fix(security): support API key copy fallback

Adds superset:<resource>:<action> scope support to the MCP service:

- CompositeTokenVerifier now propagates an API key's own ApiKey.scopes
  (via a new SupersetSecurityManager.get_api_key_scopes lookup) instead
  of always stamping the verifier-global required_scopes on the token.
- check_tool_permission/_token_scope_allows accept a per-resource scope
  (e.g. superset:dashboard:read, derived from the tool's
  class_permission_name) as an alternative grant path alongside the
  existing flat superset:read/superset:write scopes, which keep working
  for already-issued tokens.
- SupersetSecurityManager.create_api_key validates requested scopes
  against the issuing user's own RBAC before delegating to FAB
  (intersection rule: a key can never be scoped beyond the user's own
  permissions; flat scopes are Admin-only to self-issue; unknown scopes
  are rejected).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -1,6 +1,6 @@
 name: Bug report
 description: Report a bug to improve Superset's stability
-labels: ["#bug"]
+labels: ["bug"]
 body:
   - type: markdown
     attributes:

.github/ISSUE_TEMPLATE/cosmetic.md

@@ -1,7 +1,7 @@
 ---
 name: Cosmetic Issue
 about: Describe a cosmetic issue with CSS, positioning, layout, labeling, or similar
-labels: "#bug:cosmetic"
+labels: "cosmetic-issue"
 ---
 
 ## Screenshot

.github/labeler.yml

@@ -29,7 +29,7 @@
 "dependencies:python":
 - changed-files:
   - any-glob-to-any-file:
-    - 'requirements/**'
+    - 'superset/requirements/**'
     - 'superset/translations/requirements.txt'
     - 'RELEASING/requirements.txt'
 

.github/workflows/bump-python-package.yml

@@ -21,9 +21,6 @@ on:
   #schedule:
   #  - cron: '0 0 * * *'  # Runs daily at midnight UTC
 
-permissions:
-  contents: read
-
 jobs:
   bump-python-package:
     runs-on: ubuntu-slim
@@ -48,7 +45,7 @@ jobs:
           python-version: "3.11"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           python-version: "3.11"
           enable-cache: true

.github/workflows/check-db-migration-confict.yml

@@ -16,9 +16,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
-
 jobs:
   check_db_migration_conflict:
     name: Check DB migration conflict

.github/workflows/codeql-analysis.yml

@@ -14,9 +14,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
-
 jobs:
   changes:
     runs-on: ubuntu-26.04
@@ -67,7 +64,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -78,6 +75,6 @@ jobs:
           # queries: security-extended,security-and-quality
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/docker.yml

@@ -51,53 +51,6 @@ jobs:
           echo "matrix_config=${MATRIX_CONFIG}" >> $GITHUB_OUTPUT
           echo $GITHUB_OUTPUT
 
-  # Runs unconditionally (no dependency on `changes`, and no build-preset
-  # matrix restriction) so a regression in the PY_VER override logic is
-  # always caught on PRs. Without this, the real docker-build job only runs
-  # when the change detector flags docker/python/frontend changes (a
-  # workflow-only edit like this one does not), and even then the PR build
-  # matrix never includes the "py311"/"py312" presets that logic protects -
-  # so a break here would otherwise first surface on a push to master.
-  pyver-override-check:
-    name: verify docker build PY_VER override
-    runs-on: ubuntu-26.04
-    timeout-minutes: 5
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Setup supersetbot
-        uses: ./.github/actions/setup-supersetbot/
-      - name: Assert PY_VER override applies to every preset except py311/py312
-        shell: bash
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          # Asserts against the actual buildx command line `supersetbot docker
-          # --dry-run` would run, not just this repo's own extra-flags helper,
-          # so a regression in supersetbot itself (dropping the py311/py312
-          # PY_VER pin, or reordering args so our override no longer lands
-          # last) is caught here too, instead of only surfacing on master.
-          assert_effective_py_ver() {
-            local preset="$1" expected="$2" extra_flags command actual
-            extra_flags="$(scripts/docker-build-extra-flags.sh "$preset" dummy-tag)"
-            command="$(supersetbot docker --preset "$preset" --platform linux/amd64 --extra-flags "$extra_flags" --dry-run)"
-            # docker buildx keeps the LAST value of a repeated --build-arg key.
-            actual="$(grep -oE -- '--build-arg PY_VER=[^[:space:]]+' <<<"$command" | tail -1)"
-            if [ "$actual" != "--build-arg PY_VER=$expected" ]; then
-              echo "::error::preset '$preset' expected effective --build-arg PY_VER=$expected, got: ${actual:-<none>} (full command: $command)"
-              exit 1
-            fi
-          }
-          for preset in dev lean websocket dockerize; do
-            assert_effective_py_ver "$preset" "3.11.14-slim-trixie"
-          done
-          assert_effective_py_ver py311 "3.11-slim-bookworm"
-          assert_effective_py_ver py312 "3.12-slim-bookworm"
-          echo "PY_VER override logic verified against the assembled buildx command for all build presets"
-
   docker-build:
     name: docker-build
     needs: [setup_matrix, changes]
@@ -171,21 +124,19 @@ jobs:
           # the whole job. buildx reuses the buildkit layer cache from the
           # failed attempt, so a retry mostly re-does just the failed push.
           #
-          # See scripts/docker-build-extra-flags.sh for why "py311"/"py312"
-          # are excluded from the PY_VER override applied to every other
-          # preset; that logic is also exercised on every PR by the
-          # always-on pyver-override-check job below, since this job itself
-          # only runs when the change detector flags docker/python/frontend
-          # changes and the PR build matrix never includes py311/py312.
-          EXTRA_FLAGS="$(scripts/docker-build-extra-flags.sh "$BUILD_PRESET" "$IMAGE_TAG")"
-
+          # supersetbot's "dev"/"lean" presets pin their own --build-arg
+          # PY_VER, which lands ahead of --extra-flags on the assembled
+          # buildx command line; docker/buildx keeps the last value for a
+          # repeated --build-arg key, so appending PY_VER here overrides
+          # supersetbot's pin and keeps the build on the Dockerfile's own
+          # supported Python version.
           for attempt in 1 2 3; do
             if supersetbot docker \
               $PUSH_OR_LOAD \
               --preset "$BUILD_PRESET" \
               --context "$EVENT" \
               --context-ref "$RELEASE" $FORCE_LATEST \
-              --extra-flags "$EXTRA_FLAGS" \
+              --extra-flags "--build-arg PY_VER=3.11.14-slim-trixie --build-arg INCLUDE_CHROMIUM=false --tag $IMAGE_TAG" \
               $PLATFORM_ARG; then
               break
             fi

.github/workflows/enforce-single-migration-head.yml

@@ -33,9 +33,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
-
 jobs:
   enforce-single-migration-head:
     runs-on: ubuntu-26.04

.github/workflows/frontend-bundle-size-nightly.yml

@@ -1,135 +0,0 @@
-name: Frontend bundle size (nightly baseline + analyzer)
-
-# Refreshes the bundle-size baseline that superset-frontend.yml's `bundle-size`
-# job compares PRs against, and publishes a browsable bundle-analyzer treemap
-# report of the same build. Deliberately NOT triggered on every push to
-# master: a day-old baseline/report is fine for catching relative
-# regressions on PRs and for browsing what's actually in the bundle, and
-# building the production bundle on every one of the many pushes master
-# gets per day would burn CI time for no benefit a nightly refresh doesn't
-# already cover.
-on:
-  schedule:
-    - cron: "0 6 * * *"
-  workflow_dispatch: {}
-
-concurrency:
-  group: ${{ github.workflow }}
-  cancel-in-progress: true
-
-env:
-  TAG: apache/superset:bundle-size-nightly-${{ github.run_id }}
-
-permissions:
-  contents: read
-
-jobs:
-  refresh-baseline:
-    runs-on: ubuntu-26.04
-    timeout-minutes: 30
-    env:
-      NETLIFY_SITE_ID: ${{ secrets.NETLIFY_BUNDLE_ANALYZER_SITE_ID }}
-    steps:
-      - name: "Checkout master"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-          ref: master
-
-      - name: Build Docker Image
-        run: |
-          docker buildx build \
-            -t $TAG \
-            --cache-from=type=registry,ref=apache/superset-cache:3.11-slim-trixie \
-            --target superset-node-ci \
-            .
-
-      # Same cache the PR-time bundle-size job restores/writes -- webpack's
-      # persistent filesystem cache turns a warm production build into ~20s
-      # instead of several minutes. See superset-frontend.yml for the
-      # matching restore step and why it's keyed this way.
-      - name: Restore webpack build cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: superset-frontend/.temp_cache
-          key: >-
-            webpack-prod-cache-${{ hashFiles('superset-frontend/package-lock.json',
-            'superset-frontend/babel.config.js', 'superset-frontend/tsconfig.json',
-            'superset-frontend/webpack.config.js') }}
-
-      # Only ever pull the last recorded data point off the cache, keyed by
-      # run ID -- `restore-keys` prefix-matches the most recently created
-      # entry. Absent on the very first run ever; benchmark-action starts a
-      # fresh history in that case.
-      - name: Restore bundle size history
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: bundle-size-history.json
-          key: bundle-size-history-${{ github.run_id }}
-          restore-keys: |
-            bundle-size-history-
-
-      # BUNDLE_ANALYZER rides along in the same build as BUNDLE_SIZE_STATS --
-      # they're independent env-gated additions in webpack.config.js (one
-      # sets `config.stats`, the other pushes plugins), so one production
-      # build produces both the numeric stats.json and the analyzer's
-      # report.html. Only report.html is mounted out, not
-      # BUNDLE_ANALYZER's sibling `statistics.html` sunburst -- that file is
-      # documented in webpack.config.js as routinely exceeding 100MB for
-      # this app (it's .gitignore'd for exactly that reason), too large to
-      # publish as a static site page.
-      - name: Build production bundle with stats and analyzer report
-        run: |
-          mkdir -p ${{ github.workspace }}/superset-frontend/bundle-stats
-          mkdir -p ${{ github.workspace }}/superset-frontend/.temp_cache
-          mkdir -p ${{ github.workspace }}/superset/static/assets
-          docker run \
-          -v ${{ github.workspace }}/superset-frontend/bundle-stats:/app/superset-frontend/bundle-stats \
-          -v ${{ github.workspace }}/superset-frontend/.temp_cache:/app/superset-frontend/.temp_cache \
-          -v ${{ github.workspace }}/superset/static/assets:/app/superset/static/assets \
-          --rm $TAG \
-          bash -c \
-          "npm i && BUNDLE_SIZE_STATS=true BUNDLE_ANALYZER=true npm run build -- --json=bundle-stats/stats.json"
-
-      - name: Summarize bundle size
-        run: |
-          node superset-frontend/scripts/bundle-size-summary.js \
-            superset-frontend/bundle-stats/stats.json > bundle-size-summary.json
-          rm -rf superset-frontend/bundle-stats
-
-      # No PR to comment on here, so comment-on-alert is off -- the job
-      # summary (summary-always) is the only surface for this run.
-      - name: Update bundle size baseline
-        uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1
-        with:
-          tool: customSmallerIsBetter
-          output-file-path: bundle-size-summary.json
-          external-data-json-path: bundle-size-history.json
-          fail-on-alert: false
-          summary-always: true
-
-      - name: Save bundle size history
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: bundle-size-history.json
-          key: bundle-size-history-${{ github.run_id }}
-
-      # Publishes the treemap to Netlify (the same host already used for
-      # superset-storybook.netlify.app and docs previews, reusing the
-      # existing NETLIFY_AUTH_TOKEN). Skipped until
-      # NETLIFY_BUNDLE_ANALYZER_SITE_ID exists -- create a new (free)
-      # Netlify site named superset-bundle-analyzer and add its site ID as
-      # that secret to turn this on; nothing else in this workflow depends
-      # on it.
-      - name: Publish bundle analyzer report to Netlify
-        if: ${{ env.NETLIFY_SITE_ID != '' }}
-        env:
-          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
-        run: |
-          mkdir -p netlify-publish
-          cp superset/static/assets/report.html netlify-publish/index.html
-          # zizmor: ignore[adhoc-packages] - netlify-cli is a one-shot CI deploy
-          # tool, not an application dependency; a global/npx install has no
-          # lockfile context. Version pinned above the floor set by other
-          # ad-hoc installs in this repo (bump deliberately when upgrading).
-          npx --yes netlify-cli@27.0.1 deploy --prod --dir=netlify-publish

.github/workflows/github-action-validator.yml

@@ -45,8 +45,5 @@ jobs:
       - name: Run Script
         run: bash .github/workflows/github-action-validator.sh
 
-      - name: Test docs-deploy freshness gate
-        run: bash .github/workflows/scripts/check-docs-deploy-freshness.test.sh
-
       - name: Check for security issues on GHA workflows
         uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2

.github/workflows/issue-creation.yml

@@ -7,9 +7,6 @@ on:
   pull_request:
     types: [opened, edited]
 
-permissions:
-  contents: read
-
 jobs:
   superbot-orglabel:
     runs-on: ubuntu-slim

.github/workflows/labeler.yml

@@ -7,9 +7,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
-
 jobs:
   labeler:
     permissions:

.github/workflows/latest-release-tag.yml

@@ -3,9 +3,6 @@ on:
   release:
     types: [published] # This makes it run only when a new released is published
 
-permissions:
-  contents: read
-
 jobs:
   latest-release:
     name: Add/update tag to new release

.github/workflows/pr-lint.yml

@@ -19,9 +19,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: false
 
-permissions:
-  contents: read
-
 jobs:
   lint-check:
     runs-on: ubuntu-slim

.github/workflows/scripts/check-docs-deploy-freshness.sh

@@ -1,49 +0,0 @@
-#!/bin/bash
-#
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# Shared freshness gate used by the Docs Deployment workflow
-# (superset-docs-deploy.yml) both up front (check-freshness) and again right
-# before the deploy step (recheck-freshness). Writes an output declaring
-# whether BUILD_SHA is still master's current tip, so a superseded run can
-# skip cleanly instead of racing (and clobbering, or being force-cancelled
-# by) a fresher run.
-#
-# Required env vars:
-#   BUILD_SHA     - the commit SHA this run is building
-#   REPO          - "owner/repo" to query, e.g. github.repository
-#   OUTPUT_NAME   - the GITHUB_OUTPUT key to write, e.g. "is-current"
-#   GITHUB_OUTPUT - path to append outputs to (set by the Actions runner)
-# Optional env vars:
-#   EVENT_NAME    - if "workflow_dispatch", bypasses the check and always
-#                   reports current, since a manual dispatch is a deliberate,
-#                   one-off action rather than something racing other triggers
-#   GH_TOKEN      - passed through to `gh`, needed to call the GitHub API
-
-set -euo pipefail
-
-if [ "${EVENT_NAME:-}" = "workflow_dispatch" ]; then
-  echo "${OUTPUT_NAME}=true" >>"$GITHUB_OUTPUT"
-  exit 0
-fi
-
-latest_sha="$(gh api "repos/${REPO}/commits/master" --jq .sha)"
-if [ "${latest_sha}" = "${BUILD_SHA}" ]; then
-  echo "${OUTPUT_NAME}=true" >>"$GITHUB_OUTPUT"
-else
-  echo "${OUTPUT_NAME}=false" >>"$GITHUB_OUTPUT"
-  echo "::notice::master has moved on to ${latest_sha} since ${BUILD_SHA} was triggered — skipping this stale run."
-fi

.github/workflows/scripts/check-docs-deploy-freshness.test.sh

@@ -1,100 +0,0 @@
-#!/bin/bash
-#
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# Exercises check-docs-deploy-freshness.sh against a stubbed `gh`, covering
-# the dispatch-bypass, current-tip and stale-tip branches so the output
-# contract (is-current / still-current) can't silently regress. Run
-# directly, no extra tooling required:
-#   bash .github/workflows/scripts/check-docs-deploy-freshness.test.sh
-
-set -euo pipefail
-
-script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-script_under_test="${script_dir}/check-docs-deploy-freshness.sh"
-
-failures=0
-
-# Runs the script under test with a stubbed `gh` reporting $1 as master's
-# latest sha, asserting that GITHUB_OUTPUT ends up containing exactly $4.
-run_case() {
-  local case_name="$1"
-  local latest_sha="$2"
-  local build_sha="$3"
-  local event_name="$4"
-  local expected_line="$5"
-
-  local workdir
-  workdir="$(mktemp -d)"
-  trap 'rm -rf "${workdir}"' RETURN
-
-  # Fake `gh` that just echoes back the requested "latest" sha regardless of
-  # arguments, so the script under test never touches the network.
-  cat >"${workdir}/gh" <<EOF
-#!/bin/bash
-echo '${latest_sha}'
-EOF
-  chmod +x "${workdir}/gh"
-
-  local output_file="${workdir}/github_output"
-  : >"${output_file}"
-
-  if PATH="${workdir}:${PATH}" \
-    GITHUB_OUTPUT="${output_file}" \
-    OUTPUT_NAME="is-current" \
-    REPO="apache/superset" \
-    BUILD_SHA="${build_sha}" \
-    EVENT_NAME="${event_name}" \
-    GH_TOKEN="fake-token" \
-    bash "${script_under_test}"; then
-    :
-  else
-    echo "FAIL (${case_name}): script exited non-zero"
-    failures=$((failures + 1))
-    return
-  fi
-
-  local actual
-  actual="$(cat "${output_file}")"
-  if [ "${actual}" = "${expected_line}" ]; then
-    echo "PASS (${case_name})"
-  else
-    echo "FAIL (${case_name}): expected '${expected_line}', got '${actual}'"
-    failures=$((failures + 1))
-  fi
-}
-
-# `gh` prints "should-not-be-called" for the dispatch case above the trick:
-# it's never actually invoked since the bypass short-circuits before the
-# `gh api` call, but the fake still needs a body.
-run_case "workflow_dispatch bypasses the check" \
-  "unused" "abc123" "workflow_dispatch" \
-  "is-current=true"
-
-run_case "build sha matches master's tip" \
-  "abc123" "abc123" "push" \
-  "is-current=true"
-
-run_case "build sha is stale" \
-  "def456" "abc123" "push" \
-  "is-current=false"
-
-if [ "${failures}" -gt 0 ]; then
-  echo "${failures} case(s) failed"
-  exit 1
-fi
-
-echo "All cases passed"

.github/workflows/showtime-cleanup.yml

@@ -17,9 +17,6 @@ env:
   GITHUB_ORG: ${{ github.repository_owner }}
   GITHUB_REPO: ${{ github.event.repository.name }}
 
-permissions:
-  contents: read
-
 jobs:
   cleanup-expired:
     name: Clean up expired showtime environments

.github/workflows/showtime-trigger.yml

@@ -26,9 +26,6 @@ env:
   GITHUB_REPO: ${{ github.event.repository.name }}
   GITHUB_ACTOR: ${{ github.actor }}
 
-permissions:
-  contents: read
-
 jobs:
   sync:
     name: 🎪 Sync PR to desired state

.github/workflows/superset-docs-deploy.yml

@@ -18,6 +18,16 @@ on:
 
   workflow_dispatch: {}
 
+# Serialize deploys: the action pushes to apache/superset-site without
+# rebasing, so concurrent runs race on the final push and the loser fails
+# with `! [rejected] asf-site -> asf-site (fetch first)`. Cancel any
+# in-progress run as soon as a newer one starts — the destination repo
+# isn't touched until the final push step, so canceling mid-build is safe,
+# and the freshest content always wins.
+concurrency:
+  group: docs-deploy-asf-site
+  cancel-in-progress: true
+
 permissions:
   contents: read
   actions: read
@@ -38,69 +48,17 @@ jobs:
 
         env:
           SUPERSET_SITE_BUILD: ${{ (secrets.SUPERSET_SITE_BUILD != '' && secrets.SUPERSET_SITE_BUILD != '') || '' }}
-
-  # Master gets frequent, sometimes bursty pushes, and each one can trigger a
-  # deploy attempt. Rather than let every superseded attempt get force-killed
-  # by the build-deploy concurrency group below (which shows up as a
-  # `cancelled` — i.e. red/failing-looking — check on that commit), have each
-  # run check up front whether it's still building master's current tip and,
-  # if not, skip cleanly. Deliberately outside the docs-deploy-asf-site
-  # concurrency group so it runs immediately for every trigger without
-  # blocking or being blocked by anything.
-  check-freshness:
-    runs-on: ubuntu-26.04
-    outputs:
-      is-current: ${{ steps.check.outputs.is-current }}
-    steps:
-      # Sparse checkout: this job's only job is to be fast, so it fetches
-      # nothing but the freshness-check script itself.
-      - name: Checkout freshness-check script
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-          sparse-checkout: |
-            .github/workflows/scripts
-          sparse-checkout-cone-mode: false
-      - name: "Check whether this is still master's current commit"
-        id: check
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          BUILD_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
-          EVENT_NAME: ${{ github.event_name }}
-          REPO: ${{ github.repository }}
-          OUTPUT_NAME: is-current
-        run: .github/workflows/scripts/check-docs-deploy-freshness.sh
-
   build-deploy:
-    needs: [config, check-freshness]
-    # Only the run for master's current tip proceeds; anything superseded
-    # already skipped at check-freshness above instead of landing here.
+    needs: config
     # For workflow_run triggers, only deploy when the triggering run originated
     # from this repository (not a fork), ensuring the checked-out code and any
     # local actions executed with deploy credentials are trusted.
     if: >-
       needs.config.outputs.has-secrets &&
-      needs.check-freshness.outputs.is-current == 'true' &&
       (github.event_name != 'workflow_run' ||
        github.event.workflow_run.head_repository.full_name == github.repository)
     name: Build & Deploy
     runs-on: ubuntu-26.04
-    # Serialize deploys: the action pushes to apache/superset-site without
-    # rebasing, so concurrent runs race on the final push and the loser fails
-    # with `! [rejected] asf-site -> asf-site (fetch first)`. Queue instead of
-    # canceling: a run that already passed check-freshness can still be
-    # sitting in the queue for a runner when a newer run starts and finishes
-    # first. cancel-in-progress would let that stale, queued run kill the
-    # newer run's in-progress deploy the moment it's finally scheduled, and
-    # then skip itself at the re-check below — losing the deploy entirely.
-    # Queuing means the stale run just waits its turn and then no-ops at the
-    # re-check, so the fresher content that already deployed is never
-    # clobbered or lost. The check-freshness gate above means it should be
-    # rare for more than one run to reach this point, so the queue stays
-    # short in practice.
-    concurrency:
-      group: docs-deploy-asf-site
-      cancel-in-progress: false
     steps:
       - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
         with:
@@ -172,24 +130,7 @@ jobs:
         working-directory: docs
         run: |
           yarn build
-      # The check-freshness job above narrows the window but doesn't close it: an
-      # older run can observe is-current=true, then sit through this build while a
-      # newer run's own freshness check also passes and it deploys and finishes
-      # first. If this (stale) run then wins entry into the concurrency group, it
-      # would overwrite the newer content that already deployed. Re-check right
-      # before the one step that actually mutates superset-site, so a stale run
-      # skips deploying instead of clobbering a fresher one that already ran.
-      - name: "Re-check freshness immediately before deploying"
-        id: recheck-freshness
-        if: github.event_name != 'workflow_dispatch'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          BUILD_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
-          REPO: ${{ github.repository }}
-          OUTPUT_NAME: still-current
-        run: .github/workflows/scripts/check-docs-deploy-freshness.sh
       - name: deploy docs
-        if: github.event_name == 'workflow_dispatch' || steps.recheck-freshness.outputs.still-current == 'true'
         uses: ./.github/actions/github-action-push-to-another-repository
         env:
           API_TOKEN_GITHUB: ${{ secrets.SUPERSET_SITE_BUILD }}

.github/workflows/superset-e2e.yml

@@ -26,9 +26,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
-
 jobs:
   changes:
     runs-on: ubuntu-26.04
@@ -78,14 +75,14 @@ jobs:
       USE_DASHBOARD: ${{ github.event.inputs.use_dashboard == 'true' || 'false' }}
     services:
       postgres:
-        image: ghcr.io/apache/superset/ci/postgres:17-alpine
+        image: postgres:17-alpine
         env:
           POSTGRES_USER: superset
           POSTGRES_PASSWORD: superset
         ports:
           - 15432:5432
       redis:
-        image: ghcr.io/apache/superset/ci/redis:7-alpine
+        image: redis:7-alpine
         ports:
           - 16379:6379
     steps:
@@ -186,14 +183,14 @@ jobs:
       GITHUB_TOKEN: ${{ github.token }}
     services:
       postgres:
-        image: ghcr.io/apache/superset/ci/postgres:17-alpine
+        image: postgres:17-alpine
         env:
           POSTGRES_USER: superset
           POSTGRES_PASSWORD: superset
         ports:
           - 15432:5432
       redis:
-        image: ghcr.io/apache/superset/ci/redis:7-alpine
+        image: redis:7-alpine
         ports:
           - 16379:6379
     steps:

.github/workflows/superset-frontend.yml

@@ -212,100 +212,3 @@ jobs:
       - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
         with:
           expand-composite-actions: true
-
-  # Compares a PR's own bundle size against the last nightly-recorded
-  # baseline (see frontend-bundle-size-nightly.yml, which owns actually
-  # persisting new baselines). PR-only: a push to master doesn't need this
-  # check re-run against itself, and re-persisting the baseline on every
-  # push to master -- which happens many times a day -- would burn a full
-  # production build for no benefit nightly refresh doesn't already cover.
-  bundle-size:
-    needs: frontend-build
-    if: needs.frontend-build.outputs.should-run == 'true' && github.event_name == 'pull_request'
-    runs-on: ubuntu-26.04
-    timeout-minutes: 15
-    permissions:
-      contents: read
-      pull-requests: write
-    steps:
-      - name: Checkout Code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
-
-      - name: Download Docker Image Artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: docker-image
-
-      - name: Load Docker Image
-        run: |
-          zstd -d < docker-image.tar.zst | docker load
-
-      # webpack's persistent filesystem cache (superset-frontend/webpack.config.js)
-      # turns a warm production build into ~20s instead of several minutes,
-      # but GH-hosted runners are fresh VMs with nothing carried over between
-      # jobs -- without restoring it explicitly, every single PR would pay
-      # the full cold-build cost. Keyed on the same files webpack's own
-      # `buildDependencies` invalidates on, so a stale cache is never used.
-      - name: Restore webpack build cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: superset-frontend/.temp_cache
-          key: >-
-            webpack-prod-cache-${{ hashFiles('superset-frontend/package-lock.json',
-            'superset-frontend/babel.config.js', 'superset-frontend/tsconfig.json',
-            'superset-frontend/webpack.config.js') }}
-
-      # Only ever pull the last recorded data point off the cache, keyed by
-      # run ID -- `restore-keys` prefix-matches the most recently created
-      # entry, which is always the latest nightly run. Absent before the
-      # first nightly run ever happens; benchmark-action starts a fresh
-      # history in that case.
-      - name: Restore bundle size history
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: bundle-size-history.json
-          key: bundle-size-history-${{ github.run_id }}
-          restore-keys: |
-            bundle-size-history-
-
-      - name: Build production bundle with stats
-        run: |
-          mkdir -p ${{ github.workspace }}/superset-frontend/bundle-stats
-          mkdir -p ${{ github.workspace }}/superset-frontend/.temp_cache
-          docker run \
-          -v ${{ github.workspace }}/superset-frontend/bundle-stats:/app/superset-frontend/bundle-stats \
-          -v ${{ github.workspace }}/superset-frontend/.temp_cache:/app/superset-frontend/.temp_cache \
-          --rm $TAG \
-          bash -c \
-          "npm i && BUNDLE_SIZE_STATS=true npm run build -- --json=bundle-stats/stats.json"
-
-      - name: Summarize bundle size
-        run: |
-          node superset-frontend/scripts/bundle-size-summary.js \
-            superset-frontend/bundle-stats/stats.json > bundle-size-summary.json
-          rm -rf superset-frontend/bundle-stats
-
-      # Comparison + alert only -- this job never persists. See
-      # frontend-bundle-size-nightly.yml for why.
-      #
-      # comment-on-alert is gated to same-repo PRs: on a fork PR,
-      # GITHUB_TOKEN is forced read-only regardless of the `permissions`
-      # block above, so once the alert threshold is crossed the action's
-      # `pulls.createReview` call 403s. That error isn't gated by
-      # fail-on-alert (which only governs the deliberate alert-threshold
-      # failure) -- it propagates and fails the job outright. Fork PRs
-      # still get the comparison via the job summary (summary-always).
-      - name: Compare bundle size against nightly baseline
-        uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1
-        with:
-          tool: customSmallerIsBetter
-          output-file-path: bundle-size-summary.json
-          external-data-json-path: bundle-size-history.json
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          comment-on-alert: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
-          alert-threshold: "110%"
-          fail-on-alert: false
-          summary-always: true

.github/workflows/superset-helm-release.yml

@@ -27,9 +27,6 @@ concurrency:
   group: helm-release
   cancel-in-progress: false
 
-permissions:
-  contents: read
-
 jobs:
   release:
     runs-on: ubuntu-26.04

.github/workflows/superset-playwright.yml

@@ -22,9 +22,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
-
 jobs:
   changes:
     runs-on: ubuntu-26.04

.github/workflows/superset-python-integrationtest.yml

@@ -53,7 +53,9 @@ jobs:
         mysql+mysqldb://superset:superset@127.0.0.1:13306/superset?charset=utf8mb4&binary_prefix=true
     services:
       mysql:
-        image: ghcr.io/apache/superset/ci/mysql:8.0
+        image: mysql:8.0
+        # Authenticated pulls use our higher Docker Hub rate limit. Empty on
+        # fork PRs (secrets unavailable) -> runner falls back to anonymous.
         env:
           MYSQL_ROOT_PASSWORD: root
         ports:
@@ -64,7 +66,7 @@ jobs:
           --health-timeout=5s
           --health-retries=5
       redis:
-        image: ghcr.io/apache/superset/ci/redis:7-alpine
+        image: redis:7-alpine
         options: --entrypoint redis-server
         ports:
           - 16379:6379
@@ -141,7 +143,7 @@ jobs:
       SUPERSET__SQLALCHEMY_DATABASE_URI: postgresql+psycopg2://superset:superset@127.0.0.1:15432/superset
     services:
       postgres:
-        image: ghcr.io/apache/superset/ci/postgres:17-alpine
+        image: postgres:17-alpine
         env:
           POSTGRES_USER: superset
           POSTGRES_PASSWORD: superset
@@ -150,7 +152,7 @@ jobs:
           # GitHub action runner's default installations
           - 15432:5432
       redis:
-        image: ghcr.io/apache/superset/ci/redis:7-alpine
+        image: redis:7-alpine
         ports:
           - 16379:6379
     steps:
@@ -200,7 +202,7 @@ jobs:
         sqlite:///${{ github.workspace }}/.temp/examples.db?check_same_thread=true
     services:
       redis:
-        image: ghcr.io/apache/superset/ci/redis:7-alpine
+        image: redis:7-alpine
         ports:
           - 16379:6379
     steps:

.github/workflows/superset-python-presto-hive.yml

@@ -14,9 +14,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
-
 jobs:
   changes:
     runs-on: ubuntu-26.04
@@ -52,7 +49,7 @@ jobs:
       SUPERSET__SQLALCHEMY_EXAMPLES_URI: presto://localhost:15433/memory/default
     services:
       postgres:
-        image: ghcr.io/apache/superset/ci/postgres:17-alpine
+        image: postgres:17-alpine
         env:
           POSTGRES_USER: superset
           POSTGRES_PASSWORD: superset
@@ -61,7 +58,7 @@ jobs:
           # GitHub action runner's default installations
           - 15432:5432
       presto:
-        image: ghcr.io/apache/superset/ci/presto:350-e.6
+        image: starburstdata/presto:350-e.6
         env:
           POSTGRES_USER: superset
           POSTGRES_PASSWORD: superset
@@ -70,7 +67,7 @@ jobs:
           # GitHub action runner's default installations
           - 15433:8080
       redis:
-        image: ghcr.io/apache/superset/ci/redis:7-alpine
+        image: redis:7-alpine
         ports:
           - 16379:6379
     steps:
@@ -116,7 +113,7 @@ jobs:
       UPLOAD_FOLDER: /tmp/.superset/uploads/
     services:
       postgres:
-        image: ghcr.io/apache/superset/ci/postgres:17-alpine
+        image: postgres:17-alpine
         env:
           POSTGRES_USER: superset
           POSTGRES_PASSWORD: superset
@@ -125,7 +122,7 @@ jobs:
           # GitHub action runner's default installations
           - 15432:5432
       redis:
-        image: ghcr.io/apache/superset/ci/redis:7-alpine
+        image: redis:7-alpine
         ports:
           - 16379:6379
     steps:

.github/workflows/superset-python-unittest.yml

@@ -75,18 +75,13 @@ jobs:
           SUPERSET_SECRET_KEY: not-a-secret
         run: |
           pytest --durations-min=0.5 --cov-report= --cov=superset ./tests/common ./tests/unit_tests --cache-clear --maxfail=50 --junit-xml=test-results/junit-unit.xml
-      # COVERAGE_FILE keeps these scoped gates off the default .coverage that
-      # the step above wrote. pytest-cov starts a fresh data file per run, so
-      # without it the last gate replaces the full-suite data and the report
-      # uploaded below contains only that gate's subtree -- every other file
-      # then reads as uncovered, and patch coverage on an unrelated PR is 0%.
       - name: Python 100% coverage unit tests
         env:
           SUPERSET_TESTENV: true
           SUPERSET_SECRET_KEY: not-a-secret
         run: |
-          COVERAGE_FILE="${RUNNER_TEMP}/.coverage.sql" pytest --durations-min=0.5 --cov=superset/sql/ ./tests/unit_tests/sql/ --cache-clear --cov-fail-under=100 --junit-xml=test-results/junit-sql-coverage.xml
-          COVERAGE_FILE="${RUNNER_TEMP}/.coverage.semantic_layers" pytest --durations-min=0.5 --cov=superset/semantic_layers/ ./tests/unit_tests/semantic_layers/ --cache-clear --cov-fail-under=100 --junit-xml=test-results/junit-semantic-layers-coverage.xml
+          pytest --durations-min=0.5 --cov=superset/sql/ ./tests/unit_tests/sql/ --cache-clear --cov-fail-under=100 --junit-xml=test-results/junit-sql-coverage.xml
+          pytest --durations-min=0.5 --cov=superset/semantic_layers/ ./tests/unit_tests/semantic_layers/ --cache-clear --cov-fail-under=100 --junit-xml=test-results/junit-semantic-layers-coverage.xml
       - name: Upload code coverage
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:

.github/workflows/supersetbot.yml

@@ -13,9 +13,6 @@ on:
         required: true
         type: string
 
-permissions:
-  contents: read
-
 jobs:
   supersetbot:
     runs-on: ubuntu-26.04

.github/workflows/welcome-new-users.yml

@@ -5,9 +5,6 @@ on:
   pull_request_target:
     types: [opened]
 
-permissions:
-  contents: read
-
 jobs:
   welcome:
     runs-on: ubuntu-slim

README.md

@@ -31,8 +31,6 @@ under the License.
 [![Open PRs](https://img.shields.io/github/issues-pr/apache/superset)](https://github.com/apache/superset/pulls)
 [![Get on Slack](https://img.shields.io/badge/slack-join-orange.svg)](https://bit.ly/join-superset-slack)
 [![Documentation](https://img.shields.io/badge/docs-apache.org-blue.svg)](https://superset.apache.org)
-[![Storybook](https://img.shields.io/badge/storybook-live-ff4785.svg)](https://superset-storybook.netlify.app)
-[![Bundle Analyzer](https://img.shields.io/badge/bundle%20analyzer-nightly-8dd6f9.svg)](https://superset-bundle-analyzer.netlify.app)
 
 <picture width="500">
   <source

UPDATING.md

@@ -24,31 +24,6 @@ assists people when migrating to a new version.
 
 ## Next
 
-- `SAMPLES_ROW_LIMIT` is now the default for `/datasource/samples` requests without a valid explicit `per_page`, rather than a hard per-request ceiling; explicit limits are honored up to the existing global row-limit ceiling, matching `/chart/data` SAMPLES requests.
-
-### MCP tool results preserve stored string values
-
-Structured MCP tool results no longer add `<UNTRUSTED-CONTENT>` wrappers or
-rewrite delimiter-looking text inside string fields. Tool-result content remains
-user-controlled data, but clients must convey that trust boundary outside domain
-values instead of recognizing or removing marker strings.
-
-Clients that handled the former delimiter convention should stop stripping marker
-text: the same text can be legitimate stored content. Response models and content
-types are unchanged, and no metadata-database migration is required. Automated
-read-modify-write workflows should be paused or pinned away from older instances
-until every serving instance is upgraded; a mixed-version response has no reliable
-signal that tells a client whether its text is decorated. Redis-backed MCP response
-caches use a new internal namespace after the upgrade, so upgraded instances do not
-reuse older cached results.
-
-Values that a client already wrote back with presentation wrappers cannot be
-distinguished safely from intentional content. Operators should review possible
-`<UNTRUSTED-CONTENT>` / `</UNTRUSTED-CONTENT>` wrappers and
-`[ESCAPED-UNTRUSTED-CONTENT-OPEN]` /
-`[ESCAPED-UNTRUSTED-CONTENT-CLOSE]` substitutions rather than applying an automatic
-marker-removal migration.
-
 ### OAuth2 database callback metrics include their outcome
 
 The unqualified `DatabaseRestApi.oauth2` StatsD counter has been replaced with
@@ -56,7 +31,6 @@ The unqualified `DatabaseRestApi.oauth2` StatsD counter has been replaced with
 `DatabaseRestApi.oauth2.error`. Update monitoring rules and dashboards that consume
 the old counter to use the outcome-specific replacements.
 
