fix(dashboard): drop allow-same-origin from iframe sandbox; add CSP regression test

Combining `allow-scripts` with `allow-same-origin` lets an allowlisted-then-compromised third-party origin script its way out of its own sandbox restrictions. Also adds a regression test that exercises the runtime CSP merge through a real Flask response (not just a bare `Response()` object), mirroring the after_request registration order used in SupersetAppInitializer. Addresses review feedback from @sha174n on #41468. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
feat(dashboard): per-component behavior policy + extension docs
2026-08-25 01:21:18 +00:00 · 2026-08-19 21:26:50 -07:00 · 2026-08-19 21:13:23 -07:00 · 2026-08-19 21:13:23 -07:00 · 2026-08-19 21:11:21 -07:00 · 2026-08-19 21:11:21 -07:00
227 changed files with 11960 additions and 1631 deletions
@@ -29,7 +29,7 @@
 "dependencies:python":
 - changed-files:
  - any-glob-to-any-file:
-    - 'superset/requirements/**'
+    - 'requirements/**'
    - 'superset/translations/requirements.txt'
    - 'RELEASING/requirements.txt'

@@ -48,7 +48,7 @@ jobs:
          python-version: "3.11"

      - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
        with:
          python-version: "3.11"
          enable-cache: true
@@ -0,0 +1,262 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# [SIP] Proposal for a dashboard component Extensions contribution point
+
+> **Companion SIP:** Pairs with [`SIP.md`](SIP.md) (first-class iframe component +
+> runtime CSP allowlist). That SIP is the **reference implementation** that proves
+> this contribution point: the iframe's UI becomes an extension-contributed
+> dashboard component, while its security-sensitive CSP backend stays in core.
+>
+> **Status:** Draft — POC tracked in `feat/csp-runtime-allowlist-iframe`.
+
+## Motivation
+
+Adding a new dashboard layout component to Superset today is a **core-only,
+high-friction** operation. The iframe component in the companion SIP had to touch
+~12 files: a type constant, the `componentLookup` map, the builder palette, and
+**seven hardcoded behavior maps** keyed by component-type string
+(`isValidChild`, `componentIsResizable`, `newComponentFactory`,
+`shouldWrapChildInRow`, `getDetailedComponentWidth`, `isDashboardEmpty`, plus the
+prop bundle injected by `DashboardComponent.tsx`). Component types are a **closed
+enum** baked into core.
+
+There is a legacy escape hatch — the `DashboardComponentsRegistry` /
+`DYNAMIC_TYPE` path (`src/visualizations/dashboardComponents/`) — but it is an
+**antique that should be deprecated**:
+
+- It is disconnected from the modern VS Code-style Extensions framework
+  (`@apache-superset/core`, `ENABLE_EXTENSIONS`), which already has contribution
+  points for `commands`, `menus`, `views`, `editors`, and `chat`.
+- Components registered through it are **second-class**: `DynamicComponent`
+  renders them in a generic wrapper that only passes `dashboardData`. They do not
+  receive the first-class layout lifecycle (edit mode, meta editing, resize, DnD)
+  and cannot declare their own layout behavior.
+
+We want a **single, modern way** to contribute a first-class dashboard layout
+component — via the Extensions framework — and to deprecate the legacy registry.
+The iframe component is the ideal pilot because it is self-contained.
+
+## Proposed Change
+
+### 1. A `dashboardComponents` contribution point
+
+Add `dashboardComponents` to the Extensions `Contributions` interface
+(`packages/superset-core/src/contributions/index.ts`), alongside `views`,
+`commands`, etc., with a public registration API mirroring the existing ones
+(`registerDashboardComponent` returning a `Disposable`), exposed on
+`window.superset.dashboardComponents` and wired into `ExtensionsLoader`.
+
+### 2. The Dashboard Component Contract (the heart of this SIP)
+
+The contract has two halves. Getting this right is the real work — it becomes a
+**public API Superset must support indefinitely**.
+
+**(a) Declarative behavior metadata** — replaces the seven hardcoded util maps:
+
+```ts
+interface DashboardComponentContribution {
+  id: string;                 // unique type key, namespaced, e.g. "my-org.iframe"
+  name: string;               // palette label
+  description?: string;
+  icon: string;               // contributed icon id or known icon name
+  resizable?: boolean;        // -> componentIsResizable
+  defaultMeta?: {             // -> newComponentFactory
+    width?: number;
+    height?: number;
+    [key: string]: unknown;
+  };
+  nesting?: {                 // -> isValidChild / shouldWrapChildInRow
+    validParents?: string[];  // e.g. [GRID, ROW, COLUMN, TAB]
+    wrapInRow?: boolean;
+    minWidth?: number;        // -> getDetailedComponentWidth
+  };
+  isUserContent?: boolean;    // -> isDashboardEmpty
+  loadComponent: () => Promise<{ default: ComponentType<DashboardComponentProps> }>;
+}
+```
+
+**(b) Runtime props contract** — a small, stable surface. Crucially, **the host
+owns the chrome** (the `Draggable` + `ResizableContainer` + `HoverMenu`/delete
+wrapper that every current `componentLookup` component re-implements today). The
+extension component renders only its *content* and, optionally, an *editor*:
+
+```ts
+interface DashboardComponentProps {
+  id: string;
+  meta: Record<string, unknown>;
+  editMode: boolean;
+  updateMeta: (patch: Record<string, unknown>) => void; // wraps updateComponents
+  // resize/drag/delete handled by the host wrapper, NOT the component
+}
+```
+
+This is a strict improvement over the status quo: the iframe component in the
+companion PR hand-rolls the Draggable/Resizable/HoverMenu wrapper; under this
