/developer-docs/api/delete-a-dataset-metric) | `/api/v1/dataset/{pk}/metric/{metric_id}` |
 | `PUT` | [Refresh and update columns of a dataset](/developer-docs/api/refresh-and-update-columns-of-a-dataset) | `/api/v1/dataset/{pk}/refresh` |
-| `GET` | [Get charts and dashboards count associated to a dataset](/developer-docs/api/get-charts-and-dashboards-count-associated-to-a-dataset) | `/api/v1/dataset/{pk}/related_objects` |
 | `GET` | [Get distinct values from field data (dataset-distinct-column-name)](/developer-docs/api/get-distinct-values-from-field-data-dataset-distinct-column-name) | `/api/v1/dataset/distinct/{column_name}` |
 | `POST` | [Duplicate a dataset](/developer-docs/api/duplicate-a-dataset) | `/api/v1/dataset/duplicate` |
 | `GET` | [Download multiple datasets as YAML files](/developer-docs/api/download-multiple-datasets-as-yaml-files) | `/api/v1/dataset/export/` |
@@ -147,7 +150,7 @@ curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
 </details>
 
 <details>
-<summary><strong>Database</strong> (31 endpoints) — Manage database connections and metadata.</summary>
+<summary><strong>Database</strong> (30 endpoints) — Manage database connections and metadata.</summary>
 
 | Method | Endpoint | Description |
 |--------|----------|-------------|
@@ -165,7 +168,6 @@ curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
 | `GET` | [Get all schemas from a database](/developer-docs/api/get-all-schemas-from-a-database) | `/api/v1/database/{pk}/schemas/` |
 | `GET` | [Get database select star for table (database-pk-select-star-table-name)](/developer-docs/api/get-database-select-star-for-table-database-pk-select-star-table-name) | `/api/v1/database/{pk}/select_star/{table_name}/` |
 | `GET` | [Get database select star for table (database-pk-select-star-table-name-schema-name)](/developer-docs/api/get-database-select-star-for-table-database-pk-select-star-table-name-schema-name) | `/api/v1/database/{pk}/select_star/{table_name}/{schema_name}/` |
-| `DELETE` | [Delete a SSH tunnel](/developer-docs/api/delete-a-ssh-tunnel) | `/api/v1/database/{pk}/ssh_tunnel/` |
 | `POST` | [Re-sync all permissions for a database connection](/developer-docs/api/re-sync-all-permissions-for-a-database-connection) | `/api/v1/database/{pk}/sync_permissions/` |
 | `GET` | [Get table extra metadata (database-pk-table-extra-table-name-schema-name)](/developer-docs/api/get-table-extra-metadata-database-pk-table-extra-table-name-schema-name) | `/api/v1/database/{pk}/table_extra/{table_name}/{schema_name}/` |
 | `GET` | [Get table metadata](/developer-docs/api/get-table-metadata) | `/api/v1/database/{pk}/table_metadata/` |
@@ -177,7 +179,7 @@ curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
 | `GET` | [Get names of databases currently available](/developer-docs/api/get-names-of-databases-currently-available) | `/api/v1/database/available/` |
 | `GET` | [Download database(s) and associated dataset(s) as a zip file](/developer-docs/api/download-database-s-and-associated-dataset-s-as-a-zip-file) | `/api/v1/database/export/` |
 | `POST` | [Import database(s) with associated datasets](/developer-docs/api/import-database-s-with-associated-datasets) | `/api/v1/database/import/` |
-| `GET` | [Receive personal access tokens from OAuth2](/developer-docs/api/receive-personal-access-tokens-from-oauth2) | `/api/v1/database/oauth2/` |
+| `GET` | [Receive personal access tokens from OAuth2](/developer-docs/api/receive-personal-access-tokens-from-o-auth-2) | `/api/v1/database/oauth2/` |
 | `GET` | [Get related fields data (database-related-column-name)](/developer-docs/api/get-related-fields-data-database-related-column-name) | `/api/v1/database/related/{column_name}` |
 | `POST` | [Test a database connection](/developer-docs/api/test-a-database-connection) | `/api/v1/database/test_connection/` |
 | `POST` | [Upload a file and returns file metadata](/developer-docs/api/upload-a-file-and-returns-file-metadata) | `/api/v1/database/upload_metadata/` |
@@ -197,13 +199,14 @@ curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
 </details>
 
 <details>
-<summary><strong>SQL Lab</strong> (6 endpoints) — Execute SQL queries and manage SQL Lab sessions.</summary>
+<summary><strong>SQL Lab</strong> (7 endpoints) — Execute SQL queries and manage SQL Lab sessions.</summary>
 
 | Method | Endpoint | Description |
 |--------|----------|-------------|
-| `GET` | [Get the bootstrap data for SqlLab page](/developer-docs/api/get-the-bootstrap-data-for-sqllab-page) | `/api/v1/sqllab/` |
+| `GET` | [Get the bootstrap data for SqlLab page](/developer-docs/api/get-the-bootstrap-data-for-sql-lab-page) | `/api/v1/sqllab/` |
 | `POST` | [Estimate the SQL query execution cost](/developer-docs/api/estimate-the-sql-query-execution-cost) | `/api/v1/sqllab/estimate/` |
 | `POST` | [Execute a SQL query](/developer-docs/api/execute-a-sql-query) | `/api/v1/sqllab/execute/` |
+| `POST` | [Export SQL query results to CSV with streaming](/developer-docs/api/export-sql-query-results-to-csv-with-streaming) | `/api/v1/sqllab/export_streaming/` |
 | `GET` | [Export the SQL query results to a CSV](/developer-docs/api/export-the-sql-query-results-to-a-csv) | `/api/v1/sqllab/export/{client_id}/` |
 | `POST` | [Format SQL code](/developer-docs/api/format-sql-code) | `/api/v1/sqllab/format_sql/` |
 | `GET` | [Get the result of a SQL query execution](/developer-docs/api/get-the-result-of-a-sql-query-execution) | `/api/v1/sqllab/results/` |
@@ -236,20 +239,21 @@ curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
 </details>
 
 <details>
-<summary><strong>Datasources</strong> (1 endpoints) — Query datasource metadata and column values.</summary>
+<summary><strong>Datasources</strong> (2 endpoints) — Query datasource metadata and column values.</summary>
 
 | Method | Endpoint | Description |
 |--------|----------|-------------|
 | `GET` | [Get possible values for a datasource column](/developer-docs/api/get-possible-values-for-a-datasource-column) | `/api/v1/datasource/{datasource_type}/{datasource_id}/column/{column_name}/values/` |
+| `POST` | [Validate a SQL expression against a datasource](/developer-docs/api/validate-a-sql-expression-against-a-datasource) | `/api/v1/datasource/{datasource_type}/{datasource_id}/validate_expression/` |
 
 </details>
 
 <details>
-<summary><strong>Advanced Data Type</strong> (2 endpoints) — Endpoints for advanced data type operations and conversions.</summary>
+<summary><strong>Advanced Data Type</strong> (2 endpoints) — Advanced data type operations and conversions.</summary>
 
 | Method | Endpoint | Description |
 |--------|----------|-------------|
-| `GET` | [Return an AdvancedDataTypeResponse](/developer-docs/api/return-an-advanceddatatyperesponse) | `/api/v1/advanced_data_type/convert` |
+| `GET` | [Return an AdvancedDataTypeResponse](/developer-docs/api/return-an-advanced-data-type-response) | `/api/v1/advanced_data_type/convert` |
 | `GET` | [Return a list of available advanced data types](/developer-docs/api/return-a-list-of-available-advanced-data-types) | `/api/v1/advanced_data_type/types` |
 
 </details>
@@ -320,32 +324,32 @@ curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
 #### Sharing & Embedding
 
 <details>
-<summary><strong>Dashboard Permanent Link</strong> (2 endpoints) — Create and retrieve permanent links to dashboard states.</summary>
+<summary><strong>Dashboard Permanent Link</strong> (2 endpoints) — Permanent links to dashboard states.</summary>
 
 | Method | Endpoint | Description |
 |--------|----------|-------------|
-| `POST` | [Create a new dashboard's permanent link](/developer-docs/api/create-a-new-dashboard-s-permanent-link) | `/api/v1/dashboard/{pk}/permalink` |
-| `GET` | [Get dashboard's permanent link state](/developer-docs/api/get-dashboard-s-permanent-link-state) | `/api/v1/dashboard/permalink/{key}` |
+| `POST` | [Create a new dashboard's permanent link](/developer-docs/api/create-a-new-dashboards-permanent-link) | `/api/v1/dashboard/{pk}/permalink` |
+| `GET` | [Get dashboard's permanent link state](/developer-docs/api/get-dashboards-permanent-link-state) | `/api/v1/dashboard/permalink/{key}` |
 
 </details>
 
 <details>
-<summary><strong>Explore Permanent Link</strong> (2 endpoints) — Create and retrieve permanent links to chart explore states.</summary>
+<summary><strong>Explore Permanent Link</strong> (2 endpoints) — Permanent links to chart explore states.</summary>
 
 | Method | Endpoint | Description |
 |--------|----------|-------------|
 | `POST` | [Create a new permanent link (explore-permalink)](/developer-docs/api/create-a-new-permanent-link-explore-permalink) | `/api/v1/explore/permalink` |
-| `GET` | [Get chart's permanent link state](/developer-docs/api/get-chart-s-permanent-link-state) | `/api/v1/explore/permalink/{key}` |
+| `GET` | [Get chart's permanent link state](/developer-docs/api/get-charts-permanent-link-state) | `/api/v1/explore/permalink/{key}` |
 
 </details>
 
 <details>
-<summary><strong>SQL Lab Permanent Link</strong> (2 endpoints) — Create and retrieve permanent links to SQL Lab states.</summary>
+<summary><strong>SQL Lab Permanent Link</strong> (2 endpoints) — Permanent links to SQL Lab states.</summary>
 
 | Method | Endpoint | Description |
 |--------|----------|-------------|
 | `POST` | [Create a new permanent link (sqllab-permalink)](/developer-docs/api/create-a-new-permanent-link-sqllab-permalink) | `/api/v1/sqllab/permalink` |
-| `GET` | [Get permanent link state for SQLLab editor.](/developer-docs/api/get-permanent-link-state-for-sqllab-editor) | `/api/v1/sqllab/permalink/{key}` |
+| `GET` | [Get permanent link state for SQLLab editor.](/developer-docs/api/get-permanent-link-state-for-sql-lab-editor) | `/api/v1/sqllab/permalink/{key}` |
 
 </details>
 
@@ -363,10 +367,10 @@ curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
 
 | Method | Endpoint | Description |
 |--------|----------|-------------|
-| `POST` | [Create a dashboard's filter state](/developer-docs/api/create-a-dashboard-s-filter-state) | `/api/v1/dashboard/{pk}/filter_state` |
-| `DELETE` | [Delete a dashboard's filter state value](/developer-docs/api/delete-a-dashboard-s-filter-state-value) | `/api/v1/dashboard/{pk}/filter_state/{key}` |
-| `GET` | [Get a dashboard's filter state value](/developer-docs/api/get-a-dashboard-s-filter-state-value) | `/api/v1/dashboard/{pk}/filter_state/{key}` |
-| `PUT` | [Update a dashboard's filter state value](/developer-docs/api/update-a-dashboard-s-filter-state-value) | `/api/v1/dashboard/{pk}/filter_state/{key}` |
+| `POST` | [Create a dashboard's filter state](/developer-docs/api/create-a-dashboards-filter-state) | `/api/v1/dashboard/{pk}/filter_state` |
+| `DELETE` | [Delete a dashboard's filter state value](/developer-docs/api/delete-a-dashboards-filter-state-value) | `/api/v1/dashboard/{pk}/filter_state/{key}` |
+| `GET` | [Get a dashboard's filter state value](/developer-docs/api/get-a-dashboards-filter-state-value) | `/api/v1/dashboard/{pk}/filter_state/{key}` |
+| `PUT` | [Update a dashboard's filter state value](/developer-docs/api/update-a-dashboards-filter-state-value) | `/api/v1/dashboard/{pk}/filter_state/{key}` |
 