-- [42930](https://github.com/apache/superset/pull/42930): Dataset import data-URI fetches no longer honor an HTTP(S) proxy when `DATASET_IMPORT_ALLOW_INTERNAL_DATA_URLS` is `False` (the default): the connection is now made directly to the destination so the peer-address check validates the real target instead of a proxy's. Deployments that require an egress proxy to reach legitimate external data URLs for dataset import should set `DATASET_IMPORT_ALLOW_INTERNAL_DATA_URLS = True` or otherwise ensure those URLs resolve without one.
 - [42935](https://github.com/apache/superset/pull/42935): The MCP service now refuses to start (`MCPAuthConfigError`) when `MCP_JWT_ISSUER` trusts more than one issuer and no `MCP_USER_RESOLVER` is configured, instead of only logging a warning. This was already a documented misconfiguration (the default resolver isn't issuer-scoped, so distinct trusted issuers minting the same username/email would resolve to the same Superset user); deployments trusting multiple issuers must configure an `MCP_USER_RESOLVER` that derives its identity from the token's `iss` claim before upgrading. Single-issuer deployments are unaffected.
 - [42393](https://github.com/apache/superset/pull/42393): Exported dataset YAML now carries a `uuid` for each metric and column so that custom folder assignments (which reference metrics/columns by UUID) survive an import into another workspace. This affects any export bundle that contains datasets, not just a dataset export: chart, dashboard, database and full-asset exports all embed the same dataset YAML, so a dashboard exported from this release also fails to import into an older one even though no dataset was exported directly. As with `folders` and `currency_code_column`, the affected `datasets/` files fail schema validation (`Unknown field: uuid`) when imported into Superset releases that predate this change; regenerate or hand-edit exports for older targets in mixed-version fleets.
 - [42300](https://github.com/apache/superset/pull/42300): Timeseries charts (line/area/bar) with a Y-axis bound in effect — either an explicit `yAxisBounds` or one derived from `truncateYAxis` — now clamp out-of-range data points to that bound instead of letting ECharts drop the point (and the line segments around it) entirely. Any existing chart with a configured Y-axis bound and data outside it will look different after upgrading: a gap becomes a point pinned to the boundary. The clamp also rewrites the value ECharts reads for that point's tooltip and data label, so the displayed value is the bound rather than the true observation.
@@ -125,23 +99,6 @@ dialect; each package's constraint in `pyproject.toml` documents why.
 No application-level configuration changes are required for deployments
 that don't touch SQLAlchemy directly.
 
-### New metric aggregates: MEDIAN, Sample Standard Deviation, Sample Variance
-
-`MEDIAN`, `STDDEV_SAMP`, and `VAR_SAMP` are now available anywhere a metric
-aggregate is chosen (every chart type, SQL Lab, MCP), not only in Pivot
-Table's controls. Support is opt-in per database engine *spec class*,
-verified against a live instance before being enabled: Postgres, MySQL
-(`STDDEV_SAMP`/`VAR_SAMP` only, no `MEDIAN`), DuckDB, and Redshift (inherits
-Postgres's support, not yet separately verified) ship enabled in this
-release. Engine specs that subclass one of those (e.g. MariaDB, Aurora
-MySQL/Postgres, TimescaleDB) inherit the same support, on the same
-not-yet-independently-verified basis. Picking one of these aggregates on a
-database that has not opted in returns a clear "not supported on this
-database" error rather than a failed query. See
-`docs/sip/median-stddev-variance-aggregates.md` for the full design
-rationale, including why this is safe to add without reintroducing the
-totals/subtotals correctness bug fixed by #41184 (SIP-216).
-
 ### Soft delete is on by default, and purging is live
 
 `SOFT_DELETE` now ships **on** (`DEFAULT_FEATURE_FLAGS`), so deleting a

docs/admin_docs/configuration/configuring-superset.mdx

@@ -97,54 +97,6 @@ for more information on how to configure it.
 
 At the very least, you'll want to change `SECRET_KEY` and `SQLALCHEMY_DATABASE_URI`. Continue reading for more about each of these.
 
-## Localizing D3 date and time labels
-
-`BABEL_DEFAULT_LOCALE` controls Superset's application translations, while
-`D3_TIME_FORMAT` provides localized date and time names to visualizations that
-use the D3 formatter registry, including Calendar Heatmap. Configure both when
-you want the application and chart labels to use the same locale.
-
-`D3_TIME_FORMAT` accepts partial overrides. For example, Russian month names
-can be configured in `superset_config.py` as follows:
-
-```python
-BABEL_DEFAULT_LOCALE = "ru"
-
-D3_TIME_FORMAT = {
-    "months": [
-        "Январь",
-        "Февраль",
-        "Март",
-        "Апрель",
-        "Май",
-        "Июнь",
-        "Июль",
-        "Август",
-        "Сентябрь",
-        "Октябрь",
-        "Ноябрь",
-        "Декабрь",
-    ],
-    "shortMonths": [
-        "Янв",
-        "Фев",
-        "Мар",
-        "Апр",
-        "Май",
-        "Июн",
-        "Июл",
-        "Авг",
-        "Сен",
-        "Окт",
-        "Ноя",
-        "Дек",
-    ],
-}
-```
-
-Restart Superset after changing `superset_config.py` so the frontend receives
-the updated formatter configuration.
-
 ## Chart-data query timing
 
 Set `CHART_DATA_INCLUDE_TIMING = True` to add an optional versioned timing object

docs/admin_docs/configuration/mcp-server.mdx

@@ -576,7 +576,7 @@ MCP_CACHE_CONFIG = {
 | Key                  | Default   | Description                                                 |
 | -------------------- | --------- | ----------------------------------------------------------- |
 | `enabled`            | `False`   | Enable response caching                                     |
-| `CACHE_KEY_PREFIX`   | `None`    | Base prefix for shared Redis; Superset appends an internal response-contract namespace |
+| `CACHE_KEY_PREFIX`   | `None`    | Optional prefix for cache keys (useful for shared Redis)    |
 | `list_tools_ttl`     | `300`     | Cache TTL in seconds for `tools/list`                       |
 | `list_resources_ttl` | `300`     | Cache TTL for `resources/list`                              |
 | `list_prompts_ttl`   | `300`     | Cache TTL for `prompts/list`                                |
@@ -718,34 +718,6 @@ Every MCP request passes through a middleware stack before reaching the tool fun
 
 Additional middleware classes (`RateLimitMiddleware`, `FieldPermissionsMiddleware`, `PrivateToolMiddleware`) are implemented in `superset/mcp_service/middleware.py` but are not added to the default pipeline. They are available for operators who want to layer them in via a custom startup path.
 
-### Tool Result Value Contract
-
-Structured tool results preserve Superset domain values exactly. In particular,
-string fields are not wrapped in trust delimiters, and text that resembles a
-delimiter is returned as literal application data. This lets clients safely use a
-read result as the basis for an update without persisting presentation markup.
-
-All tool-result content should still be treated as user-controlled data with no
-instruction authority. MCP clients should communicate that trust boundary through
-their model instructions or presentation layer, outside the returned field values;
-fixed or generated marker strings inside a value are ambiguous and must not be used
-as a trust signal.
-
-For compatibility, clients that supported the former
-`<UNTRUSTED-CONTENT>` convention should stop recognizing or stripping those strings.
-The response schemas and content types have not changed. Because marker-looking text
-can be legitimate application data, a client cannot reliably distinguish a legacy
-decorated response from a clean one. Pause automated read-modify-write workflows, or
-route them only to upgraded instances, until every serving instance is upgraded.
-
-Redis-backed MCP response caches include an internal response-contract namespace, so
-an upgraded instance does not reuse responses cached by an older release. Older
-instances can still return legacy values while they remain in service. After the
-upgrade, review previously written values for wrapper text and both
-`[ESCAPED-UNTRUSTED-CONTENT-OPEN]` and
-`[ESCAPED-UNTRUSTED-CONTENT-CLOSE]`; do not remove these strings automatically,
-because they may be intentional content.
-
 ### Error Sanitization
 
 The `GlobalErrorHandlerMiddleware` automatically redacts sensitive information from all error messages before they reach the LLM client. The following are replaced with generic messages:
@@ -780,11 +752,7 @@ For a 3-pod Kubernetes deployment with the defaults above, expect up to 3 × (5
 Enable response caching for read-heavy workloads (dashboards/datasets that don't change frequently). With the in-memory backend (default when `MCP_STORE_CONFIG` is disabled), caching is per-process. Use Redis-backed caching for consistent cache hits across multiple pods:
 
 ```python
-MCP_CACHE_CONFIG = {
-    "enabled": True,
-    "CACHE_KEY_PREFIX": "mcp_cache_",
-    "call_tool_ttl": 3600,
-}
+MCP_CACHE_CONFIG = {"enabled": True, "call_tool_ttl": 3600}
 MCP_STORE_CONFIG = {"enabled": True, "CACHE_REDIS_URL": "redis://redis:6379/0"}
 ```
 