 </details>
 
@@ -406,16 +410,17 @@ curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
 #### Security & Access Control
 
 <details>
-<summary><strong>Security Roles</strong> (10 endpoints) — Manage security roles and their permissions.</summary>
+<summary><strong>Security Roles</strong> (11 endpoints) — Manage security roles and their permissions.</summary>
 
 | Method | Endpoint | Description |
 |--------|----------|-------------|
 | `GET` | [Get security roles](/developer-docs/api/get-security-roles) | `/api/v1/security/roles/` |
 | `POST` | [Create security roles](/developer-docs/api/create-security-roles) | `/api/v1/security/roles/` |
-| `GET` | [Get security roles info](/developer-docs/api/get-security-roles-info) | `/api/v1/security/roles/_info` |
+| `GET` | [Get security roles  info](/developer-docs/api/get-security-roles-info) | `/api/v1/security/roles/_info` |
 | `DELETE` | [Delete security roles by pk](/developer-docs/api/delete-security-roles-by-pk) | `/api/v1/security/roles/{pk}` |
 | `GET` | [Get security roles by pk](/developer-docs/api/get-security-roles-by-pk) | `/api/v1/security/roles/{pk}` |
 | `PUT` | [Update security roles by pk](/developer-docs/api/update-security-roles-by-pk) | `/api/v1/security/roles/{pk}` |
+| `PUT` | [Update security roles by role_id groups](/developer-docs/api/update-security-roles-by-role-id-groups) | `/api/v1/security/roles/{role_id}/groups` |
 | `POST` | [Create security roles by role_id permissions](/developer-docs/api/create-security-roles-by-role-id-permissions) | `/api/v1/security/roles/{role_id}/permissions` |
 | `GET` | [Get security roles by role_id permissions](/developer-docs/api/get-security-roles-by-role-id-permissions) | `/api/v1/security/roles/{role_id}/permissions/` |
 | `PUT` | [Update security roles by role_id users](/developer-docs/api/update-security-roles-by-role-id-users) | `/api/v1/security/roles/{role_id}/users` |
@@ -430,7 +435,7 @@ curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
 |--------|----------|-------------|
 | `GET` | [Get security users](/developer-docs/api/get-security-users) | `/api/v1/security/users/` |
 | `POST` | [Create security users](/developer-docs/api/create-security-users) | `/api/v1/security/users/` |
-| `GET` | [Get security users info](/developer-docs/api/get-security-users-info) | `/api/v1/security/users/_info` |
+| `GET` | [Get security users  info](/developer-docs/api/get-security-users-info) | `/api/v1/security/users/_info` |
 | `DELETE` | [Delete security users by pk](/developer-docs/api/delete-security-users-by-pk) | `/api/v1/security/users/{pk}` |
 | `GET` | [Get security users by pk](/developer-docs/api/get-security-users-by-pk) | `/api/v1/security/users/{pk}` |
 | `PUT` | [Update security users by pk](/developer-docs/api/update-security-users-by-pk) | `/api/v1/security/users/{pk}` |
@@ -443,7 +448,7 @@ curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
 | Method | Endpoint | Description |
 |--------|----------|-------------|
 | `GET` | [Get security permissions](/developer-docs/api/get-security-permissions) | `/api/v1/security/permissions/` |
-| `GET` | [Get security permissions info](/developer-docs/api/get-security-permissions-info) | `/api/v1/security/permissions/_info` |
+| `GET` | [Get security permissions  info](/developer-docs/api/get-security-permissions-info) | `/api/v1/security/permissions/_info` |
 | `GET` | [Get security permissions by pk](/developer-docs/api/get-security-permissions-by-pk) | `/api/v1/security/permissions/{pk}` |
 
 </details>
@@ -455,7 +460,7 @@ curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
 |--------|----------|-------------|
 | `GET` | [Get security resources](/developer-docs/api/get-security-resources) | `/api/v1/security/resources/` |
 | `POST` | [Create security resources](/developer-docs/api/create-security-resources) | `/api/v1/security/resources/` |
-| `GET` | [Get security resources info](/developer-docs/api/get-security-resources-info) | `/api/v1/security/resources/_info` |
+| `GET` | [Get security resources  info](/developer-docs/api/get-security-resources-info) | `/api/v1/security/resources/_info` |
 | `DELETE` | [Delete security resources by pk](/developer-docs/api/delete-security-resources-by-pk) | `/api/v1/security/resources/{pk}` |
 | `GET` | [Get security resources by pk](/developer-docs/api/get-security-resources-by-pk) | `/api/v1/security/resources/{pk}` |
 | `PUT` | [Update security resources by pk](/developer-docs/api/update-security-resources-by-pk) | `/api/v1/security/resources/{pk}` |
@@ -463,13 +468,13 @@ curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
 </details>
 
 <details>
-<summary><strong>Security Permissions on Resources (View Menus)</strong> (6 endpoints) — Manage permission-resource mappings.</summary>
+<summary><strong>Security Permissions on Resources (View Menus)</strong> (6 endpoints) — Permission-resource mappings.</summary>
 
 | Method | Endpoint | Description |
 |--------|----------|-------------|
 | `GET` | [Get security permissions resources](/developer-docs/api/get-security-permissions-resources) | `/api/v1/security/permissions-resources/` |
 | `POST` | [Create security permissions resources](/developer-docs/api/create-security-permissions-resources) | `/api/v1/security/permissions-resources/` |
-| `GET` | [Get security permissions resources info](/developer-docs/api/get-security-permissions-resources-info) | `/api/v1/security/permissions-resources/_info` |
+| `GET` | [Get security permissions resources  info](/developer-docs/api/get-security-permissions-resources-info) | `/api/v1/security/permissions-resources/_info` |
 | `DELETE` | [Delete security permissions resources by pk](/developer-docs/api/delete-security-permissions-resources-by-pk) | `/api/v1/security/permissions-resources/{pk}` |
 | `GET` | [Get security permissions resources by pk](/developer-docs/api/get-security-permissions-resources-by-pk) | `/api/v1/security/permissions-resources/{pk}` |
 | `PUT` | [Update security permissions resources by pk](/developer-docs/api/update-security-permissions-resources-by-pk) | `/api/v1/security/permissions-resources/{pk}` |
@@ -477,7 +482,7 @@ curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
 </details>
 
 <details>
-<summary><strong>Row Level Security</strong> (8 endpoints) — Manage row-level security rules for data access control.</summary>
+<summary><strong>Row Level Security</strong> (8 endpoints) — Manage row-level security rules for data access.</summary>
 
 | Method | Endpoint | Description |
 |--------|----------|-------------|
@@ -495,7 +500,7 @@ curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
 #### Import/Export & Administration
 
 <details>
-<summary><strong>Import/export</strong> (2 endpoints) — Import and export Superset assets (dashboards, charts, databases).</summary>
+<summary><strong>Import/export</strong> (2 endpoints) — Import and export Superset assets.</summary>
 
 | Method | Endpoint | Description |
 |--------|----------|-------------|
@@ -528,11 +533,12 @@ curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
 #### User & System
 
 <details>
-<summary><strong>Current User</strong> (2 endpoints) — Get information about the currently authenticated user.</summary>
+<summary><strong>Current User</strong> (3 endpoints) — Get information about the authenticated user.</summary>
 
 | Method | Endpoint | Description |
 |--------|----------|-------------|
 | `GET` | [Get the user object](/developer-docs/api/get-the-user-object) | `/api/v1/me/` |
+| `PUT` | [Update the current user](/developer-docs/api/update-the-current-user) | `/api/v1/me/` |
 | `GET` | [Get the user roles](/developer-docs/api/get-the-user-roles) | `/api/v1/me/roles/` |
 
 </details>
@@ -578,7 +584,23 @@ curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
 
 | Method | Endpoint | Description |
 |--------|----------|-------------|
-| `GET` | [Get api by version openapi](/developer-docs/api/get-api-by-version-openapi) | `/api/{version}/_openapi` |
+| `GET` | [Get api by version  openapi](/developer-docs/api/get-api-by-version-openapi) | `/api/{version}/_openapi` |
+
+</details>
+
+#### Other
+
+<details>
+<summary><strong>Security Groups</strong> (6 endpoints) — Endpoints related to Security Groups.</summary>
+
+| Method | Endpoint | Description |
+|--------|----------|-------------|
+| `GET` | [Get security groups](/developer-docs/api/get-security-groups) | `/api/v1/security/groups/` |
+| `POST` | [Create security groups](/developer-docs/api/create-security-groups) | `/api/v1/security/groups/` |
+| `GET` | [Get security groups  info](/developer-docs/api/get-security-groups-info) | `/api/v1/security/groups/_info` |
+| `DELETE` | [Delete security groups by pk](/developer-docs/api/delete-security-groups-by-pk) | `/api/v1/security/groups/{pk}` |
+| `GET` | [Get security groups by pk](/developer-docs/api/get-security-groups-by-pk) | `/api/v1/security/groups/{pk}` |
+| `PUT` | [Update security groups by pk](/developer-docs/api/update-security-groups-by-pk) | `/api/v1/security/groups/{pk}` |
 
 </details>
 
@@ -590,7 +612,7 @@ curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
 | `DELETE` | [Bulk delete themes](/developer-docs/api/bulk-delete-themes) | `/api/v1/theme/` |
 | `GET` | [Get a list of themes](/developer-docs/api/get-a-list-of-themes) | `/api/v1/theme/` |
 | `POST` | [Create a theme](/developer-docs/api/create-a-theme) | `/api/v1/theme/` |
-| `GET` | [Get metadata information about this API resource (theme-info)](/developer-docs/api/get-metadata-information-about-this-api-resource-theme-info) | `/api/v1/theme/_info` |
+| `GET` | [Get metadata information about this API resource (theme--info)](/developer-docs/api/get-metadata-information-about-this-api-resource-theme-info) | `/api/v1/theme/_info` |
 | `DELETE` | [Delete a theme](/developer-docs/api/delete-a-theme) | `/api/v1/theme/{pk}` |
 | `GET` | [Get a theme](/developer-docs/api/get-a-theme) | `/api/v1/theme/{pk}` |
 | `PUT` | [Update a theme](/developer-docs/api/update-a-theme) | `/api/v1/theme/{pk}` |
@@ -604,6 +626,22 @@ curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
 
 </details>
 
+<details>
+<summary><strong>UserRegistrationsRestAPI</strong> (8 endpoints) — Endpoints related to UserRegistrationsRestAPI.</summary>
+
+| Method | Endpoint | Description |
+|--------|----------|-------------|
+| `GET` | [Get security user registrations](/developer-docs/api/get-security-user-registrations) | `/api/v1/security/user_registrations/` |
+| `POST` | [Create security user registrations](/developer-docs/api/create-security-user-registrations) | `/api/v1/security/user_registrations/` |
+| `GET` | [Get security user registrations  info](/developer-docs/api/get-security-user-registrations-info) | `/api/v1/security/user_registrations/_info` |
+| `DELETE` | [Delete security user registrations by pk](/developer-docs/api/delete-security-user-registrations-by-pk) | `/api/v1/security/user_registrations/{pk}` |
+| `GET` | [Get security user registrations by pk](/developer-docs/api/get-security-user-registrations-by-pk) | `/api/v1/security/user_registrations/{pk}` |
+| `PUT` | [Update security user registrations by pk](/developer-docs/api/update-security-user-registrations-by-pk) | `/api/v1/security/user_registrations/{pk}` |
+| `GET` | [Get distinct values from field data (security-user-registrations-distinct-column-name)](/developer-docs/api/get-distinct-values-from-field-data-security-user-registrations-distinct-column-name) | `/api/v1/security/user_registrations/distinct/{column_name}` |
+| `GET` | [Get related fields data (security-user-registrations-related-column-name)](/developer-docs/api/get-related-fields-data-security-user-registrations-related-column-name) | `/api/v1/security/user_registrations/related/{column_name}` |
+
+</details>
+
 ---
 
 ### Additional Resources

docs/developer_docs/components/design-system/dropdowncontainer.mdx

@@ -156,7 +156,7 @@ function SelectFilters() {
 ## Import
 
 ```tsx
-import { DropdownContainer } from '@superset/components';
+import { DropdownContainer } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/design-system/flex.mdx

@@ -186,7 +186,7 @@ function JustifyAlign() {
 ## Import
 
 ```tsx
-import { Flex } from '@superset/components';
+import { Flex } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/design-system/grid.mdx

@@ -181,7 +181,7 @@ function AlignmentDemo() {
 ## Import
 
 ```tsx
-import Grid from '@superset/components';
+import { Grid } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/design-system/layout.mdx

@@ -128,7 +128,7 @@ function RightSidebar() {
 ## Import
 
 ```tsx
-import { Layout } from '@superset/components';
+import { Layout } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/design-system/metadatabar.mdx

@@ -163,7 +163,7 @@ function FullMetadata() {
 ## Import
 
 ```tsx
-import MetadataBar from '@superset/components';
+import { MetadataBar } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/design-system/space.mdx

@@ -157,7 +157,7 @@ function SpaceSizes() {
 ## Import
 
 ```tsx
-import { Space } from '@superset/components';
+import { Space } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/design-system/table.mdx

@@ -300,7 +300,7 @@ function LoadingTable() {
 ## Import
 
 ```tsx
-import { Table } from '@superset/components';
+import { Table } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/index.mdx

@@ -23,7 +23,16 @@ sidebar_position: 0
     under the License.
 -->
 
-# Superset Design System
+import { ComponentIndex } from '@site/src/components/ui-components';
+import componentData from '@site/static/data/components.json';
+
+# UI Components
+
+<ComponentIndex data={componentData} />
+
+---
+
+## Design System
 
 A design system is a complete set of standards intended to manage design at scale using reusable components and patterns.
 
@@ -35,19 +44,6 @@ The Superset Design System uses [Atomic Design](https://bradfrost.com/blog/post/
 
 <img src="/img/atomic-design.png" alt="Atoms = Foundations, Molecules = Components, Organisms = Patterns, Templates = Templates, Pages / Screens = Features" style={{maxWidth: '100%'}} />
 
----
-
-## Component Library
-
-Interactive documentation for Superset's UI component library. **53 components** documented across 2 categories.
-
-### [Core Components](./ui/)
-46 components — Buttons, inputs, modals, selects, and other fundamental UI elements.
-
-### [Layout Components](./design-system/)
-7 components — Grid, Layout, Table, Flex, Space, and container components for page structure.
-
-
 ## Usage
 
 All components are exported from `@superset-ui/core/components`:

docs/developer_docs/components/ui/autocomplete.mdx

@@ -204,7 +204,7 @@ function Demo() {
 ## Import
 
 ```tsx
-import { AutoComplete } from '@superset/components';
+import { AutoComplete } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/avatar.mdx

@@ -129,7 +129,7 @@ function Demo() {
 ## Import
 
 ```tsx
-import { Avatar } from '@superset/components';
+import { Avatar } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/badge.mdx

@@ -149,7 +149,7 @@ function ColorGallery() {
 ## Import
 
 ```tsx
-import { Badge } from '@superset/components';
+import { Badge } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/breadcrumb.mdx

@@ -82,7 +82,7 @@ function Demo() {
 ## Import
 
 ```tsx
-import { Breadcrumb } from '@superset/components';
+import { Breadcrumb } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/button.mdx

@@ -43,7 +43,7 @@ The Button component from Superset's UI library.
 <StoryWithControls
   component="Button"
   props={{
-  buttonStyle: "default",
+  buttonStyle: "primary",
   buttonSize: "default",
   children: "Button!"
 }}
@@ -111,7 +111,7 @@ Edit the code below to experiment with the component:
 function Demo() {
   return (
     <Button
-      buttonStyle="default"
+      buttonStyle="primary"
       buttonSize="default"
     >
       Button!
@@ -124,14 +124,14 @@ function Demo() {
 
 | Prop | Type | Default | Description |
 |------|------|---------|-------------|
-| `buttonStyle` | `string` | `"default"` | The style variant of the button. |
+| `buttonStyle` | `string` | `"primary"` | The style variant of the button. |
 | `buttonSize` | `string` | `"default"` | The size of the button. |
 | `children` | `string` | `"Button!"` | The button text or content. |
 
 ## Import
 
 ```tsx
-import { Button } from '@superset/components';
+import { Button } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/buttongroup.mdx

@@ -77,7 +77,7 @@ function Demo() {
 ## Import
 
 ```tsx
-import { ButtonGroup } from '@superset/components';
+import { ButtonGroup } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/cachedlabel.mdx

@@ -68,7 +68,7 @@ function Demo() {
 ## Import
 
 ```tsx
-import { CachedLabel } from '@superset/components';
+import { CachedLabel } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/card.mdx

@@ -131,7 +131,7 @@ function CardStates() {
 ## Import
 
 ```tsx
-import { Card } from '@superset/components';
+import { Card } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/checkbox.mdx

@@ -130,7 +130,7 @@ function SelectAllDemo() {
 ## Import
 
 ```tsx
-import { Checkbox } from '@superset/components';
+import { Checkbox } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/collapse.mdx

@@ -95,7 +95,7 @@ function Demo() {
 ## Import
 
 ```tsx
-import { Collapse } from '@superset/components';
+import { Collapse } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/datepicker.mdx

@@ -99,7 +99,7 @@ function Demo() {
 ## Import
 
 ```tsx
-import { DatePicker } from '@superset/components';
+import { DatePicker } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/divider.mdx

@@ -133,7 +133,7 @@ function Demo() {
 ## Import
 
 ```tsx
-import { Divider } from '@superset/components';
+import { Divider } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/editabletitle.mdx

@@ -161,7 +161,7 @@ function Demo() {
 ## Import
 
 ```tsx
-import { EditableTitle } from '@superset/components';
+import { EditableTitle } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/emptystate.mdx

@@ -136,7 +136,7 @@ function Demo() {
 ## Import
 
 ```tsx
-import { EmptyState } from '@superset/components';
+import { EmptyState } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/favestar.mdx

@@ -85,7 +85,7 @@ function Demo() {
 ## Import
 
 ```tsx
-import { FaveStar } from '@superset/components';
+import { FaveStar } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/iconbutton.mdx

@@ -95,7 +95,7 @@ function Demo() {
 ## Import
 
 ```tsx
-import { IconButton } from '@superset/components';
+import { IconButton } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/icons.mdx

@@ -241,7 +241,7 @@ function IconWithText() {
 ## Import
 
 ```tsx
-import { Icons } from '@superset/components';
+import { Icons } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/icontooltip.mdx

@@ -89,7 +89,7 @@ function Demo() {
 ## Import
 
 ```tsx
-import { IconTooltip } from '@superset/components';
+import { IconTooltip } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/infotooltip.mdx

@@ -95,7 +95,7 @@ function Demo() {
 ## Import
 
 ```tsx
-import { InfoTooltip } from '@superset/components';
+import { InfoTooltip } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/input.mdx

@@ -151,7 +151,7 @@ function Demo() {
 ## Import
 
 ```tsx
-import { Input } from '@superset/components';
+import { Input } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/label.mdx

@@ -94,7 +94,7 @@ function Demo() {
 ## Import
 
 ```tsx
-import { Label } from '@superset/components';
+import { Label } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/list.mdx

@@ -106,7 +106,7 @@ function Demo() {
 ## Import
 
 ```tsx
-import { List } from '@superset/components';
+import { List } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/listviewcard.mdx

@@ -121,7 +121,7 @@ function Demo() {
 ## Import
 
 ```tsx
-import { ListViewCard } from '@superset/components';
+import { ListViewCard } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/loading.mdx

@@ -176,7 +176,7 @@ function ContextualDemo() {
 ## Import
 
 ```tsx
-import { Loading } from '@superset/components';
+import { Loading } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/menu.mdx

@@ -163,7 +163,7 @@ function MenuWithIcons() {
 ## Import
 
 ```tsx
-import { Menu } from '@superset/components';
+import { Menu } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/modal.mdx

@@ -196,7 +196,7 @@ function ConfirmationDialogs() {
 ## Import
 
 ```tsx
-import { Modal } from '@superset/components';
+import { Modal } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/modaltrigger.mdx

@@ -181,7 +181,7 @@ function DraggableModal() {
 ## Import
 
 ```tsx
-import { ModalTrigger } from '@superset/components';
+import { ModalTrigger } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/popover.mdx

@@ -188,7 +188,7 @@ function RichPopover() {
 ## Import
 
 ```tsx
-import { Popover } from '@superset/components';
+import { Popover } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/progressbar.mdx

@@ -195,7 +195,7 @@ function CustomColors() {
 ## Import
 
 ```tsx
-import { ProgressBar } from '@superset/components';
+import { ProgressBar } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/radio.mdx

@@ -126,7 +126,7 @@ function VerticalDemo() {
 ## Import
 
 ```tsx
-import { Radio } from '@superset/components';
+import { Radio } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/safemarkdown.mdx

@@ -74,7 +74,7 @@ function Demo() {
 ## Import
 
 ```tsx
-import { SafeMarkdown } from '@superset/components';
+import { SafeMarkdown } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/select.mdx

@@ -297,7 +297,7 @@ function OneLineDemo() {
 ## Import
 
 ```tsx
-import { Select } from '@superset/components';
+import { Select } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/skeleton.mdx

@@ -129,7 +129,7 @@ function Demo() {
 ## Import
 
 ```tsx
-import { Skeleton } from '@superset/components';
+import { Skeleton } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/slider.mdx

@@ -242,7 +242,7 @@ function VerticalDemo() {
 ## Import
 
 ```tsx
-import { Slider } from '@superset/components';
+import { Slider } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/steps.mdx

@@ -261,7 +261,7 @@ function DotAndSmall() {
 ## Import
 
 ```tsx
-import { Steps } from '@superset/components';
+import { Steps } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/switch.mdx

@@ -182,7 +182,7 @@ function SettingsPanel() {
 ## Import
 
 ```tsx
-import { Switch } from '@superset/components';
+import { Switch } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/tablecollection.mdx

@@ -52,12 +52,6 @@ function Demo() {
 
 
 
-## Import
-
-```tsx
-import { TableCollection } from '@superset/components';
-```
-
 ---
 
 :::tip[Improve this page]

docs/developer_docs/components/ui/tableview.mdx

@@ -283,7 +283,7 @@ function SortingDemo() {
 ## Import
 
 ```tsx
-import { TableView } from '@superset/components';
+import { TableView } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/tabs.mdx

@@ -212,7 +212,7 @@ function IconTabs() {
 ## Import
 
 ```tsx
-import { Tabs } from '@superset/components';
+import { Tabs } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/timer.mdx

@@ -161,7 +161,7 @@ function StartStop() {
 ## Import
 
 ```tsx
-import { Timer } from '@superset/components';
+import { Timer } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/tooltip.mdx

@@ -160,7 +160,7 @@ function Triggers() {
 ## Import
 
 ```tsx
-import { Tooltip } from '@superset/components';
+import { Tooltip } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/tree.mdx

@@ -257,7 +257,7 @@ function LinesAndIcons() {
 ## Import
 
 ```tsx
-import { Tree } from '@superset/components';
+import { Tree } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/treeselect.mdx