docs/docs/faq.mdx

@@ -46,43 +46,13 @@ import FAQSchema from '@site/src/components/FAQSchema';
       answer:
         'You need to register a free account at Mapbox.com, obtain an API key, and add it to your .env file at the key MAPBOX_API_KEY.',
     },
-    {
-      question: 'How to limit the timed refresh on a dashboard?',
-      answer:
-        'To exclude specific slices from the timed refresh process, add the timed_refresh_immune_slices key to the dashboard JSON Metadata field with the slice IDs to exclude.',
-    },
-    {
-      question: "Why does 'flask fab' or Superset freeze, hang, or not respond when started (my home directory is NFS mounted)?",
-      answer:
-        'By default, Superset creates and uses an SQLite database at ~/.superset/superset.db. SQLite is known to not work well if used on NFS due to broken file locking. Override the path with the SUPERSET_HOME environment variable or change SQLALCHEMY_DATABASE_URI in superset_config.py.',
-    },
-    {
-      question: 'What if the table schema changed?',
-      answer:
-        'Go to Data -> Datasets, click the edit icon next to the dataset whose schema has changed, and hit Sync columns from source from the Columns tab. The new columns will get merged.',
-    },
     {
       question: 'What database engine can I use as a backend for Superset?',
       answer:
         'Superset is tested using MySQL, PostgreSQL, and SQLite backends for storing its internal metadata. While Superset supports many databases as data sources, only these are recommended for the metadata store in production.',
     },
     {
-      question: 'How can I configure OAuth authentication and authorization?',
-      answer:
-        'Take a look at the Flask-AppBuilder OAuth configuration example, which shows how to configure OAuth authentication and authorization in Superset.',
-    },
-    {
-      question: 'Is there a way to force the dashboard to use specific colors?',
-      answer:
-        'It is possible on a per-dashboard basis by providing a mapping of labels to colors in the JSON Metadata attribute using the label_colors key. You can use a full hex color, a named color, or the index in the current color palette.',
-    },
-    {
-      question: 'How do I expand all chart descriptions on a dashboard by default?',
-      answer:
-        'Add the expand_all_slices key to the dashboard JSON Metadata field with a value of true. Charts that have already been manually expanded or collapsed keep that per-chart override regardless of the setting.',
-    },
-    {
-      question: 'Does Superset work with [insert database engine here]?',
+      question: 'Does Superset work with my database?',
       answer:
         'Superset supports any database with a Python SQLAlchemy dialect and DBAPI driver. Check the Connecting to Databases documentation for the full list of supported databases.',
     },
@@ -91,30 +61,15 @@ import FAQSchema from '@site/src/components/FAQSchema';
       answer:
         'Yes, Superset has a public REST API documented using Swagger. Enable FAB_API_SWAGGER_UI in superset_config.py to access interactive API documentation at /swagger/v1.',
     },
-    {
-      question: 'How can I see usage statistics (e.g., monthly active users)?',
-      answer:
-        'This functionality is not included with Superset, but you can extract and analyze the logs table in Superset\u2019s metadata database to see what actions have occurred.',
-    },
-    {
-      question: 'What does Hours Offset in the Edit Dataset view do?',
-      answer:
-        'In the Edit Dataset view, the hours offset lets you configure the number of hours to be added or subtracted from the time column. This can be used, for example, to convert UTC time to local time.',
-    },
     {
       question: 'Does Superset collect any telemetry data?',
       answer:
         'Superset uses Scarf by default to collect basic telemetry data to help maintainers understand version usage. Users can opt out by setting the SCARF_ANALYTICS environment variable to false.',
     },
     {
-      question: 'Does Superset have an archive panel or trash bin from which a user can recover deleted assets?',
+      question: 'Does Superset have a trash bin to recover deleted assets?',
       answer:
-        'No. Currently, there is no way to recover a deleted Superset dashboard, chart, dataset, or database from the UI. It is recommended to take periodic backups of the metadata database and use export functionality for recovery.',
-    },
-    {
-      question: 'I ran a security scan of the Superset container image and it showed dozens of "high" and "critical" vulnerabilities! Can you release a version of Superset without these?',
-      answer:
-        'These are dependency CVEs in software that Superset uses, mostly in the Linux kernel or Python. Superset addresses them by regularly updating dependencies and welcomes pull requests that fix dependency CVEs. The Superset security team focuses primarily on vulnerabilities in Superset itself.',
+        'No, there is no built-in way to recover deleted dashboards, charts, or datasets. It is recommended to take periodic backups of the metadata database and use export functionality for recovery.',
     },
   ]}
 />
@@ -259,7 +214,8 @@ frontend falls back to a built-in default of `5000` milliseconds.
 SUPERSET_DASHBOARD_MANUAL_REFRESH_STAGGER_MS = 0
 ```
 
-## Why does `flask fab` or Superset freeze, hang, or not respond when started (my home directory is NFS mounted)?
+**Why does ‘flask fab’ or superset freeze/hang/not responding when started (my home directory is
+NFS mounted)?**
 
 By default, Superset creates and uses an SQLite database at `~/.superset/superset.db`. SQLite is
 known to [not work well if used on NFS](https://www.sqlite.org/lockingv3.html) due to broken file

docs/docs/using-superset/recently-archived.mdx

@@ -11,11 +11,6 @@ When soft-delete is enabled, deleting a chart, dashboard, or dataset archives it
 instead of removing it permanently. The **Recently Archived** view lets owners
 and admins find archived objects and restore them.
 
-A chart used by an alert or report cannot be archived while that dependency
-exists. In the chart list view, the archive confirmation lists the alerts and
-reports that use the chart; a blocked attempt names them and asks you to
-detach or delete them first.
-
 :::note
 
 This view is gated by the `SOFT_DELETE` feature flag. When the flag is off the

docs/package.json

@@ -58,14 +58,14 @@
     "@fontsource/inter": "^5.3.0",
     "@mdx-js/react": "^3.1.1",
     "@saucelabs/theme-github-codeblock": "^0.3.0",
-    "@storybook/addon-docs": "^10.5.8",
+    "@storybook/addon-docs": "^10.5.7",
     "@superset-ui/core": "^0.20.4",
     "@swc/core": "^1.15.47",
-    "antd": "^6.6.0",
-    "baseline-browser-mapping": "^2.11.13",
-    "caniuse-lite": "^1.0.30001809",
-    "docusaurus-plugin-openapi-docs": "^5.2.0",
-    "docusaurus-theme-openapi-docs": "^5.2.0",
+    "antd": "^6.5.4",
+    "baseline-browser-mapping": "^2.11.12",
+    "caniuse-lite": "^1.0.30001807",
+    "docusaurus-plugin-openapi-docs": "^5.1.3",
+    "docusaurus-theme-openapi-docs": "^5.1.3",
     "js-yaml": "^5.2.3",
     "json-bigint": "^1.0.0",
     "prism-react-renderer": "^2.4.1",
@@ -77,8 +77,8 @@
     "react-table": "^7.8.0",
     "remark-import-partial": "^0.0.2",
     "reselect": "^5.2.0",
-    "storybook": "^10.5.8",
-    "swagger-ui-react": "^5.32.13",
+    "storybook": "^10.5.7",
+    "swagger-ui-react": "^5.32.12",
     "swc-loader": "^0.2.7",
     "tinycolor2": "^1.4.2",
     "unist-util-visit": "^5.1.0"
@@ -89,14 +89,14 @@
     "@eslint/js": "^9.39.2",
     "@types/js-yaml": "^4.0.9",
     "@types/react": "^19.1.8",
-    "@typescript-eslint/eslint-plugin": "^8.67.0",
-    "@typescript-eslint/parser": "^8.67.0",
+    "@typescript-eslint/eslint-plugin": "^8.66.0",
+    "@typescript-eslint/parser": "^8.66.0",
     "eslint": "^9.39.2",
     "eslint-plugin-react": "^7.37.5",
-    "globals": "^17.11.0",
-    "oxfmt": "^0.63.0",
+    "globals": "^17.9.0",
+    "oxfmt": "^0.62.0",
     "typescript": "~6.0.3",
-    "typescript-eslint": "^8.67.0",
+    "typescript-eslint": "^8.66.0",
     "webpack": "^5.109.2"
   },
   "browserslist": {

docs/sip/median-stddev-variance-aggregates.md

@@ -1,236 +0,0 @@
-<!--
-Licensed to the Apache Software Foundation (ASF) under one
-or more contributor license agreements.  See the NOTICE file
-distributed with this work for additional information
-regarding copyright ownership.  The ASF licenses this file
-to you under the Apache License, Version 2.0 (the
-"License"); you may not use this file except in compliance
-with the License.  You may obtain a copy of the License at
-
-  http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing,
-software distributed under the License is distributed on an
-"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-KIND, either express or implied.  See the License for the
-specific language governing permissions and limitations
-under the License.
--->
-
-# SIP: System-wide MEDIAN, Sample Standard Deviation, and Sample Variance metric aggregates
-
-## [DRAFT — proposal for discussion]
-
-This document now has an accompanying implementation in this PR, for the
-proposed mechanism plus a first, empirically-verified engine set (Postgres,
-MySQL, DuckDB, Redshift by inheritance). It is intended to seed discussion on
-whether this is the right shape and scope before it goes up for a formal SIP
-vote, not to pre-empt that discussion, the code exists so reviewers have a
-concrete design to react to rather than a description of one.
-
-## Motivation
-
-Before #41184 (SIP-216, the non-additive-totals fix), the Pivot Table chart
-exposed an "Aggregation function" control with 18 choices, including
-`Median`, `Sample Standard Deviation`, `Sample Variance`, `First`, `Last`,
-`Count Unique Values`, and `List Unique Values`. #41184 deleted that control
-wholesale, and deliberately so: it re-aggregated already-aggregated cell
-values to compute totals/subtotals, which is exactly the class of bug
-SIP-216 fixed (summing per-group averages, averaging per-group medians, etc.
-produces silently wrong totals). #42761 subsequently restored the one piece
-of that control's functionality that was cleanly separable from the
-correctness bug, the "show as % of row/column/total" display option,
-redesigned as a decoupled, post-hoc-only `showValuesAs` control.
-
-A user has since noticed that several of the other pre-#41184 options never
-came back. Checking today's metric aggregate list (`AVG, COUNT,
-COUNT_DISTINCT, MAX, MIN, SUM`, see
-`superset-frontend/packages/superset-ui-core/src/query/types/Metric.ts`),
-most of these have a reasonable equivalent already: `Count Unique Values`
-maps to `COUNT_DISTINCT`; `Count`/`Average`/`Max`/`Min` are already standard
-aggregates; the two "fraction of" variants are already covered by
-`showValuesAs`. But `Median`, `Sample Standard Deviation`, and `Sample
-Variance` have no equivalent today anywhere in Superset, not just in Pivot
-Table, in any chart type, since the aggregate list is shared across the
-whole app.
-
-This is a real, currently-live gap, not a hypothetical one:
-`superset/mcp_service/chart/chart_utils.py`, `schemas.py`, and
-`prompts/create_chart_guided.py` already treat `STDDEV`, `VAR`, `MEDIAN`,
-and `PERCENTILE` as valid aggregate values in their own validation and
-documentation, but those values are never recognized by
-`superset/connectors/sqla/models.py`'s `sqla_aggregations` dict (the actual
-mapping from aggregate name to SQL), so an AI agent using the MCP tool to
-build a chart with `"aggregate": "STDDEV"` today creates a chart that
-**errors at query time** with "Adhoc metric aggregate is invalid." This SIP
-proposes closing that gap for real, at the source, rather than patching
-around it in MCP.
-
-## Proposed change
-
-Add `MEDIAN`, `STDDEV_SAMP`, and `VAR_SAMP` as first-class, system-wide
-metric aggregates, available anywhere a metric aggregate is chosen (every
-chart type, SQL Lab metric picker, MCP), not as a Pivot-Table-specific
-control.
-
-**Why this is safe with respect to SIP-216, and needs no Pivot-Table-specific
-code at all:** Pivot Table's non-additive-totals machinery
-(`superset-frontend/plugins/plugin-chart-pivot-table/src/plugin/utilities.ts`)
-already classifies any metric aggregate not in `ADDITIVE_AGGREGATES = {SUM,
-COUNT, MIN, MAX}` as non-additive, which routes totals/subtotals through the
-correct DB-`GROUPING SETS`-rollup path rather than client-side
-re-aggregation (`AVG` and `COUNT_DISTINCT` already go through this path
-today). `MEDIAN`/`STDDEV_SAMP`/`VAR_SAMP` fall into that bucket
-automatically, with zero changes needed to the additivity logic. So once
-these are valid, buildable SQL aggregates, Pivot Table (and every other
-chart) gets correct behavior for free. This is the version of "restore the
-control" that does not reopen the bug that was just fixed.
-
-**Where the actual change needs to land, and what this PR does:**
-
-1. **Done.** `superset-frontend/packages/superset-ui-core/src/query/types/Metric.ts`,
-   extended the `Aggregate` type.
-2. **Done.** `superset-frontend/src/explore/constants.ts`, added to `AGGREGATES`
-   (drives `AGGREGATES_OPTIONS`, the dropdown in `AdhocMetricEditPopover`).
-3. **Done**, but not consolidated. `superset/connectors/sqla/models.py`
-   (`sqla_aggregations`) and `superset/models/helpers.py`
-   (`ExploreMixin.sqla_aggregations`) are both wired to consult the new
-   `BaseEngineSpec.get_extended_aggregation_func`, in addition to their
-   existing 6-aggregate dict, so neither's original, already-tested behavior
-   changed. They remain two separate dicts, consolidating them into one
-   source of truth is left as a follow-up (see Open questions).
-4. **Done**, and it surfaced a second, smaller bug on top of the one this SIP
-   opened with: MCP's own aggregate names (`STDDEV`, `VAR`) never matched any
-   real Superset aggregate, before or after this PR, they were always going
-   to error regardless of what this SIP does. `superset/mcp_service/chart/*`
-   now accepts the old shorthand as an alias, normalized to the real,
-   unambiguous names (`STDDEV_SAMP`, `VAR_SAMP`) this PR ships, and the guided
-   prompt text points at the correct names going forward. `MEDIAN`/
-   `PERCENTILE` were already spelled correctly in MCP; `PERCENTILE` remains
-   unimplemented (it needs a parameter this schema has no field for) and is
-   unchanged by this PR, out of scope here.
-
-**The part that needs real engineering care, this must not be a blind
-`sa.func.MEDIAN` / `sa.func.STDDEV_SAMP` / `sa.func.VAR_SAMP`:**
-
-`sqla_aggregations` today is a flat, engine-unaware dict (`sa.func.AVG`,
-etc., SQLAlchemy emits whatever function name it is given, with zero
-validation that the target dialect actually has it). Superset already has
-precedent for exactly this class of per-engine capability difference:
-`BaseEngineSpec.supports_grouping_sets` and `_time_grain_expressions`, both
-introduced by #41184 itself. This SIP proposes the same shape, a new
-per-engine-overridable mechanism (for example
-`BaseEngineSpec.get_aggregate_sql(aggregate, column)` with a sensible
-default, overridden per engine spec where the default does not hold),
-rather than a single hardcoded dict.
-
-Verified findings so far (via `sqlglot.transpile`, cross-checked against
-known engine docs; **not** exhaustively tested against live databases, that
-is necessary follow-up work this SIP alone cannot complete):
-
-| Engine | `MEDIAN(x)` | `STDDEV_SAMP(x)` | `VAR_SAMP(x)` |
-|---|---|---|---|
-| Postgres | `PERCENTILE_CONT(0.5) WITHIN GROUP (ORDER BY x)` | native | native |
-| MySQL | no native equivalent, needs explicit "unsupported" handling, not a blind emit | native | MySQL's `VARIANCE()` is an alias for `VAR_POP` (population), not `VAR_SAMP` (sample); a naive dialect-name substitution would silently compute the wrong statistic and needs an explicit, verified expression instead |
-| SQLite | only if the specific build was compiled with the (non-default) `SQLITE_ENABLE_PERCENTILE` extension (added in SQLite 3.43, 2023), cannot be assumed available | not available in core SQLite | not available in core SQLite |
-| BigQuery / Snowflake / DuckDB / Redshift / Oracle / T-SQL / Databricks / Spark | native `MEDIAN(x)` | native | native on BigQuery/Snowflake/Databricks/Spark, where `VARIANCE` is correctly sample variance; T-SQL has no function named `VARIANCE` at all and needs `VAR(x)` instead |
-| Trino / Presto / Hive | `PERCENTILE_CONT` / `approx_percentile` (dialect- and exactness-dependent) | native | `variance` is correctly sample variance per Trino/Presto docs |
-
-This table is deliberately not exhaustive, Superset has roughly 75
-`db_engine_specs` files. The proposed default (`BaseEngineSpec`) should be
-the safe choice (mark unsupported, surface a clear user-facing error) rather
-than an optimistic one, with individual engine specs opting in once
-verified. Ship for the handful of engines above first, extend
-opportunistically.
-
-**`Count Unique Values`, `First`, `Last`, `List Unique Values`, explicitly
-out of scope for this SIP:**
-
-- `Count Unique Values` needs no work, it is already `COUNT_DISTINCT`.
-- `First`/`Last` have no well-defined, unambiguous meaning as a plain
-  `GROUP BY` aggregate without an explicit ordering; most engines only
-  support this via window functions (`FIRST_VALUE`/`LAST_VALUE` `OVER
-  (ORDER BY ...)`) or do not support it as a simple aggregate at all
-  (Postgres has neither built in). Restoring this properly would mean
-  designing an "order by" sub-control on the metric, a real, separate
-  feature, not a one-line aggregate addition. Proposed as a follow-up SIP if
-  there is demand.
-- `List Unique Values` maps to the `STRING_AGG`/`GROUP_CONCAT`/`LISTAGG`/
-  `ARRAY_AGG(DISTINCT ...)` family, real dialect differences, plus an open
-  UX question (unbounded cell content for high-cardinality columns).
-  Proposed as a follow-up SIP.
-
-## New or changed public interfaces
-
-- New `Aggregate` values (`MEDIAN`, `STDDEV_SAMP`, `VAR_SAMP`) selectable
-  anywhere the standard metric control appears, every chart type, not just
-  Pivot Table.
-- New `BaseEngineSpec` extensibility point for per-engine aggregate SQL
-  generation (exact shape TBD in implementation, likely mirrors
-  `_time_grain_expressions`).
-- No REST API surface changes beyond the existing metric aggregate field
-  accepting new values.
-
-## Migration plan and compatibility
-
-No new tables/columns needed for the aggregate addition itself.
-
-Restoring prior chart settings, the way #42761 restored `show_values_as` for
-charts that had it before #41184, is murkier here than it was for that PR
-and needs its own design pass: the old `aggregate_function` was a single
-Pivot-Table-level setting applied uniformly to every metric on the chart,
-not a per-metric property. A chart that had `aggregate_function: Median`
-before #41184, with a metric of `SUM(sales)`, was already silently wrong
-under the old architecture (that is the bug that was fixed); mechanically
-rewriting its metric to `MEDIAN(sales)` on upgrade would change what the
-chart's leaf cells display, not just its totals, which may not match user
-intent. This SIP proposes a best-effort, flagged-for-review migration
-(surface affected charts to admins rather than silently rewriting them)
-rather than a fully automatic one-to-one restoration.
-
-## Rejected alternatives
-
-- **Restoring the old `aggregateFunction` Pivot-Table control as-is.**
-  Rejected: this is the literal mechanism SIP-216 removed because it
-  reintroduces incorrect totals for non-additive metrics. Any fix has to go
-  through the metric's own aggregate, not a separate pivot-level override.
-- **Routing all metric SQL generation through `sqlglot` expression-building
-  instead of SQLAlchemy's `sa.func`.** More architecturally thorough (would
-  give correct dialect syntax for free across more of the roughly 75 engine
-  specs), but a much larger, more invasive change to a hot path used by
-  every chart query. Noted as a possible future direction, not this SIP's
-  scope; this SIP proposes the smaller, `supports_grouping_sets`-shaped
-  extensibility point instead.
-
-## Open questions
-
-- **Resolved for this PR, worth confirming as the community's preferred
-  shape:** implemented as `BaseEngineSpec._extended_aggregations` (a
-  `{aggregate_name: sqla_column -> sqla_column}` dict) plus a
-  `get_extended_aggregation_func` accessor, set on the concrete or shared
-  base engine spec class per engine (e.g. on `PostgresBaseEngineSpec` so
-  Redshift inherits it, but *not* on `PrestoBaseEngineSpec` so Hive/Spark/
-  Databricks don't silently inherit unverified behavior, mirroring how
-  `supports_grouping_sets` is opted into per-concrete-engine there today).
-  Did not route through the `superset/sql/dialects/` sqlglot-based layer;
-  that layer is for SQL Lab parsing, wiring it into chart-metric query
-  building felt like a separate, larger change from this SIP's scope.
-- **Still open, not addressed in this PR:** how aggressively should
-  `MEDIAN` degrade on engines without a native or exact equivalent?
-  Trino/Presto/Hive were left unimplemented (unsupported) specifically to
-  avoid silently answering this with an approximate function
-  (`approx_percentile`) that changes the semantics of what a user asked
-  for. If someone wants `MEDIAN` on those engines, this needs a real
-  decision: require explicit opt-in, show a UI warning, or keep it
-  disallowed.
-- **Resolved for this PR:** left the two `sqla_aggregations` dicts
-  (`connectors/sqla/models.py` and `models/helpers.py`) unconsolidated,
-  both now separately wired to the same new `get_extended_aggregation_func`
-  hook. Consolidating them into one source of truth is real but unrelated
-  cleanup, not bundled here to keep the diff reviewable.
-- **New, from implementation:** only Postgres, MySQL (partial), DuckDB, and
-  Redshift (by inheritance, unverified) ship enabled. BigQuery, Snowflake,
-  Trino, Presto, Hive, Spark, Databricks, Oracle, and T-SQL all have
-  documented (not live-verified) support per the table above but are not
-  yet wired up, each needs the same live-instance verification treatment
-  before being enabled, this PR intentionally didn't guess.

docs/static/resources/openapi.json

@@ -3407,26 +3407,22 @@
             "nullable": true,
             "type": "string"
           },
-          "description": {
-            "nullable": true,
-            "type": "string"
-          },
-          "editors": {
-            "items": {
-              "$ref": "#/components/schemas/DashboardRestApi.get_list.Subject"
-            },
-            "type": "array"
-          },
           "id": {
             "type": "integer"
           },
           "is_managed_externally": {
             "type": "boolean"
           },
+          "owners": {
+            "$ref": "#/components/schemas/DashboardRestApi.get_list.User2"
+          },
           "published": {
             "nullable": true,
             "type": "boolean"
           },
+          "roles": {
+            "$ref": "#/components/schemas/DashboardRestApi.get_list.Role"
+          },
           "slug": {
             "maxLength": 255,
             "nullable": true,
@@ -3436,10 +3432,10 @@
             "readOnly": true
           },
           "tags": {
-            "items": {
-              "$ref": "#/components/schemas/DashboardRestApi.get_list.Tag"
-            },
-            "type": "array"
+            "$ref": "#/components/schemas/DashboardRestApi.get_list.Tag"
+          },
+          "thumbnail_url": {
+            "readOnly": true
           },
           "url": {
             "readOnly": true
@@ -3448,46 +3444,21 @@
             "format": "uuid",
             "nullable": true,
             "type": "string"
-          },
-          "viewers": {
-            "items": {
-              "$ref": "#/components/schemas/DashboardRestApi.get_list.Subject1"
-            },
-            "type": "array"
           }
         },
         "type": "object"
       },
-      "DashboardRestApi.get_list.Subject": {
+      "DashboardRestApi.get_list.Role": {
         "properties": {
           "id": {
             "type": "integer"
           },
-          "label": {
-            "maxLength": 255,
+          "name": {
+            "maxLength": 64,
             "type": "string"
-          },
-          "type": {
-            "type": "integer"
           }
         },
-        "required": ["label", "type"],
-        "type": "object"
-      },
-      "DashboardRestApi.get_list.Subject1": {
-        "properties": {
-          "id": {
-            "type": "integer"
-          },
-          "label": {
-            "maxLength": 255,
-            "type": "string"
-          },
-          "type": {
-            "type": "integer"
-          }
-        },
-        "required": ["label", "type"],
+        "required": ["name"],
         "type": "object"
       },
       "DashboardRestApi.get_list.Tag": {
@@ -3540,6 +3511,23 @@
         "required": ["first_name", "last_name"],
         "type": "object"
       },
+      "DashboardRestApi.get_list.User2": {
+        "properties": {
+          "first_name": {
+            "maxLength": 64,
+            "type": "string"
+          },
+          "id": {
+            "type": "integer"
+          },
+          "last_name": {
+            "maxLength": 64,
+            "type": "string"
+          }
+        },
+        "required": ["first_name", "last_name"],
+        "type": "object"
+      },
       "DashboardRestApi.post": {
         "properties": {
           "certification_details": {
@@ -16518,7 +16506,7 @@
                     },
                     "result": {
                       "items": {
-                        "$ref": "#/components/schemas/DashboardRestApi.get_list"
+                        "type": "object"
                       },
                       "type": "array"
                     }

docs/yarn.lock

@@ -1142,11 +1142,6 @@
   resolved "https://registry.yarnpkg.com/@babel/runtime/-/runtime-7.29.7.tgz#12022450c45a4da6d8d8287b18a4ff2ddb23f768"
   integrity sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==
 
-"@babel/runtime@^8.0.0":
-  version "8.0.0"
-  resolved "https://registry.yarnpkg.com/@babel/runtime/-/runtime-8.0.0.tgz#d7bd513e6843662346552c2798ab895716cf97f2"
-  integrity sha512-sL6cvO2IfkSu/iU+zs2S/w01B7A8V7suXSIKEN4hPFFdZoiPGxrj5pAG0lCaqLWiEIrjKzdznIWuaLcxPR53qw==
-
 "@babel/template@^7.29.7":
   version "7.29.7"
   resolved "https://registry.yarnpkg.com/@babel/template/-/template-7.29.7.tgz#4d9d4004f645cdd304de958c725162784ecac700"
@@ -3175,100 +3170,100 @@
   resolved "https://registry.yarnpkg.com/@oxc-resolver/binding-win32-x64-msvc/-/binding-win32-x64-msvc-11.23.0.tgz#8b66dbfa7b796139e719063fc0e44084e80a1c15"
   integrity sha512-gUGJpr+Rn6zMxm5juApV0K3U845i8t47o8k+rbO0BHbi4PoJIfSPeQmrE2dgohQm2g5k6iviNFyXCGqvmaYUpw==
 
-"@oxfmt/binding-android-arm-eabi@0.63.0":
-  version "0.63.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-android-arm-eabi/-/binding-android-arm-eabi-0.63.0.tgz#136176dc94fdc41e21415cc770d86f5066282e0f"
-  integrity sha512-YmRth4ZPGgEXcgmkhvANbC9uD67dxmSobW7DQuyt5tOBOKvPnIpk5SVHBj88E+7wMNRI2FhqaDbOhQFBix+b8A==
+"@oxfmt/binding-android-arm-eabi@0.62.0":
+  version "0.62.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-android-arm-eabi/-/binding-android-arm-eabi-0.62.0.tgz#3f5b9d3ba944f42ad3fa2697b9fef88a8c9d4ce0"
+  integrity sha512-pdsv0C4gPjJ8H1+sd8u0BDx+yLACTL+rgeMIOL1ln4ihSnhw8CWXtYWgvcSkyTfgGBIzFKab+d8rx9Xl4en/Kw==
 
-"@oxfmt/binding-android-arm64@0.63.0":
-  version "0.63.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-android-arm64/-/binding-android-arm64-0.63.0.tgz#10bc42457179210061c801122a64304619e3bdab"
-  integrity sha512-icbahX8X2X3sRamOMecvdYeZXWjPDazRDIfvWfy7Ca1nc/ZDT2Y9k5Nt7s46EqFd7NQPdgk+CM3/SgIT5LPCaQ==
+"@oxfmt/binding-android-arm64@0.62.0":
+  version "0.62.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-android-arm64/-/binding-android-arm64-0.62.0.tgz#4c7e2c567f645ed051be100318e9e3f716630c1b"
+  integrity sha512-WC3YQ7uS/KtDrjmqwBviwFKe9qeoi+eXx8aX1z/ffG23Md75myjrJaQqTuJvdOLPoa4EYTjDWH0dHXfwulCVog==
 
-"@oxfmt/binding-darwin-arm64@0.63.0":
-  version "0.63.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-darwin-arm64/-/binding-darwin-arm64-0.63.0.tgz#5f9084d9a760a1836387f8970a7f9d614ec3d909"
-  integrity sha512-WV+Ze5v5gI2qoj8jpAovt8KBTW8pjEz/AiMXXjeTQS+Bmf/MmZXTS40S8xNPDszX+W8WDv2Bbk6qKrMTtUGu1A==
+"@oxfmt/binding-darwin-arm64@0.62.0":
+  version "0.62.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-darwin-arm64/-/binding-darwin-arm64-0.62.0.tgz#6c8007ae65ed17f9d1ecc6c680da19ec19276c67"
+  integrity sha512-GM8Yf3LjjaR1I8PD0SfeoIlwhsh9GvSF+cQ8sf624Yxnjsyumn95aFzYfKJVefblfDIiOAnZ7QVm2sa21Er/0Q==
 
-"@oxfmt/binding-darwin-x64@0.63.0":
-  version "0.63.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-darwin-x64/-/binding-darwin-x64-0.63.0.tgz#badd4a02218a9a62319817d5c337b30159a54a21"
-  integrity sha512-CJGSBdDxXOWIpoFXHpverimCvz084KA7L483rqJ44c3jDtzv6d4qOSoR/V9ywSHfV+Ks1lwIj2P49BFhunLNAA==
+"@oxfmt/binding-darwin-x64@0.62.0":
+  version "0.62.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-darwin-x64/-/binding-darwin-x64-0.62.0.tgz#0661a0274e8625921c5a054aeb21a36251946e6b"
+  integrity sha512-d5THp7F8bCxLqNogEXDORRsQD6dosf3EyFtnXfBer6v+8tGdcWIjoDX9WaXrrF/26zOmL8qHpPTKCEvpBDmZkQ==
 
-"@oxfmt/binding-freebsd-x64@0.63.0":
-  version "0.63.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-freebsd-x64/-/binding-freebsd-x64-0.63.0.tgz#a17261e95c8ebef1f76d8aaac746a64fdb6ba51e"
-  integrity sha512-BDfKY+KhL2078cgswBBFQPAYuxCy93bS/iC5frdSeSbTLcGrR6VC2hsuPTanoJmg84+wSyWl0wWC1eR+uTnkRg==
+"@oxfmt/binding-freebsd-x64@0.62.0":
+  version "0.62.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-freebsd-x64/-/binding-freebsd-x64-0.62.0.tgz#f3345001102ac3e6c2947920d6d1676e9cf97e75"
+  integrity sha512-1DnrtXGZooOZ0fHgAXZUaDQzBVh1CM2MNW4oBXyQ2aWKvCHjyljvT9fgBkOM0fEOb96X5eqtcfJ0YUVt9jj66g==
 
-"@oxfmt/binding-linux-arm-gnueabihf@0.63.0":
-  version "0.63.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-0.63.0.tgz#baeee34bb08e0769af878623f442e83bc0aacd7a"
-  integrity sha512-Ov1cQEXT4mj7cojAokWSS1eoxkoyvbDfAbxNsGIKY2o36kvdAaFzPxRN6NxFRk9fD72B8oCoTTX/NuYTUWlpsg==
+"@oxfmt/binding-linux-arm-gnueabihf@0.62.0":
+  version "0.62.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-0.62.0.tgz#ddc03bc2a899f2071d6706c06dfdec3a7f3e8b5a"
+  integrity sha512-4pQDHOYRH+Huqe0StIaWyvk2CVl/aTaqSrbZpA3/pLS2xH24ME7lBgYprhQF2fRkHBzhGGGKliwxFsDdHwx59g==
 
-"@oxfmt/binding-linux-arm-musleabihf@0.63.0":
-  version "0.63.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-arm-musleabihf/-/binding-linux-arm-musleabihf-0.63.0.tgz#e70d5697ec4b6bb5f87a3f019e01b3f956b8e44b"
-  integrity sha512-0LE7ro3+6L79jcMANycAZfRaC7zxr9YZ2+vEL5uMD9QlEep+rS/r1kSJsnuLl991NXJZD60euh0PC1GHrR20vw==
+"@oxfmt/binding-linux-arm-musleabihf@0.62.0":
+  version "0.62.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-arm-musleabihf/-/binding-linux-arm-musleabihf-0.62.0.tgz#5e82208d612c4caf64ada75e129e34d1a9eefb2c"
+  integrity sha512-X0jAaZJFMCVKhB6YyWVTQ/wN2DLsBcZKSMqTS76bF6riT+XZdtg2FPEdjDvdVbunO9cG+tWiVaEs4Zs38lxYog==
 
-"@oxfmt/binding-linux-arm64-gnu@0.63.0":
-  version "0.63.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-0.63.0.tgz#638a8ed4f3d256c50aeb6d2c19cfc65792c902e1"
-  integrity sha512-izPk+2Z4gjuZK32Fqh5qXoMpT/2NXzLh++ob57HiEiVSQZ1iYXu8EKMzb+K5AvWyIEXhdDIt7ADjGGtFhkT9Bw==
+"@oxfmt/binding-linux-arm64-gnu@0.62.0":
+  version "0.62.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-0.62.0.tgz#eb379bc58aa962e753d58b4cc68ff4081bc19a5d"
+  integrity sha512-682Z8T5s8T5ATArYtsejKvbIfd8LEAXyyDkKkoZVq8HND7Vx8TYLlrDjDSeYfodMeVwHOgkj13lJYR8cj6vUSg==
 
-"@oxfmt/binding-linux-arm64-musl@0.63.0":
-  version "0.63.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-arm64-musl/-/binding-linux-arm64-musl-0.63.0.tgz#af5a9b787f5233f27a3360ad56235fc1b011f760"
-  integrity sha512-alPmbOuWXFXiSo+lOtv6X71C7SYMEDW2WVvywOvf9BwKgEhSNGhMTLeFVSjKUMCamcjbbgVdsWF8GN1uy8xshg==
+"@oxfmt/binding-linux-arm64-musl@0.62.0":
+  version "0.62.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-arm64-musl/-/binding-linux-arm64-musl-0.62.0.tgz#dc1c62510405e874bf6a53a34f548032eb6dfed7"
+  integrity sha512-lk25fAl7KWaLWVJcW0CHEXB7QlQZtx5eDkjpaGMK0hzXTjUe0Wmlu8IKuFHoviSOcEJedRTs4VE/506VqGxGew==
 
-"@oxfmt/binding-linux-ppc64-gnu@0.63.0":
-  version "0.63.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-0.63.0.tgz#c1a211206134a5577e355a495989e0d733218d60"
-  integrity sha512-BdzCPvolJc4AWZ+YMzgUDJcDzbQWrFjYuqBHoNHNqP1aCaluQRJNs4k3vNU5IG7vTpjf9zeD73D7MFM1TecZpg==
+"@oxfmt/binding-linux-ppc64-gnu@0.62.0":
+  version "0.62.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-0.62.0.tgz#9f9afee327090024db86b70ec81a57ad06bb2f00"
+  integrity sha512-SFyNqHQLwySceWNLhiSldx7wPXRAzP0L0WcW9GegP3uWrpZGJiZlQO85NbHAFPEfxR9PhZ9qSnZryEh7+v+4Gw==
 
-"@oxfmt/binding-linux-riscv64-gnu@0.63.0":
-  version "0.63.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-riscv64-gnu/-/binding-linux-riscv64-gnu-0.63.0.tgz#4863f0311e5c1b88f75ef822959b3ca4fd938937"
-  integrity sha512-7sIgfLzqtNKSkMGsGVyRpHwpjNezRg2XONvUOheFZs95TSZpM0JAuPpA8KrQFsWc4wPU95roX2O69JgH8igOgw==
+"@oxfmt/binding-linux-riscv64-gnu@0.62.0":
+  version "0.62.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-riscv64-gnu/-/binding-linux-riscv64-gnu-0.62.0.tgz#4427d42ee3bad0e55b38dc76fe14a7e5318c360c"
+  integrity sha512-KYj55C1ywJfHo6+aKDuEmUtVEdJALsC5GwayDGsI6FGz2GxFqNr/mA8nxVsNbJzm7sE5MRqTQ9ziImSzhYXysA==
 
-"@oxfmt/binding-linux-riscv64-musl@0.63.0":
-  version "0.63.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-riscv64-musl/-/binding-linux-riscv64-musl-0.63.0.tgz#ad05a017d12553e2f544743c4940adb552aa1d1c"
-  integrity sha512-9Tcg0y0WcVa6Mm9AgcgFMseDS+VkFJZpKZ8We9SpDY4gg5jewSwln+0sO04QLcTS1BtfDl9MwR+NfID8L7PUTg==
+"@oxfmt/binding-linux-riscv64-musl@0.62.0":
+  version "0.62.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-riscv64-musl/-/binding-linux-riscv64-musl-0.62.0.tgz#a117f82909f075cf07c333842d89a5638429e21d"
+  integrity sha512-BhZDNo5GOU5nC378RhD0/XpvaEBHsH3HLgJp8YZX3A0InC7oivzA63HsRmiXFLtLSHAstEVrDf6fbC7Rs8Jh/A==
 
-"@oxfmt/binding-linux-s390x-gnu@0.63.0":
-  version "0.63.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-0.63.0.tgz#2803f539db15bc66db115888fa8f84d6531ed2b9"
-  integrity sha512-qWKC1pEOpx1qYhXaugPhHUeXwSfqEOk2wJH2LqVXGPV5iQYfdAZdt+d2XDiX4DTSWA2QDMUcFB+wEORh3Xn/sA==
+"@oxfmt/binding-linux-s390x-gnu@0.62.0":
+  version "0.62.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-0.62.0.tgz#3fac79fefe7ffc3f0a9393678ebd782aac918fcd"
+  integrity sha512-UyAFmyHkgSgUJ/wOM4p3U8AC2yAFvRH5PNBs7TnK0fObTT/XSWcdr/lAzPSWaekHaZFaMeFZyk9n93Joq3J93A==
 
-"@oxfmt/binding-linux-x64-gnu@0.63.0":
-  version "0.63.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-x64-gnu/-/binding-linux-x64-gnu-0.63.0.tgz#c22a06a60ae2d6b3de522095e0c50a816040a033"
-  integrity sha512-S9wXYOiGSqYGS4Fx/TFsY+xDd/7dE5s+rUgbA4TsHiVF9e8J3ZcKmP7dsP/7iqLI9Wz7Ic7TzEr3mdthRCTdrA==
+"@oxfmt/binding-linux-x64-gnu@0.62.0":
+  version "0.62.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-x64-gnu/-/binding-linux-x64-gnu-0.62.0.tgz#8da207bef27941f0265c129d1c7c82c7cf91d1ce"
+  integrity sha512-1iYMP0leytWazFubD/WnINJuIrzRPuoL1aWEJdlGezEzDbTxcd29R4r8IUzP2oWeKst5V02uMJgR2NILlPlG6w==
 
-"@oxfmt/binding-linux-x64-musl@0.63.0":
-  version "0.63.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-x64-musl/-/binding-linux-x64-musl-0.63.0.tgz#48d3eeaf8e3757f638cf92de5ee4858befc9c0a3"
-  integrity sha512-5eGyTJuMZNwBSHCivXt8Yuta6GeTYksOPXRk2MIhajiyFGQx7bjaHIwY+ZusAoFHhT157A9x6sktLjYo9D5oMQ==
+"@oxfmt/binding-linux-x64-musl@0.62.0":
+  version "0.62.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-x64-musl/-/binding-linux-x64-musl-0.62.0.tgz#e55cf9b7c8c2204fdbb5d4818f8c5ba02aa49360"
+  integrity sha512-4rA/URtJSTVNVAQz6Q8wf7SaRvOXVy+TizriT9hs/Y1XhLR/R+92uWKRQG8yFWRAIEBbFHJ6WevQcl/G9SXEfw==
 