@@ -275,7 +275,7 @@ function TreeLinesDemo() {
 ## Import
 
 ```tsx
-import { TreeSelect } from '@superset/components';
+import { TreeSelect } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/typography.mdx

@@ -225,7 +225,7 @@ function TextStyles() {
 ## Import
 
 ```tsx
-import { Typography } from '@superset/components';
+import { Typography } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/unsavedchangesmodal.mdx

@@ -115,7 +115,7 @@ function CustomTitle() {
 ## Import
 
 ```tsx
-import { UnsavedChangesModal } from '@superset/components';
+import { UnsavedChangesModal } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/components/ui/upload.mdx

@@ -125,7 +125,7 @@ function DragDrop() {
 ## Import
 
 ```tsx
-import { Upload } from '@superset/components';
+import { Upload } from '@superset-ui/core/components';
 ```
 
 ---

docs/developer_docs/contributing/development-setup.md

@@ -485,7 +485,7 @@ Frontend assets (TypeScript, JavaScript, CSS, and images) must be compiled in or
 
 First, be sure you are using the following versions of Node.js and npm:
 
-- `Node.js`: Version 20
+- `Node.js`: Version 22 (LTS)
 - `npm`: Version 10
 
 We recommend using [nvm](https://github.com/nvm-sh/nvm) to manage your node environment:

docs/developer_docs/extensions/overview.md

@@ -43,7 +43,7 @@ Extensions can provide:
 
 ## UI Components for Extensions
 
-Extension developers have access to pre-built UI components via `@apache-superset/core/components`. Browse all available components on the [UI Components](/docs/components/) page and filter by **Extension Compatible** to see components available to extensions.
+Extension developers have access to pre-built UI components via `@apache-superset/core/components`. Browse all available components on the [UI Components](/developer-docs/components/) page and filter by **Extension Compatible** to see components available to extensions.
 
 ## Next Steps
 

docs/docs/using-superset/creating-your-first-dashboard.mdx

@@ -215,7 +215,7 @@ Access to dashboards is managed via owners and permissions. Non-owner access can
 through dataset permissions or dashboard-level roles (using the `DASHBOARD_RBAC` feature flag).
 
 For detailed information on configuring dashboard access, see the
-[Dashboard Access Control](/admin-docs/security/security#dashboard-access-control) section in the
+[Dashboard Access Control](/admin-docs/security/#dashboard-access-control) section in the
 Security documentation.
 
 <img src={useBaseUrl("/img/tutorial/tutorial_dashboard_access.png" )} />
@@ -256,6 +256,34 @@ For example, when running the local development build, the following will disabl
 Top Nav and remove the Filter Bar:
 `http://localhost:8088/superset/dashboard/my-dashboard/?standalone=1&show_filters=0`
 
+### Table Chart Features
+
+The **Table** chart type has several advanced capabilities worth knowing:
+
+#### Conditional Formatting
+
+Conditional formatting rules highlight cells based on their values. Rules can be applied to:
+- **Numeric columns** — color cells above/below a threshold, or use a gradient across a range
+- **String columns** — highlight cells matching specific text values or patterns
+- **Boolean columns** — color cells that are `true` or `false`, or `null`/`not null`
+
+Each rule has a **"Use gradient"** toggle: enabled applies a varying opacity (lighter = further from threshold), disabled applies a solid fill at full opacity regardless of value.
+
+#### HTML Rendering in Table Cells
+
+Table chart cells can render raw HTML, enabling rich formatting such as hyperlinks, colored badges, and icons directly in the data. Enable this per-column in the chart's **Column Configuration** panel by toggling **Render HTML**.
+
+:::caution
+Only enable HTML rendering for columns sourced from data you control. Rendering untrusted HTML can expose users to cross-site scripting (XSS) risks.
+:::
+
+#### Column Header Tooltips
+
+Column headers display a tooltip with the column's **Description** from the dataset editor when the user hovers over them. Keep dataset column descriptions up to date to improve chart discoverability.
+
+#### Display Controls
+
+In dashboard view mode (without entering Edit mode), charts with configurable display options expose a **Display Controls** panel accessible from the chart's context menu. This surfaces controls such as Time Grain, Time Column, and layer visibility for applicable chart types — making it easy to adjust a chart's view without going to Explore.
 ### AG Grid Interactive Table
 
 The **AG Grid Interactive Table** chart type is Superset's fully-featured data grid, suitable for large paginated datasets where the standard Table chart is not enough.
@@ -314,6 +342,26 @@ ECharts option overrides bypass Superset's validation layer. Invalid option keys
 
 When the **Search Box** is visible in a Table chart, the **Download** action exports only the rows currently visible after the search filter is applied — not the full underlying dataset. This matches the visual output and is intentional. To export the full dataset regardless of search state, use the **Download as CSV** option from the chart's three-dot menu in the dashboard or from the Explore chart toolbar before applying a search filter.
 
+### Sharing a Specific Tab
+
+When a dashboard has tabs, each tab gets its own shareable URL. Navigate to the tab you want to share and copy the URL from your browser's address bar — the tab anchor is encoded in the URL so that anyone opening the link lands directly on that tab.
+
+### Auto-Refresh
+
+Dashboards can be configured to refresh automatically at a fixed interval without user interaction. Open a dashboard, click the **⋮** (more options) menu in the top-right, and select **Set auto-refresh interval**. Choose an interval (e.g., every 10 seconds, 1 minute, or 10 minutes). The setting is per-session and resets when you close the tab.
+
+:::note
+Auto-refresh triggers a full data reload for all charts on the dashboard. For dashboards with expensive queries, choose longer intervals to avoid overloading your database.
+:::
+
+### Last Queried Timestamp
+
+Charts can display a "Last queried at" timestamp showing when the chart data was last fetched. This is useful on auto-refreshing dashboards to confirm data freshness. Enable it in **Dashboard Properties → Styling → Show last queried time**.
+
+### Saving a Chart to a Specific Tab
+
+When saving or adding a chart to a dashboard from Explore, you can select which tab it should land on using the tab tree-select dropdown in the "Add to dashboard" modal.
+
 :::resources
 - [Dashboard Customization](https://docs.preset.io/docs/dashboard-customization) - Advanced dashboard styling and layout options
 - [Blog: BI Dashboard Best Practices](https://preset.io/blog/bi-dashboard-best-practices/)

docs/docs/using-superset/embedding.mdx

@@ -1,3 +1,8 @@
+---
+title: Embedding Superset
+sidebar_position: 6
+---
+
 {/*
 Licensed to the Apache Software Foundation (ASF) under one
 or more contributor license agreements.  See the NOTICE file
@@ -17,10 +22,6 @@ specific language governing permissions and limitations
 under the License.
 */}
 
----
-title: Embedding Superset
-sidebar_position: 6
----
 
 # Embedding Superset
 

docs/docs/using-superset/sql-templating.mdx

@@ -33,6 +33,29 @@ SQL templating must be enabled by your administrator via the `ENABLE_TEMPLATE_PR
 For advanced configuration options, see the [SQL Templating Configuration Guide](/admin-docs/configuration/sql-templating).
 :::
 
+## Using Jinja in Calculated Columns
+
+Jinja template macros are available in calculated column expressions in the dataset editor — not just in SQL Lab queries and virtual datasets. This allows column expressions to reference the current user or dynamic context.
+
+**Example: User-scoped calculated column**
+
+```sql
+CASE WHEN sales_rep = '{{ current_username() }}' THEN amount ELSE 0 END
+```
+
+**Example: Conditional display based on role**
+
+Because `current_user_roles()` returns a Python list, test role membership with a Jinja
+conditional at template time rather than matching against the list's string representation:
+
+```sql
+{% if 'Finance' in current_user_roles() %}revenue{% else %}NULL{% endif %} AS finance_revenue
+```
+
+:::note
+The `ENABLE_TEMPLATE_PROCESSING` feature flag must be enabled by your administrator for Jinja in calculated columns to work.
+:::
+
 ## Basic Usage
 
 Jinja templates use double curly braces `{{ }}` for expressions and `{% %}` for logic blocks.
@@ -243,6 +266,7 @@ Using `remove_filter=True` applies the filter in the inner query for better perf
 - Use `|tojson` to serialize arrays as JSON strings
 - Test queries with explicit parameter values before relying on filter context
 - For complex templating needs, ask your administrator about custom Jinja macros
+- **Format SQL is Jinja-aware**: The "Format SQL" button in SQL Lab correctly preserves `{{ }}` and `{% %}` template syntax and applies your selected database's SQL dialect when formatting.
 
 :::resources
 - [Admin Guide: SQL Templating Configuration](/admin-docs/configuration/sql-templating)

docs/docs/using-superset/using-ai-with-superset.mdx

@@ -55,9 +55,10 @@ Ask your AI assistant to browse what's available in your Superset instance:
 
 Describe the visualization you want and AI creates it for you:
 
+- **Preview-first workflow** -- by default AI generates an Explore link so you can review the chart before it is saved. Say "save it" to commit permanently
 - **Create charts from natural language** -- describe what you want to see and AI picks the right chart type, metrics, and dimensions
 - **Preview before saving** -- `generate_chart` defaults to `save_chart=False`, showing the chart in Explore before it's committed. Ask AI to save once you're satisfied.
-- **Modify existing charts** -- `update_chart` also supports preview mode so you can review changes before saving
+- **Modify existing charts** -- `update_chart` also supports preview mode so you can review changes before saving (update filters, change chart types, add metrics)
 - **Get Explore links** -- open any chart in Superset's Explore view for further refinement
 
 **Example prompts:**
@@ -65,6 +66,16 @@ Describe the visualization you want and AI creates it for you:
 > "Update chart 42 to use a line chart instead"
 > "Give me a link to explore this chart further"
 
+:::tip Preview-first workflow
+Charts are **not saved by default**. The workflow is intentionally iterative:
+
+1. **Explore** — AI generates an Explore link so you can see the chart before it exists in Superset
+2. **Iterate** — ask the AI to adjust the chart; changes are previewed without touching the database
+3. **Save** — when you're happy, say "save it" and the chart is permanently stored
+
+To skip the preview and save immediately, include "and save it" in your prompt.
+:::
+
 ### Create Dashboards
 
 Build dashboards from a collection of charts:
@@ -76,16 +87,40 @@ Build dashboards from a collection of charts:
 > "Create a dashboard called 'Q4 Sales Overview' with charts 10, 15, and 22"
 > "Add the revenue trend chart to the executive dashboard"
 
+### Browse Databases
+
+Discover what database connections are configured in your Superset instance:
+
+- **List databases** -- see all database connections you have access to
+- **Get database details** -- name, backend type (PostgreSQL, Snowflake, etc.), and connection status
+
+**Example prompts:**
+> "What databases are connected to Superset?"
+> "Show me details about the data warehouse connection"
+
+### Create Virtual Datasets
+
+Build ad-hoc SQL datasets that can be used as the basis for charts:
+
+- **Create virtual datasets** -- write a SQL query and save it as a reusable dataset
+- **Use immediately in charts** -- the returned dataset ID can be passed directly to chart creation
+
+**Example prompts:**
+> "Create a dataset from: SELECT region, SUM(revenue) as total_revenue FROM orders GROUP BY region"
+> "Make a virtual dataset called 'monthly_signups' from the users table filtered to last 12 months"
+
 ### Run SQL Queries
 
 Execute SQL directly through your AI assistant:
 
 - **Run queries** -- execute SQL with full Superset RBAC enforcement (you can only query data your roles allow)
 - **Open SQL Lab** -- get a link to SQL Lab pre-populated with a query, ready to run and explore
+- **Save queries** -- save a SQL query to SQL Lab's Saved Queries for later reuse
 
 **Example prompts:**
 > "Run this query: SELECT region, SUM(revenue) FROM sales GROUP BY region"
 > "Open SQL Lab with a query to show the top 10 customers by order count"
+> "Save this query as 'Weekly Revenue Report'"
 
 ### Analyze Chart Data
 

docs/docusaurus.config.ts

@@ -178,7 +178,7 @@ if (!versionsConfig.admin_docs.disabled) {
       },
       {
         label: 'Security',
-        to: '/admin-docs/security/security',
+        to: '/admin-docs/security/',
         activeBaseRegex: '^/admin-docs/security/',
       },
     ],
@@ -227,35 +227,28 @@ if (!versionsConfig.developer_docs.disabled && !versionsConfig.developer_docs.hi
   });
 }
 
-// Docusaurus Faster: Rspack bundler, SWC transpilation, and other build
-// optimizations. Only enabled for local development — CI runners (GitHub
-// Actions, Netlify) have ~8GB RAM and these features push memory usage over
-// the limit. See https://docusaurus.io/blog/releases/3.6#docusaurus-faster
-const isCI = process.env.CI === 'true';
 
 const config: Config = {
-  ...(!isCI && {
-    future: {
-      v4: {
-        removeLegacyPostBuildHeadAttribute: true,
-        // Disabled: CSS cascade layers change specificity and cause antd
-        // styles (from Storybook component pages) to override theme styles
-        useCssCascadeLayers: false,
-      },
-      experimental_faster: {
-        swcJsLoader: true,
-        swcJsMinimizer: true,
-        swcHtmlMinimizer: true,
-        lightningCssMinimizer: true,
-        rspackBundler: true,
-        mdxCrossCompilerCache: true,
-        rspackPersistentCache: true,
-        // SSG worker threads spawn parallel Node processes, each consuming
-        // significant memory. Disabled to keep total usage reasonable.
-        ssgWorkerThreads: false,
-      },
+  future: {
+    v4: {
+      removeLegacyPostBuildHeadAttribute: true,
+      // Disabled: CSS cascade layers change specificity and cause antd
+      // styles (from Storybook component pages) to override theme styles
+      useCssCascadeLayers: false,
     },
-  }),
+    faster: {
+      swcJsLoader: false,
+      swcJsMinimizer: true,
+      swcHtmlMinimizer: true,
+      lightningCssMinimizer: true,
+      rspackBundler: true,
+      mdxCrossCompilerCache: true,
+      rspackPersistentCache: true,
+      // SSG worker threads spawn parallel Node processes, each consuming
+      // significant memory. Disabled to keep total usage reasonable.
+      ssgWorkerThreads: false,
+    },
+  },
   title: 'Superset',
   tagline:
     'Apache Superset is a modern data exploration and visualization platform',
@@ -892,10 +885,8 @@ const config: Config = {
           ],
         },
         {
-          href: '/user-docs/',
+          type: 'custom-getStartedSplit',
           position: 'right',
-          className: 'default-button-theme get-started-button',
-          label: 'Get Started',
         },
         {
           href: 'https://github.com/apache/superset',

docs/package.json

@@ -40,7 +40,7 @@
     "version:remove:components": "node scripts/manage-versions.mjs remove components"
   },
   "dependencies": {
-    "@ant-design/icons": "^6.1.1",
+    "@ant-design/icons": "^6.2.2",
     "@docusaurus/core": "^3.10.0",
     "@docusaurus/faster": "^3.10.0",
     "@docusaurus/plugin-client-redirects": "^3.10.0",
@@ -67,10 +67,10 @@
     "@storybook/preview-api": "^8.6.18",
     "@storybook/theming": "^8.6.15",
     "@superset-ui/core": "^0.20.4",
-    "@swc/core": "^1.15.30",
-    "antd": "^6.3.6",
-    "baseline-browser-mapping": "^2.10.21",
-    "caniuse-lite": "^1.0.30001790",
+    "@swc/core": "^1.15.32",
+    "antd": "^6.3.7",
+    "baseline-browser-mapping": "^2.10.24",
+    "caniuse-lite": "^1.0.30001791",
     "docusaurus-plugin-openapi-docs": "^5.0.1",
     "docusaurus-theme-openapi-docs": "^5.0.1",
     "js-yaml": "^4.1.1",
@@ -86,7 +86,7 @@
     "remark-import-partial": "^0.0.2",
     "reselect": "^5.1.1",
     "storybook": "^8.6.18",
-    "swagger-ui-react": "^5.32.4",
+    "swagger-ui-react": "^5.32.5",
     "swc-loader": "^0.2.7",
     "tinycolor2": "^1.4.2",
     "unist-util-visit": "^5.1.0"
@@ -106,7 +106,7 @@
     "globals": "^17.5.0",
     "prettier": "^3.8.3",
     "typescript": "~6.0.3",
-    "typescript-eslint": "^8.59.0",
+    "typescript-eslint": "^8.59.1",
     "webpack": "^5.106.2"
   },
   "browserslist": {

docs/scripts/generate-superset-components.mjs

@@ -185,6 +185,76 @@ const SKIP_STORIES = [
 ];
 
 
+/**
+ * Collect the set of value names exported from a barrel file, following
+ * `export * from './X'` re-exports one level deep. Used to verify that a
+ * component the docs claim is importable is actually re-exported from the
+ * public package entry point.
+ */
+function collectBarrelExports(barrelPath, visited = new Set()) {
+  const exports = new Set();
+  if (!fs.existsSync(barrelPath) || visited.has(barrelPath)) return exports;
+  visited.add(barrelPath);
+
+  const content = fs.readFileSync(barrelPath, 'utf8');
+
+  for (const m of content.matchAll(/export\s+\{([\s\S]*?)\}(?:\s+from\s+['"][^'"]+['"])?/g)) {
+    for (const part of m[1].split(',')) {
+      const cleaned = part.trim().replace(/^type\s+/, '');
+      if (!cleaned) continue;
+      const asMatch = cleaned.match(/(?:^|\s)as\s+([A-Za-z_]\w*)\s*$/);
+      if (asMatch) {
+        exports.add(asMatch[1]);
+      } else {
+        const plain = cleaned.match(/^([A-Za-z_]\w*)\s*$/);
+        if (plain) exports.add(plain[1]);
+      }
+    }
+  }
+
+  for (const m of content.matchAll(
+    /export\s+(?:const|let|var|function|class)\s+([A-Za-z_]\w*)/g
+  )) {
+    exports.add(m[1]);
+  }
+
+  for (const m of content.matchAll(/export\s+\*\s+from\s+['"]([^'"]+)['"]/g)) {
+    const target = m[1];
+    if (!target.startsWith('.')) continue;
+    const baseDir = path.dirname(barrelPath);
+    const candidates = [
+      path.resolve(baseDir, `${target}.ts`),
+      path.resolve(baseDir, `${target}.tsx`),
+      path.resolve(baseDir, target, 'index.ts'),
+      path.resolve(baseDir, target, 'index.tsx'),
+    ];
+    const resolved = candidates.find(p => fs.existsSync(p));
+    if (resolved) {
+      for (const name of collectBarrelExports(resolved, visited)) {
+        exports.add(name);
+      }
+    }
+  }
+
+  return exports;
+}
+
+const SOURCE_PUBLIC_EXPORTS = new Map();
+function getPublicExports(sourceConfig) {
+  if (SOURCE_PUBLIC_EXPORTS.has(sourceConfig)) {
+    return SOURCE_PUBLIC_EXPORTS.get(sourceConfig);
+  }
+  const sourceDir = path.join(FRONTEND_DIR, sourceConfig.path);
+  const candidates = [
+    path.join(sourceDir, 'index.ts'),
+    path.join(sourceDir, 'index.tsx'),
+  ];
+  const barrel = candidates.find(p => fs.existsSync(p));
+  const result = barrel ? collectBarrelExports(barrel) : null;
+  SOURCE_PUBLIC_EXPORTS.set(sourceConfig, result);
+  return result;
+}
+
 /**
  * Recursively find all story files in a directory
  */
@@ -1048,6 +1118,28 @@ function generateMDX(component, storyContent) {
   // Use resolved import path if available, otherwise fall back to source config
   const componentImportPath = resolvedImportPath || sourceConfig.importPrefix;
 
+  // The displayed import in user docs should reflect the public package path,
+  // not the internal storybook alias.
+  const docImportPath = sourceConfig.importPrefix.startsWith('@superset/')
+    ? sourceConfig.docImportPrefix
+    : componentImportPath;
+
+  // When the source uses the internal storybook alias, the public package
+  // re-exports components as named exports (e.g. `export { default as Foo }`),
+  // so users must use named imports even when the story uses a default import.
+  const useDefaultImport =
+    isDefaultExport && !sourceConfig.importPrefix.startsWith('@superset/');
+
+  // Only render the import snippet if the component is actually re-exported
+  // from the public package barrel; otherwise the snippet would mislead users
+  // copy-pasting it (e.g. TableCollection, which has a story but is not
+  // re-exported from `@superset-ui/core/components`).
+  const publicExports = sourceConfig.importPrefix.startsWith('@superset/')
+    ? getPublicExports(sourceConfig)
+    : null;
+  const isPubliclyExported =
+    !publicExports || publicExports.has(componentName);
+
   // Determine component description based on source
   const defaultDesc = sourceConfig.category === 'ui'
     ? `The ${componentName} component from Superset's UI library.`
@@ -1134,13 +1226,13 @@ ${Object.keys(args).length > 0 ? `## Props
 |------|------|---------|-------------|
 ${propsTable}` : ''}
 
-## Import
+${isPubliclyExported ? `## Import
 
 \`\`\`tsx
-${isDefaultExport ? `import ${componentName} from '${componentImportPath}';` : `import { ${componentName} } from '${componentImportPath}';`}
+${useDefaultImport ? `import ${componentName} from '${docImportPath}';` : `import { ${componentName} } from '${docImportPath}';`}
 \`\`\`
 
----
+---` : '---'}
 
 :::tip[Improve this page]
 This documentation is auto-generated from the component's Storybook story.

docs/src/components/GetStartedSplitButton.tsx

@@ -0,0 +1,155 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { DownOutlined } from '@ant-design/icons';
+import Link from '@docusaurus/Link';
+import { Dropdown } from 'antd';
+import type { MenuProps } from 'antd';
+import styled from '@emotion/styled';
+import { mq } from '../utils.js';
+
+const getStartedMenuItems: MenuProps['items'] = [