-"@oxfmt/binding-openharmony-arm64@0.63.0":
-  version "0.63.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-openharmony-arm64/-/binding-openharmony-arm64-0.63.0.tgz#02be9e140ae35ba30f52bdce27612fece4a01ab3"
-  integrity sha512-Rz7hx+Dv3DoW/S6pwVAyjfFXp7/trdQ1zg+vNmsdsdDNlUccugp4XNqambSuEAeP0DaG9k72AtNyfDXCEg0AGw==
+"@oxfmt/binding-openharmony-arm64@0.62.0":
+  version "0.62.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-openharmony-arm64/-/binding-openharmony-arm64-0.62.0.tgz#4998769ee1b5894efcd6cb99729d5a75f4c09dd1"
+  integrity sha512-mSZuFHU2ar1KLUjXpI2QBQcJ1VsOB3mOCgQXuXCpKs19dgh4u+OaovNfrWDfiJb+ihJ2+f7YFcaO9bS2dlTCXA==
 
-"@oxfmt/binding-win32-arm64-msvc@0.63.0":
-  version "0.63.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-0.63.0.tgz#2226eaf52b6345a2cb926499216b2486cf0dbec2"
-  integrity sha512-T/IuizKN9mr4Xw6YYnptkXRNdLkyIlUZ7c8zfTOBpoytZyJ1BAsMUvsMDEx0X4YvSMpaivm+DR8112rQfzC25g==
+"@oxfmt/binding-win32-arm64-msvc@0.62.0":
+  version "0.62.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-0.62.0.tgz#e09eaabdde76c885c4f8a190518c2eb2de08548a"
+  integrity sha512-OfwuhkcjDlqC4EgDojtiV9mzpLqeB9KqTOWPOjLEYBVdDCVSxqW3qzp/xcIxsbtI0UgGCnKvAqYKyY25kf5JZw==
 
-"@oxfmt/binding-win32-ia32-msvc@0.63.0":
-  version "0.63.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-win32-ia32-msvc/-/binding-win32-ia32-msvc-0.63.0.tgz#58d263bb5ecd7330c02f9dcd8cda10f66e42e74b"
-  integrity sha512-XjrO5FJ5Wl9vsAxtCP1G/eaeT6y1K2s9CICUHGE42cEjou32/J6S+B1KnrOAboj6E7uhJnwPbRSvznWcxNdA0g==
+"@oxfmt/binding-win32-ia32-msvc@0.62.0":
+  version "0.62.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-win32-ia32-msvc/-/binding-win32-ia32-msvc-0.62.0.tgz#f36e306308923977365270d8b26290f4ca2fcfa5"
+  integrity sha512-P9uDDNFRzghO3X8QAzhkjKhK7JvtABsVn8UYtFX7uor12IAnwNt8nNIctvfWj1JkQU/kE+fmLRPiw7XlrIHsZw==
 
-"@oxfmt/binding-win32-x64-msvc@0.63.0":
-  version "0.63.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-win32-x64-msvc/-/binding-win32-x64-msvc-0.63.0.tgz#02a166c8a8049c55d0096d1ba9d8e73f3a4d26a7"
-  integrity sha512-sgsHCQy432OTQH4Ikk3tZptp3GqwnhwUDuY0loBH41zyHWfMZY9v8Dy78wsnSofHejvFozZGgJgBB1A0LQRwMQ==
+"@oxfmt/binding-win32-x64-msvc@0.62.0":
+  version "0.62.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-win32-x64-msvc/-/binding-win32-x64-msvc-0.62.0.tgz#bb6545e581d5ee7111084dbabeec7fe548bae418"
+  integrity sha512-dlI5SY7XYQCiCBafntWagCR6HcAJB/NpsLtdlPx8x08+Osz8Ok1HHz1GZuusegCe/VoJ6pAnF5a4pd5OZAq7qQ==
 
 "@parcel/watcher-android-arm64@2.5.6":
   version "2.5.6"
@@ -3537,13 +3532,13 @@
   dependencies:
     "@babel/runtime" "^7.24.4"
 
-"@rc-component/cascader@~1.22.0":
-  version "1.22.0"
-  resolved "https://registry.yarnpkg.com/@rc-component/cascader/-/cascader-1.22.0.tgz#eec0b6f4d2df5903aa12cfed321a578705926937"
-  integrity sha512-SffrA57aS9oub3VuI7ajPhJTPtaNxngSvtRhD40Rd8dwJ5vfWPSrVanWgeepdWFGBt7EHftIK5RUU0u3rCTwWw==
+"@rc-component/cascader@~1.17.0":
+  version "1.17.0"
+  resolved "https://registry.yarnpkg.com/@rc-component/cascader/-/cascader-1.17.0.tgz#52c0eceada2c7b4b37ebe822c19a6544b9562edf"
+  integrity sha512-3cVNG0zrQF1PoXq262L3wGCU+/YLEC1mGSVHDl577dQmA0ZKkXFbY6nwyXo+beCcM7buo49t24jkr+QZdL7O8w==
   dependencies:
-    "@rc-component/select" "~1.10.0"
-    "@rc-component/tree" "~1.4.0"
+    "@rc-component/select" "~1.8.0"
+    "@rc-component/tree" "~1.3.2"
     "@rc-component/util" "^1.11.1"
     clsx "^2.1.1"
 
@@ -3619,14 +3614,14 @@
     "@rc-component/util" "^1.11.1"
     clsx "^2.1.1"
 
-"@rc-component/image@~1.10.0":
-  version "1.10.0"
-  resolved "https://registry.yarnpkg.com/@rc-component/image/-/image-1.10.0.tgz#5d7a82d20e4c91f75875ea64eb1dadd7af676b1d"
-  integrity sha512-BjeZCRQ+hw+4WAhvrw8rJvy5fckA2xpf/X2XQEOABUHvLTNB9inB98X3Mp54jYQ7g10DfWERQWHXeC4ylxp1Uw==
+"@rc-component/image@~1.9.0":
+  version "1.9.0"
+  resolved "https://registry.yarnpkg.com/@rc-component/image/-/image-1.9.0.tgz#110785d735d20336afcdbac84e8fbfd059a7a44e"
+  integrity sha512-khF7w7xkBH5B1bsBcI1FSUZdkyd1aqpl2eYyILCqCzzQH3XdfehGUaZTnptyaJJfs09/R5hv9jXWyazOMFIClQ==
   dependencies:
     "@rc-component/motion" "^1.0.0"
     "@rc-component/portal" "^2.1.2"
-    "@rc-component/util" "^1.11.1"
+    "@rc-component/util" "^1.10.1"
     clsx "^2.1.1"
 
 "@rc-component/input-number@~1.6.2":
@@ -3638,7 +3633,7 @@
     "@rc-component/util" "^1.4.0"
     clsx "^2.1.1"
 
-"@rc-component/input@~1.3.1":
+"@rc-component/input@~1.3.0", "@rc-component/input@~1.3.1":
   version "1.3.1"
   resolved "https://registry.yarnpkg.com/@rc-component/input/-/input-1.3.1.tgz#230b8b59cdde8521d50f0eede63ddacb61cc0cd3"
   integrity sha512-iFvTUT9W+JC/MSin2aGAk8NqsVlTzcExNC9DZariON1IWirju9NoNeEk47an4Q8iHazkoVI/y1LnDi88+CPcig==
@@ -3647,27 +3642,15 @@
     "@rc-component/util" "^1.11.1"
     clsx "^2.1.1"
 
-"@rc-component/listy@~1.2.3":
-  version "1.2.3"
-  resolved "https://registry.yarnpkg.com/@rc-component/listy/-/listy-1.2.3.tgz#e9c8ef4f409c231b44dded37e63ae2875bbe0334"
-  integrity sha512-IXiMjV5s0rczLBlfh7G5nB4M3365mrEeedjwKtf5I+Ns3PqRUsebR2h5u8CeFarsVfLUPC2I5p0h09TNoOWyvQ==
+"@rc-component/mentions@~1.10.0":
+  version "1.10.0"
+  resolved "https://registry.yarnpkg.com/@rc-component/mentions/-/mentions-1.10.0.tgz#46b1117cfb0c716b476e97f342555eccc2f41c97"
+  integrity sha512-CI1njYUVY0NjHtLhNoVmXlJyy568Sfep9Wsak6vmGjtT6uazx98djGYlCXz2xkHhEm73g91Y3MTvzUyE5avI7w==
   dependencies:
-    "@rc-component/motion" "^1.1.4"
-    "@rc-component/portal" "^2.0.0"
-    "@rc-component/resize-observer" "^1.0.0"
-    "@rc-component/util" "^1.3.1"
-    "@rc-component/virtual-list" "^1.4.0"
-    clsx "^2.1.1"
-
-"@rc-component/mentions@~1.11.0":
-  version "1.11.0"
-  resolved "https://registry.yarnpkg.com/@rc-component/mentions/-/mentions-1.11.0.tgz#cee0c4710f26766ad8550d386cfec5ff86fd58d9"
-  integrity sha512-IC2qXuEBMFHxPIXEFfYWj6Sr7UiDZnOqJHCYQBbwPzopBJOPZIR6mV9U4QH1bYQRlKYlYnIsajWDMgVGgWQyWQ==
-  dependencies:
-    "@rc-component/input" "~1.3.1"
+    "@rc-component/input" "~1.3.0"
     "@rc-component/menu" "~1.4.0"
     "@rc-component/trigger" "^3.0.0"
-    "@rc-component/util" "^1.11.1"
+    "@rc-component/util" "^1.3.0"
     clsx "^2.1.1"
 
 "@rc-component/menu@~1.4.0", "@rc-component/menu@~1.4.1":
@@ -3741,7 +3724,7 @@
     "@rc-component/util" "^1.11.1"
     clsx "^2.1.1"
 
-"@rc-component/portal@^2.0.0", "@rc-component/portal@^2.1.0", "@rc-component/portal@^2.1.2", "@rc-component/portal@^2.1.3", "@rc-component/portal@^2.2.0", "@rc-component/portal@^2.2.1":
+"@rc-component/portal@^2.1.0", "@rc-component/portal@^2.1.2", "@rc-component/portal@^2.1.3", "@rc-component/portal@^2.2.0", "@rc-component/portal@^2.2.1":
   version "2.2.1"
   resolved "https://registry.yarnpkg.com/@rc-component/portal/-/portal-2.2.1.tgz#37c34b4c8cd73f53cc7072c96dd0e9ac332669ec"
   integrity sha512-ck+r1kW/JSv0wxPji3KN2ss9K6Z0qqwusw/mf/0JobXhZ8hC2ejZwCJObW/SvDi0uhA0VzmCnx0CaCci95tcmA==
@@ -3789,10 +3772,10 @@
     "@rc-component/util" "^1.3.0"
     clsx "^2.1.1"
 
-"@rc-component/select@~1.10.0":
-  version "1.10.1"
-  resolved "https://registry.yarnpkg.com/@rc-component/select/-/select-1.10.1.tgz#323b2f458a637e8e752f8341094783741c613c34"
-  integrity sha512-H+yQsl+qED9NilQ3g6zdpsMwUgwVjrcMTkNHAWRVU/MoNCYgTbDgU+MIMgZDK+rVdd2JUfI/MkysMcZZ0cyQKw==
+"@rc-component/select@~1.8.0", "@rc-component/select@~1.8.2":
+  version "1.8.2"
+  resolved "https://registry.yarnpkg.com/@rc-component/select/-/select-1.8.2.tgz#f016992dae5c57186535512d73783e2fc7e4c59e"
+  integrity sha512-HQ9zuYqjfZTlcEMWlU1GAPBajd2OHIMVHyjZSGVTCVARwkfCgvXZMTEn0cduy3L+ejAKkaZluOQvxovZoaJaQw==
   dependencies:
     "@rc-component/overflow" "^1.0.0"
     "@rc-component/trigger" "^3.0.0"
@@ -3824,10 +3807,10 @@
     "@rc-component/util" "^1.3.0"
     clsx "^2.1.1"
 
-"@rc-component/table@~1.11.0":
-  version "1.11.1"
-  resolved "https://registry.yarnpkg.com/@rc-component/table/-/table-1.11.1.tgz#7b5c2a7c26fd37b6a403082029b5a72fcb330a4d"
-  integrity sha512-OWdS6DMmeWb7bJBGqPxYZpQbzBlBiXZUu2sqo6Ii7Sjs9GeK1IsrXrWk26SL2c6KEseabswdxrRj7WUm9LdECw==
+"@rc-component/table@~1.10.4":
+  version "1.10.4"
+  resolved "https://registry.yarnpkg.com/@rc-component/table/-/table-1.10.4.tgz#8c4e33bc150aa39f579c15426421348a789de326"
+  integrity sha512-HwoTnrwc29zeoXkXGhWqzJh8FIibGUxi1jM4LtoSzmR9d5Vv5osUQpZxnXKBP8iOCvyD6BQzZm1nXJRcnrxpAg==
   dependencies:
     "@rc-component/context" "^2.0.1"
     "@rc-component/resize-observer" "^1.0.0"
@@ -3835,10 +3818,10 @@
     "@rc-component/virtual-list" "^1.0.1"
     clsx "^2.1.1"
 
-"@rc-component/tabs@~1.12.0":
-  version "1.12.0"
-  resolved "https://registry.yarnpkg.com/@rc-component/tabs/-/tabs-1.12.0.tgz#41a1a77ed1afc4f1b8b727003a058c631aceea1b"
-  integrity sha512-XL7Kqy5fnUE2WTlO1/fCGrrfNlGFebdr7JseGkEIjzcVMAtIFQJ8sqCSOmxcXstjU6fonD/4rnhZHxj7sDTajQ==
+"@rc-component/tabs@~1.11.0":
+  version "1.11.0"
+  resolved "https://registry.yarnpkg.com/@rc-component/tabs/-/tabs-1.11.0.tgz#c157b2fadcdc2f3ab6c69d0098f73e03c6aa0c12"
+  integrity sha512-hA/drZYOVa/MMIb4M2fWf3yaTyTG4qVuIABmghvEhyfw2nBob5VTH69lMCDjSVKmgODjO6nWlCV+gVn3xBrj5Q==
   dependencies:
     "@rc-component/dropdown" "~1.0.0"
     "@rc-component/menu" "~1.4.0"
@@ -3847,13 +3830,13 @@
     "@rc-component/util" "^1.11.1"
     clsx "^2.1.1"
 
-"@rc-component/tooltip@~1.5.0":
-  version "1.5.0"
-  resolved "https://registry.yarnpkg.com/@rc-component/tooltip/-/tooltip-1.5.0.tgz#422aa0760b310e0a1d0f9f7223e7f0d455de57a2"
-  integrity sha512-agQ/+mBqrEQfTX4D3KhQ7j+ZbX4/VHjoJ7Noa2wIdZ1/FbQTOd7Sn92rp+jtCoqAVTLUgSOydePIgZ204gi2EQ==
+"@rc-component/tooltip@~1.4.0":
+  version "1.4.0"
+  resolved "https://registry.yarnpkg.com/@rc-component/tooltip/-/tooltip-1.4.0.tgz#c8cf15c6773218a5a36271467f06e663f99c28e7"
+  integrity sha512-8Rx5DCctIlLI4raR0I0xHjVTf1aF48+gKCNeAAo5bmF5VoR5YED+A/XEqzXv9KKqrJDRcd3Wndpxh2hyzrTtSg==
   dependencies:
-    "@rc-component/trigger" "^3.10.0"
-    "@rc-component/util" "^1.11.1"
+    "@rc-component/trigger" "^3.7.1"
+    "@rc-component/util" "^1.3.0"
     clsx "^2.1.1"
 
 "@rc-component/tour@~2.4.0":
@@ -3866,27 +3849,27 @@
     "@rc-component/util" "^1.7.0"
     clsx "^2.1.1"
 
-"@rc-component/tree-select@~1.16.0":
-  version "1.16.1"
-  resolved "https://registry.yarnpkg.com/@rc-component/tree-select/-/tree-select-1.16.1.tgz#dcaea96e396e98108cb29cc051840d4fbdda38cc"
-  integrity sha512-a1Oi6EJhqAhdOxxupdJi6fP0RPHMKn5TcfkX2+llaQ4lF4nwfH7b6SCHcnsybaa2s+pk1yZYwVyeOYkDnEBRdg==
+"@rc-component/tree-select@~1.11.0":
+  version "1.11.0"
+  resolved "https://registry.yarnpkg.com/@rc-component/tree-select/-/tree-select-1.11.0.tgz#9080cdf1d28f2ddd6d8a4879b7aa90d3170f7db9"
+  integrity sha512-EhS0X0wtUhBfK4S5TlpSY3MR9ndPMGgujtt1PJW3Ej+ToAlnS/6ohYURtCoXBYGqazUwHmgQGVUDsfpVwhWPkg==
   dependencies:
-    "@rc-component/select" "~1.10.0"
-    "@rc-component/tree" "~1.4.0"
+    "@rc-component/select" "~1.8.0"
+    "@rc-component/tree" "~1.3.2"
     "@rc-component/util" "^1.11.1"
     clsx "^2.1.1"
 
-"@rc-component/tree@~1.4.0":
-  version "1.4.0"
-  resolved "https://registry.yarnpkg.com/@rc-component/tree/-/tree-1.4.0.tgz#c0031180e681389bf0bdcb867a0087525b45c8a9"
-  integrity sha512-dGsJGDJQedA0BqqVgj3F8BvHXTSZijyhTXdbAdkcx8lynzZkty/CV3Z3LOm/fxz+BCfl3dfGiAQpb7Q5XNvl0Q==
+"@rc-component/tree@~1.3.2":
+  version "1.3.2"
+  resolved "https://registry.yarnpkg.com/@rc-component/tree/-/tree-1.3.2.tgz#4b0c13564314eff61ca948c18ef923b87c9d7e44"
+  integrity sha512-bJFj46wEkpBPnWyTm18XmgAgNQ/4YvprxMOPPY2a6rmhGJYxLuNKEFiL5Qej4Qctu9wHJm8WW+v2SYskafE0kA==
   dependencies:
     "@rc-component/motion" "^1.0.0"
     "@rc-component/util" "^1.11.1"
     "@rc-component/virtual-list" "^1.2.0"
     clsx "^2.1.1"
 
-"@rc-component/trigger@^3.0.0", "@rc-component/trigger@^3.10.0", "@rc-component/trigger@^3.10.1", "@rc-component/trigger@^3.6.15":
+"@rc-component/trigger@^3.0.0", "@rc-component/trigger@^3.10.1", "@rc-component/trigger@^3.6.15", "@rc-component/trigger@^3.7.1":
   version "3.10.1"
   resolved "https://registry.yarnpkg.com/@rc-component/trigger/-/trigger-3.10.1.tgz#cb28e1bc0745a2af6897dd7ec774f9b56dc88f86"
   integrity sha512-mXlDN0IXdtV8Yqqm8195ECCyrbmfvvfKvwVvSlH0+qvKD6BUF8gRhEjSy0FOcD1+CcDRHgTiX99LoxfQrmh3Cw==
@@ -3905,7 +3888,7 @@
     "@rc-component/util" "^1.11.1"
     clsx "^2.1.1"
 
-"@rc-component/util@^1.11.0", "@rc-component/util@^1.11.1", "@rc-component/util@^1.12.0", "@rc-component/util@^1.2.0", "@rc-component/util@^1.2.1", "@rc-component/util@^1.3.0", "@rc-component/util@^1.3.1", "@rc-component/util@^1.4.0", "@rc-component/util@^1.7.0", "@rc-component/util@^1.9.0":
+"@rc-component/util@^1.10.1", "@rc-component/util@^1.11.0", "@rc-component/util@^1.11.1", "@rc-component/util@^1.12.0", "@rc-component/util@^1.2.0", "@rc-component/util@^1.2.1", "@rc-component/util@^1.3.0", "@rc-component/util@^1.4.0", "@rc-component/util@^1.7.0", "@rc-component/util@^1.9.0":
   version "1.12.0"
   resolved "https://registry.yarnpkg.com/@rc-component/util/-/util-1.12.0.tgz#58e453585810bcb8a35ff1aafd5e01187457b86f"
   integrity sha512-AEjPL8JVdohIITaiXokyjL9WQ6tKWWjAYK9QU16tGNE9JaQABBQy+hA4H2Lup5MgXy9yY3iLrbZJheuU13hTdQ==
@@ -3923,16 +3906,6 @@
     "@rc-component/util" "^1.4.0"
     clsx "^2.1.1"
 
-"@rc-component/virtual-list@^1.4.0":
-  version "1.5.1"
-  resolved "https://registry.yarnpkg.com/@rc-component/virtual-list/-/virtual-list-1.5.1.tgz#71c5844a8d6bd5b3501dfb66419d3a4612b2bb18"
-  integrity sha512-boqHxdtyWC88u8quYgEO49bcBy5fzRiOcnBge+N4nLzs2k8hUQ/yw7JE9dM6yCBE4jSm5YSHVCVMS+suBuJGKA==
-  dependencies:
-    "@babel/runtime" "^8.0.0"
-    "@rc-component/resize-observer" "^1.0.1"
-    "@rc-component/util" "^1.4.0"
-    clsx "^2.1.1"
-
 "@redocly/ajv@^8.18.1":
   version "8.18.3"
   resolved "https://registry.yarnpkg.com/@redocly/ajv/-/ajv-8.18.3.tgz#a925753d9a33375219f1b2ba91aef320f9929577"
@@ -4122,23 +4095,23 @@
   resolved "https://registry.yarnpkg.com/@standard-schema/utils/-/utils-0.3.0.tgz#3d5e608f16c2390c10528e98e59aef6bf73cae7b"
   integrity sha512-e7Mew686owMaPJVNNLs55PUvgz371nKgwsc4vxE49zsODpJEnxgxRo2y/OKrqueavXgZNMDVj3DdHFlaSAeU8g==
 
-"@storybook/addon-docs@^10.5.8":
-  version "10.5.8"
-  resolved "https://registry.yarnpkg.com/@storybook/addon-docs/-/addon-docs-10.5.8.tgz#767c10c7a4cc1b625b93f869b2a2b09fc8514f2e"
-  integrity sha512-NlHiMKW/UvW/uL8HXFDCEVwoH3qZeGYZ/qlWax4d7H471b/T54MBq2KcB4ZrdA785FfIH3numAJdBb5jwn00Mg==
+"@storybook/addon-docs@^10.5.7":
+  version "10.5.7"
+  resolved "https://registry.yarnpkg.com/@storybook/addon-docs/-/addon-docs-10.5.7.tgz#6d599c94fc871c248ce06a5c081f57655c83f40a"
+  integrity sha512-KNARJfjICaizinsR3INMEiipZm1ObYo+xw+E26gteu50Bcy2dIZUtk5uHY5XdtardU3AXX6yRXoBZ2HCY3lbHA==
   dependencies:
     "@mdx-js/react" "^3.0.0"
-    "@storybook/csf-plugin" "10.5.8"
+    "@storybook/csf-plugin" "10.5.7"
     "@storybook/icons" "^2.0.2"
-    "@storybook/react-dom-shim" "10.5.8"
+    "@storybook/react-dom-shim" "10.5.7"
     react "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
     react-dom "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
     ts-dedent "^2.0.0"
 
-"@storybook/csf-plugin@10.5.8":
-  version "10.5.8"
-  resolved "https://registry.yarnpkg.com/@storybook/csf-plugin/-/csf-plugin-10.5.8.tgz#c626c5bfe55d0e279b2457e5cf150a788d1fc637"
-  integrity sha512-/FHiMyOWWEXfwK/lM0WxmkP9GLzbSJJuzGtfeuNWSOVDnvAMbjavitxfHb5wSbWKIQo0XYC1EJ2Y7x91XNYP4w==
+"@storybook/csf-plugin@10.5.7":
+  version "10.5.7"
+  resolved "https://registry.yarnpkg.com/@storybook/csf-plugin/-/csf-plugin-10.5.7.tgz#bc73f164d1b5f8e2931b2774f4b389a06453cf6e"
+  integrity sha512-IaX8FlM0H36HNFhJ2+4L9bCldqfvHGqcLg841SJNyK/DhfMlM7JsvY/GDH2ZFuWrUf8FSOx96GRRnHq6XfRKag==
   dependencies:
     unplugin "^2.3.5"
 
@@ -4152,10 +4125,10 @@
   resolved "https://registry.yarnpkg.com/@storybook/icons/-/icons-2.1.0.tgz#edfc2450a39c5e780f28c6cbc49acd7bff59b41a"
   integrity sha512-Fxh9vYpX9bQqFeHRiY8h2ApeRGDzRSMLwJwNZ/AIRqnyOKHxRKL+yFe+ctEkVJmuptRE9u1Hrn8ZZNHyfDKKNg==
 
-"@storybook/react-dom-shim@10.5.8":
-  version "10.5.8"
-  resolved "https://registry.yarnpkg.com/@storybook/react-dom-shim/-/react-dom-shim-10.5.8.tgz#40cc3e32af424baa2e4109a325dae2ede29999e2"
-  integrity sha512-N8D13/Xny+V3kfe1KBgsAHS0nKWXLLdgOOXS9poKdYzVwVCN+CGEGBxWX0zMMtdCptqa6/57em9coPlZMoO+bg==
+"@storybook/react-dom-shim@10.5.7":
+  version "10.5.7"
+  resolved "https://registry.yarnpkg.com/@storybook/react-dom-shim/-/react-dom-shim-10.5.7.tgz#9a5aa0e0f89c09e71c6cbfc6bb1abeb537e5aabf"
+  integrity sha512-lxOkyh+wu/MiBXvYQHjZfD+DRKOa4bHBzbuGuiHXnHXmdOcTRdcrQTsoeN2FPtfugmmOG66cZUEgDwNX+k5eRA==
 
 "@superset-ui/core@^0.20.4":
   version "0.20.4"
@@ -5685,100 +5658,110 @@
   dependencies:
     "@types/yargs-parser" "*"
 
-"@typescript-eslint/eslint-plugin@8.67.0", "@typescript-eslint/eslint-plugin@^8.67.0":
-  version "8.67.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.67.0.tgz#52f9f0e47d5a7571c4336e69bfeea581509ef2cf"
-  integrity sha512-Un7Heoyj65NREbKAyIrFxeM143NZpExWmy1Nep4DLeQOeLlTeumPjoNKnBrU5D5moWXbPJgRa5Uwcdu0faVNGQ==
+"@typescript-eslint/eslint-plugin@8.66.0", "@typescript-eslint/eslint-plugin@^8.66.0":
+  version "8.66.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.66.0.tgz#76e86aa5a2459fbf5bbd7a839c0dc0cce1d56224"
+  integrity sha512-p088eaGrzYz1s+7cov0aMOCkNGTJlVxF4jgubf28c8L0Cv9Rloj8YBHnv4hXLq6IIEE1AsjNWavO+k+8kP2Y0A==
   dependencies:
     "@eslint-community/regexpp" "^4.12.2"
-    "@typescript-eslint/scope-manager" "8.67.0"
-    "@typescript-eslint/type-utils" "8.67.0"
-    "@typescript-eslint/utils" "8.67.0"
-    "@typescript-eslint/visitor-keys" "8.67.0"
+    "@typescript-eslint/scope-manager" "8.66.0"
+    "@typescript-eslint/type-utils" "8.66.0"
+    "@typescript-eslint/utils" "8.66.0"
+    "@typescript-eslint/visitor-keys" "8.66.0"
     ignore "^7.0.5"
     natural-compare "^1.4.0"
     ts-api-utils "^2.5.0"
 
-"@typescript-eslint/parser@8.67.0", "@typescript-eslint/parser@^8.67.0":
-  version "8.67.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/parser/-/parser-8.67.0.tgz#0158022ec9927e0afcd58a8cc2ad57e01d892f5c"
-  integrity sha512-fUBfTuuEulWqX6V8+O3PtScV01tzYYRUDTAirHFKoRAt7nOzoGiPt0M/bB47wWNy0coOOcgEwAMUtBpykMxl6w==
+"@typescript-eslint/parser@8.66.0", "@typescript-eslint/parser@^8.66.0":
+  version "8.66.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/parser/-/parser-8.66.0.tgz#88e3865ecf73b0118134e7cb831da87a961a57a1"
+  integrity sha512-X6ypGChaWYk6PBtUg2BwuTZEFFcHJAtGTVJ9/lCTOufhZ4i9fNolQNnktq+kkMCwMj7V8Svsq7+TxSDslmhE0g==
   dependencies:
-    "@typescript-eslint/scope-manager" "8.67.0"
-    "@typescript-eslint/types" "8.67.0"
-    "@typescript-eslint/typescript-estree" "8.67.0"
-    "@typescript-eslint/visitor-keys" "8.67.0"
+    "@typescript-eslint/scope-manager" "8.66.0"
+    "@typescript-eslint/types" "8.66.0"
+    "@typescript-eslint/typescript-estree" "8.66.0"
+    "@typescript-eslint/visitor-keys" "8.66.0"
     debug "^4.4.3"
 
-"@typescript-eslint/project-service@8.67.0":
-  version "8.67.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/project-service/-/project-service-8.67.0.tgz#1552db007ca9206a1c6c7acf49e210bd17a8c56f"
-  integrity sha512-cvE8c7ulYeXN9fYuszhCeCsbzyVEXuhrRCybnBre7TUmqb5nRmBfQAwCj0O3WJFDeyAZt4VYv51vMCC9LHSdYw==
+"@typescript-eslint/project-service@8.66.0":
+  version "8.66.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/project-service/-/project-service-8.66.0.tgz#828f788895df52d9eb2b543445a3a5a13e35ab4e"
+  integrity sha512-7MthGPTt4BP69lSryqpqq8HQqxuzynssckL/jyDyk3+TNMQ3y2jFWkptCrktWvBrP+EH787Nl5N5Qpw7WZg+5g==
   dependencies:
-    "@typescript-eslint/tsconfig-utils" "^8.67.0"
-    "@typescript-eslint/types" "^8.67.0"
+    "@typescript-eslint/tsconfig-utils" "^8.66.0"
+    "@typescript-eslint/types" "^8.66.0"
     debug "^4.4.3"
 
-"@typescript-eslint/scope-manager@8.67.0":
-  version "8.67.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/scope-manager/-/scope-manager-8.67.0.tgz#4d4c2da09560d10dd7d947cba2d29d14d25af16d"
-  integrity sha512-EgvsleTwS4E+WzzSvem8fAUubLwatMNF1B5hHSLQxcvs7q2dtRhGyujHwLJSYlG41niJ7GP24Aha2+0mb1b2kg==
+"@typescript-eslint/scope-manager@8.66.0":
+  version "8.66.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/scope-manager/-/scope-manager-8.66.0.tgz#4fffcc6ebd0df9fe7983c0256967567ea6f5ac63"
+  integrity sha512-8TGcH25j9zqJ/IULB/ppyhRvxA8QYfFEZ7nfbg6/BN9spDgb8fPWQXlE5l8TWBL50EtUx007uZ1o9VOwrq2/9g==
   dependencies:
-    "@typescript-eslint/types" "8.67.0"
-    "@typescript-eslint/visitor-keys" "8.67.0"
+    "@typescript-eslint/types" "8.66.0"
+    "@typescript-eslint/visitor-keys" "8.66.0"
 
-"@typescript-eslint/tsconfig-utils@8.67.0", "@typescript-eslint/tsconfig-utils@^8.67.0":
+"@typescript-eslint/tsconfig-utils@8.66.0":
+  version "8.66.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.66.0.tgz#3a89066c507aa30541dc176804685b4b444e1e52"
+  integrity sha512-9D5gLYZG4rOjcoag8MQ/fWI8WqA9wcPDyOGyWtWFhvM1lHRbliqUSPIY5J3zqCU1tvSwzXxnnjhQhz5Ne7mJ4g==
+
+"@typescript-eslint/tsconfig-utils@^8.66.0":
   version "8.67.0"
   resolved "https://registry.yarnpkg.com/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.67.0.tgz#f45a3eba6b9132fb47141ec03ce2f275f1ea991d"
   integrity sha512-vV+LUSv5njUWsknE71fqKTlXUva+R76SaeORd6Zojcunk/6DvKFXONU3BrAs2H49mbygUXt6gbYunzwqNwlhdg==
 
-"@typescript-eslint/type-utils@8.67.0":
-  version "8.67.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/type-utils/-/type-utils-8.67.0.tgz#96bed105275559df3bcf0449b73a6414d35c59ce"
-  integrity sha512-aVWDXbRmdXO9siTfX4ditQI1T9+zVcNazT48EJCD0v40/9RIFoUgZ05CmGEq9H2gixRpjUn/iplwvlcvutJW/Q==
+"@typescript-eslint/type-utils@8.66.0":
+  version "8.66.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/type-utils/-/type-utils-8.66.0.tgz#b2315303eca72fad9afa7be4f58f053c8f2a0479"
+  integrity sha512-LG2dWfjZQQp0ADtAu/EWJVayefGL2UEZ3CDeI44D9v3rXB/WYUqE/jpO28KrEKul5AySrmI+Zh1v6v+xW2U9+g==
   dependencies:
-    "@typescript-eslint/types" "8.67.0"
-    "@typescript-eslint/typescript-estree" "8.67.0"
-    "@typescript-eslint/utils" "8.67.0"
+    "@typescript-eslint/types" "8.66.0"
+    "@typescript-eslint/typescript-estree" "8.66.0"
+    "@typescript-eslint/utils" "8.66.0"
     debug "^4.4.3"
     ts-api-utils "^2.5.0"
 
-"@typescript-eslint/types@8.67.0", "@typescript-eslint/types@^8.67.0":
+"@typescript-eslint/types@8.66.0":
+  version "8.66.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/types/-/types-8.66.0.tgz#3cacab94d3b564c1d48c56eb37b89f89a6d48479"
+  integrity sha512-H6gcYaSDOyvL3AD/jHUtUFo2jqGgn/F6nuyuZSu0QTesxL+cP4dQoIMrODRofuJC09g64+WgZ6tE19Y1N2YIFQ==
+
+"@typescript-eslint/types@^8.66.0":
   version "8.67.0"
   resolved "https://registry.yarnpkg.com/@typescript-eslint/types/-/types-8.67.0.tgz#4a8d00cc1faba5c14feabc60f85b7a32652f34b6"
   integrity sha512-sBtgslww8nsMYUjhdPBiSyUqSzT8uR6g93A2QXnQC8+cGdjz0CyaOdqHDRJb1AtORbZCNUJBBeFA/tNR2uQmww==
 
-"@typescript-eslint/typescript-estree@8.67.0":
-  version "8.67.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/typescript-estree/-/typescript-estree-8.67.0.tgz#116c3a47c06119c5a050e8851861d6497dd64bc2"
-  integrity sha512-EKQBCE9yNlRJYm7jdTW5AhDacDUmSwQb0FAJAmK2EKYrNXIsa2vxcSZx6PvJ/dEdI6lS+Y9W+EXckLj0iPFGcw==
+"@typescript-eslint/typescript-estree@8.66.0":
+  version "8.66.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/typescript-estree/-/typescript-estree-8.66.0.tgz#1a38c3a97dc6c669b66d585d7f90ebc4fbb32a50"
+  integrity sha512-8/x4INiiQb10jGgXYD7116/zQ+OL84ZIFn0za68wwFHCanT/VLbBEroWht8RV8fn0/ZCAoazHLQgwUC0UQcDfg==
   dependencies:
-    "@typescript-eslint/project-service" "8.67.0"
-    "@typescript-eslint/tsconfig-utils" "8.67.0"
-    "@typescript-eslint/types" "8.67.0"
-    "@typescript-eslint/visitor-keys" "8.67.0"
+    "@typescript-eslint/project-service" "8.66.0"
+    "@typescript-eslint/tsconfig-utils" "8.66.0"
+    "@typescript-eslint/types" "8.66.0"
+    "@typescript-eslint/visitor-keys" "8.66.0"
     debug "^4.4.3"
     minimatch "^10.2.2"
     semver "^7.7.3"
     tinyglobby "^0.2.15"
     ts-api-utils "^2.5.0"
 
-"@typescript-eslint/utils@8.67.0":
-  version "8.67.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/utils/-/utils-8.67.0.tgz#3e478a3d69d330a1fc50c12746cc2ee0732ccfcd"
-  integrity sha512-U9D1FdwEWBwok3hxxSdhclMb0twvt9QnjIQ0VfQ1AiX2epnpSgv2ubVDsayOFyY8K6FX+AQ7E0FKWVG3iKsj1A==
+"@typescript-eslint/utils@8.66.0":
+  version "8.66.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/utils/-/utils-8.66.0.tgz#e277d67427043cdca2580ee91aa62921e4689969"
+  integrity sha512-jasearZPolBw5NJNYGMwxzHMF83niVWmMU1VdHzG1CyfI2VS7f7nZltnKtHcg20hW+7Uo5GfK4MeDPoU3qI8EA==
   dependencies:
     "@eslint-community/eslint-utils" "^4.9.1"
-    "@typescript-eslint/scope-manager" "8.67.0"
-    "@typescript-eslint/types" "8.67.0"
-    "@typescript-eslint/typescript-estree" "8.67.0"
+    "@typescript-eslint/scope-manager" "8.66.0"
+    "@typescript-eslint/types" "8.66.0"
+    "@typescript-eslint/typescript-estree" "8.66.0"
 
-"@typescript-eslint/visitor-keys@8.67.0":
-  version "8.67.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/visitor-keys/-/visitor-keys-8.67.0.tgz#601d40af9acf82a28da2286f3edafc69bba9017f"
-  integrity sha512-fkv8dHRDqfGtTHuJeebdrQ7cX6Ad4WAS00rgHh9UGvMycF1mjBfsxry1XsLIFhWZ6Judlh6UdzK+TYlbpCXgnA==
+"@typescript-eslint/visitor-keys@8.66.0":
+  version "8.66.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/visitor-keys/-/visitor-keys-8.66.0.tgz#4c494e94745fb2724a4f37a310091e56b644d18a"
+  integrity sha512-dkKR8q+lKciskj1Y3vthHktl+3cMLWGyVUP23bRiPZ5O9BRT++4EqDDV+TVeIKBL1VXVEqrJlz8MYbcnvJcAlg==
   dependencies:
-    "@typescript-eslint/types" "8.67.0"
+    "@typescript-eslint/types" "8.66.0"
     eslint-visitor-keys "^5.0.0"
 
 "@ungap/structured-clone@^1.0.0":
@@ -6181,10 +6164,10 @@ ansis@^3.2.0:
   resolved "https://registry.yarnpkg.com/ansis/-/ansis-3.17.0.tgz#fa8d9c2a93fe7d1177e0c17f9eeb562a58a832d7"
   integrity sha512-0qWUglt9JEqLFr3w1I1pbrChn1grhaiAR2ocX1PP/flRmxgtwTzPFFFnfIlD6aMOLQZgSuCRlidD70lvx8yhzg==
 
-antd@^6.6.0:
-  version "6.6.0"
-  resolved "https://registry.yarnpkg.com/antd/-/antd-6.6.0.tgz#8acb84c54b36594b5c1a9084c8acb6a03b79961b"
-  integrity sha512-UDwWIbpmrCHB9ZQ+bPh4vQfB6DTI2ulIyoQ0Tc9xxalFblttiNGHl3ySBD9SyV/8+gUjFzfSx1+iU1Fog2i46w==
+antd@^6.5.4:
+  version "6.5.4"
+  resolved "https://registry.yarnpkg.com/antd/-/antd-6.5.4.tgz#b41665e86a5f46ca761abd3b0abef7460116ca0d"
+  integrity sha512-jchA6i0rEwHjLpgC+l6HeLHP0gL4Q4yjs6Mxqt6PlhGD5ArxCj3ZH+fKFbNquCtd6Rlzzi+emfNFpP2dGLwZzg==
   dependencies:
     "@ant-design/colors" "^8.0.1"
     "@ant-design/cssinjs" "^2.1.2"
@@ -6193,7 +6176,7 @@ antd@^6.6.0:
     "@ant-design/icons" "^6.3.2"
     "@ant-design/react-slick" "~2.0.0"
     "@babel/runtime" "^7.29.2"
-    "@rc-component/cascader" "~1.22.0"
+    "@rc-component/cascader" "~1.17.0"
     "@rc-component/checkbox" "~2.0.0"
     "@rc-component/collapse" "~1.2.0"
     "@rc-component/color-picker" "~3.1.1"
@@ -6201,11 +6184,10 @@ antd@^6.6.0:
     "@rc-component/drawer" "~1.4.2"
     "@rc-component/dropdown" "~1.0.3"
     "@rc-component/form" "~1.8.6"
-    "@rc-component/image" "~1.10.0"
+    "@rc-component/image" "~1.9.0"
     "@rc-component/input" "~1.3.1"
     "@rc-component/input-number" "~1.6.2"
-    "@rc-component/listy" "~1.2.3"
-    "@rc-component/mentions" "~1.11.0"
+    "@rc-component/mentions" "~1.10.0"
     "@rc-component/menu" "~1.4.1"
     "@rc-component/motion" "^1.3.3"
     "@rc-component/mutate-observer" "^2.0.1"
@@ -6217,16 +6199,16 @@ antd@^6.6.0:
     "@rc-component/rate" "~1.0.1"
     "@rc-component/resize-observer" "^1.1.2"
     "@rc-component/segmented" "~1.3.0"
-    "@rc-component/select" "~1.10.0"
+    "@rc-component/select" "~1.8.2"
     "@rc-component/slider" "~1.1.1"
     "@rc-component/steps" "~1.2.2"
     "@rc-component/switch" "~1.0.3"
-    "@rc-component/table" "~1.11.0"
-    "@rc-component/tabs" "~1.12.0"
-    "@rc-component/tooltip" "~1.5.0"
+    "@rc-component/table" "~1.10.4"
+    "@rc-component/tabs" "~1.11.0"
+    "@rc-component/tooltip" "~1.4.0"
     "@rc-component/tour" "~2.4.0"
-    "@rc-component/tree" "~1.4.0"
-    "@rc-component/tree-select" "~1.16.0"
+    "@rc-component/tree" "~1.3.2"
+    "@rc-component/tree-select" "~1.11.0"
     "@rc-component/trigger" "^3.10.1"
     "@rc-component/upload" "~1.1.1"
     "@rc-component/util" "^1.12.0"
@@ -6522,10 +6504,10 @@ base64-js@^1.3.1, base64-js@^1.5.1:
   resolved "https://registry.yarnpkg.com/base64-js/-/base64-js-1.5.1.tgz#1b1b440160a5bf7ad40b650f095963481903930a"
   integrity sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==
 
-baseline-browser-mapping@^2.10.38, baseline-browser-mapping@^2.11.13, baseline-browser-mapping@^2.9.19:
-  version "2.11.13"
-  resolved "https://registry.yarnpkg.com/baseline-browser-mapping/-/baseline-browser-mapping-2.11.13.tgz#660073103c1bee93e54df55f117b7528adf6af19"
-  integrity sha512-k9HNuUVMlqVjQ9UHzfPjIqiDbWw7WqT1AoT7GL8VwvF3r0ZfArtgiSPAlmupyNquNgOJHTuH4CKYf8ttMTWBTQ==
+baseline-browser-mapping@^2.10.38, baseline-browser-mapping@^2.11.12, baseline-browser-mapping@^2.9.19:
+  version "2.11.12"
+  resolved "https://registry.yarnpkg.com/baseline-browser-mapping/-/baseline-browser-mapping-2.11.12.tgz#42ac48770bf73d292f60ce8ba4dc5e7ebb242ec3"
+  integrity sha512-r7WnVImvVCeFpf2DOXfy41aPWzeNg3H/A2X4dKmy1QL0MSyyk/e7z8ihJ3N6Nn2PsdhkVlqnEfnUE4a05P2aTA==
 
 batch@0.6.1:
   version "0.6.1"
@@ -6763,10 +6745,10 @@ caniuse-api@^3.0.0:
     lodash.memoize "^4.1.2"
     lodash.uniq "^4.5.0"
 
-caniuse-lite@^1.0.0, caniuse-lite@^1.0.30001799, caniuse-lite@^1.0.30001809:
-  version "1.0.30001809"
-  resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001809.tgz#e6cf71f14ddfe008f114dd2a846923be3c03a07b"
-  integrity sha512-xxWVywk6a6Arlk+hymeycyn/VgqEfLDxupvhH/xiY5SJ/18kmi9o6MiO320DCUzypORHLtvh0I4i04tUhCNHNQ==
+caniuse-lite@^1.0.0, caniuse-lite@^1.0.30001799, caniuse-lite@^1.0.30001807:
+  version "1.0.30001807"
+  resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001807.tgz#a113854941fb45b4c1f51793f4636920489079b4"
+  integrity sha512-daRXJ9EB/rdRgu7kV+TTl1YUKtlsMWblPl2sLnpg9DZae16QCegol6A1SmCE31Lm9mXC1sRWGt/krouH+/dl7Q==
 
 ccount@^2.0.0:
   version "2.0.1"
@@ -8014,10 +7996,10 @@ doctrine@^2.1.0:
   dependencies:
     esutils "^2.0.2"
 
-docusaurus-plugin-openapi-docs@^5.2.0:
-  version "5.2.0"
-  resolved "https://registry.yarnpkg.com/docusaurus-plugin-openapi-docs/-/docusaurus-plugin-openapi-docs-5.2.0.tgz#8318ec90cd21fed023be57696211af7d72fd81db"
-  integrity sha512-MjrfRAMB64uvdxRVz6L9AXWe4QFjCdoBAzYs306yyI3nnXHsFj2lv2FnLA90JV9CAUZaGiYMvvkzBo2Nrkq/9w==
+docusaurus-plugin-openapi-docs@^5.1.3:
+  version "5.1.3"
+  resolved "https://registry.yarnpkg.com/docusaurus-plugin-openapi-docs/-/docusaurus-plugin-openapi-docs-5.1.3.tgz#b8cd5f8451aaf881deb1a744a8295685f1681865"
+  integrity sha512-HnpblSBdXoR39VNTIW9zWERUsMJxXOpvdQoBKyaTkUBPwCM48Z76+ndo2yO2vADq+EhWjJlfxL1DUzCrgNjThQ==
   dependencies:
     "@apidevtools/json-schema-ref-parser" "^15.3.3"
     "@redocly/openapi-core" "^2.25.2"
@@ -8035,10 +8017,10 @@ docusaurus-plugin-openapi-docs@^5.2.0:
     swagger2openapi "^7.0.8"
     xml-formatter "^3.6.6"
 
-docusaurus-theme-openapi-docs@^5.2.0:
-  version "5.2.0"
-  resolved "https://registry.yarnpkg.com/docusaurus-theme-openapi-docs/-/docusaurus-theme-openapi-docs-5.2.0.tgz#6d93a74e2e3cf0ae77d24e1c4144bd2e74a52115"
-  integrity sha512-L0b80LzaMUfr76a9EQXRPCf8nxkEz8Xo6Aknnke1UeE2oXsgoiVki6U+RTE7GmJRjO8zSNKXyckGmGmqqWuHeA==
+docusaurus-theme-openapi-docs@^5.1.3:
+  version "5.1.3"
+  resolved "https://registry.yarnpkg.com/docusaurus-theme-openapi-docs/-/docusaurus-theme-openapi-docs-5.1.3.tgz#e23644a63785352abbc76e42760c0dfdff3669e1"
+  integrity sha512-npbD1QahtjAEmrOet/86i5fTmcJX4/rPhVT+c0qKjm7StUNbyqjwchSVBQuU1rB69T51JOA9TpT/y6QcB9Xjvw==
   dependencies:
     "@hookform/error-message" "^2.0.1"
     "@reduxjs/toolkit" "^2.8.2"
@@ -8123,7 +8105,7 @@ domhandler@^5.0.2, domhandler@^5.0.3:
   dependencies:
     domelementtype "^2.3.0"
 
-dompurify@^3.3.3, dompurify@^3.4.13:
+dompurify@^3.3.3, dompurify@^3.4.12:
   version "3.4.13"
   resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-3.4.13.tgz#fc28949d59f92d62e28a3a764bcbeee35897a1be"
   integrity sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ==
@@ -9174,10 +9156,10 @@ globals@^14.0.0:
   resolved "https://registry.yarnpkg.com/globals/-/globals-14.0.0.tgz#898d7413c29babcf6bafe56fcadded858ada724e"
   integrity sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==
 
-globals@^17.11.0:
-  version "17.11.0"
-  resolved "https://registry.yarnpkg.com/globals/-/globals-17.11.0.tgz#d643485bb30220d7751e511cf4f68c73d3870d87"
-  integrity sha512-Z2I8hM+PbJDXQDq3Icgpzv+mPdwr68iZUU9d5WW4FuXfDUQfkZaZuvjMv42/5crNyw154+9+VWXbYrUgDXbxNw==
+globals@^17.9.0:
+  version "17.9.0"
+  resolved "https://registry.yarnpkg.com/globals/-/globals-17.9.0.tgz#e43f252d6bbe71508da43902a1709c8895a59f70"
+  integrity sha512-m/MvAW61QVU5VDNF1Vj8axt016h8w7L5TU1e9zlab7XIttAT2YAlCwl75K1fOqvMM9apmD7lbCIRhpfkhmxhCg==
 
 globalthis@^1.0.4:
   version "1.0.4"
@@ -10284,10 +10266,10 @@ js-levenshtein@^1.1.6:
   resolved "https://registry.yarnpkg.com/js-tokens/-/js-tokens-4.0.0.tgz#19203fb59991df98e3a287050d4647cdeaf32499"
   integrity sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==
 
-js-yaml@4.1.0, js-yaml@=4.3.1, js-yaml@^4.1.0, js-yaml@^4.1.1, js-yaml@^4.2.0, js-yaml@^4.3.0:
-  version "4.3.1"
-  resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.3.1.tgz#01216c001d67f48e2cd560d708c7af21090a3848"
-  integrity sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==
+js-yaml@4.1.0, js-yaml@=4.3.0, js-yaml@^4.1.0, js-yaml@^4.1.1, js-yaml@^4.2.0, js-yaml@^4.3.0:
+  version "4.3.0"
+  resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.3.0.tgz#d1900572a7f7cf0b5f540c83673e60bad3436592"
+  integrity sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==
   dependencies:
     argparse "^2.0.1"
 
@@ -12262,32 +12244,32 @@ oxc-resolver@^11.19.1:
     "@oxc-resolver/binding-win32-arm64-msvc" "11.23.0"
     "@oxc-resolver/binding-win32-x64-msvc" "11.23.0"
 
-oxfmt@^0.63.0:
-  version "0.63.0"
-  resolved "https://registry.yarnpkg.com/oxfmt/-/oxfmt-0.63.0.tgz#c7338e6c43a68d5cf8dc61c08b617d77cb54e323"
-  integrity sha512-kgdDwv35wvVf6554U2Ab8Jnd0zTM+TsEQWwaB70RAjK3gICFAFGO+2Hd3Be27GMoXj3XRL9IKSNRVl7KBQL6iw==
+oxfmt@^0.62.0:
+  version "0.62.0"
+  resolved "https://registry.yarnpkg.com/oxfmt/-/oxfmt-0.62.0.tgz#9945728022d26dc0a1d5bc486db112e7e340507a"
+  integrity sha512-vxgGHTmnDU9j4CX7dDBLzxgmHxfda/yPcgJkGCMUSCwRmz+euo/V08xXLNgXTeqAB9Fhf3Pe2nO1RNKLCVgphQ==
   dependencies:
     tinypool "2.1.0"
   optionalDependencies:
-    "@oxfmt/binding-android-arm-eabi" "0.63.0"
-    "@oxfmt/binding-android-arm64" "0.63.0"
-    "@oxfmt/binding-darwin-arm64" "0.63.0"
-    "@oxfmt/binding-darwin-x64" "0.63.0"
-    "@oxfmt/binding-freebsd-x64" "0.63.0"
-    "@oxfmt/binding-linux-arm-gnueabihf" "0.63.0"
-    "@oxfmt/binding-linux-arm-musleabihf" "0.63.0"
-    "@oxfmt/binding-linux-arm64-gnu" "0.63.0"
-    "@oxfmt/binding-linux-arm64-musl" "0.63.0"
-    "@oxfmt/binding-linux-ppc64-gnu" "0.63.0"
-    "@oxfmt/binding-linux-riscv64-gnu" "0.63.0"
-    "@oxfmt/binding-linux-riscv64-musl" "0.63.0"
-    "@oxfmt/binding-linux-s390x-gnu" "0.63.0"
-    "@oxfmt/binding-linux-x64-gnu" "0.63.0"
-    "@oxfmt/binding-linux-x64-musl" "0.63.0"
-    "@oxfmt/binding-openharmony-arm64" "0.63.0"
-    "@oxfmt/binding-win32-arm64-msvc" "0.63.0"
-    "@oxfmt/binding-win32-ia32-msvc" "0.63.0"
-    "@oxfmt/binding-win32-x64-msvc" "0.63.0"
+    "@oxfmt/binding-android-arm-eabi" "0.62.0"
+    "@oxfmt/binding-android-arm64" "0.62.0"
+    "@oxfmt/binding-darwin-arm64" "0.62.0"
+    "@oxfmt/binding-darwin-x64" "0.62.0"
+    "@oxfmt/binding-freebsd-x64" "0.62.0"
+    "@oxfmt/binding-linux-arm-gnueabihf" "0.62.0"
+    "@oxfmt/binding-linux-arm-musleabihf" "0.62.0"
+    "@oxfmt/binding-linux-arm64-gnu" "0.62.0"
+    "@oxfmt/binding-linux-arm64-musl" "0.62.0"
+    "@oxfmt/binding-linux-ppc64-gnu" "0.62.0"
+    "@oxfmt/binding-linux-riscv64-gnu" "0.62.0"
+    "@oxfmt/binding-linux-riscv64-musl" "0.62.0"
+    "@oxfmt/binding-linux-s390x-gnu" "0.62.0"
+    "@oxfmt/binding-linux-x64-gnu" "0.62.0"
+    "@oxfmt/binding-linux-x64-musl" "0.62.0"
+    "@oxfmt/binding-openharmony-arm64" "0.62.0"
+    "@oxfmt/binding-win32-arm64-msvc" "0.62.0"
+    "@oxfmt/binding-win32-ia32-msvc" "0.62.0"
+    "@oxfmt/binding-win32-x64-msvc" "0.62.0"
 
 p-cancelable@^3.0.0:
   version "3.0.0"
@@ -14783,10 +14765,10 @@ stop-iteration-iterator@^1.1.0:
     es-errors "^1.3.0"
     internal-slot "^1.1.0"
 
-storybook@^10.5.8:
-  version "10.5.8"
-  resolved "https://registry.yarnpkg.com/storybook/-/storybook-10.5.8.tgz#d5f051983e6232c0a73ea02149a72c7bafb43275"
-  integrity sha512-rR4oFMSiWBSqI0lvsJPtcQUPj8+hzj3TkLu+Mw61Wo6YxPSb5FsLSHai0jZnuaIdKIlmu25KCfwlSQl4e1uvnA==
+storybook@^10.5.7:
+  version "10.5.7"
+  resolved "https://registry.yarnpkg.com/storybook/-/storybook-10.5.7.tgz#adfc465e51f337291c095278c23f1b8024ef2da7"
+  integrity sha512-oiKvWIwIoOhFP1i6dASYyMXwPHKEtVZMshqSB7EvIVYjWRh0l9H7gHEt1z4Gh2rLGFMekWdsm4s94rvwpR7gkg==
   dependencies:
     "@storybook/global" "^5.0.0"
     "@storybook/icons" "^2.0.2"
@@ -15103,10 +15085,10 @@ swagger-client@^3.37.8:
     "@swagger-api/apidom-parser-adapter-openapi-yaml-3-2" "^1.12.0"
     "@swagger-api/apidom-parser-adapter-yaml-1-2" "^1.12.0"
 
-swagger-ui-react@^5.32.13:
-  version "5.32.13"
-  resolved "https://registry.yarnpkg.com/swagger-ui-react/-/swagger-ui-react-5.32.13.tgz#04c96140b0a2d4ea01ebec4d4cfc655d5ed9a500"
-  integrity sha512-XIDl+Ny6kE1N8wpSPiOFrjPfAevs4GR4XmV6BT6NLMikkMFIbIVocWbA8pnKYyYXQe8Rccfli5o2zDfySw0FnQ==
+swagger-ui-react@^5.32.12:
+  version "5.32.12"
+  resolved "https://registry.yarnpkg.com/swagger-ui-react/-/swagger-ui-react-5.32.12.tgz#47525a26774eb02db0e6203af72f5b32fa6205cc"
+  integrity sha512-WCdkNOQyMTZDu+z356FpwVWHf1dwZgQPUjdQPh1L4r7jULaJTKKlIItXq6WsZdYeXvsHndMdxxccEQXOAroUHQ==
   dependencies:
     "@babel/runtime-corejs3" "^7.27.1"
     "@scarf/scarf" "=1.4.0"
@@ -15115,11 +15097,11 @@ swagger-ui-react@^5.32.13:
     classnames "^2.5.1"
     css.escape "1.5.1"
     deep-extend "0.6.0"
-    dompurify "^3.4.13"
+    dompurify "^3.4.12"
     ieee754 "^1.2.1"
     immutable "^4.3.9"
     js-file-download "^0.4.12"
-    js-yaml "=4.3.1"
+    js-yaml "=4.3.0"
     lodash "^4.18.1"
     prop-types "^15.8.1"
     randexp "^0.5.3"
@@ -15485,15 +15467,15 @@ types-ramda@^0.30.1:
   dependencies:
     ts-toolbelt "^9.6.0"
 
-typescript-eslint@^8.67.0:
-  version "8.67.0"
-  resolved "https://registry.yarnpkg.com/typescript-eslint/-/typescript-eslint-8.67.0.tgz#1e92de09ee0ff2d96cc0848f5e9f345ea930d963"
-  integrity sha512-S2udFs8tCKEKffuJ4TB1idGUZiXdCPGi3IPBGWXarbLQ5UPXORV8QEVzJ4gCRduURMb5EkpNCdjbk0eDIuI8Yg==
+typescript-eslint@^8.66.0:
+  version "8.66.0"
+  resolved "https://registry.yarnpkg.com/typescript-eslint/-/typescript-eslint-8.66.0.tgz#0809b6d25c8a0924690ba30dc1f05607093c11fb"
+  integrity sha512-QlEbBPz/RuJ1XUHj29nm3t0F/O/cSlEnntozqPOYHnnTGAXFamnMBu5i9Vn6vhUPHGAjR+Vl+5J8vPN/BMUrJw==
   dependencies:
-    "@typescript-eslint/eslint-plugin" "8.67.0"
-    "@typescript-eslint/parser" "8.67.0"
-    "@typescript-eslint/typescript-estree" "8.67.0"
-    "@typescript-eslint/utils" "8.67.0"
+    "@typescript-eslint/eslint-plugin" "8.66.0"
+    "@typescript-eslint/parser" "8.66.0"
+    "@typescript-eslint/typescript-estree" "8.66.0"
+    "@typescript-eslint/utils" "8.66.0"
 
 typescript@~6.0.3:
   version "6.0.3"

pyproject.toml

@@ -42,7 +42,7 @@ dependencies = [
     # ``google-auth`` 2.53+ dropped it, so Superset must declare it
     # explicitly to keep fresh ``pip install apache-superset`` working
     # without the ``base.txt`` lock file (#40962).
-    "cachetools>=7.1.7, <8",
+    "cachetools>=7.1.6, <8",
     "celery>=5.6.3, <6.0.0",
     "click>=8.4.2",
     "click-option-group",
@@ -75,7 +75,7 @@ dependencies = [
     "humanize",
     "isodate",
     "jsonpath-ng>=1.8.0, <2",
-    "Mako>=1.4.1",
+    "Mako>=1.2.2",
     "markdown>=3.10.3",
     # marshmallow 4 compatibility: see superset/marshmallow_compatibility.py for a
     # Flask-AppBuilder workaround. Tracking issue:
@@ -135,10 +135,10 @@ athena = ["pyathena[pandas]>=3.35.4, <4"]
 # superset/db_engine_specs/aurora.py's known_incompatibilities metadata.
 aurora-data-api = ["preset-sqlalchemy-aurora-data-api>=0.2.8,<0.3"]
 bigquery = [
-    "pandas-gbq>=0.35.1",
+    "pandas-gbq>=0.35.0",
     # 1.17.1 is likely the final release: googleapis/python-bigquery-sqlalchemy
     # was archived 2026-05-16. Both 1.17.0 and 1.17.1 support SQLAlchemy 1.4/2.0.
-    "sqlalchemy-bigquery>=1.17.2",
+    "sqlalchemy-bigquery>=1.17.1",
     "google-cloud-bigquery>=3.42.3",
 ]
 clickhouse = ["clickhouse-connect>=1.6.0, <2.0"]
@@ -185,7 +185,7 @@ excel = ["xlrd>=2.0.2, <2.1"]
 # installing this extra is only required to actually run exports.
 excel-export = ["boto3"]
 fastmcp = [
-    "fastmcp>=3.4.6,<4.0",
+    "fastmcp>=3.4.5,<4.0",
     # tiktoken backs the response-size-guard token estimator. Without
     # it, the middleware falls back to a coarser character-based
     # heuristic that under-counts JSON-heavy MCP responses.
@@ -221,7 +221,7 @@ ocient = [
     # unpinned sqlalchemy>=1.4 declared, but SQLAlchemy 2.0 support is
     # unverified. Lower confidence than the other bumps in this PR.
     "sqlalchemy-ocient>=3.0.0, <4",
-    "pyocient>=3.9.0, <4",
+    "pyocient>=1.0.15, <4",
     "shapely",
     "geojson",
 ]

requirements/base.in

@@ -28,7 +28,7 @@ numexpr>=2.9.0
 # Security: CVE-2026-34073 (MEDIUM) - Improper Certificate Validation
 cryptography>=50.0.0,<51.0.0
 # Security: Snyk - XSS vulnerability in Mako templates
-mako>=1.4.1,<2.0.0
+mako>=1.3.11,<2.0.0
 # Security: CVE-2024-52338 (CRITICAL) - Deserialization of untrusted data in IPC/Parquet readers
 pyarrow>=24.0.0,<26.0.0
 # Security: CVE-2026-27459 - pyopenssl certificate validation

requirements/base.txt

@@ -44,7 +44,7 @@ cachelib==0.13.0
     # via
     #   flask-caching
     #   flask-session
-cachetools==7.1.7
+cachetools==7.1.6
     # via apache-superset (pyproject.toml)
 cattrs==25.1.1
     # via requests-cache
@@ -207,7 +207,7 @@ kombu==5.6.2
     # via celery
 limits==5.1.0
     # via flask-limiter
-mako==1.4.1
+mako==1.3.12
     # via
     #   -r requirements/base.in
     #   apache-superset (pyproject.toml)

requirements/development.txt

@@ -99,7 +99,7 @@ cachelib==0.13.0
     #   -c requirements/base-constraint.txt
     #   flask-caching
     #   flask-session
-cachetools==7.1.7
+cachetools==7.1.6
     # via
     #   -c requirements/base-constraint.txt
     #   apache-superset
@@ -239,9 +239,9 @@ et-xmlfile==2.0.0
     #   openpyxl
 exceptiongroup==1.3.0
     # via fastmcp-slim
-fastmcp==3.4.7
+fastmcp==3.4.5
     # via apache-superset
-fastmcp-slim==3.4.7
+fastmcp-slim==3.4.5
     # via fastmcp
 filelock==3.20.3
     # via
@@ -510,7 +510,7 @@ limits==5.1.0
     #   flask-limiter
 lz4==4.4.5
     # via trino
-mako==1.4.1
+mako==1.3.12
     # via
     #   -c requirements/base-constraint.txt
     #   alembic
@@ -640,7 +640,7 @@ pandas==2.3.3
     #   db-dtypes
     #   pandas-gbq
     #   prophet
-pandas-gbq==0.35.1
+pandas-gbq==0.35.0
     # via apache-superset
 parameterized==0.9.0
     # via apache-superset
@@ -964,7 +964,7 @@ sqlalchemy==2.0.51
     #   sqlalchemy-bigquery
     #   sqlalchemy-continuum
     #   sqlalchemy-utils
-sqlalchemy-bigquery==1.17.2
+sqlalchemy-bigquery==1.17.1
     # via apache-superset
 sqlalchemy-continuum==1.7.0
     # via

scripts/benchmark_migration.py

@@ -93,7 +93,7 @@ def find_models(module: ModuleType) -> list[type[Model]]:  # noqa: C901
     # where the current model is out-of-sync with the existing table after a
     # downgrade
     sqlalchemy_uri = current_app.config["SQLALCHEMY_DATABASE_URI"]
-    engine = create_engine(sqlalchemy_uri)
+    engine = create_engine(sqlalchemy_uri, future=True)
     Base = automap_base()  # noqa: N806
     Base.prepare(engine, reflect=True)
     seen = set()

scripts/docker-build-extra-flags.sh

@@ -1,48 +0,0 @@
-#!/usr/bin/env bash
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-
-# Computes the `--extra-flags` value passed to `supersetbot docker` for a
-# given build preset. Factored out of .github/workflows/docker.yml so the
-# PY_VER override logic below can be exercised by an always-on CI check
-# (docker.yml's docker-build job only runs when the change detector's
-# docker/python/frontend outputs are true, and the PR build matrix never
-# includes py311/py312 at all, so a regression here would otherwise go
-# unnoticed until the fix actually runs on master) without duplicating -
-# and risking drift from - the logic used by the real build step.
-#
-# supersetbot's "py311"/"py312" presets pin their own --build-arg PY_VER,
-# which lands ahead of --extra-flags on the assembled buildx command line;
-# docker/buildx keeps the last value for a repeated --build-arg key, so
-# appending PY_VER here would override supersetbot's pin and silently make
-# "py311"/"py312" build the exact same image as "lean". Every other preset
-# gets the override so its build lands on the Dockerfile's own supported
-# Python version.
-#
-# Usage: docker-build-extra-flags.sh <build_preset> <image_tag>
-
-set -euo pipefail
-
-BUILD_PRESET="${1:?usage: docker-build-extra-flags.sh <build_preset> <image_tag>}"
-IMAGE_TAG="${2:?usage: docker-build-extra-flags.sh <build_preset> <image_tag>}"
-
-EXTRA_FLAGS="--build-arg INCLUDE_CHROMIUM=false --tag $IMAGE_TAG"
-if [ "$BUILD_PRESET" != "py311" ] && [ "$BUILD_PRESET" != "py312" ]; then
-  EXTRA_FLAGS="--build-arg PY_VER=3.11.14-slim-trixie $EXTRA_FLAGS"
-fi
-
-echo "$EXTRA_FLAGS"

superset-core/src/superset_core/semantic_layers/types.py

@@ -18,9 +18,8 @@
 from __future__ import annotations
 
 import enum
-from dataclasses import dataclass, field
+from dataclasses import dataclass
 from datetime import date, datetime, time, timedelta
-from typing import Any
 
 import isodate
 import pyarrow as pa
@@ -91,8 +90,6 @@ class Dimension:
     definition: str | None = None
     description: str | None = None
     grain: Grain | None = None
-    verbose_name: str | None = field(default=None, compare=False)
-    metadata: dict[str, Any] = field(default_factory=dict, compare=False)
 
 
 class AggregationType(str, enum.Enum):
@@ -124,9 +121,6 @@ class Metric:
     definition: str
     description: str | None = None
     aggregation: AggregationType | None = None
-    verbose_name: str | None = field(default=None, compare=False)
-    d3format: str | None = field(default=None, compare=False)
-    metadata: dict[str, Any] = field(default_factory=dict, compare=False)
 
 
 @dataclass(frozen=True)

superset-core/tests/semantic_layers/test_types.py

@@ -1,97 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-
-import pyarrow as pa
-from superset_core.semantic_layers.types import Dimension, Metric
-
-
-def test_dimension_metadata_is_not_part_of_identity() -> None:
-    first = Dimension(
-        "sales.region",
-        "region",
-        pa.utf8(),
-        verbose_name="Region",
-        metadata={"display_name": "Region"},
-    )
-    second = Dimension(
-        "sales.region",
-        "region",
-        pa.utf8(),
-        verbose_name="Sales region",
-        metadata={"display_name": "Sales region"},
-    )
-
-    assert first == second
-    assert {first, second} == {first}
-
-
-def test_metric_metadata_is_not_part_of_identity() -> None:
-    first = Metric(
-        "sales.total_revenue",
-        "total_revenue",
-        pa.float64(),
-        "SUM(revenue)",
-        verbose_name="Total revenue",
-        d3format="$,.2f",
-        metadata={"unit": {"kind": "currency", "code": "USD"}},
-    )
-    second = Metric(
-        "sales.total_revenue",
-        "total_revenue",
-        pa.float64(),
-        "SUM(revenue)",
-        verbose_name="Revenue",
-        d3format=",.0f",
-        metadata={"unit": {"kind": "currency", "code": "EUR"}},
-    )
-
-    assert first == second
-    assert {first, second} == {first}
-
-
-def test_metric_accepts_superset_presentation_fields() -> None:
-    metric = Metric(
-        "sales.total_revenue",
-        "total_revenue",
-        pa.float64(),
-        "SUM(revenue)",
-        verbose_name="Total revenue",
-        d3format="$,.2f",
-    )
-
-    assert metric.verbose_name == "Total revenue"
-    assert metric.d3format == "$,.2f"
-
-
-def test_dimension_accepts_superset_presentation_fields() -> None:
-    dimension = Dimension(
-        "sales.region",
-        "region",
-        pa.utf8(),
-        verbose_name="Region",
-    )
-
-    assert dimension.verbose_name == "Region"
-
-
-def test_metadata_defaults_are_not_shared() -> None:
-    first = Metric("first", "first", pa.int64(), "COUNT(*)")
-    second = Metric("second", "second", pa.int64(), "COUNT(*)")
-
-    first.metadata["display_name"] = "First"
-
-    assert second.metadata == {}

superset-embedded-sdk/package-lock.json

@@ -19,7 +19,6 @@
         "@babel/preset-typescript": "7.29.7",
         "@types/node": "^25.4.0",
         "babel-loader": "^9.1.3",
-        "jsdom": "^26.1.0",
         "tscw-config": "^1.1.2",
         "typescript": "^5.9.3",
         "vitest": "^4.0.18",
@@ -27,27 +26,6 @@
         "webpack-cli": "^5.1.4"
       }
     },
-    "node_modules/@asamuzakjp/css-color": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/@asamuzakjp/css-color/-/css-color-3.2.0.tgz",
-      "integrity": "sha512-K1A6z8tS3XsmCMM86xoWdn7Fkdn9m6RSVtocUrJYIwZnFVkng/PvkEoWtOWmP+Scc6saYWHWZYbndEEXxl24jw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@csstools/css-calc": "^2.1.3",
-        "@csstools/css-color-parser": "^3.0.9",
-        "@csstools/css-parser-algorithms": "^3.0.4",
-        "@csstools/css-tokenizer": "^3.0.3",
-        "lru-cache": "^10.4.3"
-      }
-    },
-    "node_modules/@asamuzakjp/css-color/node_modules/lru-cache": {
-      "version": "10.4.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
-      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
-      "dev": true,
-      "license": "ISC"
-    },
     "node_modules/@babel/cli": {
       "version": "7.29.7",
       "resolved": "https://registry.npmjs.org/@babel/cli/-/cli-7.29.7.tgz",
@@ -1678,121 +1656,6 @@
         "node": ">=6.9.0"
       }
     },
-    "node_modules/@csstools/color-helpers": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-5.1.0.tgz",
-      "integrity": "sha512-S11EXWJyy0Mz5SYvRmY8nJYTFFd1LCNV+7cXyAgQtOOuzb4EsgfqDufL+9esx72/eLhsRdGZwaldu/h+E4t4BA==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/csstools"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/csstools"
-        }
-      ],
-      "license": "MIT-0",
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@csstools/css-calc": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/@csstools/css-calc/-/css-calc-2.1.4.tgz",
-      "integrity": "sha512-3N8oaj+0juUw/1H3YwmDDJXCgTB1gKU6Hc/bB502u9zR0q2vd786XJH9QfrKIEgFlZmhZiq6epXl4rHqhzsIgQ==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/csstools"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/csstools"
-        }
-      ],
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "peerDependencies": {
-        "@csstools/css-parser-algorithms": "^3.0.5",
-        "@csstools/css-tokenizer": "^3.0.4"
-      }
-    },
-    "node_modules/@csstools/css-color-parser": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-3.1.0.tgz",
-      "integrity": "sha512-nbtKwh3a6xNVIp/VRuXV64yTKnb1IjTAEEh3irzS+HkKjAOYLTGNb9pmVNntZ8iVBHcWDA2Dof0QtPgFI1BaTA==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/csstools"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/csstools"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "@csstools/color-helpers": "^5.1.0",
-        "@csstools/css-calc": "^2.1.4"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "peerDependencies": {
-        "@csstools/css-parser-algorithms": "^3.0.5",
-        "@csstools/css-tokenizer": "^3.0.4"
-      }
-    },
-    "node_modules/@csstools/css-parser-algorithms": {
-      "version": "3.0.5",
-      "resolved": "https://registry.npmjs.org/@csstools/css-parser-algorithms/-/css-parser-algorithms-3.0.5.tgz",
-      "integrity": "sha512-DaDeUkXZKjdGhgYaHNJTV9pV7Y9B3b644jCLs9Upc3VeNGg6LWARAT6O+Q+/COo+2gg/bM5rhpMAtf70WqfBdQ==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/csstools"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/csstools"
-        }
-      ],
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "peerDependencies": {
-        "@csstools/css-tokenizer": "^3.0.4"
-      }
-    },
-    "node_modules/@csstools/css-tokenizer": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@csstools/css-tokenizer/-/css-tokenizer-3.0.4.tgz",
-      "integrity": "sha512-Vd/9EVDiu6PPJt9yAh6roZP6El1xHrdvIVGjyBsHR0RYwNHgL7FJPyIIW4fANJNG6FtyZfvlRPpFI4ZM/lubvw==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/csstools"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/csstools"
-        }
-      ],
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      }
-    },
     "node_modules/@discoveryjs/json-ext": {
       "version": "0.5.6",
       "resolved": "https://registry.npmjs.org/@discoveryjs/json-ext/-/json-ext-0.5.6.tgz",
@@ -2638,16 +2501,6 @@
         "acorn": "^8.14.0"
       }
     },
-    "node_modules/agent-base": {
-      "version": "7.1.4",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
-      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 14"
-      }
-    },
     "node_modules/ajv": {
       "version": "8.20.0",
       "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
@@ -3015,34 +2868,6 @@
         "node": ">= 8"
       }
     },
-    "node_modules/cssstyle": {
-      "version": "4.6.0",
-      "resolved": "https://registry.npmjs.org/cssstyle/-/cssstyle-4.6.0.tgz",
-      "integrity": "sha512-2z+rWdzbbSZv6/rhtvzvqeZQHrBaqgogqt85sqFNbabZOuFbCVFb8kPeEtZjiKkbrm395irpNKiYeFeLiQnFPg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@asamuzakjp/css-color": "^3.2.0",
-        "rrweb-cssom": "^0.8.0"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/data-urls": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/data-urls/-/data-urls-5.0.0.tgz",
-      "integrity": "sha512-ZYP5VBHshaDAiVZxjbRVcFJpc+4xGgT0bK3vzy1HLN8jTO975HEbuYzZJcHoQEY5K1a0z8YayJkyVETa08eNTg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "whatwg-mimetype": "^4.0.0",
-        "whatwg-url": "^14.0.0"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
     "node_modules/debug": {
       "version": "4.4.3",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
@@ -3061,13 +2886,6 @@
         }
       }
     },
-    "node_modules/decimal.js": {
-      "version": "10.6.0",
-      "resolved": "https://registry.npmjs.org/decimal.js/-/decimal.js-10.6.0.tgz",
-      "integrity": "sha512-YpgQiITW3JXGntzdUmyUR1V812Hn8T1YVXhCu+wO3OpS4eU9l4YdD3qjyiKdV6mvV29zapkMeD390UVEf2lkUg==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/detect-libc": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
@@ -3097,19 +2915,6 @@
         "node": ">=10.13.0"
       }
     },
-    "node_modules/entities": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/entities/-/entities-6.0.1.tgz",
-      "integrity": "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "engines": {
-        "node": ">=0.12"
-      },
-      "funding": {
-        "url": "https://github.com/fb55/entities?sponsor=1"
-      }
-    },
     "node_modules/envinfo": {
       "version": "7.13.0",
       "resolved": "https://registry.npmjs.org/envinfo/-/envinfo-7.13.0.tgz",
@@ -3511,60 +3316,6 @@
         "node": ">= 0.4"
       }
     },
-    "node_modules/html-encoding-sniffer": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/html-encoding-sniffer/-/html-encoding-sniffer-4.0.0.tgz",
-      "integrity": "sha512-Y22oTqIU4uuPgEemfz7NDJz6OeKf12Lsu+QC+s3BVpda64lTiMYCyGwg5ki4vFxkMwQdeZDl2adZoqUgdFuTgQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "whatwg-encoding": "^3.1.1"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/http-proxy-agent": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
-      "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "agent-base": "^7.1.0",
-        "debug": "^4.3.4"
-      },
-      "engines": {
-        "node": ">= 14"
-      }
-    },
-    "node_modules/https-proxy-agent": {
-      "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
-      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "agent-base": "^7.1.2",
-        "debug": "4"
-      },
-      "engines": {
-        "node": ">= 14"
-      }
-    },
-    "node_modules/iconv-lite": {
-      "version": "0.6.3",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
-      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "safer-buffer": ">= 2.1.2 < 3.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/import-local": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/import-local/-/import-local-3.1.0.tgz",
@@ -3687,13 +3438,6 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/is-potential-custom-element-name": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/is-potential-custom-element-name/-/is-potential-custom-element-name-1.0.1.tgz",
-      "integrity": "sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/isexe": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
@@ -3754,46 +3498,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/jsdom": {
-      "version": "26.1.0",
-      "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-26.1.0.tgz",
-      "integrity": "sha512-Cvc9WUhxSMEo4McES3P7oK3QaXldCfNWp7pl2NNeiIFlCoLr3kfq9kb1fxftiwk1FLV7CvpvDfonxtzUDeSOPg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "cssstyle": "^4.2.1",
-        "data-urls": "^5.0.0",
-        "decimal.js": "^10.5.0",
-        "html-encoding-sniffer": "^4.0.0",
-        "http-proxy-agent": "^7.0.2",
-        "https-proxy-agent": "^7.0.6",
-        "is-potential-custom-element-name": "^1.0.1",
-        "nwsapi": "^2.2.16",
-        "parse5": "^7.2.1",
-        "rrweb-cssom": "^0.8.0",
-        "saxes": "^6.0.0",
-        "symbol-tree": "^3.2.4",
-        "tough-cookie": "^5.1.1",
-        "w3c-xmlserializer": "^5.0.0",
-        "webidl-conversions": "^7.0.0",
-        "whatwg-encoding": "^3.1.1",
-        "whatwg-mimetype": "^4.0.0",
-        "whatwg-url": "^14.1.1",
-        "ws": "^8.18.0",
-        "xml-name-validator": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "peerDependencies": {
-        "canvas": "^3.0.0"
-      },
-      "peerDependenciesMeta": {
-        "canvas": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/jsesc": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-3.1.0.tgz",
@@ -4273,13 +3977,6 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/nwsapi": {
-      "version": "2.2.24",
-      "resolved": "https://registry.npmjs.org/nwsapi/-/nwsapi-2.2.24.tgz",
-      "integrity": "sha512-7YRhZ3jS45LwmSCT4b2sVFHt/WuovaktDU07QrtOBY2PXskss5a9jfmR9jptyumwXST+rFjrmppMY1KT/yn35A==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/obug": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.1.tgz",
@@ -4336,19 +4033,6 @@
         "node": ">=6"
       }
     },
-    "node_modules/parse5": {
-      "version": "7.3.0",
-      "resolved": "https://registry.npmjs.org/parse5/-/parse5-7.3.0.tgz",
-      "integrity": "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "entities": "^6.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/inikulin/parse5?sponsor=1"
-      }
-    },
     "node_modules/path-exists": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
@@ -4458,16 +4142,6 @@
         "node": "^10 || ^12 || >=14"
       }
     },
-    "node_modules/punycode": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
-      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
     "node_modules/readdirp": {
       "version": "3.6.0",
       "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz",
@@ -4640,33 +4314,6 @@
         "@rolldown/binding-win32-x64-msvc": "1.1.3"
       }
     },
-    "node_modules/rrweb-cssom": {
-      "version": "0.8.0",
-      "resolved": "https://registry.npmjs.org/rrweb-cssom/-/rrweb-cssom-0.8.0.tgz",
-      "integrity": "sha512-guoltQEx+9aMf2gDZ0s62EcV8lsXR+0w8915TC3ITdn2YueuNjdAYh/levpU9nFaoChh9RUS5ZdQMrKfVEN9tw==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/safer-buffer": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
-      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/saxes": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/saxes/-/saxes-6.0.0.tgz",
-      "integrity": "sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "xmlchars": "^2.2.0"
-      },
-      "engines": {
-        "node": ">=v12.22.7"
-      }
-    },
     "node_modules/schema-utils": {
       "version": "4.3.3",
       "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-4.3.3.tgz",
@@ -4800,13 +4447,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/symbol-tree": {
-      "version": "3.2.4",
-      "resolved": "https://registry.npmjs.org/symbol-tree/-/symbol-tree-3.2.4.tgz",
-      "integrity": "sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/tapable": {
       "version": "2.3.0",
       "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.0.tgz",
@@ -4952,26 +4592,6 @@
         "node": ">=14.0.0"
       }
     },
-    "node_modules/tldts": {
-      "version": "6.1.86",
-      "resolved": "https://registry.npmjs.org/tldts/-/tldts-6.1.86.tgz",
-      "integrity": "sha512-WMi/OQ2axVTf/ykqCQgXiIct+mSQDFdH2fkwhPwgEwvJ1kSzZRiinb0zF2Xb8u4+OqPChmyI6MEu4EezNJz+FQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "tldts-core": "^6.1.86"
-      },
-      "bin": {
-        "tldts": "bin/cli.js"
-      }
-    },
-    "node_modules/tldts-core": {
-      "version": "6.1.86",
-      "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-6.1.86.tgz",
-      "integrity": "sha512-Je6p7pkk+KMzMv2XXKmAE3McmolOQFdxkKw0R8EYNr7sELW46JqnNeTX8ybPiQgvg1ymCoF8LXs5fzFaZvJPTA==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/to-regex-range": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
@@ -4985,32 +4605,6 @@
         "node": ">=8.0"
       }
     },
-    "node_modules/tough-cookie": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-5.1.2.tgz",
-      "integrity": "sha512-FVDYdxtnj0G6Qm/DhNPSb8Ju59ULcup3tuJxkFb5K8Bv2pUXILbf0xZWU8PX8Ov19OXljbUyveOFwRMwkXzO+A==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "tldts": "^6.1.32"
-      },
-      "engines": {
-        "node": ">=16"
-      }
-    },
-    "node_modules/tr46": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/tr46/-/tr46-5.1.1.tgz",
-      "integrity": "sha512-hdF5ZgjTqgAntKkklYw0R03MG2x/bSzTtkxmIRw/sTNV8YXsCJ1tfLAX23lhxhHJlEf3CRCOCGGWw3vI3GaSPw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "punycode": "^2.3.1"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
     "node_modules/tscw-config": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/tscw-config/-/tscw-config-1.1.2.tgz",
@@ -5337,19 +4931,6 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
-    "node_modules/w3c-xmlserializer": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/w3c-xmlserializer/-/w3c-xmlserializer-5.0.0.tgz",
-      "integrity": "sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "xml-name-validator": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
     "node_modules/watchpack": {
       "version": "2.5.1",
       "resolved": "https://registry.npmjs.org/watchpack/-/watchpack-2.5.1.tgz",
@@ -5363,16 +4944,6 @@
         "node": ">=10.13.0"
       }
     },
-    "node_modules/webidl-conversions": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-7.0.0.tgz",
-      "integrity": "sha512-VwddBukDzu71offAQR975unBIGqfKZpM+8ZX6ySk8nYhVoo5CYaZyzt3YBvYtRtO+aoGlqxPg/B87NGVZ/fu6g==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "engines": {
-        "node": ">=12"
-      }
-    },
     "node_modules/webpack": {
       "version": "5.105.0",
       "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.105.0.tgz",
@@ -5499,44 +5070,6 @@
         "node": ">=10.13.0"
       }
     },
-    "node_modules/whatwg-encoding": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/whatwg-encoding/-/whatwg-encoding-3.1.1.tgz",
-      "integrity": "sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ==",
-      "deprecated": "Use @exodus/bytes instead for a more spec-conformant and faster implementation",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "iconv-lite": "0.6.3"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/whatwg-mimetype": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-4.0.0.tgz",
-      "integrity": "sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/whatwg-url": {
-      "version": "14.2.0",
-      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-14.2.0.tgz",
-      "integrity": "sha512-De72GdQZzNTUBBChsXueQUnPKDkg/5A5zp7pFDuQAj5UFoENpiACU0wlCvzpAGnTkj++ihpKwKyYewn/XNUbKw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "tr46": "^5.1.0",
-        "webidl-conversions": "^7.0.0"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
     "node_modules/which": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
@@ -5581,45 +5114,6 @@
       "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8=",
       "dev": true
     },
-    "node_modules/ws": {
-      "version": "8.21.1",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.1.tgz",
-      "integrity": "sha512-+0NTnW77fFN/DjQi6k/Sq/Yvk4Sgajw7urW8V+asjXnRgDs9gyGkdb7EzgfhA4goXsRIZKE28fzIXBHEzhuiWw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=10.0.0"
-      },
-      "peerDependencies": {
-        "bufferutil": "^4.0.1",
-        "utf-8-validate": ">=5.0.2"
-      },
-      "peerDependenciesMeta": {
-        "bufferutil": {
-          "optional": true
-        },
-        "utf-8-validate": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/xml-name-validator": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-5.0.0.tgz",
-      "integrity": "sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/xmlchars": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz",
-      "integrity": "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/yallist": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",

superset-embedded-sdk/package.json

@@ -43,7 +43,6 @@
     "@babel/preset-typescript": "7.29.7",
     "@types/node": "^25.4.0",
     "babel-loader": "^9.1.3",
-    "jsdom": "^26.1.0",
     "tscw-config": "^1.1.2",
     "typescript": "^5.9.3",
     "vitest": "^4.0.18",

superset-embedded-sdk/src/index.test.ts

@@ -1,213 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-// @vitest-environment jsdom
-
-import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
-import { Switchboard } from "@superset-ui/switchboard";
-import { embedDashboard } from "./index";
-
-vi.mock("@superset-ui/switchboard");
-
-function makeFakeJWT(claims: any) {
-  // not a valid jwt, but close enough for this code
-  const tokenifiedClaims = Buffer.from(JSON.stringify(claims)).toString(
-    "base64",
-  );
-  return `abc.${tokenifiedClaims}.xyz`;
-}
-
-describe("embedDashboard", () => {
-  let mountPoint: HTMLElement;
-  let mockSwitchboard: Switchboard;
-
-  beforeEach(() => {
-    mountPoint = document.createElement("div");
-    document.body.appendChild(mountPoint);
-
-    mockSwitchboard = {
-      emit: vi.fn(),
-      get: vi.fn(),
-      start: vi.fn(),
-      defineMethod: vi.fn(),
-    } as any;
-
-    // Constructor mocks must use `function`, since arrow functions cannot be
-    // invoked with `new`.
-    vi.mocked(Switchboard).mockImplementation(function () {
-      return mockSwitchboard;
-    } as any);
-
-    // Mock MessageChannel API
-    globalThis.MessageChannel = vi.fn(function (this: any) {
-      this.port1 = {};
-      this.port2 = {};
-    }) as any;
-
-    // Mock iframe load event and sandbox
-    const originalCreateElement = document.createElement.bind(document);
-    vi.spyOn(document, "createElement").mockImplementation(tagName => {
-      const element = originalCreateElement(tagName);
-      if (tagName === "iframe") {
-        // Mock sandbox DOMTokenList
-        (element as any).sandbox = {
-          add: vi.fn(),
-        };
-        // Mock contentWindow for postMessage
-        Object.defineProperty(element, "contentWindow", {
-          writable: true,
-          value: {
-            postMessage: vi.fn(),
-          },
-        });
-        setTimeout(() => {
-          element.dispatchEvent(new Event("load"));
-        }, 0);
-      }
-      return element;
-    });
-  });
-
-  afterEach(() => {
-    document.body.removeChild(mountPoint);
-    vi.restoreAllMocks();
-  });
-
-  test("setDataMask sends dataMask to iframe", async () => {
-    const fakeToken = makeFakeJWT({ exp: Date.now() / 1000 + 300 });
-    const mockFetchGuestToken = vi.fn().mockResolvedValue(fakeToken);
-    const testDataMask = {
-      "NATIVE_FILTER-1": {
-        filterState: {
-          value: ["value1", "value2"],
-        },
-      },
-    };
-
-    const dashboard = await embedDashboard({
-      id: "test-id",
-      supersetDomain: "https://superset.example.com",
-      mountPoint,
-      fetchGuestToken: mockFetchGuestToken,
-    });
-
-    dashboard.setDataMask(testDataMask);
-
-    expect(mockSwitchboard.get).toHaveBeenCalledWith("setDataMask", {
-      dataMask: testDataMask,
-    });
-  });
-
-  test("setDataMask sends empty dataMask", async () => {
-    const fakeToken = makeFakeJWT({ exp: Date.now() / 1000 + 300 });
-    const mockFetchGuestToken = vi.fn().mockResolvedValue(fakeToken);
-    const emptyDataMask = {};
-
-    const dashboard = await embedDashboard({
-      id: "test-id",
-      supersetDomain: "https://superset.example.com",
-      mountPoint,
-      fetchGuestToken: mockFetchGuestToken,
-    });
-
-    dashboard.setDataMask(emptyDataMask);
-
-    expect(mockSwitchboard.get).toHaveBeenCalledWith("setDataMask", {
-      dataMask: emptyDataMask,
-    });
-  });
-
-  test("setDataMask drops the change-trigger flags observeDataMask adds", async () => {
-    const fakeToken = makeFakeJWT({ exp: Date.now() / 1000 + 300 });
-    const mockFetchGuestToken = vi.fn().mockResolvedValue(fakeToken);
-    const observedMask = {
-      "NATIVE_FILTER-1": {
-        filterState: {
-          value: ["CA"],
-        },
-      },
-      crossFiltersChanged: false,
-      nativeFiltersChanged: true,
-    };
-
-    const dashboard = await embedDashboard({
-      id: "test-id",
-      supersetDomain: "https://superset.example.com",
-      mountPoint,
-      fetchGuestToken: mockFetchGuestToken,
-    });
-
-    dashboard.setDataMask(observedMask);
-
-    expect(mockSwitchboard.get).toHaveBeenCalledWith("setDataMask", {
-      dataMask: {
-        "NATIVE_FILTER-1": observedMask["NATIVE_FILTER-1"],
-      },
-    });
-  });
-
-  test("setDataMask sends complex dataMask with multiple filters", async () => {
-    const fakeToken = makeFakeJWT({ exp: Date.now() / 1000 + 300 });
-    const mockFetchGuestToken = vi.fn().mockResolvedValue(fakeToken);
-    const complexDataMask = {
-      "NATIVE_FILTER-1": {
-        filterState: {
-          value: ["CA", "NY"],
-        },
-      },
-      "NATIVE_FILTER-2": {
-        filterState: {
-          value: [2023, 2024],
-        },
-      },
-    };
-
-    const dashboard = await embedDashboard({
-      id: "test-id",
-      supersetDomain: "https://superset.example.com",
-      mountPoint,
-      fetchGuestToken: mockFetchGuestToken,
-    });
-
-    dashboard.setDataMask(complexDataMask);
-
-    expect(mockSwitchboard.get).toHaveBeenCalledWith("setDataMask", {
-      dataMask: complexDataMask,
-    });
-  });
-
-  test("setDataMask rejects when the embedded page does not support it", async () => {
-    const fakeToken = makeFakeJWT({ exp: Date.now() / 1000 + 300 });
-    const mockFetchGuestToken = vi.fn().mockResolvedValue(fakeToken);
-    vi.mocked(mockSwitchboard.get).mockRejectedValue(
-      new Error('Method "setDataMask" is not defined'),
-    );
-
-    const dashboard = await embedDashboard({
-      id: "test-id",
-      supersetDomain: "https://superset.example.com",
-      mountPoint,
-      fetchGuestToken: mockFetchGuestToken,
-    });
-
-    await expect(dashboard.setDataMask({})).rejects.toThrow(
-      'Method "setDataMask" is not defined',
-    );
-  });
-});

superset-embedded-sdk/src/index.ts

@@ -115,12 +115,6 @@ export type EmbeddedDashboard = {
   getActiveTabs: () => Promise<string[]>;