+  { key: 'users', label: <Link to="/user-docs/">Users</Link> },
+  { key: 'admins', label: <Link to="/admin-docs/">Admins</Link> },
+  { key: 'developers', label: <Link to="/developer-docs/">Developers</Link> },
+];
+
+const Root = styled.div<{ $variant: 'hero' | 'navbar' }>`
+  display: flex;
+  align-items: stretch;
+  border-radius: 10px;
+  overflow: hidden;
+  position: relative;
+  z-index: 2;
+  font-weight: bold;
+
+  ${({ $variant }) =>
+    $variant === 'hero'
+      ? `
+    width: 208px;
+    margin: 15px auto 0;
+    font-size: 20px;
+    ${mq[1]} {
+      font-size: 19px;
+      width: 214px;
+    }
+  `
+      : `
+    width: 176px;
+    margin-right: 20px;
+    font-size: 18px;
+  `}
+
+  .split-main {
+    flex: 1;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    color: #ffffff;
+    text-decoration: none;
+    min-width: 0;
+    ${({ $variant }) =>
+      $variant === 'hero'
+        ? `padding: 10px 10px;`
+        : `padding: 7px 8px;`}
+  }
+
+  .split-main:hover {
+    color: #ffffff;
+  }
+
+  .split-divider {
+    width: 1px;
+    flex-shrink: 0;
+    align-self: stretch;
+    background: rgba(255, 255, 255, 0.38);
+    ${({ $variant }) =>
+      $variant === 'hero'
+        ? `margin: 8px 0;`
+        : `margin: 6px 0;`}
+  }
+
+  .split-dropdown-trigger {
+    flex-shrink: 0;
+    border: none;
+    padding: 0;
+    margin: 0;
+    cursor: pointer;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    background: transparent;
+    color: #ffffff;
+    ${({ $variant }) =>
+      $variant === 'hero'
+        ? `
+      width: 44px;
+      font-size: 11px;
+      ${mq[1]} {
+        width: 46px;
+      }
+    `
+        : `
+      width: 38px;
+      font-size: 10px;
+    `}
+  }
+
+  .split-dropdown-trigger:hover {
+    color: #ffffff;
+  }
+`;
+
+export type GetStartedSplitButtonProps = {
+  variant: 'hero' | 'navbar';
+  /** Classes for the outer control (include default-button-theme get-started-split) */
+  rootClassName: string;
+};
+
+export default function GetStartedSplitButton({
+  variant,
+  rootClassName,
+}: GetStartedSplitButtonProps) {
+  const menuClassName = `get-started-split-dropdown-menu get-started-split-dropdown-menu--${variant}`;
+
+  return (
+    <Root $variant={variant} className={rootClassName}>
+      <Link to="/user-docs/" className="split-main">
+        Get Started
+      </Link>
+      <span className="split-divider" aria-hidden />
+      <Dropdown
+        menu={{
+          items: getStartedMenuItems,
+          className: menuClassName,
+        }}
+        trigger={['click']}
+        placement="bottomRight"
+      >
+        <button
+          type="button"
+          className="split-dropdown-trigger"
+          aria-haspopup="menu"
+          aria-label="Choose documentation: Users, Admins, or Developers"
+        >
+          <DownOutlined />
+        </button>
+      </Dropdown>
+    </Root>
+  );
+}

docs/src/data/databases.json

@@ -1,13 +1,13 @@
 {
-  "generated": "2026-02-24T20:28:17.222Z",
+  "generated": "2026-04-25T02:18:43.905Z",
   "statistics": {
-    "totalDatabases": 72,
-    "withDocumentation": 72,
-    "withConnectionString": 72,
+    "totalDatabases": 73,
+    "withDocumentation": 73,
+    "withConnectionString": 73,
     "withDrivers": 36,
-    "withAuthMethods": 4,
-    "supportsJoins": 68,
-    "supportsSubqueries": 69,
+    "withAuthMethods": 5,
+    "supportsJoins": 69,
+    "supportsSubqueries": 70,
     "supportsDynamicSchema": 15,
     "supportsCatalog": 9,
     "averageScore": 31,
@@ -23,6 +23,7 @@
         "Amazon Athena",
         "Google BigQuery",
         "Databend",
+        "Google Datastore",
         "IBM Db2",
         "Denodo",
         "Dremio",
@@ -177,10 +178,12 @@
       ],
       "Cloud - Google": [
         "Google BigQuery",
+        "Google Datastore",
         "Google Sheets"
       ],
       "Search & NoSQL": [
         "Couchbase",
+        "Google Datastore",
         "Amazon DynamoDB",
         "Elasticsearch",
         "MongoDB",
@@ -751,14 +754,14 @@
           "OPEN_SOURCE"
         ],
         "pypi_packages": [
-          "clickhouse-connect>=0.6.8"
+          "clickhouse-connect>=0.13.0"
         ],
         "connection_string": "clickhousedb://{username}:{password}@{host}:{port}/{database}",
         "default_port": 8123,
         "drivers": [
           {
             "name": "clickhouse-connect (Recommended)",
-            "pypi_package": "clickhouse-connect>=0.6.8",
+            "pypi_package": "clickhouse-connect>=0.13.0",
             "connection_string": "clickhousedb://{username}:{password}@{host}:{port}/{database}",
             "is_recommended": true,
             "notes": "Official ClickHouse Python driver with native protocol support."
@@ -781,7 +784,7 @@
             "connection_string": "clickhousedb://localhost/default"
           }
         ],
-        "install_instructions": "echo \"clickhouse-connect>=0.6.8\" >> ./docker/requirements-local.txt",
+        "install_instructions": "echo \"clickhouse-connect>=0.13.0\" >> ./docker/requirements-local.txt",
         "compatible_databases": [
           {
             "name": "ClickHouse Cloud",
@@ -794,7 +797,7 @@
               "HOSTED_OPEN_SOURCE"
             ],
             "pypi_packages": [
-              "clickhouse-connect>=0.6.8"
+              "clickhouse-connect>=0.13.0"
             ],
             "connection_string": "clickhousedb://{username}:{password}@{host}:8443/{database}?secure=true",
             "parameters": {
@@ -816,7 +819,7 @@
               "HOSTED_OPEN_SOURCE"
             ],
             "pypi_packages": [
-              "clickhouse-connect>=0.6.8"
+              "clickhouse-connect>=0.13.0"
             ],
             "connection_string": "clickhousedb://{username}:{password}@{host}/{database}?secure=true",
             "docs_url": "https://docs.altinity.com/"
@@ -1013,7 +1016,7 @@
       "documentation": {
         "description": "CrateDB is a distributed SQL database for machine data and IoT workloads.",
         "logo": "cratedb.svg",
-        "homepage_url": "https://crate.io/",
+        "homepage_url": "https://cratedb.com",
         "categories": [
           "TIME_SERIES",
           "OPEN_SOURCE"
@@ -1296,6 +1299,114 @@
       "query_cost_estimation": false,
       "sql_validation": false
     },
+    "Google Datastore": {
+      "engine": "google_datastore",
+      "engine_name": "Google Datastore",
+      "module": "datastore",
+      "documentation": {
+        "description": "Google Cloud Datastore is a highly scalable NoSQL database for your applications.",
+        "logo": "datastore.png",
+        "homepage_url": "https://cloud.google.com/datastore/",
+        "categories": [
+          "CLOUD_GCP",
+          "SEARCH_NOSQL",
+          "PROPRIETARY"
+        ],
+        "pypi_packages": [
+          "python-datastore-sqlalchemy"
+        ],
+        "connection_string": "datastore://{project_id}/?database={database_id}",
+        "authentication_methods": [
+          {
+            "name": "Service Account JSON",
+            "description": "Upload service account credentials JSON or paste in Secure Extra",
+            "secure_extra": {
+              "credentials_info": {
+                "type": "service_account",
+                "project_id": "...",
+                "private_key_id": "...",
+                "private_key": "...",
+                "client_email": "...",
+                "client_id": "...",
+                "auth_uri": "...",
+                "token_uri": "..."
+              }
+            }
+          }
+        ],
+        "notes": "Create a Service Account via GCP console with access to datastore datasets.",
+        "docs_url": "https://github.com/splasky/Python-datastore-sqlalchemy",
+        "custom_errors": [
+          {
+            "regex_name": "CONNECTION_DATABASE_PERMISSIONS_REGEX",
+            "message_template": "Unable to connect. Verify that the following roles are set on the service account: \"Cloud Datastore Viewer\", \"Cloud Datastore User\", \"Cloud Datastore Creator\"",
+            "error_type": "CONNECTION_DATABASE_PERMISSIONS_ERROR",
+            "category": "Permissions",
+            "description": "Insufficient permissions",
+            "issue_codes": [
+              1017
+            ]
+          },
+          {
+            "regex_name": "TABLE_DOES_NOT_EXIST_REGEX",
+            "message_template": "The table \"%(table)s\" does not exist. A valid table must be used to run this query.",
+            "error_type": "TABLE_DOES_NOT_EXIST_ERROR",
+            "category": "Query",
+            "description": "Table not found",
+            "issue_codes": [
+              1003,
+              1005
+            ]
+          },
+          {
+            "regex_name": "COLUMN_DOES_NOT_EXIST_REGEX",
+            "message_template": "We can't seem to resolve column \"%(column)s\" at line %(location)s.",
+            "error_type": "COLUMN_DOES_NOT_EXIST_ERROR",
+            "category": "Query",
+            "description": "Column not found",
+            "issue_codes": [
+              1003,
+              1004
+            ]
+          },
+          {
+            "regex_name": "SCHEMA_DOES_NOT_EXIST_REGEX",
+            "message_template": "The schema \"%(schema)s\" does not exist. A valid schema must be used to run this query.",
+            "error_type": "SCHEMA_DOES_NOT_EXIST_ERROR",
+            "category": "Query",
+            "description": "Schema not found",
+            "issue_codes": [
+              1003,
+              1016
+            ]
+          },
+          {
+            "regex_name": "SYNTAX_ERROR_REGEX",
+            "message_template": "Please check your query for syntax errors at or near \"%(syntax_error)s\". Then, try running your query again.",
+            "error_type": "SYNTAX_ERROR",
+            "category": "Query",
+            "description": "SQL syntax error",
+            "issue_codes": [
+              1030
+            ]
+          }
+        ]
+      },
+      "time_grains": {},
+      "score": 0,
+      "max_score": 0,
+      "joins": true,
+      "subqueries": true,
+      "supports_dynamic_schema": false,
+      "supports_catalog": false,
+      "supports_dynamic_catalog": false,
+      "ssh_tunneling": false,
+      "query_cancelation": false,
+      "supports_file_upload": false,
+      "user_impersonation": false,
+      "query_cost_estimation": false,
+      "sql_validation": false
+    },
     "IBM Db2": {
       "engine": "ibm_db2",
       "engine_name": "IBM Db2",
@@ -4754,9 +4865,9 @@
             }
           },
           {
-            "name": "IAM Credentials (Serverless)",
-            "description": "Use IAM-based credentials for Redshift Serverless",
-            "requirements": "IAM role must have redshift-serverless:GetCredentials and redshift-serverless:GetWorkgroup permissions",