   observeDataMask: (callbackFn: ObserveDataMaskCallbackFn) => void;
   getDataMask: () => Promise<Record<string, any>>;
-  /**
-   * Applies a data mask to the dashboard.
-   * Rejects if the embedded Superset page does not support `setDataMask`,
-   * so a version mismatch surfaces instead of silently doing nothing.
-   */
-  setDataMask: (dataMask: Record<string, any>) => Promise<void>;
   getChartStates: () => Promise<Record<string, any>>;
   getChartDataPayloads: (params?: {
     chartId?: number;
@@ -361,21 +355,6 @@ export async function embedDashboard({
     ourPort.get<string>("getDashboardPermalink", { anchor });
   const getActiveTabs = () => ourPort.get<string[]>("getActiveTabs");
   const getDataMask = () => ourPort.get<Record<string, any>>("getDataMask");
-  // `observeDataMask` hands the host a mask with the change-trigger booleans
-  // mixed in, so feeding that payload straight back into `setDataMask` is a
-  // natural thing for a host to do. Keep only the entries that look like a
-  // filter's mask, so those flags never reach the dashboard as filter ids.
-  // Sent with `get` rather than `emit` so the iframe acknowledges the call:
-  // an embedded page that predates `setDataMask` replies with an error instead
-  // of dropping the message silently.
-  const setDataMask = (dataMask: Record<string, any>) =>
-    ourPort.get<void>("setDataMask", {
-      dataMask: Object.fromEntries(
-        Object.entries(dataMask).filter(
-          ([, mask]) => typeof mask === "object" && mask !== null,
-        ),
-      ),
-    });
   const getChartStates = () =>
     ourPort.get<Record<string, any>>("getChartStates");
   const getChartDataPayloads = (params?: { chartId?: number }) =>
@@ -417,7 +396,6 @@ export async function embedDashboard({
     getActiveTabs,
     observeDataMask,
     getDataMask,
-    setDataMask,
     getChartStates,
     getChartDataPayloads,
     setThemeConfig,

superset-frontend/package.json

@@ -110,7 +110,7 @@
     "@fontsource/fira-code": "^5.3.0",
     "@fontsource/ibm-plex-mono": "^5.3.0",
     "@fontsource/inter": "^5.3.0",
-    "@googleapis/sheets": "^14.0.0",
+    "@googleapis/sheets": "^13.0.2",
     "@great-expectations/jsonforms-antd-renderers": "^2.2.10",
     "@jsonforms/core": "^3.7.0",
     "@jsonforms/react": "^3.7.0",
@@ -158,7 +158,7 @@
     "@visx/xychart": "^4.0.0",
     "ag-grid-community": "36.1.0",
     "ag-grid-react": "36.1.0",
-    "antd": "^6.6.0",
+    "antd": "^6.5.4",
     "chrono-node": "^2.10.1",
     "classnames": "^2.2.5",
     "content-disposition": "^2.0.1",
@@ -176,7 +176,7 @@
     "geostyler-openlayers-parser": "^5.7.1",
     "geostyler-style": "11.0.2",
     "geostyler-wfs-parser": "^3.0.1",
-    "google-auth-library": "^11.0.2",
+    "google-auth-library": "^11.0.0",
     "immer": "^11.1.16",
     "interweave": "^13.1.1",
     "jquery": "^4.0.0",
@@ -257,16 +257,16 @@
     "@istanbuljs/nyc-config-typescript": "^1.0.1",
     "@playwright/test": "^1.62.1",
     "@pmmmwh/react-refresh-webpack-plugin": "^0.6.2",
-    "@storybook/addon-docs": "10.5.8",
-    "@storybook/addon-links": "10.5.8",
-    "@storybook/react-webpack5": "10.5.8",
+    "@storybook/addon-docs": "10.5.7",
+    "@storybook/addon-links": "10.5.7",
+    "@storybook/react-webpack5": "10.5.7",
     "@storybook/test-runner": "0.24.4",
     "@svgr/webpack": "^8.1.0",
     "@swc/core": "^1.15.47",
-    "@swc/plugin-emotion": "^14.19.0",
+    "@swc/plugin-emotion": "^14.15.0",
     "@swc/plugin-transform-imports": "^12.5.0",
     "@testing-library/dom": "^10.4.1",
-    "@testing-library/jest-dom": "^7.0.1",
+    "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^15.0.0",
     "@testing-library/user-event": "^12.8.3",
     "@types/content-disposition": "^0.5.9",
@@ -277,7 +277,7 @@
     "@types/json-bigint": "^1.0.4",
     "@types/lodash-es": "^4.17.12",
     "@types/mousetrap": "^1.6.15",
-    "@types/node": "^26.2.0",
+    "@types/node": "^26.1.2",
     "@types/react": "^18.3.0",
     "@types/react-dom": "^18.3.0",
     "@types/react-loadable": "^5.5.11",
@@ -289,19 +289,19 @@
     "@types/rison": "0.1.0",
     "@types/tinycolor2": "^1.4.3",
     "@types/unzipper": "^0.10.11",
-    "@typescript-eslint/eslint-plugin": "^8.67.0",
+    "@typescript-eslint/eslint-plugin": "^8.66.0",
     "@typescript-eslint/parser": "^8.63.0",
     "babel-jest": "^30.4.1",
     "babel-loader": "^10.1.1",
     "babel-plugin-dynamic-import-node": "^2.3.3",
     "babel-plugin-jsx-remove-data-test-id": "^3.0.0",
-    "baseline-browser-mapping": "^2.11.14",
+    "baseline-browser-mapping": "^2.11.12",
     "cheerio": "1.2.0",
     "concurrently": "^10.0.4",
     "copy-webpack-plugin": "^14.0.0",
     "cross-env": "^10.1.0",
     "css-loader": "^7.1.4",
-    "eslint": "^10.8.1",
+    "eslint": "^10.8.0",
     "eslint-import-resolver-alias": "^1.1.2",
     "eslint-import-resolver-typescript": "^4.4.5",
     "eslint-plugin-i18n-strings": "file:eslint-rules/eslint-plugin-i18n-strings",
@@ -312,7 +312,7 @@
     "eslint-plugin-no-only-tests": "^3.4.0",
     "eslint-plugin-react-prefer-function-component": "^5.0.0",
     "eslint-plugin-react-you-might-not-need-an-effect": "^1.0.1",
-    "eslint-plugin-storybook": "10.5.8",
+    "eslint-plugin-storybook": "10.5.7",
     "eslint-plugin-testing-library": "^7.16.2",
     "eslint-plugin-theme-colors": "file:eslint-rules/eslint-plugin-theme-colors",
     "fetch-mock": "^12.6.0",
@@ -331,8 +331,8 @@
     "mini-css-extract-plugin": "^2.10.2",
     "minimizer-webpack-plugin": "^5.6.1",
     "open-cli": "^9.0.0",
-    "oxfmt": "^0.63.0",
-    "oxlint": "^1.78.0",
+    "oxfmt": "^0.62.0",
+    "oxlint": "^1.77.0",
     "po2json": "^0.4.5",
     "postcss-styled-syntax": "^0.7.2",
     "process": "^0.11.10",
@@ -343,13 +343,13 @@
     "source-map": "^0.8.0",
     "source-map-support": "^0.5.21",
     "speed-measure-webpack-plugin": "^1.6.0",
-    "storybook": "10.5.8",
+    "storybook": "10.5.7",
     "style-loader": "^4.0.0",
     "stylelint": "^17.14.1",
     "swc-loader": "^0.2.7",
     "ts-jest": "^29.4.12",
     "tscw-config": "^1.1.2",
-    "tsx": "^4.23.12",
+    "tsx": "^4.23.10",
     "typescript": "5.4.5",
     "unzipper": "^0.12.5",
     "wait-on": "^9.1.0",
@@ -415,7 +415,6 @@
     "minimatch@>=10": {
       "brace-expansion": ">=5.0.8"
     },
-    "nanoid@>=3 <4": "3.3.18",
     "nwsapi": "^2.2.13",
     "puppeteer": "^22.4.1",
     "tar": "^7.5.16",

superset-frontend/packages/superset-core/src/common/index.ts

@@ -130,7 +130,6 @@ export enum GenericDataType {
   String = 1,
   Temporal = 2,
   Boolean = 3,
-  MultiValue = 4,
 }
 
 /**

superset-frontend/packages/superset-ui-chart-controls/src/components/ColumnTypeLabel/ColumnTypeLabel.tsx

@@ -28,7 +28,6 @@ import {
   FieldBinaryOutlined,
   FieldStringOutlined,
   NumberOutlined,
-  UnorderedListOutlined,
 } from '@ant-design/icons';
 import { Icons } from '@superset-ui/core/components';
 
@@ -73,10 +72,6 @@ export function ColumnTypeLabel({ type }: ColumnTypeLabelProps) {
     typeIcon = <FieldBinaryOutlined aria-label={t('boolean type icon')} />;
   } else if (type === GenericDataType.Temporal) {
     typeIcon = <ClockCircleOutlined aria-label={t('temporal type icon')} />;
-  } else if (type === GenericDataType.MultiValue) {
-    typeIcon = (
-      <UnorderedListOutlined aria-label={t('multi-value type icon')} />
-    );
   }
 
   return <TypeIconWrapper>{typeIcon}</TypeIconWrapper>;

superset-frontend/packages/superset-ui-chart-controls/src/components/MetricOption.tsx

@@ -51,20 +51,6 @@ export interface MetricOptionProps {
   shouldShowTooltip?: boolean;
 }
 
-/**
- * `url` is an arbitrary caller-supplied string rendered as an href. Only
- * http(s) and relative URLs become links; other schemes degrade to plain
- * text.
- */
-function isSafeHref(url: string): boolean {
-  try {
-    const { protocol } = new URL(url, window.location.origin);
-    return protocol === 'http:' || protocol === 'https:';
-  } catch {
-    return false;
-  }
-}
-
 export function MetricOption({
   metric,
   labelRef,
@@ -84,7 +70,7 @@ export function MetricOption({
       `}
       ref={labelRef}
     >
-      {url && isSafeHref(url) ? (
+      {url ? (
         <Typography.Link
           href={url}
           target={openInNewWindow ? '_blank' : ''}

superset-frontend/packages/superset-ui-chart-controls/test/components/ColumnTypeLabel.test.tsx

@@ -64,21 +64,4 @@ describe('ColumnOption', () => {
     renderColumnTypeLabel({ type: GenericDataType.Temporal });
     expect(screen.getByLabelText('temporal type icon')).toBeVisible();
   });
-  test('multi-value (array) type shows list icon', () => {
-    renderColumnTypeLabel({ type: GenericDataType.MultiValue });
-    expect(screen.getByLabelText('multi-value type icon')).toBeVisible();
-  });
-});
-
-describe('GenericDataType enum parity', () => {
-  // These numeric values are shared with the backend enum in
-  // superset/utils/core.py (GenericDataType). They must stay in sync because
-  // the backend serializes columns using these integers.
-  test('values match the backend contract', () => {
-    expect(GenericDataType.Numeric).toBe(0);
-    expect(GenericDataType.String).toBe(1);
-    expect(GenericDataType.Temporal).toBe(2);
-    expect(GenericDataType.Boolean).toBe(3);
-    expect(GenericDataType.MultiValue).toBe(4);
-  });
 });

superset-frontend/packages/superset-ui-chart-controls/test/components/MetricOption.test.tsx

@@ -112,26 +112,3 @@ test('shows a Tooltip for the verbose metric name', () => {
   const { getByTestId } = setup();
   expect(getByTestId('mock-tooltip')).toBeInTheDocument();
 });
-test('does not render javascript: URLs as links', () => {
-  // Regression test: the url prop can be creator-authored and must
-  // never become a script-bearing href for other viewers.
-  const { queryByRole, getByText } = setup({
-    url: 'javascript:alert(document.domain)', // eslint-disable-line no-script-url
-  });
-  expect(queryByRole('link')).not.toBeInTheDocument();
-  expect(getByText(defaultProps.metric.verbose_name)).toBeInTheDocument();
-});
-test('does not render data: URLs as links', () => {
-  const { queryByRole } = setup({
-    url: 'data:text/html,<script>alert(1)</script>',
-  });
-  expect(queryByRole('link')).not.toBeInTheDocument();
-});
-test('renders relative URLs as links', () => {
-  const { getByRole } = setup({
-    url: '/superset/dashboard/1/',
-  });
-  expect(
-    getByRole('link', { name: defaultProps.metric.verbose_name }),
-  ).toHaveAttribute('href', '/superset/dashboard/1/');
-});

superset-frontend/packages/superset-ui-core/package.json

@@ -103,7 +103,7 @@
     "@types/d3-time-format": "^4.0.3",
     "@types/jquery": "^4.0.1",
     "@types/lodash": "^4.17.25",
-    "@types/node": "^26.2.0",
+    "@types/node": "^26.1.2",
     "@types/prop-types": "^15.7.15",
     "@types/react-syntax-highlighter": "^15.5.13",
     "@types/react-table": "^7.7.20",

superset-frontend/packages/superset-ui-core/src/components/Select/AsyncSelect.test.tsx

@@ -107,14 +107,12 @@ const getAllSelectOptions = () =>
 
 const findSelectOption = (text: string) =>
   waitFor(() =>
-    within(getElementByClassName('.ant-select-dropdown-list')).getByText(text),
+    within(getElementByClassName('.rc-virtual-list')).getByText(text),
   );
 
 const querySelectOption = (text: string) =>
   waitFor(() =>
-    within(getElementByClassName('.ant-select-dropdown-list')).queryByText(
-      text,
-    ),
+    within(getElementByClassName('.rc-virtual-list')).queryByText(text),
   );
 
 const findAllSelectOptions = () =>
@@ -646,7 +644,7 @@ test('does not add a new option if the option already exists', async () => {
   await type(option);
   await waitFor(() => {
     const array = within(
-      getElementByClassName('.ant-select-dropdown-list'),
+      getElementByClassName('.rc-virtual-list'),
     ).getAllByText(option);
     expect(array.length).toBe(1);
   });
@@ -1400,7 +1398,7 @@ test('appends page>1 results during an active search and discards them when sear
   // scrollTop via e.currentTarget in its onFallbackScroll handler, which
   // then forwards to onPopupScroll (handlePagination here).
   const holder = document.querySelector(
-    '.ant-select-dropdown-list-holder',
+    '.rc-virtual-list-holder',
   ) as HTMLElement | null;
   if (!holder) throw new Error('virtual-list holder not rendered');
   Object.defineProperty(holder, 'scrollHeight', {

superset-frontend/packages/superset-ui-core/src/components/Select/Select.test.tsx

@@ -93,14 +93,12 @@ const deselectAllButtonText = (length: number) =>
 
 const findSelectOption = (text: string) =>
   waitFor(() =>
-    within(getElementByClassName('.ant-select-dropdown-list')).getByText(text),
+    within(getElementByClassName('.rc-virtual-list')).getByText(text),
   );
 
 const querySelectOption = (text: string) =>
   waitFor(() =>
-    within(getElementByClassName('.ant-select-dropdown-list')).queryByText(
-      text,
-    ),
+    within(getElementByClassName('.rc-virtual-list')).queryByText(text),
   );
 
 const getAllSelectOptions = () =>

superset-frontend/packages/superset-ui-core/src/query/types/Metric.ts

@@ -25,11 +25,8 @@ export type Aggregate =
   | 'COUNT'
   | 'COUNT_DISTINCT'
   | 'MAX'
-  | 'MEDIAN'
   | 'MIN'
-  | 'STDDEV_SAMP'
-  | 'SUM'
-  | 'VAR_SAMP';
+  | 'SUM';
 
 export interface AdhocMetricBase {
   hasCustomLabel?: boolean;

superset-frontend/packages/superset-ui-core/src/time-format/index.ts

@@ -49,6 +49,5 @@ export { default as finestTemporalGrainFormatter } from './formatters/finestTemp
 
 export { default as normalizeTimestamp } from './utils/normalizeTimestamp';
 export { default as denormalizeTimestamp } from './utils/denormalizeTimestamp';
-export { default as createTimeRangeFromGranularity } from './utils/createTimeRangeFromGranularity';
 
 export * from './types';

superset-frontend/packages/superset-ui-core/src/utils/html.test.tsx

@@ -123,25 +123,6 @@ describe('isProbablyHTML', () => {
     expect(isProbablyHTML('<canvas></canvas>')).toBe(true);
     expect(isProbablyHTML('<iframe src="page.html"></iframe>')).toBe(true);
   });
-
-  test('should return true for script-capable and foreign-content tags', () => {
-    expect(isProbablyHTML('<svg onload="alert(1)"></svg>')).toBe(true);
-    expect(isProbablyHTML('<math><mi>x</mi></math>')).toBe(true);
-    expect(
-      isProbablyHTML('<details open ontoggle="alert(1)">x</details>'),
-    ).toBe(true);
-    expect(isProbablyHTML('<summary>x</summary>')).toBe(true);
-    expect(isProbablyHTML('<object data="x"></object>')).toBe(true);
-    expect(isProbablyHTML('<embed src="x">')).toBe(true);
-    expect(isProbablyHTML('<marquee>x</marquee>')).toBe(true);
-    expect(isProbablyHTML('<template>x</template>')).toBe(true);
-    expect(isProbablyHTML('<dialog open>x</dialog>')).toBe(true);
-  });
-
-  test('should return true for elements that parse into document.head', () => {
-    expect(isProbablyHTML('<style>body { display: none; }</style>')).toBe(true);
-    expect(isProbablyHTML('<title>injected</title>')).toBe(true);
-  });
 });
 
 describe('sanitizeHtmlIfNeeded', () => {
@@ -156,24 +137,6 @@ describe('sanitizeHtmlIfNeeded', () => {
     const sanitizedString = sanitizeHtmlIfNeeded(plainText);
     expect(sanitizedString).toEqual(plainText);
   });
-
-  test('should sanitize svg/details/style payloads instead of passing them through', () => {
-    const svgPayload = '<svg onload="alert(document.cookie)"></svg>';
-    const sanitizedSvg = sanitizeHtmlIfNeeded(svgPayload);
-    expect(sanitizedSvg).not.toContain('<svg');
-    expect(sanitizedSvg).not.toContain('onload');
-
-    // `details` (with its `open` attribute) is in js-xss's default
-    // whitelist, so the tag itself survives sanitization; the fix is that
-    // the payload is now routed through FilterXSS at all, which strips the
-    // non-whitelisted `ontoggle` handler instead of returning it verbatim.
-    const detailsPayload = '<details open ontoggle="alert(1)">x</details>';
-    const sanitizedDetails = sanitizeHtmlIfNeeded(detailsPayload);
-    expect(sanitizedDetails).toEqual('<details open>x</details>');
-
-    const stylePayload = '<style>body { display: none; }</style>';
-    expect(sanitizeHtmlIfNeeded(stylePayload)).not.toContain('<style');
-  });
 });
 
 describe('safeHtmlSpan', () => {

superset-frontend/packages/superset-ui-core/src/utils/html.tsx

@@ -154,20 +154,6 @@ const KNOWN_HTML_TAGS = new Set([
   'html',
   'head',
   'body',
-  // Script-capable elements and foreign-content roots (SVG/MathML). These
-  // must be classified as HTML so that downstream sanitization is applied;
-  // omitting them makes the heuristic fail open — payloads such as
-  // `<svg onload=...>` or `<details open ontoggle=...>` would be classified
-  // "not HTML" and returned verbatim by sanitizeHtmlIfNeeded.
-  'svg',
-  'math',
-  'details',
-  'summary',
-  'object',
-  'embed',
-  'marquee',
-  'template',
-  'dialog',
 ]);
 
 const HTML_TAG_PATTERN = new RegExp(
@@ -197,15 +183,10 @@ export function isProbablyHTML(text: string) {
   const parser = new DOMParser();
   const doc = parser.parseFromString(cleanedStr, 'text/html');
 
-  // Check if parsing created actual HTML elements (not just text nodes).
-  // Some elements (e.g. <style>, <title>, <meta>, <link>) parse into
-  // document.head rather than document.body, so both must be inspected —
-  // otherwise a bare <style> payload is classified "not HTML" and skips
-  // sanitization.
-  const elements = [
-    ...Array.from(doc.head.childNodes),
-    ...Array.from(doc.body.childNodes),
-  ].filter(node => node.nodeType === 1) as Element[];
+  // Check if parsing created actual HTML elements (not just text nodes)
+  const elements = Array.from(doc.body.childNodes).filter(
+    node => node.nodeType === 1,
+  ) as Element[];
 
   // If no elements were created, it's not HTML
   if (elements.length === 0) {

superset-frontend/packages/superset-ui-core/src/utils/tooltip.ts

@@ -19,71 +19,19 @@
 import { t } from '@apache-superset/core/translation';
 import { sanitizeHtml } from './html';
 
-export type TooltipTruncationMode = 'off' | 'end' | 'start' | 'middle';
-
-export const TRUNCATION_MAX_CHARS = 40;
-
 const TRUNCATION_STYLE = `
   max-width: 300px;
   overflow: hidden;
   text-overflow: ellipsis;
 `;
 
-const NOWRAP_STYLE = `
-  white-space: nowrap;
-`;
-
-/**
- * Shortens plain text so a tooltip label stays readable, placing the ellipsis
- * where the caller asked for it.
- *
- * Only 'start' and 'middle' slice. 'end' is handled by CSS in tooltipHtml, and
- * 'off' means no truncation at all, so both return the input untouched.
- *
- * The input must be plain text. Callers are responsible for truncating before
- * any markup (such as the ECharts series marker) is prepended, and before
- * sanitization — slicing a string that already contains markup would cut into
- * a tag.
- */
-export function truncateLabel(
-  text: string,
-  mode: TooltipTruncationMode = 'end',
-): string {
-  if (
-    (mode !== 'start' && mode !== 'middle') ||
-    text.length <= TRUNCATION_MAX_CHARS
-  ) {
-    return text;
-  }
-  const budget = TRUNCATION_MAX_CHARS - 1;
-  if (mode === 'start') {
-    return `…${text.slice(-budget)}`;
-  }
-  const head = Math.ceil(budget / 2);
-  const tail = Math.floor(budget / 2);
-  return `${text.slice(0, head)}…${text.slice(-tail)}`;
-}
-
-function getTruncationStyle(mode: TooltipTruncationMode): string {
-  if (mode === 'end') {
-    return TRUNCATION_STYLE;
-  }
-  if (mode === 'off') {
-    return '';
-  }
-  // 'start' and 'middle' are already sliced upstream; keep them on one line.
-  return NOWRAP_STYLE;
-}
-
 export function tooltipHtml(
   data: string[][],
   title?: string,
   focusedRow?: number,
-  truncation: TooltipTruncationMode = 'end',
 ) {
-  const truncationStyle = getTruncationStyle(truncation);
   const titleRow = title
-    ? `<span style="font-weight: 700;${truncationStyle}">${title}</span>`
+    ? `<span style="font-weight: 700;${TRUNCATION_STYLE}">${title}</span>`
     : '';
   return sanitizeHtml(`
     <div>
@@ -98,7 +46,7 @@ export function tooltipHtml(
                 const cellStyle = `
                   text-align: ${j > 0 ? 'right' : 'left'};
                   padding-left: ${j === 0 ? 0 : 16}px;
-                  ${truncationStyle}
+                  ${TRUNCATION_STYLE}
                 `;
                 return `<td style="${cellStyle}">${cell}</td>`;
               });

superset-frontend/packages/superset-ui-core/test/utils/tooltip.test.ts

@@ -16,12 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import {
-  sanitizeHtml,
-  tooltipHtml,
-  truncateLabel,
-  TRUNCATION_MAX_CHARS,
-} from '@superset-ui/core';
+import { sanitizeHtml, tooltipHtml } from '@superset-ui/core';
 
 const TITLE_STYLE =
   'style="font-weight: 700;max-width:300px;overflow:hidden;text-overflow:ellipsis;"';
@@ -187,88 +182,3 @@ test('should preserve table styling after sanitization (fixes ECharts tooltip fo
   expect(html).toContain('padding-left:16px');
   expect(html).toContain('max-width:300px');
 });
-
-describe('truncateLabel', () => {
-  const long = 'prod-us-east-1-service-checkout-latency-p99'; // 43 chars
-
-  test('returns text unchanged for off and end', () => {
-    expect(truncateLabel(long, 'off')).toBe(long);
-    expect(truncateLabel(long, 'end')).toBe(long);
-  });
-
-  test('defaults to end, which does not slice', () => {
-    expect(truncateLabel(long)).toBe(long);
-  });
-
-  test('truncates the start, keeping the distinguishing suffix', () => {
-    expect(truncateLabel(long, 'start')).toBe(
-      '…-us-east-1-service-checkout-latency-p99',
-    );
-    expect(truncateLabel(long, 'start')).toHaveLength(TRUNCATION_MAX_CHARS);
-  });
-
-  test('truncates the middle, keeping both ends', () => {
-    expect(truncateLabel(long, 'middle')).toBe(
-      'prod-us-east-1-servi…heckout-latency-p99',
-    );
-    expect(truncateLabel(long, 'middle')).toHaveLength(TRUNCATION_MAX_CHARS);
-  });
-
-  test('leaves text at or under the limit untouched', () => {
-    const atLimit = 'x'.repeat(TRUNCATION_MAX_CHARS);
-    expect(truncateLabel(atLimit, 'start')).toBe(atLimit);
-    expect(truncateLabel(atLimit, 'middle')).toBe(atLimit);
-    expect(truncateLabel('short', 'start')).toBe('short');
-    expect(truncateLabel('', 'middle')).toBe('');
-  });
-
-  test('truncates text one character over the limit', () => {
-    const overLimit = 'x'.repeat(TRUNCATION_MAX_CHARS + 1);
-    expect(truncateLabel(overLimit, 'start')).toBe(
-      `…${'x'.repeat(TRUNCATION_MAX_CHARS - 1)}`,
-    );
-  });
-});
-
-describe('tooltipHtml truncation modes', () => {
-  const rows = [['label', 'value']];
-
-  // sanitizeHtml normalizes spacing inside style attributes, and it does so
-  // differently across versions, so compare with whitespace stripped.
-  const styles = (
-    title: string | undefined,
-    truncation?: 'off' | 'end' | 'start' | 'middle',
-  ) => removeWhitespaces(tooltipHtml(rows, title, undefined, truncation));
-
-  test('emits the 300px cap for end and for the default', () => {
-    expect(styles('Title', 'end')).toContain('max-width:300px');
-    expect(tooltipHtml(rows, 'Title')).toBe(
-      tooltipHtml(rows, 'Title', undefined, 'end'),
-    );
-  });
-
-  test('emits no truncation style for off', () => {
-    const html = styles('Title', 'off');
-    expect(html).not.toContain('max-width');
-    expect(html).not.toContain('text-overflow');
-    expect(html).not.toContain('white-space');
-  });
-
-  test.each(['start', 'middle'] as const)(
-    'emits nowrap instead of a cap for %s',
-    mode => {
-      const html = styles('Title', mode);
-      expect(html).toContain('white-space:nowrap');
-      expect(html).not.toContain('max-width');
-    },
-  );
-
-  test('never slices cell text itself, whatever the mode', () => {
-    const longCell = 'y'.repeat(TRUNCATION_MAX_CHARS + 20);
-    (['off', 'end', 'start', 'middle'] as const).forEach(mode => {
-      expect(tooltipHtml([[longCell]], undefined, undefined, mode)).toContain(
-        longCell,
-      );
-    });
-  });
-});

superset-frontend/playwright.config.ts

@@ -47,10 +47,6 @@ export default defineConfig({
   // Retry logic - 2 retries in CI, 0 locally
   retries: process.env.CI ? 2 : 0,
 
-  // Disable capturing Git commit info as the project's history is increasingly dense
-  // and breach Playwright's default 3-seconds `git` command timeout limit
-  captureGitInfo: { commit: false, diff: false },
-
   // Reporter configuration - multiple reporters for better visibility
   reporter: process.env.CI
     ? [

superset-frontend/playwright/components/modals/ConfirmDialog.ts

@@ -22,7 +22,7 @@ import { Modal } from '../core/Modal';
 
 /**
  * Confirm Dialog component for Ant Design Modal.confirm dialogs.
- * These are the "Confirm" / "Cancel" confirmation dialogs used throughout Superset.
+ * These are the "OK" / "Cancel" confirmation dialogs used throughout Superset.
  * Uses getByRole with name to target specific confirm dialogs when multiple are open.
  */
 export class ConfirmDialog extends Modal {
@@ -43,7 +43,7 @@ export class ConfirmDialog extends Modal {
   }
 
   /**
-   * Clicks the Confirm button to confirm.
+   * Clicks the OK button to confirm.
    * @param options.timeout - If provided, silently returns if dialog doesn't appear
    *                          within timeout. If not provided, waits indefinitely (strict mode).
    */
@@ -53,7 +53,7 @@ export class ConfirmDialog extends Modal {
         state: 'visible',
         timeout: options?.timeout,
       });
-      await this.clickFooterButton('Confirm');
+      await this.clickFooterButton('OK');
       await this.waitForHidden();
     } catch (error) {
       // Only swallow TimeoutError when timeout was explicitly provided

superset-frontend/playwright/tests/recently-archived/delete-modal.spec.ts

@@ -0,0 +1,58 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * With SOFT_DELETE enabled the delete-confirmation modal becomes recoverable:
+ * it explains the object is moved to the archive (and for how long), and drops
+ * the "type DELETE to confirm" friction. Non-destructive — the modal is opened
+ * and dismissed without deleting anything.
+ */
+import { test, expect } from '@playwright/test';
+import { skipUnlessFeatureEnabled } from '../../helpers/featureFlags';
+
+test.beforeEach(async ({ page }) => {
+  await skipUnlessFeatureEnabled(page, 'SOFT_DELETE');
+});
+
+test('chart delete confirmation reflects soft-delete (archive) semantics', async ({
+  page,
+}) => {
+  await page.goto('chart/list/');
+  await page.locator('[data-test="chart-row-delete"]').first().waitFor();
+  await page.locator('[data-test="chart-row-delete"]').first().click();
+
+  // The action reads as "Archive", not "Delete". Scope to the dialog: with
+  // the flag on, every list row's delete action is also named "Archive", so
+  // an unscoped button query is a strict-mode violation (25 rows + modal).
+  const dialog = page.getByRole('dialog');
+  await expect(dialog.getByText(/^Archive .+\?$/)).toBeVisible();
+  await expect(dialog.getByRole('button', { name: 'Archive' })).toBeVisible();
+
+  // Recoverable copy instead of "Are you sure … permanently".
+  await expect(page.getByText(/moved to Recently Archived/i)).toBeVisible();
+  await expect(
+    page.getByText(/recover it there within \d+ days/i),
+  ).toBeVisible();
+
+  // No "type DELETE to confirm" input in recoverable mode.
+  await expect(page.getByTestId('delete-modal-input')).toHaveCount(0);
+
+  // Dismiss without deleting.
+  await page.getByTestId('close-modal-btn').click();
+});

superset-frontend/playwright/tests/recently-archived/recently-archived.spec.ts

@@ -29,7 +29,7 @@
  * restore it and asserts — via the API — that it is live again.
  */
 import { test, expect, Page } from '@playwright/test';
-import { apiGet } from '../../helpers/api/requests';
+import { apiGet, apiPost } from '../../helpers/api/requests';
 import { extractIdFromResponse } from '../../helpers/api/assertions';
 import {
   apiPostChart,
@@ -188,3 +188,58 @@ test('permanently deletes an archived item from the view', async ({ page }) => {
     await TYPES[0].softDelete(page, id).catch(() => {});
   }
 });
+
+test('shows an empty message and no rows when the search matches nothing', async ({
+  page,
+}) => {
+  await page.goto('archived/');
+  await expect(page.getByTestId('archived-list-view')).toBeVisible();
+
+  const search = page.getByPlaceholder(/type a value/i);
+  await search.click();
+  await search.fill(`e2e_nonexistent_${Date.now()}`);
+  await search.press('Enter');
+
+  await expect(
+    page.getByText('No results match your filter criteria'),
+  ).toBeVisible();
+  await expect(page.getByTestId('archived-row-restore')).toHaveCount(0);
+});
+
+test('restoring an already-restored row surfaces an error without crashing', async ({
+  page,
+}) => {
+  const name = `e2e_stale_${Date.now()}`;
+  const id = await TYPES[0].create(page, name);
+  // Capture the uuid before soft-delete (a soft-deleted GET returns 404).
+  const { uuid } = (await (await apiGetDashboard(page, id)).json()).result;
+  try {
+    expect((await apiDeleteDashboard(page, id)).ok()).toBeTruthy();
+
+    await openArchive(page, 'Dashboard', name);
+    await expect(page.getByText(name, { exact: false })).toBeVisible();
+
+    // Simulate another actor restoring the object out from under this view.
+    const restored = await apiPost(
+      page,
+      `api/v1/dashboard/${uuid}/restore`,
+      {},
+    );
+    expect(restored.ok()).toBeTruthy();
+
+    // Clicking the now-stale row's Restore yields a 404 → danger toast, no crash.
+    await page
+      .getByRole('row')
+      .filter({ hasText: name })
+      .getByTestId('archived-row-restore')
+      .click();
+    await expect(
+      page.getByText(`Failed to restore ${name}`, { exact: false }),
+    ).toBeVisible({ timeout: 15000 });
+    // The page is still functional (the list view did not crash).
+    await expect(page.getByTestId('archived-list-view')).toBeVisible();
+  } finally {
+    // Re-archive the (possibly) restored dashboard, whatever happened above.
+    await apiDeleteDashboard(page, id).catch(() => {});
+  }
+});

superset-frontend/plugins/plugin-chart-ag-grid-table/src/renderers/NumericCellRenderer.tsx

@@ -27,21 +27,11 @@ const StyledTotalCell = styled.div`
   `}
 `;
 
-// `align` originates from the chart's stored column_config
-// (col.config.horizontalAlign), which can be set to an arbitrary string via
-// a direct chart-params API write. Emotion compiles interpolated strings as
-// CSS source, so the value must be clamped to a closed set of keywords
-// before it reaches the stylesheet — never interpolated raw.
-const ALLOWED_ALIGN_VALUES = new Set(['left', 'right', 'center']);
-
-const safeAlign = (align?: string) =>
-  align && ALLOWED_ALIGN_VALUES.has(align) ? align : 'left';
-
 const CellContainer = styled.div<{ backgroundColor?: string; align?: string }>`
   display: flex;
   background-color: ${({ backgroundColor }) =>
     backgroundColor || 'transparent'};
-  justify-content: ${({ align }) => safeAlign(align)};
+  justify-content: ${({ align }) => align || 'left'};
 `;
 
 const ArrowContainer = styled.div<{ arrowColor?: string }>`

superset-frontend/plugins/plugin-chart-ag-grid-table/test/NumericCellRenderer.test.tsx

@@ -1,59 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import '@testing-library/jest-dom';
-import { render } from '@superset-ui/core/spec';
-import { NumericCellRenderer } from '../src/renderers/NumericCellRenderer';
-
-const renderCell = (horizontalAlign?: string) => {
-  const params = {
-    value: 42,
-    valueFormatted: '42',
-    node: { rowPinned: undefined, rowIndex: 0 },
-    hasBasicColorFormatters: false,
-    basicColorFormatters: [],
-    col: {
-      isNumeric: true,
-      config: horizontalAlign ? { horizontalAlign } : {},
-    },
-    valueRange: undefined,
-    alignPositiveNegative: false,
-    colorPositiveNegative: false,
-  } as unknown as Parameters<typeof NumericCellRenderer>[0];
-  return render(<NumericCellRenderer {...params} />);
-};
-
-const collectInjectedCss = () =>
-  Array.from(document.querySelectorAll('style'))
-    .map(style => style.textContent ?? '')
-    .join('\n');
-
-test('applies an allowed horizontalAlign value from column config', () => {
-  const { container } = renderCell('center');
-  expect(container.firstChild).toHaveStyle({ justifyContent: 'center' });
-});
-
-test('does not compile a malicious horizontalAlign into the stylesheet', () => {
-  const payload =
-    'right;} & { position:fixed; top:0; left:0; width:100vw; height:100vh; z-index:99999; background:#fff url(https://attacker.example/beacon) }';
-  const { container } = renderCell(payload);
-  const css = collectInjectedCss();
-  expect(css).not.toContain('position:fixed');
-  expect(css).not.toContain('attacker.example');
-  expect(container.firstChild).toHaveStyle({ justifyContent: 'left' });
-});

superset-frontend/plugins/plugin-chart-calendar/src/Calendar.ts

@@ -22,7 +22,7 @@ import { getSequentialSchemeRegistry } from '@superset-ui/core';
 import { SupersetTheme } from '@apache-superset/core/theme';
 import { t } from '@apache-superset/core/translation';
 import CalHeatMapImport from './vendor/cal-heatmap';
-import { convertUTCTimestampToLocal, getFormattedUTCTime } from './utils';
+import { convertUTCTimestampToLocal } from './utils';
 
 // The vendor file is @ts-nocheck, so its export lacks type info.
 // Define a minimal constructor interface for use in this file.
@@ -103,8 +103,6 @@ function Calendar(element: HTMLElement, props: CalendarProps) {
   const subDomainTextFormat = showValues
     ? (_date: Date, value: number) => valueFormatter(value)
     : null;
-  const dateFormatter = (date: Date, format: string) =>
-    getFormattedUTCTime(date.getTime(), format);
 
   const metricsData = data.data;
 
@@ -168,7 +166,6 @@ function Calendar(element: HTMLElement, props: CalendarProps) {
       itemName: '',
       valueFormatter,
       timeFormatter,
-      dateFormatter,
       subDomainTextFormat,
     });
   });

superset-frontend/plugins/plugin-chart-calendar/src/utils.ts

@@ -38,11 +38,3 @@ export const convertUTCTimestampToLocal = (utcTimestamp: number): number => {
   const offsetMs = date.getTimezoneOffset() * 60 * 1000;
   return utcTimestamp + offsetMs;
 };
-
-// Escapes HTML special characters before formatter output reaches an
-// innerHTML sink. Mirrors plugin-chart-country-map's escapeHtml.
-export const escapeHtml = (text: unknown): string => {
-  const div = document.createElement('div');
-  div.textContent = String(text);
-  return div.innerHTML;
-};

superset-frontend/plugins/plugin-chart-calendar/src/vendor/cal-heatmap.ts

@@ -13,7 +13,6 @@ import d3tip from 'd3-tip';
 import { t } from '@apache-superset/core/translation';
 import { getContrastingColor } from '@superset-ui/core';
 import { CALENDAR_TOOLTIP_CLASS } from '../tooltip';
-import { escapeHtml } from '../utils';
 
 var d3 = typeof require === 'function' ? require('d3') : window.d3;
 
@@ -23,16 +22,14 @@ var CalHeatMap = function () {
   'use strict';
 
   var self = this;
-  // d3-tip assigns the .html() return value to the tip node via
-  // innerHTML, so formatter output is HTML-escaped first.
   self.tip = d3tip()
     .attr('class', `d3-tip ${CALENDAR_TOOLTIP_CLASS}`)
     .direction('n')
     .offset([-5, 0])
     .html(
       d => `
-      ${escapeHtml(self.options.timeFormatter(d.t))}: <strong>${escapeHtml(
-        self.options.valueFormatter(d.v),
+      ${self.options.timeFormatter(d.t)}: <strong>${self.options.valueFormatter(
+        d.v,
       )}</strong>
     `,
     );
@@ -40,7 +37,7 @@ var CalHeatMap = function () {
     .attr('class', `d3-tip ${CALENDAR_TOOLTIP_CLASS}`)
     .direction('n')
     .offset([-5, 0])
-    .html(d => escapeHtml(self.options.valueFormatter(d)));
+    .html(d => self.options.valueFormatter(d));
 
   this.allowedDataType = ['json', 'csv', 'tsv', 'txt'];
 
@@ -79,8 +76,6 @@ var CalHeatMap = function () {
 
     timeFormatter: d => d,
 
-    dateFormatter: null,
-
     domain: 'hour',
 
     subDomain: 'min',
@@ -1995,14 +1990,10 @@ CalHeatMap.prototype = {
 
     if (typeof format === 'function') {
       return format(d);
+    } else {
+      var f = d3.time.format(format);
+      return f(d);
     }
-
-    if (typeof this.options.dateFormatter === 'function') {
-      return this.options.dateFormatter(d, format);
-    }
-
-    var f = d3.time.format(format);
-    return f(d);
   },
 
   getSubDomainTitle: function (d) {

superset-frontend/plugins/plugin-chart-calendar/test/ReactCalendar.test.tsx

@@ -25,11 +25,9 @@ import {
   waitFor,
 } from 'spec/helpers/testing-library';
 import { CALENDAR_TOOLTIP_CLASS } from '../src/tooltip';
-import { convertUTCTimestampToLocal } from '../src/utils';
 
 interface MockCalHeatMapConfig {
   itemSelector: Element;
-  dateFormatter?: (date: Date, format: string) => string;
 }
 
 type MetricNameInput = string | string[];
@@ -40,7 +38,6 @@ let mockInitCallCount = 0;
 let mockThrowOnInitCall: number | null = null;
 let mockDestroyCallCount = 0;
 let mockDestroyedInstanceIds: string[] = [];
-let mockDateFormatter: MockCalHeatMapConfig['dateFormatter'];
 
 const mockTheme = {
   colorBgElevated: '#ffffff',
@@ -59,7 +56,6 @@ jest.mock('../src/vendor/cal-heatmap', () => ({
       } = require('../src/tooltip');
 
       mockInitCallCount += 1;
-      mockDateFormatter = config.dateFormatter;
       if (mockThrowOnInitCall === mockInitCallCount) {
         throw new Error('Mock CalHeatMap init failure');
       }
@@ -288,28 +284,9 @@ afterEach(() => {
   mockThrowOnInitCall = null;
   mockDestroyCallCount = 0;
   mockDestroyedInstanceIds = [];
-  mockDateFormatter = undefined;
   document.body.innerHTML = '';
 });
 
-test('Calendar provides a timezone-safe date formatter to CalHeatMap', () => {
-  const calendarOwner = document.createElement('div');
-  document.body.appendChild(calendarOwner);
-
-  Calendar(calendarOwner, {
-    ...createCalendarProps('localized-metric'),
-    theme: mockTheme,
-  });
-
-  if (!mockDateFormatter) {
-    throw new Error('Expected Calendar to configure a date formatter');
-  }
-
-  const localDate = new Date(convertUTCTimestampToLocal(Date.UTC(2024, 0, 1)));
-
-  expect(mockDateFormatter(localDate, '%Y-%m-%d')).toBe('2024-01-01');
-});
-
 test('rerender and unmount clean up only the affected calendar tooltips', () => {
   jest.useFakeTimers();
 

superset-frontend/plugins/plugin-chart-calendar/test/cal-heatmap.test.ts

@@ -1,91 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import CalHeatMapImport from '../src/vendor/cal-heatmap';
-
-type DateFormatter = (date: Date, format: string) => string;
-type FunctionalDateFormat = (date: Date) => string;
-
-interface CalHeatMapInstance {
-  options: {
-    dateFormatter: DateFormatter | null;
-    timeFormatter: (t: number) => string;
-    valueFormatter: (v: number) => string;
-  };
-  formatDate(date: Date, format: string | FunctionalDateFormat): string;
-  tip: { html(): (d: { t: number; v: number }) => string };
-  legendTip: { html(): (d: number) => string };
-}
-
-const CalHeatMap = CalHeatMapImport as unknown as new () => CalHeatMapInstance;
-
-test('CalHeatMap delegates string date formats to the configured formatter', () => {
-  const calendar = new CalHeatMap();
-  const date = new Date(2024, 0, 1);
-  const dateFormatter = jest.fn<string, [Date, string]>(() => 'Январь');
-  calendar.options.dateFormatter = dateFormatter;
-
-  expect(calendar.formatDate(date, '%B')).toBe('Январь');
-  expect(dateFormatter).toHaveBeenCalledWith(date, '%B');
-});
-
-test('CalHeatMap preserves functional formatters over the configured formatter', () => {
-  const calendar = new CalHeatMap();
-  const date = new Date(2024, 0, 1);
-  const dateFormatter = jest.fn<string, [Date, string]>(() => 'localized');
-  const functionalFormat = jest.fn<string, [Date]>(() => 'custom');
-  calendar.options.dateFormatter = dateFormatter;
-
-  expect(calendar.formatDate(date, functionalFormat)).toBe('custom');
-  expect(functionalFormat).toHaveBeenCalledWith(date);
-  expect(dateFormatter).not.toHaveBeenCalled();
-});
-
-test('CalHeatMap keeps the D3 formatter fallback', () => {
-  const calendar = new CalHeatMap();
-  const date = new Date(2024, 0, 1);
-
-  expect(calendar.formatDate(date, '%B')).toBe('January');
-});
-
-test('cell tooltip HTML escapes creator-controlled formatter output', () => {
-  // Regression test: the tip's .html() callback is assigned to the
-  // tooltip node via innerHTML (d3-tip), so formatter output must be
-  // escaped before it's returned.
-  const calendar = new CalHeatMap();
-  calendar.options.timeFormatter = () => '<img src=x onerror=alert(1)>';
-  calendar.options.valueFormatter = () => '<svg onload=alert(2)>';
-
-  const html = calendar.tip.html()({ t: 0, v: 1 });
-
-  expect(html).not.toContain('<img');
-  expect(html).not.toContain('<svg');
-  expect(html).toContain('&lt;img');
-  expect(html).toContain('&lt;svg');
-});
-
-test('legend tooltip HTML escapes creator-controlled formatter output', () => {
-  const calendar = new CalHeatMap();
-  calendar.options.valueFormatter = () => '<img src=x onerror=alert(1)>';
-
-  const html = calendar.legendTip.html()(1);
-
-  expect(html).not.toContain('<img');
-  expect(html).toContain('&lt;img');
-});

superset-frontend/plugins/plugin-chart-calendar/test/utils.test.ts

@@ -17,11 +17,7 @@
  * under the License.
  */
 
-import {
-  getFormattedUTCTime,
-  convertUTCTimestampToLocal,
-  escapeHtml,
-} from '../src/utils';
+import { getFormattedUTCTime, convertUTCTimestampToLocal } from '../src/utils';
 
 test('getFormattedUTCTime formats local timestamp for display as UTC date', () => {
   const utcTimestamp = 1420070400000; // 2015-01-01 00:00:00 UTC
@@ -91,22 +87,3 @@ test('convertUTCTimestampToLocal and getFormattedUTCTime work together to displa
   const formattedTime = getFormattedUTCTime(localTimestamp, '%Y-%m-%d');
   expect(formattedTime).toContain('2024-01-01');
 });
-
-test('escapeHtml neutralizes markup smuggled through a time format string', () => {
-  // Regression test: d3-time-format passes non-% characters through
-  // verbatim, so escaping must happen before the innerHTML sink.
-  const formatted = getFormattedUTCTime(
-    1704067200000,
-    '%Y <img src=x onerror=alert(1)>',
-  );
-  const escaped = escapeHtml(formatted);
-
-  expect(formatted).toContain('<img');
-  expect(escaped).not.toContain('<img');
-  expect(escaped).toContain('&lt;img');
-});
-
-test('escapeHtml stringifies non-string formatter output safely', () => {
-  expect(escapeHtml(1234)).toEqual('1234');
-  expect(escapeHtml('a & b < c')).toEqual('a &amp; b &lt; c');
-});

superset-frontend/plugins/plugin-chart-cartodiagram/src/util/layerUtil.tsx

@@ -33,27 +33,6 @@ import { WmsLayerConf, WfsLayerConf, LayerConf, XyzLayerConf } from '../types';
 import { isWfsLayerConf, isWmsLayerConf, isXyzLayerConf } from '../typeguards';
 import { isVersionBelow } from './serviceUtil';
 
-/**
- * Escape HTML special characters in a layer attribution string.
- *
- * OpenLayers' Attribution control renders attribution strings via innerHTML,
- * and the attribution here comes from creator-supplied chart form data, so it
- * must be treated as untrusted text rather than markup to prevent stored XSS.
- *
- * @param attribution The attribution string from the layer configuration
- *
- * @returns The attribution with HTML special characters escaped
- */
-export const escapeAttribution = (attribution?: string): string | undefined =>
-  attribution === undefined
-    ? undefined
-    : attribution
-        .replace(/&/g, '&')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;')
-        .replace(/"/g, '&quot;')
-        .replace(/'/g, '&#039;');
-
 /**
  * Create a WMS layer.
  *
@@ -70,7 +49,7 @@ export const createWmsLayer = (wmsLayerConf: WmsLayerConf) => {
         LAYERS: layersParam,
         VERSION: version,
       },
-      attributions: escapeAttribution(attribution),
+      attributions: attribution,
     }),
   });
 };
@@ -87,7 +66,7 @@ export const createXyzLayer = (xyzLayerConf: XyzLayerConf) => {
   return new TileLayer({
     source: new XyzSource({
       url,
-      attributions: escapeAttribution(attribution),
+      attributions: attribution,
     }),
   });
 };
@@ -111,7 +90,7 @@ export const createWfsLayer = async (wfsLayerConf: WfsLayerConf) => {
 
   const wfsSource = new VectorSource({
     format: new GeoJSON(),
-    attributions: escapeAttribution(attribution),
+    attributions: attribution,
     url: extent => {
       const requestUrl = new URL(url);
       const params = requestUrl.searchParams;

superset-frontend/plugins/plugin-chart-cartodiagram/test/util/layerUtil.test.ts

@@ -17,65 +17,20 @@
  * under the License.
  */
 
-import { WfsLayerConf, WmsLayerConf, XyzLayerConf } from '../../src/types';
+import { WfsLayerConf } from '../../src/types';
 import {
   createLayer,
   createWfsLayer,
   createWmsLayer,
   createXyzLayer,
-  escapeAttribution,
 } from '../../src/util/layerUtil';
 
 describe('layerUtil', () => {
-  describe('escapeAttribution', () => {
-    test('escapes HTML markup in attribution strings', () => {
-      expect(escapeAttribution('(c) OSM <img src=x onerror=alert(1)>')).toBe(
-        '(c) OSM &lt;img src=x onerror=alert(1)&gt;',
-      );
-      expect(escapeAttribution('a & "b" \'c\'')).toBe(
-        'a &amp; &quot;b&quot; &#039;c&#039;',
-      );
-      expect(escapeAttribution(undefined)).toBeUndefined();
-    });
-  });
-
   describe('createWmsLayer', () => {
     test('exists', () => {
       // function is trivial
       expect(createWmsLayer).toBeDefined();
     });
-
-    test('escapes HTML in the layer attribution', () => {
-      const wmsLayerConf: WmsLayerConf = {
-        title: 'wms',
-        type: 'WMS',
-        url: 'https://ows-demo.terrestris.de/geoserver/osm/wms',
-        version: '1.3.0',
-        layersParam: 'osm:osm-fuel',
-        attribution: '(c) OSM <img src=x onerror=alert(1)>',
-      };
-      const layer = createWmsLayer(wmsLayerConf);
-      const attributions = layer.getSource()?.getAttributions();
-      expect(attributions?.(undefined as never)).toEqual([
-        '(c) OSM &lt;img src=x onerror=alert(1)&gt;',
-      ]);
-    });
-  });
-
-  describe('createXyzLayer', () => {
-    test('escapes HTML in the layer attribution', () => {
-      const xyzLayerConf: XyzLayerConf = {
-        title: 'osm',
-        type: 'XYZ',
-        url: 'https://tile.openstreetmap.org/{z}/{x}/{y}.png',
-        attribution: '(c) OSM <img src=x onerror=alert(1)>',
-      };
-      const layer = createXyzLayer(xyzLayerConf);
-      const attributions = layer.getSource()?.getAttributions();
-      expect(attributions?.(undefined as never)).toEqual([
-        '(c) OSM &lt;img src=x onerror=alert(1)&gt;',
-      ]);
-    });
   });
 
   describe('createWfsLayer', () => {

superset-frontend/plugins/plugin-chart-chord/package.json

@@ -30,12 +30,12 @@
   },
   "dependencies": {
     "d3": "^3.5.17",
-    "prop-types": "^15.8.1"
+    "prop-types": "^15.8.1",
+    "react": "^19.2.7"
   },
   "peerDependencies": {
     "@apache-superset/core": "*",
     "@superset-ui/chart-controls": "*",
-    "@superset-ui/core": "*",
-    "react": "^18.3.0"
+    "@superset-ui/core": "*"
   }
 }

superset-frontend/plugins/plugin-chart-echarts/src/BigNumber/BigNumberViz.test.tsx

@@ -17,10 +17,6 @@
  * under the License.
  */
 
-import { getNumberFormatter } from '@superset-ui/core';
-import { render, fireEvent } from '../../../../spec/helpers/testing-library';
-import BigNumberVis from './BigNumberViz';
-
 /**
  * Tests for the color threshold formatter logic in BigNumberViz.
  *
@@ -87,33 +83,3 @@ describe('BigNumberViz color formatters', () => {
     expect(getColorFromValue).not.toHaveBeenCalled();
   });
 });
-
-describe('BigNumberViz context menu', () => {
-  test('invokes onContextMenu and stops the event bubbling to ancestor handlers', () => {
-    const onContextMenu = jest.fn();
-    const ancestorHandler = jest.fn();
-
-    const { container } = render(
-      <div onContextMenu={ancestorHandler}>
-        <BigNumberVis
-          width={200}
-          height={100}
-          bigNumber={42}
-          headerFormatter={getNumberFormatter()}
-          headerFontSize={0.3}
-          subheaderFontSize={0.125}
-          subtitleFontSize={0.125}
-          subtitle=""
-          refs={{}}
-          onContextMenu={onContextMenu}
-        />
-      </div>,
-    );
-
-    const headerLine = container.querySelector('.header-line');
-    fireEvent.contextMenu(headerLine!, { clientX: 10, clientY: 20 });
-
-    expect(onContextMenu).toHaveBeenCalledWith(10, 20);
-    expect(ancestorHandler).not.toHaveBeenCalled();
-  });
-});

superset-frontend/plugins/plugin-chart-echarts/src/BigNumber/BigNumberViz.tsx

@@ -224,7 +224,6 @@ function BigNumberVis({
     const handleContextMenu = (e: MouseEvent<HTMLDivElement>) => {
       if (onContextMenu) {
         e.preventDefault();
-        e.stopPropagation();
         onContextMenu(e.nativeEvent.clientX, e.nativeEvent.clientY);
       }
     };

superset-frontend/plugins/plugin-chart-echarts/src/Bubble/transformProps.test.ts

@@ -1,70 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import { SqlaFormData } from '@superset-ui/core';
-import transformProps from './transformProps';
-import { EchartsBubbleChartProps } from './types';
-
-const baseFormData: SqlaFormData = {
-  datasource: '1__table',
-  viz_type: 'bubble_v2',
-  entity: 'customer_name',
-  x: 'price',
-  y: 'sales',
-  size: 'count',
-};
-
-const baseChartProps = {
-  width: 400,
-  height: 400,
-  hooks: {},
-  queriesData: [
-    {
-      data: [
-        { customer_name: 'A', price: 10, sales: 100, count: 5 },
-        { customer_name: 'B', price: 20, sales: 200, count: 8 },
-      ],
-    },
-  ],
-  theme: { colorText: '#000' },
-};
-
-test('nests xAxisLabelInterval under axisLabel rather than the axis itself', () => {
-  // Regression test: xAxis.interval forces echarts' IntervalScale into a
-  // fixed-tick-spacing mode that expects a number and crashes on the
-  // 'auto'/'0' strings this control actually produces (observed as an
-  // uncaught assertion deep in echarts' axis "nice" tick calculation,
-  // reproducing on every dashboard bubble chart). The interval belongs on
-  // axisLabel, where it only controls how many labels are skipped.
-  const { echartOptions } = transformProps({
-    ...baseChartProps,
-    formData: baseFormData,
-  } as unknown as EchartsBubbleChartProps);
-
-  expect((echartOptions.xAxis as any).interval).toBeUndefined();
-  expect((echartOptions.xAxis as any).axisLabel.interval).toBe('auto');
-});
-
-test('honors an explicit xAxisLabelInterval override', () => {
-  const { echartOptions } = transformProps({
-    ...baseChartProps,
-    formData: { ...baseFormData, xAxisLabelInterval: '0' },
-  } as unknown as EchartsBubbleChartProps);
-
-  expect((echartOptions.xAxis as any).axisLabel.interval).toBe('0');
-});

superset-frontend/plugins/plugin-chart-echarts/src/Bubble/transformProps.ts

@@ -212,16 +212,13 @@ export default function transformProps(chartProps: EchartsBubbleChartProps) {
   const echartOptions: EChartsCoreOption = {
     series,
     xAxis: {
-      axisLabel: {
-        formatter: xAxisFormatter,
-        rotate: xAxisLabelRotation,
-        interval: xAxisLabelInterval,
-      },
+      axisLabel: { formatter: xAxisFormatter, rotate: xAxisLabelRotation },
       splitLine: {
         lineStyle: {
           type: 'dashed',
         },
       },
+      interval: xAxisLabelInterval,
       scale: true,
       name: bubbleXAxisTitle,
       nameLocation: 'middle',

superset-frontend/plugins/plugin-chart-echarts/src/Gantt/transformProps.ts

@@ -390,7 +390,6 @@ export default function transformProps(chartProps: EchartsGanttChartProps) {
     [GenericDataType.String]: undefined,
     [GenericDataType.Temporal]: tooltipTimeFormatter,
     [GenericDataType.Boolean]: undefined,
-    [GenericDataType.MultiValue]: undefined,
   };
 
   const echartOptions: EChartsCoreOption = {

superset-frontend/plugins/plugin-chart-echarts/src/MixedTimeseries/transformProps.ts

@@ -40,7 +40,6 @@ import {
   TimeseriesChartDataResponseResult,
   TimeseriesDataRecord,
   tooltipHtml,
-  truncateLabel,
   ValueFormatter,
 } from '@superset-ui/core';
 import { GenericDataType } from '@apache-superset/core/common';
@@ -80,7 +79,6 @@ import {
   getAnnotationData,
 } from '../utils/annotation';
 import {
-  collapseForecastKeys,
   extractForecastSeriesContext,
   extractForecastValuesFromTooltipParams,
   formatForecastTooltipSeries,
@@ -209,7 +207,6 @@ export default function transformProps(
     zoomable,
     richTooltip,
     tooltipSortByMetric,
-    tooltipTruncation,
     xAxisBounds,
     xAxisLabelRotation,
     xAxisLabelInterval,
@@ -770,9 +767,7 @@ export default function transformProps(
       nameGap: xAxisTitleMarginPx,
       nameLocation: 'middle',
       axisLabel: {
-        hideOverlap: showMaxLabel
-          ? false
-          : !(xAxisType === AxisType.Time && xAxisLabelRotation !== 0),
+        hideOverlap: !(xAxisType === AxisType.Time && xAxisLabelRotation !== 0),
         formatter: deduplicatedFormatter,
         rotate: xAxisLabelRotation,
         interval: xAxisLabelInterval,
@@ -864,14 +859,12 @@ export default function transformProps(
           : params.value[0];
         const forecastValue: any[] = richTooltip ? params : [params];
 
-        const sortedKeys = collapseForecastKeys(
-          extractTooltipKeys(
-            forecastValue,
-            // horizontal mode is not supported in mixed series chart
-            1,
-            richTooltip,
-            tooltipSortByMetric,
-          ),
+        const sortedKeys = extractTooltipKeys(
+          forecastValue,
+          // horizontal mode is not supported in mixed series chart
+          1,
+          richTooltip,
+          tooltipSortByMetric,
         );
 
         const rows: string[][] = [];
@@ -914,19 +907,13 @@ export default function transformProps(
               formatter: primarySeries.has(key)
                 ? tooltipFormatter
                 : tooltipFormatterSecondary,
-              truncation: tooltipTruncation,
             });
             rows.push(row);
             if (key === focusedSeries) {
               focusedRow = rows.length - 1;
             }
           });
-        return tooltipHtml(
-          rows,
-          truncateLabel(tooltipFormatter(xValue), tooltipTruncation),
-          focusedRow,
-          tooltipTruncation,
-        );
+        return tooltipHtml(rows, tooltipFormatter(xValue), focusedRow);
       },
     },
     legend: {

superset-frontend/plugins/plugin-chart-echarts/src/MixedTimeseries/types.ts

@@ -24,7 +24,6 @@ import {
   ContributionType,
   TimeFormatter,
   AxisType,
-  TooltipTruncationMode,
 } from '@superset-ui/core';
 import {
   BaseChartProps,
@@ -60,7 +59,6 @@ export type EchartsMixedTimeseriesFormData = QueryFormData & {
   timeGrainSqla?: TimeGranularity;
   forceMaxInterval?: boolean;
   tooltipTimeFormat?: string;
-  tooltipTruncation?: TooltipTruncationMode;
   zoomable: boolean;
   richTooltip: boolean;
   showQueryIdentifiers?: boolean;
@@ -110,7 +108,6 @@ export const DEFAULT_FORM_DATA: EchartsMixedTimeseriesFormData = {
   yAxisFormatSecondary: TIMESERIES_DEFAULTS.yAxisFormat,
   yAxisTitleSecondary: DEFAULT_TITLE_FORM_DATA.yAxisTitle,
   tooltipTimeFormat: TIMESERIES_DEFAULTS.tooltipTimeFormat,
-  tooltipTruncation: TIMESERIES_DEFAULTS.tooltipTruncation,
   xAxisBounds: TIMESERIES_DEFAULTS.xAxisBounds,
   xAxisForceCategorical: TIMESERIES_DEFAULTS.xAxisForceCategorical,
   xAxisTimeFormat: TIMESERIES_DEFAULTS.xAxisTimeFormat,

superset-frontend/plugins/plugin-chart-echarts/src/Radar/utils.ts

@@ -18,7 +18,6 @@
  */
 import { t } from '@apache-superset/core/translation';
 import { NumberFormatter } from '@superset-ui/core';
-import { sanitizeHtml } from '../utils/series';
 
 /*
  function for finding the max metric values among all series data for Radar Chart
@@ -64,7 +63,7 @@ export const renderNormalizedTooltip = (
   const { color, name = '', value: values } = params;
   const seriesName = name || 'series0';
 
-  const colorDot = `<span style="display:inline-block;margin-right:5px;border-radius:50%;width:5px;height:5px;background-color:${sanitizeHtml(color)}"></span>`;
+  const colorDot = `<span style="display:inline-block;margin-right:5px;border-radius:50%;width:5px;height:5px;background-color:${color}"></span>`;
 
   // Get metric values with denormalization if needed
   const metricValues: TooltipMetricValue[] = metrics.map((metric, index) => {
@@ -86,26 +85,19 @@ export const renderNormalizedTooltip = (
     };
   });
 
-  // Tooltip is rendered via innerHTML (ECharts default renderMode
-  // 'html'), so seriesName/metric/value/color are HTML-escaped, matching
-  // the treatment every other echarts tooltip path applies.
   const tooltipRows = metricValues
     .map(
       ({ metric, value }) => `
         <div style="display:flex;">
-          <div>${colorDot}${sanitizeHtml(metric)}:</div>
-          <div style="font-weight:bold;margin-left:auto;">${sanitizeHtml(
-            String(value),
-          )}</div>
+          <div>${colorDot}${metric}:</div>
+          <div style="font-weight:bold;margin-left:auto;">${value}</div>
         </div>
       `,
     )
     .join('');
 
   return `
-    <div style="font-weight:bold;margin-bottom:5px;">${sanitizeHtml(
-      seriesName,
-    )}</div>
+    <div style="font-weight:bold;margin-bottom:5px;">${seriesName}</div>
     ${tooltipRows}
   `;
 };

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/EchartsTimeseries.test.tsx

@@ -21,14 +21,8 @@ import {
   waitFor,
   cleanup,
 } from '../../../../spec/helpers/testing-library';
-import {
-  AxisType,
-  createTimeRangeFromGranularity,
-  DTTM_ALIAS,
-  TimeGranularity,
-} from '@superset-ui/core';
+import { AxisType, TimeGranularity } from '@superset-ui/core';
 import { GenericDataType } from '@apache-superset/core/common';
-import { logging } from '@apache-superset/core/utils';
 import type { EChartsCoreOption } from 'echarts/core';
 import type { ECElementEvent } from 'echarts/types/src/util/types';
 import type { ReactNode } from 'react';
@@ -99,17 +93,12 @@ afterAll(() => {
 });
 
 afterEach(() => {
-  jest.useRealTimers();
   cleanup();
   mockEchart.mockReset();
   (globalThis as { ResizeObserver?: typeof ResizeObserver }).ResizeObserver =
     originalResizeObserver;
 });
 
-const advanceClickTimer = () => {
-  jest.advanceTimersByTime(300);
-};
-
 const defaultFormData: EchartsTimeseriesFormData & {
   vizType: string;
   dateFormat: string;
@@ -325,8 +314,7 @@ test('falls back to window resize listener when ResizeObserver is unavailable',
 });
 
 // Test for issue #25334: Bar chart cross-filter without dimensions
-test('emits cross-filter on X-axis value when no dimensions and categorical X-axis', () => {
-  jest.useFakeTimers();
+test('emits cross-filter on X-axis value when no dimensions and categorical X-axis', async () => {
   const setDataMaskMock = jest.fn();
 
   const propsWithCategoricalXAxis: TimeseriesChartTransformedProps = {
@@ -360,7 +348,13 @@ test('emits cross-filter on X-axis value when no dimensions and categorical X-ax
       dataIndex: 0,
     });
 
-    advanceClickTimer();
+    // Wait for the timer (TIMER_DURATION = 300ms)
+    await waitFor(
+      () => {
+        expect(setDataMaskMock).toHaveBeenCalled();
+      },
+      { timeout: 500 },
+    );
 
     // Verify the cross-filter uses the X-axis column and value, not the metric
     const dataMaskCall = setDataMaskMock.mock.calls[0][0];
@@ -374,8 +368,7 @@ test('emits cross-filter on X-axis value when no dimensions and categorical X-ax
   }
 });
 
-test('emits cross-filter on category value for horizontal bar clicks', () => {
-  jest.useFakeTimers();
+test('emits cross-filter on category value for horizontal bar clicks', async () => {
   const setDataMaskMock = jest.fn();
 
   render(
@@ -404,7 +397,12 @@ test('emits cross-filter on category value for horizontal bar clicks', () => {
     dataIndex: 0,
   });
 
-  advanceClickTimer();
+  await waitFor(
+    () => {
+      expect(setDataMaskMock).toHaveBeenCalled();
+    },
+    { timeout: 500 },
+  );
 
   expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
     {
@@ -426,7 +424,9 @@ test('uses rendered categorical axis for query event handlers', () => {
     />,
   );
 
-  expect(getLatestEchartProps().queryEventHandlers?.[0].query).toBe('xAxis');
+  expect(getLatestEchartProps().queryEventHandlers?.[0].query).toBe(
+    'xAxis.category',
+  );
 
   cleanup();
   mockEchart.mockReset();
@@ -445,7 +445,9 @@ test('uses rendered categorical axis for query event handlers', () => {
     />,
   );
 
-  expect(getLatestEchartProps().queryEventHandlers?.[0].query).toBe('yAxis');
+  expect(getLatestEchartProps().queryEventHandlers?.[0].query).toBe(
+    'yAxis.category',
+  );
 });
 
 test('emits cross-filter from horizontal categorical axis label clicks', () => {
@@ -471,9 +473,8 @@ test('emits cross-filter from horizontal categorical axis label clicks', () => {
     getLatestEchartProps().queryEventHandlers?.[0].handler;
   expect(labelClickHandler).toBeDefined();
   labelClickHandler?.({
-    targetType: 'axisLabel',
     value: 'Product A',
-  } as unknown as ECElementEvent);
+  } as ECElementEvent);
 
   expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
     {
@@ -484,8 +485,7 @@ test('emits cross-filter from horizontal categorical axis label clicks', () => {
   ]);
 });
 
-test('does not emit duplicate cross-filter for generic axis label clicks', () => {
-  jest.useFakeTimers();
+test('does not emit duplicate cross-filter for generic axis label clicks', async () => {
   const setDataMaskMock = jest.fn();
 
   render(
@@ -507,28 +507,11 @@ test('does not emit duplicate cross-filter for generic axis label clicks', () =>
     name: 'Product A',
   });
 
-  jest.advanceTimersByTime(400);
+  await new Promise(resolve => setTimeout(resolve, 400));
   expect(setDataMaskMock).not.toHaveBeenCalled();
 });
 
-test('keeps temporal range exclusive ends on whole-second boundaries', () => {
-  const clickedTimestamp = new Date(Date.UTC(2021, 0, 15, 12, 34, 56, 789));
-
-  [TimeGranularity.DAY, TimeGranularity.MONTH, TimeGranularity.YEAR].forEach(
-    grain => {
-      const [, inclusiveEnd] = createTimeRangeFromGranularity(
-        clickedTimestamp,
-        grain,
-        false,
-      );
-      const exclusiveEnd = new Date(inclusiveEnd.getTime() + 1);
-
-      expect(exclusiveEnd.getUTCMilliseconds()).toBe(0);
-    },
-  );
-});
-
-test('emits TEMPORAL_RANGE cross-filter from time axis label click on day bucket', () => {
+test('does not emit cross-filter when no dimensions and time-based X-axis', async () => {
   const setDataMaskMock = jest.fn();
 
   const propsWithTimeXAxis: TimeseriesChartTransformedProps = {
@@ -536,610 +519,39 @@ test('emits TEMPORAL_RANGE cross-filter from time axis label click on day bucket
     emitCrossFilters: true,
     setDataMask: setDataMaskMock,
     groupby: [], // No dimensions
-    resolvedTimeGrain: TimeGranularity.DAY,
-    formData: {
-      ...defaultFormData,
-      granularitySqla: 'ds',
-      timeGrainSqla: TimeGranularity.DAY,
-    },
     xAxis: {
-      label: DTTM_ALIAS,
-      type: AxisType.Time,
+      label: '__timestamp',
+      type: AxisType.Time, // Time-based X-axis (not categorical)
     },
   };
 
   render(<EchartsTimeseries {...propsWithTimeXAxis} />);
 
-  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
-    ({ query }) => query === 'xAxis',
-  )?.handler;
-  expect(labelClickHandler).toBeDefined();
-  labelClickHandler?.({
-    targetType: 'axisLabel',
-    value: '2021-01-01',
-  } as unknown as ECElementEvent);
+  const lastCall = mockEchart.mock.calls.at(-1);
+  expect(lastCall).toBeDefined();
+  const [props] = lastCall as [EchartsProps];
 
-  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
-    {
-      col: 'ds',
-      op: 'TEMPORAL_RANGE',
-      val: '2021-01-01T00:00:00 : 2021-01-02T00:00:00',
-    },
-  ]);
-});
+  // Simulate a click event
+  const clickHandler = props.eventHandlers?.click;
+  if (clickHandler) {
+    clickHandler({
+      componentType: 'series',
+      seriesName: 'Sales',
+      data: [1609459200000, 100], // Timestamp
+      name: '2021-01-01',
+      dataIndex: 0,
+    });
 
-test('emits TEMPORAL_RANGE cross-filter from time axis label click on month bucket', () => {
-  const setDataMaskMock = jest.fn();
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      setDataMask={setDataMaskMock}
-      groupby={[]}
-      resolvedTimeGrain={TimeGranularity.MONTH}
-      formData={{
-        ...defaultFormData,
-        granularitySqla: 'ds',
-        timeGrainSqla: TimeGranularity.MONTH,
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
-    ({ query }) => query === 'xAxis',
-  )?.handler;
-  expect(labelClickHandler).toBeDefined();
-  labelClickHandler?.({
-    targetType: 'axisLabel',
-    value: '2021-01-01',
-  } as unknown as ECElementEvent);
-
-  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
-    {
-      col: 'ds',
-      op: 'TEMPORAL_RANGE',
-      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
-    },
-  ]);
-});
-
-test('emits TEMPORAL_RANGE cross-filter from time axis label click on year bucket', () => {
-  const setDataMaskMock = jest.fn();
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      setDataMask={setDataMaskMock}
-      groupby={[]}
-      resolvedTimeGrain={TimeGranularity.YEAR}
-      formData={{
-        ...defaultFormData,
-        granularitySqla: 'ds',
-        timeGrainSqla: TimeGranularity.YEAR,
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
-    ({ query }) => query === 'xAxis',
-  )?.handler;
-  expect(labelClickHandler).toBeDefined();
-  labelClickHandler?.({
-    targetType: 'axisLabel',
-    value: '2021-01-01',
-  } as unknown as ECElementEvent);
-
-  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
-    {
-      col: 'ds',
-      op: 'TEMPORAL_RANGE',
-      val: '2021-01-01T00:00:00 : 2022-01-01T00:00:00',
-    },
-  ]);
-});
-
-test('emits upper-exclusive TEMPORAL_RANGE from time point click on month bucket', () => {
-  jest.useFakeTimers();
-  const setDataMaskMock = jest.fn();
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      setDataMask={setDataMaskMock}
-      groupby={[]}
-      resolvedTimeGrain={TimeGranularity.MONTH}
-      formData={{
-        ...defaultFormData,
-        granularitySqla: 'ds',
-        timeGrainSqla: TimeGranularity.MONTH,
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const clickHandler = getLatestEchartProps().eventHandlers?.click;
-  expect(clickHandler).toBeDefined();
-  clickHandler?.({
-    componentType: 'series',
-    seriesName: 'Sales',
-    data: [Date.UTC(2021, 0, 1), 100],
-    name: '2021-01-01',
-    dataIndex: 0,
-  });
-
-  advanceClickTimer();
-
-  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
-    {
-      col: 'ds',
-      op: 'TEMPORAL_RANGE',
-      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
-    },
-  ]);
-});
-
-test('emits TEMPORAL_RANGE from string-typed time point click value', () => {
-  jest.useFakeTimers();
-  const setDataMaskMock = jest.fn();
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      setDataMask={setDataMaskMock}
-      groupby={[]}
-      resolvedTimeGrain={TimeGranularity.MONTH}
-      formData={{
-        ...defaultFormData,
-        granularitySqla: 'ds',
-        timeGrainSqla: TimeGranularity.MONTH,
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const clickHandler = getLatestEchartProps().eventHandlers?.click;
-  expect(clickHandler).toBeDefined();
-  clickHandler?.({
-    componentType: 'series',
-    seriesName: 'Sales',
-    data: ['2021-01-01T00:00:00Z', 100],
-    name: '2021-01-01',
-    dataIndex: 0,
-  });
-
-  advanceClickTimer();
-
-  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
-    {
-      col: 'ds',
-      op: 'TEMPORAL_RANGE',
-      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
-    },
-  ]);
-});
-
-test('uses resolved time grain for temporal point-click cross-filter', () => {
-  jest.useFakeTimers();
-  const setDataMaskMock = jest.fn();
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      setDataMask={setDataMaskMock}
-      groupby={[]}
-      resolvedTimeGrain={TimeGranularity.MONTH}
-      formData={{
-        ...defaultFormData,
-        granularitySqla: 'ds',
-        timeGrainSqla: TimeGranularity.DAY,
-        extraFormData: {
-          time_grain_sqla: TimeGranularity.MONTH,
-        },
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const clickHandler = getLatestEchartProps().eventHandlers?.click;
-  expect(clickHandler).toBeDefined();
-  clickHandler?.({
-    componentType: 'series',
-    seriesName: 'Sales',
-    data: [Date.UTC(2021, 0, 1), 100],
-    name: '2021-01-01',
-    dataIndex: 0,
-  });
-
-  advanceClickTimer();
-
-  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
-    {
-      col: 'ds',
-      op: 'TEMPORAL_RANGE',
-      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
-    },
-  ]);
-});
-
-test('emits TEMPORAL_RANGE from horizontal time point click using timestamp, not metric', () => {
-  jest.useFakeTimers();
-  const setDataMaskMock = jest.fn();
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      setDataMask={setDataMaskMock}
-      groupby={[]}
-      resolvedTimeGrain={TimeGranularity.MONTH}
-      formData={{
-        ...defaultFormData,
-        orientation: OrientationType.Horizontal,
-        granularitySqla: 'ds',
-        timeGrainSqla: TimeGranularity.MONTH,
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const clickHandler = getLatestEchartProps().eventHandlers?.click;
-  expect(clickHandler).toBeDefined();
-  clickHandler?.({
-    componentType: 'series',
-    seriesName: 'Sales',
-    data: [129, Date.UTC(2021, 0, 1)],
-    name: '2021-01-01',
-    dataIndex: 0,
-  });
-
-  advanceClickTimer();
-
-  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
-    {
-      col: 'ds',
-      op: 'TEMPORAL_RANGE',
-      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
-    },
-  ]);
-});
-
-test('emits TEMPORAL_RANGE cross-filter from horizontal time axis label click', () => {
-  const setDataMaskMock = jest.fn();
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      setDataMask={setDataMaskMock}
-      groupby={[]}
-      resolvedTimeGrain={TimeGranularity.MONTH}
-      formData={{
-        ...defaultFormData,
-        orientation: OrientationType.Horizontal,
-        granularitySqla: 'ds',
-        timeGrainSqla: TimeGranularity.MONTH,
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
-    ({ query }) => query === 'yAxis',
-  )?.handler;
-  expect(labelClickHandler).toBeDefined();
-  labelClickHandler?.({
-    targetType: 'axisLabel',
-    value: '2021-01-01',
-  } as unknown as ECElementEvent);
-
-  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
-    {
-      col: 'ds',
-      op: 'TEMPORAL_RANGE',
-      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
-    },
-  ]);
-});
-
-test('warns and skips temporal axis label cross-filter when label value cannot be parsed', () => {
-  const setDataMaskMock = jest.fn();
-  const warn = jest.spyOn(logging, 'warn').mockImplementation();
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      setDataMask={setDataMaskMock}
-      groupby={[]}
-      formData={{
-        ...defaultFormData,
-        granularitySqla: 'ds',
-        timeGrainSqla: TimeGranularity.MONTH,
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
-    ({ query }) => query === 'xAxis',
-  )?.handler;
-  expect(labelClickHandler).toBeDefined();
-  labelClickHandler?.({
-    targetType: 'axisLabel',
-    value: 'not-a-date',
-  } as unknown as ECElementEvent);
-
-  expect(setDataMaskMock).not.toHaveBeenCalled();
-  expect(warn).toHaveBeenCalledWith(