+            "name": "IAM Role (Serverless)",
+            "description": "Authenticate using the IAM role attached to the environment (EC2 instance profile, ECS task role, etc.). No credentials needed.",
+            "requirements": "The attached IAM role must have redshift-serverless:GetCredentials and redshift-serverless:GetWorkgroup permissions.",
             "connection_string": "redshift+redshift_connector://",
             "engine_parameters": {
               "connect_args": {
@@ -4768,6 +4879,26 @@
                 "user": "IAMR:<superset iam role name>"
               }
             }
+          },
+          {
+            "name": "IAM Access Key (Serverless)",
+            "description": "Authenticate using explicit AWS access key and secret. Suitable for local development or CI environments without an attached IAM role.",
+            "requirements": "The IAM user must have redshift-serverless:GetCredentials and redshift-serverless:GetWorkgroup permissions.",
+            "connection_string": "redshift+redshift_connector://",
+            "engine_parameters": {
+              "connect_args": {
+                "iam": true,
+                "is_serverless": true,
+                "serverless_acct_id": "<aws account number>",
+                "serverless_work_group": "<redshift work group>",
+                "database": "<database>",
+                "host": "<endpoint>",
+                "port": 5439,
+                "region": "<aws region>",
+                "access_key_id": "<aws access key id>",
+                "secret_access_key": "<aws secret access key>"
+              }
+            }
           }
         ],
         "custom_errors": [

docs/src/pages/index.tsx

@@ -28,6 +28,7 @@ import databaseData from '../data/databases.json';
 import BlurredSection from '../components/BlurredSection';
 import DataSet from '../../../RESOURCES/INTHEWILD.yaml';
 import type { DatabaseData } from '../components/databases/types';
+import GetStartedSplitButton from '../components/GetStartedSplitButton';
 import '../styles/main.css';
 
 // Build database list from databases.json (databases with logos)
@@ -191,20 +192,6 @@ const StyledTitleContainer = styled('div')`
   }
 `;
 
-const StyledButton = styled(Link)`
-  border-radius: 10px;
-  font-size: 20px;
-  font-weight: bold;
-  width: 170px;
-  padding: 10px 0;
-  margin: 15px auto 0;
-  ${mq[1]} {
-    font-size: 19px;
-    width: 175px;
-    padding: 10px 0;
-  }
-`;
-
 const StyledScreenshotContainer = styled('div')`
   position: relative;
   display: inline-block;
@@ -717,9 +704,10 @@ export default function Home(): JSX.Element {
               </span>
             </div>
             <img src="/img/community/line.png" alt="line" />
-            <StyledButton className="default-button-theme" href="/docs/intro">
-              Get Started
-            </StyledButton>
+            <GetStartedSplitButton
+              variant="hero"
+              rootClassName="default-button-theme get-started-split"
+            />
           </div>
           <StyledScreenshotContainer>
             <img

docs/src/styles/main.css

@@ -105,6 +105,45 @@ a > span > svg {
   opacity: 1;
 }
 
+/* Homepage split "Get started": gradient button + chevron column */
+.default-button-theme.get-started-split {
+  display: flex;
+  padding: 0;
+}
+
+.get-started-split-dropdown-menu.ant-dropdown-menu {
+  background: linear-gradient(180deg, #20a7c9 0%, #0c8fae 100%) !important;
+  border: 1px solid rgba(255, 255, 255, 0.22);
+  box-shadow: 0 4px 14px rgba(0, 0, 0, 0.2) !important;
+}
+
+.get-started-split-dropdown-menu--hero.ant-dropdown-menu {
+  min-width: 208px;
+}
+
+@media (max-width: 768px) {
+  .get-started-split-dropdown-menu--hero.ant-dropdown-menu {
+    min-width: 214px;
+  }
+}
+
+.get-started-split-dropdown-menu--navbar.ant-dropdown-menu {
+  min-width: 176px;
+}
+
+.get-started-split-dropdown-menu .ant-dropdown-menu-item {
+  color: #ffffff !important;
+}
+
+.get-started-split-dropdown-menu .ant-dropdown-menu-item:hover,
+.get-started-split-dropdown-menu .ant-dropdown-menu-item-active {
+  background: rgba(255, 255, 255, 0.15) !important;
+}
+
+.get-started-split-dropdown-menu .ant-dropdown-menu-item a {
+  color: inherit !important;
+}
+
 /* Navbar */
 
 .navbar {
@@ -117,11 +156,14 @@ a > span > svg {
   border-radius: 10px;
   font-size: 18px;
   font-weight: bold;
-  width: 142px;
-  padding: 7px 0;
   margin-right: 20px;
 }
 
+.navbar .get-started-button.get-started-split {
+  width: 176px;
+  padding: 0;
+}
+
 .navbar .github-button {
   background-image: url('/img/github.png');
   background-size: contain;

docs/src/theme/NavbarItem/ComponentTypes.tsx

@@ -0,0 +1,41 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import DocNavbarItem from '@theme-original/NavbarItem/DocNavbarItem';
+import DocSidebarNavbarItem from '@theme-original/NavbarItem/DocSidebarNavbarItem';
+import DocsVersionDropdownNavbarItem from '@theme-original/NavbarItem/DocsVersionDropdownNavbarItem';
+import DocsVersionNavbarItem from '@theme-original/NavbarItem/DocsVersionNavbarItem';
+import DropdownNavbarItem from '@theme-original/NavbarItem/DropdownNavbarItem';
+import DefaultNavbarItem from '@theme-original/NavbarItem/DefaultNavbarItem';
+import HtmlNavbarItem from '@theme-original/NavbarItem/HtmlNavbarItem';
+import LocaleDropdownNavbarItem from '@theme-original/NavbarItem/LocaleDropdownNavbarItem';
+import SearchNavbarItem from '@theme-original/NavbarItem/SearchNavbarItem';
+import GetStartedSplitNavbarItem from './GetStartedSplitNavbarItem';
+
+export default {
+  default: DefaultNavbarItem,
+  localeDropdown: LocaleDropdownNavbarItem,
+  search: SearchNavbarItem,
+  dropdown: DropdownNavbarItem,
+  html: HtmlNavbarItem,
+  doc: DocNavbarItem,
+  docSidebar: DocSidebarNavbarItem,
+  docsVersion: DocsVersionNavbarItem,
+  docsVersionDropdown: DocsVersionDropdownNavbarItem,
+  'custom-getStartedSplit': GetStartedSplitNavbarItem,
+};

docs/src/theme/NavbarItem/GetStartedSplitNavbarItem.tsx

@@ -0,0 +1,29 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import GetStartedSplitButton from '../../components/GetStartedSplitButton';
+import '../../styles/main.css';
+
+export default function GetStartedSplitNavbarItem() {
+  return (
+    <GetStartedSplitButton
+      variant="navbar"
+      rootClassName="default-button-theme get-started-split get-started-button"
+    />
+  );
+}

docs/src/theme/Root.js

@@ -147,7 +147,9 @@ export default function Root({ children }) {
         const button = event.target.closest('.get-started-button, .default-button-theme');
         if (button) {
           const buttonText = button.textContent?.trim() || 'Unknown';
-          const href = button.getAttribute('href') || '';
+          const clickedLink = event.target.closest?.('a');
+          const href =
+            clickedLink?.getAttribute('href') || button.getAttribute('href') || '';
           trackEvent('CTA', 'Click', `${buttonText} - ${href}`);
         }
       };

pyproject.toml

@@ -70,13 +70,13 @@ dependencies = [
     # marshmallow>=4 has issues: https://github.com/apache/superset/issues/33162
     "marshmallow>=3.0, <4",
     "marshmallow-union>=0.1",
-    "msgpack>=1.0.0, <1.1",
+    "msgpack>=1.0.0, <1.2",
     "nh3>=0.2.11, <0.3",
     "numpy>1.23.5, <2.3",
     "packaging",
     # --------------------------
     # pandas and related (wanting pandas[performance] without numba as it's 100+MB and not needed)
-    "pandas[excel]>=2.1.4, <2.2",
+    "pandas[excel]>=2.1.4, <2.4",
     "bottleneck", # recommended performance dependency for pandas, see https://pandas.pydata.org/docs/getting_started/install.html#performance-dependencies-recommended
     # --------------------------
     "parsedatetime",
@@ -109,7 +109,7 @@ dependencies = [
     "watchdog>=6.0.0",
     "wtforms>=2.3.3, <4",
     "wtforms-json",
-    "xlsxwriter>=3.0.7, <3.1",
+    "xlsxwriter>=3.0.7, <3.3",
 ]
 
 [project.optional-dependencies]
@@ -145,7 +145,7 @@ solr = ["sqlalchemy-solr >= 0.2.0"]
 elasticsearch = ["elasticsearch-dbapi>=0.2.12, <0.3.0"]
 exasol = ["sqlalchemy-exasol >= 2.4.0, <3.0"]
 excel = ["xlrd>=1.2.0, <1.3"]
-fastmcp = ["fastmcp>=3.1.0,<4.0"]
+fastmcp = ["fastmcp>=3.2.4,<4.0"]
 firebird = ["sqlalchemy-firebird>=0.7.0, <0.8"]
 firebolt = ["firebolt-sqlalchemy>=1.0.0, <2"]
 gevent = ["gevent>=23.9.1"]
@@ -175,7 +175,7 @@ oracle = ["cx-Oracle>8.0.0, <8.1"]
 parseable = ["sqlalchemy-parseable>=0.1.3,<0.2.0"]
 pinot = ["pinotdb>=5.0.0, <6.0.0"]
 playwright = ["playwright>=1.37.0, <2"]
-postgres = ["psycopg2-binary==2.9.9"]
+postgres = ["psycopg2-binary==2.9.12"]
 presto = ["pyhive[presto]>=0.6.5"]
 trino = ["trino>=0.328.0"]
 prophet = ["prophet>=1.1.6, <2"]

requirements/base.txt

@@ -339,7 +339,7 @@ python-dateutil==2.9.0.post0
     #   holidays
     #   pandas
     #   shillelagh
-python-dotenv==1.1.0
+python-dotenv==1.2.2
     # via apache-superset (pyproject.toml)
 pytz==2025.2
     # via

requirements/development.txt

@@ -52,7 +52,7 @@ attrs==25.3.0
     #   referencing
     #   requests-cache
     #   trio
-authlib==1.6.7
+authlib==1.6.9
     # via fastmcp
 babel==2.17.0
     # via
@@ -236,7 +236,7 @@ et-xmlfile==2.0.0
     #   openpyxl
 exceptiongroup==1.3.0
     # via fastmcp
-fastmcp==3.1.0
+fastmcp==3.2.4
     # via apache-superset
 filelock==3.20.3
     # via
@@ -379,6 +379,8 @@ greenlet==3.1.1
     #   gevent
     #   shillelagh
     #   sqlalchemy
+griffelib==2.0.2
+    # via fastmcp
 grpcio==1.71.0
     # via
     #   apache-superset
@@ -705,7 +707,7 @@ protobuf==4.25.8
     #   proto-plus
 psutil==6.1.0
     # via apache-superset
-psycopg2-binary==2.9.9
+psycopg2-binary==2.9.12
     # via apache-superset
 py-key-value-aio==0.4.4
     # via fastmcp
@@ -825,7 +827,7 @@ python-dateutil==2.9.0.post0
     #   pyhive
     #   shillelagh
     #   trino
-python-dotenv==1.1.0
+python-dotenv==1.2.2
     # via
     #   -c requirements/base-constraint.txt
     #   apache-superset

scripts/oxlint.sh

@@ -45,7 +45,17 @@ if [ ${#js_ts_files[@]} -gt 0 ]; then
   # Skip custom OXC build in pre-commit for speed
   export SKIP_CUSTOM_OXC=true
   # Use quiet mode in pre-commit to reduce noise (only show errors)
-  npx oxlint --config oxlint.json --fix --quiet "${js_ts_files[@]}"
+  # Capture output so we can treat "No files found" (all files ignored by
+  # ignorePatterns) as success rather than a false-positive failure.
+  output=$(npx oxlint --config oxlint.json --fix --quiet "${js_ts_files[@]}" 2>&1) || {
+    if echo "$output" | grep -q "No files found"; then
+      echo "No files to lint after applying ignore patterns"
+      exit 0
+    fi
+    echo "$output" >&2
+    exit 1
+  }
+  [ -n "$output" ] && echo "$output"
 else
   echo "No JavaScript/TypeScript files to lint"
 fi

superset-frontend/package.json

@@ -196,7 +196,7 @@
     "re-resizable": "^6.11.2",
     "react": "^17.0.2",
     "react-arborist": "^3.5.0",
-    "react-checkbox-tree": "^2.0.1",
+    "react-checkbox-tree": "^1.8.0",
     "react-diff-viewer-continued": "^4.2.2",
     "react-dnd": "^11.1.3",
     "react-dnd-html5-backend": "^11.1.3",
@@ -232,7 +232,7 @@
     "use-query-params": "^2.2.2",
     "uuid": "^14.0.0",
     "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz",
-    "yargs": "^17.7.2"
+    "yargs": "^18.0.0"
   },
   "devDependencies": {
     "@babel/cli": "^7.28.6",
@@ -270,8 +270,8 @@
     "@storybook/test": "^8.6.18",
     "@storybook/test-runner": "^0.17.0",
     "@svgr/webpack": "^8.1.0",
-    "@swc/core": "^1.15.30",
-    "@swc/plugin-emotion": "^14.8.0",
+    "@swc/core": "^1.15.32",
+    "@swc/plugin-emotion": "^14.9.0",
     "@swc/plugin-transform-imports": "^12.5.0",
     "@testing-library/dom": "^8.20.1",
     "@testing-library/jest-dom": "^6.9.1",
@@ -299,7 +299,7 @@
     "@types/rison": "0.1.0",
     "@types/tinycolor2": "^1.4.3",
     "@types/unzipper": "^0.10.11",
-    "@typescript-eslint/eslint-plugin": "^8.59.0",
+    "@typescript-eslint/eslint-plugin": "^8.59.1",
     "@typescript-eslint/parser": "^8.58.2",
     "babel-jest": "^30.0.2",
     "babel-loader": "^10.1.1",
@@ -323,7 +323,7 @@
     "eslint-plugin-import": "^2.32.0",
     "eslint-plugin-jest-dom": "^5.5.0",
     "eslint-plugin-lodash": "^7.4.0",
-    "eslint-plugin-no-only-tests": "^3.3.0",
+    "eslint-plugin-no-only-tests": "^3.4.0",
     "eslint-plugin-prettier": "^5.5.5",
     "eslint-plugin-react-prefer-function-component": "^5.0.0",
     "eslint-plugin-react-you-might-not-need-an-effect": "^0.9.3",
@@ -341,12 +341,12 @@
     "jest-html-reporter": "^4.4.0",
     "jest-websocket-mock": "^2.5.0",
     "js-yaml-loader": "^1.2.2",
-    "jsdom": "^29.0.2",
+    "jsdom": "^29.1.0",
     "lerna": "^9.0.4",
     "lightningcss": "^1.32.0",
     "mini-css-extract-plugin": "^2.10.2",
     "open-cli": "^9.0.0",
-    "oxlint": "^1.61.0",
+    "oxlint": "^1.62.0",
     "po2json": "^0.4.5",
     "prettier": "3.8.3",
     "prettier-plugin-packagejson": "^3.0.2",
@@ -361,7 +361,6 @@
     "style-loader": "^4.0.0",
     "swc-loader": "^0.2.7",
     "terser-webpack-plugin": "^5.5.0",
-    "thread-loader": "^4.0.4",
     "ts-jest": "^29.4.9",
     "tscw-config": "^1.1.2",
     "tsx": "^4.21.0",

superset-frontend/packages/generator-superset/package.json

@@ -30,7 +30,7 @@
   "dependencies": {
     "chalk": "^5.6.2",
     "lodash-es": "^4.18.1",
-    "yeoman-generator": "^8.1.2",
+    "yeoman-generator": "^8.2.2",
     "yosay": "^3.0.0"
   },
   "devDependencies": {

superset-frontend/packages/superset-core/src/theme/GlobalStyles.tsx

@@ -29,14 +29,20 @@ import '@fontsource/ibm-plex-mono/600.css';
 /* eslint-enable import/extensions */
 
 import { css, useTheme, Global } from '@emotion/react';
+import { useThemeMode } from './utils/themeUtils';
 
 export const GlobalStyles = () => {
   const theme = useTheme();
+  const isDark = useThemeMode();
   return (
     <Global
       key={`global-${theme.colorLink}`}
       styles={css`
         // SPA
+        html {
+          color-scheme: ${isDark ? 'dark' : 'light'};
+        }
+
         html,
         body,
         #app {

superset-frontend/packages/superset-ui-chart-controls/src/types.ts

@@ -588,6 +588,7 @@ export type ControlFormItemSpec<T extends ControlType = ControlType> = {
       creatable?: boolean;
       minWidth?: number | string;
       validators?: ControlFormValueValidator<string>[];
+      tokenSeparators?: string[];
     }
   : T extends 'RadioButtonControl'
     ? {

superset-frontend/packages/superset-ui-core/package.json

@@ -24,7 +24,7 @@
     "lib"
   ],
   "dependencies": {
-    "@ant-design/icons": "^6.1.1",
+    "@ant-design/icons": "^6.2.2",
     "@apache-superset/core": "*",
     "@babel/runtime": "^7.29.2",
     "@types/json-bigint": "^1.0.4",
@@ -56,7 +56,7 @@
     "react-js-cron": "^5.2.0",
     "react-markdown": "^8.0.7",
     "react-resize-detector": "^7.1.2",
-    "react-syntax-highlighter": "^16.1.1",
+    "react-syntax-highlighter": "^16.1.0",
     "react-ultimate-pagination": "^1.3.2",
     "regenerator-runtime": "^0.14.1",
     "rehype-raw": "^7.0.0",

superset-frontend/packages/superset-ui-core/src/components/AsyncAceEditor/useJsonValidation.test.ts

@@ -60,7 +60,7 @@ describe('useJsonValidation', () => {
     expect(result.current[0]).toMatchObject({
       type: 'error',
       row: 0,
-      column: 0,
+      column: 1,
       text: expect.stringContaining('Invalid JSON'),
     });
   });

superset-frontend/packages/superset-ui-core/src/components/Modal/Modal.tsx

@@ -55,132 +55,138 @@ export const StyledModal = styled(BaseModal)<StyledModalProps>`
     height,
     draggable,
     hideFooter,
-  }) => css`
-    ${responsive &&
-    css`
-      max-width: ${maxWidth ?? '900px'};
-      padding-left: ${theme.sizeUnit * 3}px;
-      padding-right: ${theme.sizeUnit * 3}px;
-      padding-bottom: 0;
-      top: 0;
-    `}
+  }) => {
+    const closeButtonWidth = theme.sizeUnit * 14;
 
-    .ant-modal-content {
-      background-color: ${theme.colorBgContainer};
-      display: flex;
-      flex-direction: column;
-      max-height: calc(100vh - ${theme.sizeUnit * 8}px);
-      margin-bottom: ${theme.sizeUnit * 4}px;
-      margin-top: ${theme.sizeUnit * 4}px;
-      padding: 0;
-    }
+    return css`
+      ${responsive &&
+      css`
+        max-width: ${maxWidth ?? '900px'};
+        padding-left: ${theme.sizeUnit * 3}px;
+        padding-right: ${theme.sizeUnit * 3}px;
+        padding-bottom: 0;
+        top: 0;
+      `}
 
-    .ant-modal-header {
-      flex: 0 0 auto;
-      border-radius: ${theme.borderRadius}px ${theme.borderRadius}px 0 0;
-      padding: ${theme.sizeUnit * 4}px ${theme.sizeUnit * 4}px;
-
-      .ant-modal-title {
-        font-weight: ${theme.fontWeightStrong};
-      }
-
-      .ant-modal-title h4 {
+      .ant-modal-content {
+        background-color: ${theme.colorBgContainer};
         display: flex;
-        margin: 0;
-        align-items: center;
+        flex-direction: column;
+        max-height: calc(100vh - ${theme.sizeUnit * 8}px);
+        margin-bottom: ${theme.sizeUnit * 4}px;
+        margin-top: ${theme.sizeUnit * 4}px;
+        padding: 0;
       }
-    }
 
-    .ant-modal-close {
-      width: ${theme.sizeUnit * 14}px;
-      height: ${theme.sizeUnit * 14}px;
-      padding: ${theme.sizeUnit * 6}px ${theme.sizeUnit * 4}px
-        ${theme.sizeUnit * 4}px;
-      top: 0;
-      right: 0;
-      display: flex;
-      justify-content: center;
-    }
+      .ant-modal-header {
+        flex: 0 0 auto;
+        border-radius: ${theme.borderRadius}px ${theme.borderRadius}px 0 0;
+        padding: ${theme.sizeUnit * 4}px ${closeButtonWidth}px
+          ${theme.sizeUnit * 4}px ${theme.sizeUnit * 4}px;
 
-    .ant-modal-close:hover {
-      background: transparent;
-    }
+        .ant-modal-title {
+          font-weight: ${theme.fontWeightStrong};
+        }
 
-    .ant-modal-close-x {
-      display: flex;
-      align-items: center;
-      [data-test='close-modal-btn'] {
+        .ant-modal-title h4 {
+          display: flex;
+          margin: 0;
+          align-items: center;
+        }
+      }
+
+      .ant-modal-close {
+        width: ${closeButtonWidth}px;
+        height: ${theme.sizeUnit * 14}px;
+        padding: ${theme.sizeUnit * 6}px ${theme.sizeUnit * 4}px
+          ${theme.sizeUnit * 4}px;
+        top: 0;
+        right: 0;
+        display: flex;
         justify-content: center;
       }
-      .close {
-        flex: 1 1 auto;
-        margin-bottom: ${theme.sizeUnit}px;
-        color: ${theme.colorPrimaryText};
-        font-weight: ${theme.fontWeightLight};
-      }
-    }
 
-    .ant-modal-body {
-      flex: 0 1 auto;
-      padding: ${theme.sizeUnit * 4}px ${theme.sizeUnit * 6}px;
-
-      overflow: auto;
-      ${!resizable && height && `height: ${height};`}
-    }
-
-    .ant-modal-footer {
-      flex: 0 0 1;
-      border-top: ${theme.sizeUnit / 4}px solid ${theme.colorSplit};
-      padding: ${theme.sizeUnit * 4}px;
-      margin-top: 0;
-
-      .btn {
-        font-size: 12px;
+      .ant-modal-close:hover {
+        background: transparent;
       }
 
-      .btn + .btn {
-        margin-left: ${theme.sizeUnit * 2}px;
+      .ant-modal-close-x {
+        display: flex;
+        align-items: center;
+        [data-test='close-modal-btn'] {
+          justify-content: center;
+        }
+        .close {
+          flex: 1 1 auto;
+          margin-bottom: ${theme.sizeUnit}px;
+          color: ${theme.colorPrimaryText};
+          font-weight: ${theme.fontWeightLight};
+        }
       }
-    }
 
-    &.no-content-padding .ant-modal-body {
-      padding: 0;
-    }
+      .ant-modal-body {
+        flex: 0 1 auto;
+        padding: ${theme.sizeUnit * 4}px ${theme.sizeUnit * 6}px;
 
-    ${draggable &&
-    css`
-      .ant-modal-header {
+        overflow: auto;
+        ${!resizable && height && `height: ${height};`}
+      }
+
+      .ant-modal-footer {
+        flex: 0 0 1;
+        border-top: ${theme.sizeUnit / 4}px solid ${theme.colorSplit};
+        padding: ${theme.sizeUnit * 4}px;
+        margin-top: 0;
+
+        .btn {
+          font-size: 12px;
+        }
+
+        .btn + .btn {
+          margin-left: ${theme.sizeUnit * 2}px;
+        }
+      }
+
+      &.no-content-padding .ant-modal-body {
         padding: 0;
-
-        .draggable-trigger {
-          cursor: move;
-          padding: ${theme.sizeUnit * 4}px;
-          width: 100%;
-        }
       }
-    `}
 
-    ${resizable &&
-    css`
-      .resizable {
-        pointer-events: all;
+      ${draggable &&
+      css`
+        .ant-modal-header {
+          padding: 0;
 
-        .resizable-wrapper {
-          height: 100%;
-        }
-
-        .ant-modal-content {
-          height: 100%;
-
-          .ant-modal-body {
-            height: ${hideFooter
-              ? `calc(100% - ${MODAL_HEADER_HEIGHT}px)`
-              : `calc(100% - ${MODAL_HEADER_HEIGHT}px - ${MODAL_FOOTER_HEIGHT}px)`};
+          .draggable-trigger {
+            cursor: move;
+            padding: ${theme.sizeUnit * 4}px ${closeButtonWidth}px
+              ${theme.sizeUnit * 4}px ${theme.sizeUnit * 4}px;
+            width: 100%;
           }
         }
-      }
-    `}
-  `}
+      `}
+
+      ${resizable &&
+      css`
+        .resizable {
+          pointer-events: all;
+
+          .resizable-wrapper {
+            height: 100%;
+          }
+
+          .ant-modal-content {
+            height: 100%;
+
+            .ant-modal-body {
+              height: ${hideFooter
+                ? `calc(100% - ${MODAL_HEADER_HEIGHT}px)`
+                : `calc(100% - ${MODAL_HEADER_HEIGHT}px - ${MODAL_FOOTER_HEIGHT}px)`};
+            }
+          }
+        }
+      `}
+    `;
+  }}
 `;
 
 const defaultResizableConfig = (hideFooter: boolean | undefined) => ({