-    'Unable to parse time axis value for cross-filtering',
-    'not-a-date',
-  );
-
-  warn.mockRestore();
-});
-
-test('logs and skips temporal point-click cross-filter when string value cannot be parsed', () => {
-  jest.useFakeTimers();
-  const setDataMaskMock = jest.fn();
-  const warn = jest.spyOn(logging, 'warn').mockImplementation();
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      setDataMask={setDataMaskMock}
-      groupby={[]}
-      resolvedTimeGrain={TimeGranularity.MONTH}
-      formData={{
-        ...defaultFormData,
-        granularitySqla: 'ds',
-        timeGrainSqla: TimeGranularity.MONTH,
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const clickHandler = getLatestEchartProps().eventHandlers?.click;
-  expect(clickHandler).toBeDefined();
-  clickHandler?.({
-    componentType: 'series',
-    seriesName: 'Sales',
-    data: ['not-a-date', 100],
-    name: 'not-a-date',
-    dataIndex: 0,
-  });
-
-  advanceClickTimer();
-
-  expect(setDataMaskMock).not.toHaveBeenCalled();
-  expect(warn).toHaveBeenCalledWith(
-    'Unable to parse time axis value for cross-filtering',
-    'not-a-date',
-  );
-
-  warn.mockRestore();
-});
-
-test('emits empty temporal X-axis data mask when filter grain is missing', () => {
-  jest.useFakeTimers();
-  const setDataMaskMock = jest.fn();
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      setDataMask={setDataMaskMock}
-      groupby={[]}
-      formData={{
-        ...defaultFormData,
-        granularitySqla: 'ds',
-        timeGrainSqla: undefined,
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const clickHandler = getLatestEchartProps().eventHandlers?.click;
-  expect(clickHandler).toBeDefined();
-  clickHandler?.({
-    componentType: 'series',
-    seriesName: 'Sales',
-    data: [Date.UTC(2021, 0, 1), 100],
-    name: '2021-01-01',
-    dataIndex: 0,
-  });
-
-  advanceClickTimer();
-
-  expect(setDataMaskMock.mock.calls[0][0]).toEqual({
-    extraFormData: {
-      filters: [],
-    },
-    filterState: {
-      label: undefined,
-      value: null,
-      selectedValues: null,
-    },
-  });
-});
-
-test('clears temporal X-axis cross-filter when clicking selected bucket again', () => {
-  jest.useFakeTimers();
-  const setDataMaskMock = jest.fn();
-  const selectedRange = '2021-01-01T00:00:00 : 2021-02-01T00:00:00';
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      setDataMask={setDataMaskMock}
-      groupby={[]}
-      selectedValues={{ 0: selectedRange }}
-      resolvedTimeGrain={TimeGranularity.MONTH}
-      formData={{
-        ...defaultFormData,
-        granularitySqla: 'ds',
-        timeGrainSqla: TimeGranularity.MONTH,
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const clickHandler = getLatestEchartProps().eventHandlers?.click;
-  expect(clickHandler).toBeDefined();
-  clickHandler?.({
-    componentType: 'series',
-    seriesName: 'Sales',
-    data: [Date.UTC(2021, 0, 1), 100],
-    name: '2021-01-01',
-    dataIndex: 0,
-  });
-
-  advanceClickTimer();
-
-  expect(setDataMaskMock.mock.calls[0][0]).toEqual({
-    extraFormData: {
-      filters: [],
-    },
-    filterState: {
-      label: undefined,
-      value: null,
-      selectedValues: null,
-    },
-  });
-});
-
-test('does not emit temporal X-axis label cross-filter when dimensions are set', () => {
-  const setDataMaskMock = jest.fn();
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      setDataMask={setDataMaskMock}
-      groupby={['country']}
-      formData={{
-        ...defaultFormData,
-        groupby: ['country'],
-        granularitySqla: 'ds',
-        timeGrainSqla: TimeGranularity.MONTH,
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
-    ({ query }) => query === 'xAxis',
-  )?.handler;
-  expect(labelClickHandler).toBeDefined();
-  labelClickHandler?.({
-    targetType: 'axisLabel',
-    value: '2021-01-01',
-  } as unknown as ECElementEvent);
-
-  expect(setDataMaskMock).not.toHaveBeenCalled();
-});
-
-test('does not emit temporal X-axis cross-filter when dimensions are set', () => {
-  jest.useFakeTimers();
-  const setDataMaskMock = jest.fn();
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      setDataMask={setDataMaskMock}
-      groupby={['country']}
-      labelMap={{
-        Sales: ['US'],
-      }}
-      formData={{
-        ...defaultFormData,
-        groupby: ['country'],
-        granularitySqla: 'ds',
-        timeGrainSqla: TimeGranularity.MONTH,
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const clickHandler = getLatestEchartProps().eventHandlers?.click;
-  expect(clickHandler).toBeDefined();
-  clickHandler?.({
-    componentType: 'series',
-    seriesName: 'Sales',
-    data: [Date.UTC(2021, 0, 1), 100],
-    name: '2021-01-01',
-    dataIndex: 0,
-  });
-
-  advanceClickTimer();
-
-  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
-    {
-      col: 'country',
-      op: 'IN',
-      val: ['US'],
-    },
-  ]);
-  expect(
-    setDataMaskMock.mock.calls[0][0].extraFormData.filters.some(
-      (filter: { op: string }) => filter.op === 'TEMPORAL_RANGE',
-    ),
-  ).toBe(false);
+    // Wait a bit and verify setDataMask was NOT called
+    await new Promise(resolve => setTimeout(resolve, 400));
+    expect(setDataMaskMock).not.toHaveBeenCalled();
+  }
 });
 
 // Test for issue #41102: horizontal bar cross-filter must use the category
 // value, not the metric. For horizontal bars the data tuple is value-first
 // (e.g. [100, 'Product A']), so relying on data[0] emitted the metric value.
-test('emits cross-filter on the category value for a horizontal categorical bar', () => {
-  jest.useFakeTimers();
+test('emits cross-filter on the category value for a horizontal categorical bar', async () => {
   const setDataMaskMock = jest.fn();
 
   const propsWithHorizontalXAxis: TimeseriesChartTransformedProps = {
@@ -1173,7 +585,12 @@ test('emits cross-filter on the category value for a horizontal categorical bar'
       dataIndex: 0,
     });
 
-    advanceClickTimer();
+    await waitFor(
+      () => {
+        expect(setDataMaskMock).toHaveBeenCalled();
+      },
+      { timeout: 500 },
+    );
 
     // Must filter on the category ('Product A'), not the metric value (100)
     const dataMaskCall = setDataMaskMock.mock.calls[0][0];
@@ -1187,55 +604,6 @@ test('emits cross-filter on the category value for a horizontal categorical bar'
   }
 });
 
-test('context menu cross-filter is available for a temporal bar point', async () => {
-  const onContextMenuMock = jest.fn();
-
-  render(
-    <EchartsTimeseries
-      {...defaultProps}
-      emitCrossFilters
-      onContextMenu={onContextMenuMock}
-      groupby={[]}
-      resolvedTimeGrain={TimeGranularity.MONTH}
-      formData={{
-        ...defaultFormData,
-        granularitySqla: 'ds',
-        timeGrainSqla: TimeGranularity.DAY,
-        extraFormData: {
-          time_grain_sqla: TimeGranularity.MONTH,
-        },
-      }}
-      xAxis={{
-        label: DTTM_ALIAS,
-        type: AxisType.Time,
-      }}
-    />,
-  );
-
-  const contextMenuHandler = getLatestEchartProps().eventHandlers?.contextmenu;
-  expect(contextMenuHandler).toBeDefined();
-  await contextMenuHandler?.({
-    componentType: 'series',
-    seriesName: 'Sales',
-    data: [Date.UTC(2021, 0, 1), 100],
-    name: '2021-01-01',
-    event: { stop: jest.fn(), event: { clientX: 10, clientY: 20 } },
-  });
-
-  await waitFor(() => {
-    expect(onContextMenuMock).toHaveBeenCalled();
-  });
-
-  const { crossFilter } = onContextMenuMock.mock.calls[0][2];
-  expect(crossFilter.dataMask.extraFormData.filters).toEqual([
-    {
-      col: 'ds',
-      op: 'TEMPORAL_RANGE',
-      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
-    },
-  ]);
-});
-
 // Test for issue #41102: the context-menu ("Add cross-filter") path must also
 // use the category value, not the metric, for a horizontal categorical bar.
 test('context menu cross-filter uses the category value for a horizontal categorical bar', async () => {

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/EchartsTimeseries.tsx

@@ -21,17 +21,14 @@ import {
   DTTM_ALIAS,
   BinaryQueryObjectFilterClause,
   AxisType,
-  type TimeGranularity,
   getTimeFormatter,
   getColumnLabel,
   getNumberFormatter,
   LegendState,
   ensureIsArray,
-  createTimeRangeFromGranularity,
 } from '@superset-ui/core';
 import { useTheme } from '@apache-superset/core/theme';
 import { GenericDataType } from '@apache-superset/core/common';
-import { logging } from '@apache-superset/core/utils';
 import type {
   ECElementEvent,
   ViewRootGroup,
@@ -51,29 +48,6 @@ import { getTemporalXAxisDrillByFilter } from '../utils/xAxisDrillByFilter';
 import { ExtraControls } from '../components/ExtraControls';
 
 const TIMER_DURATION = 300;
-const getTimestampFromTimeAxisValue = (value: string | number) => {
-  if (typeof value === 'number') {
-    return Number.isFinite(value) ? value : undefined;
-  }
-  const timestamp = Date.parse(value);
-  if (Number.isNaN(timestamp)) {
-    logging.warn('Unable to parse time axis value for cross-filtering', value);
-  }
-  return Number.isNaN(timestamp) ? undefined : timestamp;
-};
-
-// Day, month, and year ranges end at 23:59:59.999, so adding 1ms lands on a
-// whole-second next bucket boundary. The formatter intentionally emits seconds.
-const formatDateTime = (date: Date) =>
-  `${[
-    date.getUTCFullYear(),
-    String(date.getUTCMonth() + 1).padStart(2, '0'),
-    String(date.getUTCDate()).padStart(2, '0'),
-  ].join('-')}T${[
-    String(date.getUTCHours()).padStart(2, '0'),
-    String(date.getUTCMinutes()).padStart(2, '0'),
-    String(date.getUTCSeconds()).padStart(2, '0'),
-  ].join(':')}`;
 
 // Percent-change draggable baseline handle geometry, in pixels.
 const BASELINE_HANDLE_WIDTH = 8;
@@ -97,7 +71,6 @@ export default function EchartsTimeseries({
   onFocusedSeries,
   xValueFormatter,
   xAxis,
-  resolvedTimeGrain,
   refs,
   emitCrossFilters,
   coltypeMapping,
@@ -390,65 +363,6 @@ export default function EchartsTimeseries({
     [selectedValues, xAxis.label],
   );
 
-  const getTimeAxisCrossFilterDataMask = useCallback(
-    (clickedTimestamp: number) => {
-      const filterColumn =
-        xAxis.label === DTTM_ALIAS ? formData.granularitySqla : xAxis.label;
-      const grain = resolvedTimeGrain as TimeGranularity | undefined;
-
-      if (!filterColumn || !grain) {
-        return {
-          dataMask: {
-            extraFormData: {
-              filters: [],
-            },
-            filterState: {
-              label: undefined,
-              value: null,
-              selectedValues: null,
-            },
-          },
-          isCurrentValueSelected: false,
-        };
-      }
-
-      const [start, inclusiveEnd] = createTimeRangeFromGranularity(
-        new Date(clickedTimestamp),
-        grain,
-        false,
-      );
-      const exclusiveEnd = new Date(inclusiveEnd.getTime() + 1);
-      const timeRange = `${formatDateTime(start)} : ${formatDateTime(exclusiveEnd)}`;
-      const selected: string[] = Object.values(selectedValues);
-      const isCurrentValueSelected = selected.includes(timeRange);
-      const values = isCurrentValueSelected ? [] : [timeRange];
-
-      return {
-        dataMask: {
-          extraFormData: {
-            filters:
-              values.length === 0
-                ? []
-                : [
-                    {
-                      col: filterColumn,
-                      op: 'TEMPORAL_RANGE' as const,
-                      val: timeRange,
-                    },
-                  ],
-          },
-          filterState: {
-            label: values.length ? values : undefined,
-            value: values.length ? values : null,
-            selectedValues: values.length ? values : null,
-          },
-        },
-        isCurrentValueSelected,
-      };
-    },
-    [formData.granularitySqla, resolvedTimeGrain, selectedValues, xAxis.label],
-  );
-
   const handleChange = useCallback(
     (value: string) => {
       if (!emitCrossFilters) {
@@ -470,26 +384,15 @@ export default function EchartsTimeseries({
     [emitCrossFilters, setDataMask, getXAxisCrossFilterDataMask],
   );
 
-  const handleTimeAxisChange = useCallback(
-    (clickedTimestamp: number) => {
-      if (!emitCrossFilters) {
-        return;
-      }
-      setDataMask(getTimeAxisCrossFilterDataMask(clickedTimestamp).dataMask);
-    },
-    [emitCrossFilters, setDataMask, getTimeAxisCrossFilterDataMask],
-  );
-
   // Determine if X-axis can be used for cross-filtering (categorical axis without dimensions)
   const canCrossFilterByXAxis =
-    !hasDimensions &&
-    (xAxis.type === AxisType.Category || xAxis.type === AxisType.Time);
-  const xAxisValueIndex =
+    !hasDimensions && xAxis.type === AxisType.Category;
+  const categoryAxisValueIndex =
     formData.orientation === OrientationType.Horizontal ? 1 : 0;
-  const getXAxisValue = useCallback(
+  const getCategoryAxisValue = useCallback(
     (data: unknown, name: unknown) => {
       if (Array.isArray(data)) {
-        const categoryAxisValue = data[xAxisValueIndex];
+        const categoryAxisValue = data[categoryAxisValueIndex];
         if (
           typeof categoryAxisValue === 'string' ||
           typeof categoryAxisValue === 'number'
@@ -502,7 +405,7 @@ export default function EchartsTimeseries({
       }
       return undefined;
     },
-    [xAxisValueIndex],
+    [categoryAxisValueIndex],
   );
 
   const eventHandlers: EventHandlers = {
@@ -520,28 +423,15 @@ export default function EchartsTimeseries({
           // Cross-filter by dimension (original behavior)
           const { seriesName: name } = props;
           handleChange(name);
-        } else if (
-          canCrossFilterByXAxis &&
-          xAxis.type === AxisType.Category &&
-          props.componentType === 'series'
-        ) {
+        } else if (canCrossFilterByXAxis && props.componentType === 'series') {
           // Cross-filter by X-axis value when no dimensions (issue #25334)
-          const categoryAxisValue = getXAxisValue(props.data, props.name);
+          const categoryAxisValue = getCategoryAxisValue(
+            props.data,
+            props.name,
+          );
           if (categoryAxisValue !== undefined) {
             handleXAxisChange(categoryAxisValue);
           }
-        } else if (
-          canCrossFilterByXAxis &&
-          xAxis.type === AxisType.Time &&
-          props.componentType === 'series'
-        ) {
-          const timeAxisValue = getXAxisValue(props.data, props.name);
-          if (timeAxisValue !== undefined) {
-            const timestamp = getTimestampFromTimeAxisValue(timeAxisValue);
-            if (timestamp !== undefined) {
-              handleTimeAxisChange(timestamp);
-            }
-          }
         }
       }, TIMER_DURATION);
     },
@@ -576,20 +466,17 @@ export default function EchartsTimeseries({
         ];
         const groupBy = ensureIsArray(formData.groupby);
         if (data && xAxis.type === AxisType.Time) {
-          const timeAxisValue = getXAxisValue(data, eventParams.name);
-          if (timeAxisValue !== undefined) {
-            drillToDetailFilters.push({
-              col:
-                // if the xAxis is '__timestamp', granularity_sqla will be the column of filter
-                xAxis.label === DTTM_ALIAS
-                  ? formData.granularitySqla
-                  : xAxis.label,
-              grain: resolvedTimeGrain,
-              op: '==',
-              val: timeAxisValue,
-              formattedVal: xValueFormatter(timeAxisValue),
-            });
-          }
+          drillToDetailFilters.push({
+            col:
+              // if the xAxis is '__timestamp', granularity_sqla will be the column of filter
+              xAxis.label === DTTM_ALIAS
+                ? formData.granularitySqla
+                : xAxis.label,
+            grain: formData.timeGrainSqla,
+            op: '==',
+            val: data[0],
+            formattedVal: xValueFormatter(data[0]),
+          });
         }
         [
           ...(xAxis.type === AxisType.Category && data ? [xAxis.label] : []),
@@ -630,7 +517,9 @@ export default function EchartsTimeseries({
           xAxis.label === DTTM_ALIAS ? formData.granularitySqla : xAxis.label;
         if (data && xAxis.type === AxisType.Time && xAxisCol) {
           // For horizontal orientation the [x, value] pair is swapped
-          const xValue = Array.isArray(data) ? data[xAxisValueIndex] : data;
+          const xValue = Array.isArray(data)
+            ? data[categoryAxisValueIndex]
+            : data;
           const xAxisFilter = getTemporalXAxisDrillByFilter(
             xAxisCol,
             xValue,
@@ -641,7 +530,10 @@ export default function EchartsTimeseries({
             xAxisFilters.push(xAxisFilter);
           }
         } else if (xAxis.type === AxisType.Category && xAxisCol) {
-          const categoryAxisValue = getXAxisValue(data, eventParams.name);
+          const categoryAxisValue = getCategoryAxisValue(
+            data,
+            eventParams.name,
+          );
           if (categoryAxisValue !== undefined) {
             // A category axis can still sit on a temporal column when the
             // axis is forced categorical; filter by time bucket in that case
@@ -672,25 +564,15 @@ export default function EchartsTimeseries({
           crossFilter = getCrossFilterDataMask(seriesName);
         } else if (
           canCrossFilterByXAxis &&
-          xAxis.type === AxisType.Category &&
           eventParams.componentType === 'series'
         ) {
-          const categoryAxisValue = getXAxisValue(data, eventParams.name);
+          const categoryAxisValue = getCategoryAxisValue(
+            data,
+            eventParams.name,
+          );
           if (categoryAxisValue !== undefined) {
             crossFilter = getXAxisCrossFilterDataMask(categoryAxisValue);
           }
-        } else if (
-          canCrossFilterByXAxis &&
-          xAxis.type === AxisType.Time &&
-          eventParams.componentType === 'series'
-        ) {
-          const timeAxisValue = getXAxisValue(data, eventParams.name);
-          if (timeAxisValue !== undefined) {
-            const timestamp = getTimestampFromTimeAxisValue(timeAxisValue);
-            if (timestamp !== undefined) {
-              crossFilter = getTimeAxisCrossFilterDataMask(timestamp);
-            }
-          }
         }
 
         onContextMenu(pointerEvent.clientX, pointerEvent.clientY, {
@@ -711,39 +593,26 @@ export default function EchartsTimeseries({
       const { value } = event;
       if (
         canCrossFilterByXAxis &&
-        event.targetType === 'axisLabel' &&
         (typeof value === 'string' || typeof value === 'number')
       ) {
-        if (xAxis.type === AxisType.Time) {
-          const timestamp = getTimestampFromTimeAxisValue(value);
-          if (timestamp !== undefined) {
-            handleTimeAxisChange(timestamp);
-          }
-        } else {
-          handleXAxisChange(value);
-        }
+        handleXAxisChange(value);
       }
     },
-    [
-      canCrossFilterByXAxis,
-      handleTimeAxisChange,
-      handleXAxisChange,
-      xAxis.type,
-    ],
+    [canCrossFilterByXAxis, handleXAxisChange],
   );
 
-  const renderedXAxis =
+  const categoryAxis =
     formData.orientation === OrientationType.Horizontal ? 'yAxis' : 'xAxis';
 
   const queryEventHandlers = useMemo(
     () => [
       {
         name: 'click',
-        query: renderedXAxis,
+        query: `${categoryAxis}.category`,
         handler: handleXAxisLabelClick,
       },
     ],
-    [renderedXAxis, handleXAxisLabelClick],
+    [categoryAxis, handleXAxisLabelClick],
   );
 
   const zrEventHandlers: EventHandlers = {

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/constants.ts

@@ -73,7 +73,6 @@ export const DEFAULT_FORM_DATA: EchartsTimeseriesFormData = {
   seriesType: EchartsTimeseriesSeriesType.Line,
   stack: false,
   tooltipTimeFormat: 'smart_date',
-  tooltipTruncation: 'end',
   xAxisTimeFormat: 'smart_date',
   xAxisNumberFormat: 'SMART_NUMBER',
   truncateXAxis: true,

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/transformProps.ts

@@ -30,7 +30,6 @@ import {
   DTTM_ALIAS,
   ensureIsArray,
   tooltipHtml,
-  truncateLabel,
   getCustomFormatter,
   getMetricLabel,
   getNumberFormatter,
@@ -95,7 +94,6 @@ import {
   getAnnotationData,
 } from '../utils/annotation';
 import {
-  collapseForecastKeys,
   extractForecastSeriesContext,
   extractForecastSeriesContexts,
   extractForecastValuesFromTooltipParams,
@@ -305,7 +303,6 @@ export default function transformProps(
     tooltipSortByMetric,
     showTooltipTotal,
     showTooltipPercentage,
-    tooltipTruncation,
     truncateXAxis,
     truncateYAxis,
     xAxis: xAxisOrig,
@@ -1248,7 +1245,7 @@ export default function transformProps(
     name: xAxisTitle,
     nameGap: convertInteger(xAxisTitleMargin),
     nameLocation: 'middle',
-    ...((xAxisType === AxisType.Category || xAxisType === AxisType.Time) &&
+    ...(xAxisType === AxisType.Category &&
       groupBy.length === 0 && {
         triggerEvent: true,
       }),
@@ -1256,12 +1253,10 @@ export default function transformProps(
       // When rotation is applied on time axes, hideOverlap can
       // aggressively hide the last label. Rotated labels already
       // have less overlap, so disabling hideOverlap is safe.
-      // At 0° rotation, also disable hideOverlap when showMaxLabel
-      // is active so the forced boundary label is never suppressed
-      // by ECharts' overlap detection (#39899).
-      hideOverlap: showMaxLabel
-        ? false
-        : !(xAxisType === AxisType.Time && xAxisLabelRotation !== 0),
+      // At 0° rotation, keep hideOverlap to prevent long labels
+      // from overlapping each other, with showMaxLabel to ensure
+      // the last data point label stays visible (#37181).
+      hideOverlap: !(xAxisType === AxisType.Time && xAxisLabelRotation !== 0),
       formatter: deduplicatedFormatter,
       rotate: xAxisLabelRotation,
       interval: xAxisLabelInterval,
@@ -1395,13 +1390,11 @@ export default function transformProps(
         const forecastValue: CallbackDataParams[] = richTooltip
           ? params
           : [params];
-        const sortedKeys = collapseForecastKeys(
-          extractTooltipKeys(
-            forecastValue,
-            yIndex,
-            richTooltip,
-            tooltipSortByMetric,
-          ),
+        const sortedKeys = extractTooltipKeys(
+          forecastValue,
+          yIndex,
+          richTooltip,
+          tooltipSortByMetric,
         );
         const filteredForecastValue = forecastValue.filter(
           (item: CallbackDataParams) =>
@@ -1456,7 +1449,6 @@ export default function transformProps(
               seriesName: key,
               formatter,
               marker,
-              truncation: tooltipTruncation,
             });
 
             const annotationRow = annotationLayers.some(
@@ -1490,12 +1482,7 @@ export default function transformProps(
           }
           rows.push(totalRow);
         }
-        return tooltipHtml(
-          rows,
-          truncateLabel(tooltipFormatter(xValue), tooltipTruncation),
-          focusedRow,
-          tooltipTruncation,
-        );
+        return tooltipHtml(rows, tooltipFormatter(xValue), focusedRow);
       },
     },
     legend: {
@@ -1600,7 +1587,6 @@ export default function transformProps(
       label: xAxisLabel,
       type: xAxisType,
     },
-    resolvedTimeGrain,
     refs,
     coltypeMapping: dataTypes,
     onLegendScroll,

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/transformers.ts

@@ -467,14 +467,6 @@ export function transformSeries(
           return formatter(numericValue);
         }
         if (!onlyTotal) {
-          // A stacked segment with no height begins and ends at the same
-          // coordinate as the top of the segment beneath it, so its label is
-          // drawn over that segment's label. Zero and null have no height, so
-          // they carry no label. The rich tooltip omits zero observations from
-          // a stacked series for the same reason.
-          if (stack && !numericValue) {
-            return '';
-          }
           if (
             numericValue >=
             (thresholdValues[dataIndex] || Number.MIN_SAFE_INTEGER)

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/types.ts

@@ -25,7 +25,6 @@ import {
   QueryFormMetric,
   TimeFormatter,
   TimeGranularity,
-  TooltipTruncationMode,
 } from '@superset-ui/core';
 import {
   BaseChartProps,
@@ -83,7 +82,6 @@ export type EchartsTimeseriesFormData = QueryFormData & {
   tooltipTimeFormat?: string;
   showTooltipTotal?: boolean;
   showTooltipPercentage?: boolean;
-  tooltipTruncation?: TooltipTruncationMode;
   truncateXAxis: boolean;
   truncateYAxis: boolean;
   yAxisFormat?: string;
@@ -122,6 +120,5 @@ export type TimeseriesChartTransformedProps =
         label: string;
         type: AxisType;
       };
-      resolvedTimeGrain?: TimeGranularity;
       onFocusedSeries: (series: string | null) => void;
     };

superset-frontend/plugins/plugin-chart-echarts/src/components/Echart.test.tsx

@@ -16,13 +16,9 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import type { EChartsCoreOption } from 'echarts/core';
 import { render, waitFor } from '../../../../spec/helpers/testing-library';
-import Echart, {
-  ECHARTS_HOST_CLASS,
-  ECHARTS_RENDER_FINISHED_CLASS,
-  isReportScreenshotMode,
-} from './Echart';
+import type { EChartsCoreOption } from 'echarts/core';
+import Echart, { isReportScreenshotMode } from './Echart';
 import type { EchartsProps } from '../types';
 
 type Handler = (params: unknown) => void;
@@ -276,31 +272,3 @@ test('keeps animation enabled when not in report screenshot mode', async () => {
   const lastOptions = mockChart.setOption.mock.calls.at(-1)?.[0];
   expect(lastOptions.animation).not.toBe(false);
 });
-
-test('tags the ECharts canvas host with the readiness-gate class', async () => {
-  const { container } = render(renderEchart(), {
-    initialState,
-    useRedux: true,
-  });
-  await waitFor(() => expect(mockChart.setOption).toHaveBeenCalled());
-  expect(container.querySelector(`.${ECHARTS_HOST_CLASS}`)).not.toBeNull();
-});
-
-test('marks the host painted only on the ECharts `finished` event', async () => {
-  const { container } = render(renderEchart(), {
-    initialState,
-    useRedux: true,
-  });
-  await waitFor(() => expect(mockChart.setOption).toHaveBeenCalled());
-
-  const host = container.querySelector(`.${ECHARTS_HOST_CLASS}`) as HTMLElement;
-  expect(host).not.toBeNull();
-
-  // `setOption` ran during mount, which clears the marker; `finished` has not
-  // fired yet, so the host must NOT be flagged as painted.
-  expect(host).not.toHaveClass(ECHARTS_RENDER_FINISHED_CLASS);
-
-  // Simulate ECharts completing its draw -> the host is flagged painted.
-  trigger('finished');
-  expect(host).toHaveClass(ECHARTS_RENDER_FINISHED_CLASS);
-});

superset-frontend/plugins/plugin-chart-echarts/src/components/Echart.tsx

@@ -138,15 +138,6 @@ export function isReportScreenshotMode(): boolean {
   }
 }
 
-// Report-screenshot readiness contract (see superset/utils/screenshot_utils.py).
-// `echarts-host` marks the canvas host element; `echarts-render-finished` is
-// toggled OFF before each setOption and ON in the ECharts `finished` event --
-// the only signal that the canvas is fully painted (chartStatus/onRenderSuccess
-// both fire pre-paint). The readiness gate treats a host that lacks
-// `echarts-render-finished` as not-yet-painted so it never captures a blank chart.
-export const ECHARTS_HOST_CLASS = 'echarts-host';
-export const ECHARTS_RENDER_FINISHED_CLASS = 'echarts-render-finished';
-
 function Echart(
   {
     width,
@@ -210,11 +201,6 @@ function Echart(
           width,
           height,
         });
-        // Paint marker for the report-screenshot readiness gate. `finished`
-        // is the only event that guarantees the canvas is fully drawn.
-        chartRef.current.on('finished', () => {
-          divRef.current?.classList.add(ECHARTS_RENDER_FINISHED_CLASS);
-        });
       }
       // did mount
       handleSizeChange({ width, height });
@@ -335,9 +321,6 @@ function Echart(
             }
           )?.dataZoom
         : undefined;
-      // Clear the paint marker before (re)drawing; the `finished` handler
-      // re-adds it once the new frame is fully rendered.
-      divRef.current?.classList.remove(ECHARTS_RENDER_FINISHED_CLASS);
       chartRef.current?.setOption(themedEchartOptions, {
         notMerge,
         replaceMerge: notMerge ? undefined : ['series'],
@@ -429,14 +412,7 @@ function Echart(
     handleSizeChange({ width, height });
   }, [width, height, handleSizeChange]);
 
-  return (
-    <Styles
-      ref={divRef}
-      className={ECHARTS_HOST_CLASS}
-      height={height}
-      width={width}
-    />
-  );
+  return <Styles ref={divRef} height={height} width={width} />;
 }
 
 export default forwardRef(Echart);

superset-frontend/plugins/plugin-chart-echarts/src/controls.tsx

@@ -315,27 +315,6 @@ const tooltipPercentageControl: ControlSetItem = {
   },
 };
 
-const tooltipTruncationControl: ControlSetItem = {
-  name: 'tooltipTruncation',
-  config: {
-    type: 'SelectControl',
-    freeForm: false,
-    label: t('Truncate labels'),
-    renderTrigger: true,
-    default: 'end',
-    clearable: false,
-    choices: [
-      ['off', t('Off')],
-      ['end', t('End')],
-      ['start', t('Start')],
-      ['middle', t('Middle')],
-    ],
-    description: t(
-      'Where to place the ellipsis when a tooltip label is too long. Choose Off to always show the full label, or Start when labels share a common prefix.',
-    ),
-  },
-};
-
 export const richTooltipSection: ControlSetRow[] = [
   [<ControlSubSectionHeader>{t('Tooltip')}</ControlSubSectionHeader>],
   [richTooltipControl],
@@ -343,7 +322,6 @@ export const richTooltipSection: ControlSetRow[] = [
   [tooltipPercentageControl],
   [tooltipSortByMetricControl],
   [tooltipTimeFormatControl],
-  [tooltipTruncationControl],
 ];
 
 const sortSeriesType: ControlSetItem = {

superset-frontend/plugins/plugin-chart-echarts/src/utils/eChartOptionsSchema.ts

@@ -28,7 +28,6 @@
  */
 
 import { z } from 'zod';
-import { sanitizeHtml } from '@superset-ui/core';
 
 // =============================================================================
 // Common Schemas
@@ -58,33 +57,6 @@ const fontStyleSchema = z.enum(['normal', 'italic', 'oblique']);
 /** Symbol type */
 const symbolTypeSchema = z.string();
 
-/**
- * With the ECharts default renderMode 'html', a string tooltip formatter is
- * assigned to the tooltip DOM element via innerHTML. ECharts formatter
- * strings commonly rely on inline markup (e.g. '{b}<br/>{c}') for layout, so
- * rejecting every '<' would break that supported usage; instead the value is
- * run through the same allowlist sanitizer used for other tooltip HTML,
- * which keeps presentational tags and strips anything else.
- */
-const sanitizedFormatterSchema = z
-  .string()
-  .transform(value => sanitizeHtml(value));
-
-/**
- * ECharts navigates to title.link/sublink on click, so restrict them to
- * http(s) and same-origin relative paths.
- */
-const safeLinkSchema = z
-  .string()
-  .refine(
-    value =>
-      /^https?:\/\//i.test(value) ||
-      (value.startsWith('/') && !value.startsWith('//')),
-    {
-      message: 'Only http(s) or same-origin relative URLs are allowed',
-    },
-  );
-
 // =============================================================================
 // Text Style Schema
 // =============================================================================
@@ -196,11 +168,11 @@ export const titleSchema = z.object({
   id: z.string().optional(),
   show: z.boolean().optional(),
   text: z.string().optional(),
-  link: safeLinkSchema.optional(),
+  link: z.string().optional(),
   target: z.enum(['self', 'blank']).optional(),
   textStyle: textStyleSchema.optional(),
   subtext: z.string().optional(),
-  sublink: safeLinkSchema.optional(),
+  sublink: z.string().optional(),
   subtarget: z.enum(['self', 'blank']).optional(),
   subtextStyle: textStyleSchema.optional(),
   textAlign: z.enum(['left', 'center', 'right']).optional(),
@@ -414,9 +386,7 @@ export const tooltipSchema = z.object({
       z.array(z.union([z.number(), z.string()])),
     ])
     .optional(),
-  // Only string formatters: a string tooltip formatter is rendered via
-  // innerHTML (default renderMode 'html'), so it is sanitized above.
-  formatter: sanitizedFormatterSchema.optional(),
+  formatter: z.string().optional(), // Only string formatters
   padding: z.union([z.number(), z.array(z.number())]).optional(),
   backgroundColor: colorSchema.optional(),
   borderColor: colorSchema.optional(),
@@ -427,9 +397,7 @@ export const tooltipSchema = z.object({
   shadowOffsetX: z.number().optional(),
   shadowOffsetY: z.number().optional(),
   textStyle: textStyleSchema.optional(),
-  // `extraCssText` is intentionally not accepted; unknown keys are
-  // stripped by the schema, so configs that still carry it keep working
-  // minus the raw CSS.
+  extraCssText: z.string().optional(),
   order: z
     .enum(['seriesAsc', 'seriesDesc', 'valueAsc', 'valueDesc'])
     .optional(),
@@ -607,9 +575,6 @@ export const seriesSchema = z.object({
   polarIndex: z.number().optional(),
   geoIndex: z.number().optional(),
   calendarIndex: z.number().optional(),
-  // Per-series `tooltip` is intentionally not admitted; the schema
-  // strips unknown keys. If per-series tooltips are ever admitted, reuse
-  // tooltipSchema so the formatter sanitization applies.
   label: labelSchema.optional(),
   labelLine: z
     .object({

superset-frontend/plugins/plugin-chart-echarts/src/utils/forecast.ts

@@ -16,13 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import {
-  DataRecord,
-  DTTM_ALIAS,
-  truncateLabel,
-  TooltipTruncationMode,
-  ValueFormatter,
-} from '@superset-ui/core';
+import { DataRecord, DTTM_ALIAS, ValueFormatter } from '@superset-ui/core';
 import type { OptionName, SeriesOption } from 'echarts/types/src/util/types';
 import type { TooltipMarker } from 'echarts/types/src/util/format';
 import {
@@ -60,21 +54,6 @@ export const extractForecastSeriesContexts = (
     {} as { [key: string]: ForecastSeriesEnum[] },
   );
 
-/**
- * Collapses raw ECharts series ids onto the names used to key tooltip rows.
- *
- * Tooltip values are grouped by forecast-stripped name, so any ordering derived
- * from the raw series ids has to be expressed in the same terms before it can be
- * matched against them. This matters beyond real Prophet output: a metric simply
- * labelled `ci__yhat_lower` collapses to `ci` exactly like a forecast bound
- * does, and a chart whose every series carries such a suffix has no id that
- * survives the comparison untouched.
- */
-export const collapseForecastKeys = (seriesIds: string[]): string[] =>
-  Array.from(
-    new Set(seriesIds.map(id => extractForecastSeriesContext(id).name)),
-  );
-
 export const extractForecastValuesFromTooltipParams = (
   params: any[],
   isHorizontal = false,
@@ -112,16 +91,12 @@ export const formatForecastTooltipSeries = ({
   forecastUpper,
   marker,
   formatter,
-  truncation = 'end',
 }: ForecastValue & {
   seriesName: string;
   marker: TooltipMarker;
   formatter: ValueFormatter;
-  truncation?: TooltipTruncationMode;
 }): string[] => {
-  // Truncate before sanitizing and before the marker is prepended: slicing a
-  // string that already contains markup would cut into the marker's tag.
-  const name = `${marker}${sanitizeHtml(truncateLabel(seriesName, truncation))}`;
+  const name = `${marker}${sanitizeHtml(seriesName)}`;
   let value = typeof observation === 'number' ? formatter(observation) : '';
   // Use finite-number checks rather than truthiness so that legitimate
   // zero values (e.g. a forecast that crosses zero, or a confidence bound of