+contract that boilerplate moves into the host once, and contributed components
+shrink to "render content + edit meta."
+
+### 3. Registry-driven core
+
+Refactor `componentLookup` and the seven behavior maps to consult a registry,
+with the **built-in leaf components seeded into it** at startup. Structural
+container components (Chart, Tabs, Row, Column, Header) *are* the layout engine
+and stay bespoke; the contribution point targets **leaf/content components**
+(today: Markdown, Divider, Iframe; tomorrow: anything). `DashboardComponent.tsx`
+resolves contributed types through the registry and renders them inside the
+shared host chrome.
+
+### 4. Deprecate `DashboardComponentsRegistry` / `DYNAMIC_TYPE`
+
+Mark the legacy registry and `DYNAMIC_TYPE` deprecated. Provide a shim so existing
+dynamic components keep working, with a migration note pointing at the new
+contribution point. Removal happens in a later major per Superset's deprecation
+policy.
+
+### 5. Graceful fallback for unknown types
+
+A saved dashboard layout stores component **type strings** in its position JSON.
+If a dashboard references a type whose extension is disabled/uninstalled, the host
+must render a non-destructive placeholder ("This component requires the *X*
+extension") and **preserve the meta on save** so re-enabling the extension
+restores it. The layout engine already tolerates unknown types defensively
+(`componentLookup[type]` → null; `isValidChild` → false); this SIP makes that an
+intentional, user-visible contract rather than silent breakage.
+
+### 6. Backend: APIs yes, security policy no
+
+The Extensions framework **already** lets a component contribute a backend REST
+API: the `@api` decorator (`superset-core/.../rest_api/decorators.py`) detects
+extension context and registers the route via `appbuilder.add_api()` at entrypoint
+import, serving it under `/extensions/{publisher}/{name}/...` and auto-creating
+the endpoint's FAB permission. **No new work is required for an extension to ship
+an API.**
+
+What an extension **cannot** do today, and what this SIP explicitly leaves to
+core:
+
+- **Role policy for a permission.** Endpoint permissions are auto-created, but
+  whether a permission is *Admin-only* (e.g. via
+  `SupersetSecurityManager.ADMIN_ONLY_VIEW_MENUS`) is decided in core at
+  `sync_role_definitions` time. The manifest's `permissions: list[str]` field is
+  currently **dormant** (never read), and the `ContributionProcessorRegistry` that
+  would process it is scaffolding that is not wired into the load pipeline.
+- **Security-sensitive request hooks** (e.g. rewriting CSP/Talisman headers).
+
+This is exactly why the companion CSP feature keeps its backend in core: the
+component *UI* is extension-shaped, but punching holes in the CSP and gating it
+admin-only are core security responsibilities.
+
+A **future, optional** extension of this SIP could finish wiring
+`ContributionProcessorRegistry` + a manifest permission-policy schema so
+extensions can declare role policy — but that is itself a security-review-worthy
+change and is out of scope here.
+
+## New or Changed Public Interfaces
+
+- **New contribution point** `dashboardComponents` on the `Contributions`
+  interface; new `registerDashboardComponent(...) -> Disposable` API; new
+  `window.superset.dashboardComponents` namespace.
+- **New public types** `DashboardComponentContribution` and
+  `DashboardComponentProps` (the contract) — these become long-term public API.
+- **Changed (internal → registry-driven)** `componentLookup` and the seven
+  behavior util maps; `DashboardComponent.tsx` resolution path; the host gains a
+  shared component-chrome wrapper.
+- **Deprecated** `DashboardComponentsRegistry`, `DYNAMIC_TYPE`,
+  `NewDynamicComponent`, `setupDashboardComponents`.
+
+## New dependencies
+
+None. Reuses the existing Extensions framework (module federation, manifest
+schema, `@api` decorator) and the existing functional-registry utilities.
+
+## Migration Plan and Compatibility
+
+- **No DB migration.** This is a frontend/framework change plus the (already
+  supported) extension API path.
+- **Layout JSON is unchanged** — component types remain type strings. The new
+  fallback behavior makes *unknown* types degrade gracefully instead of rendering
+  nothing.
+- **Backwards compatible:** built-in components are seeded into the registry, so
+  existing dashboards render identically. Legacy `DYNAMIC_TYPE` components keep
+  working via a deprecation shim.
+- **Rollout:** the contribution point is only active under `ENABLE_EXTENSIONS`;
+  with it off, behavior is identical to today.
+
+## Rejected Alternatives
+
+- **Keep / extend `DashboardComponentsRegistry`.** It is disconnected from the
+  modern Extensions framework and produces second-class components. Deprecating it
+  in favor of one contribution model is the goal, not a side effect.
+- **Require all built-in components to become extensions.** Chart/Tabs/Row/Column
+  are the layout engine; extracting them is high-risk and low-value. The
+  contribution point *adds* leaf components; it does not mandate extraction.
+- **Let the extension component own its own DnD/resize chrome** (as
+  `componentLookup` components do today). Rejected: it bloats the contract,
+  duplicates host logic, and makes the public API fragile. The host owns chrome.
+- **One combined SIP with the CSP feature.** Rejected: the framework change and
+  the security-sensitive feature are distinct discussions with different
+  reviewers and risk profiles, even though they share a POC branch.
+- **Move the CSP permission/role policy into the extension.** Not supported today
+  (dormant manifest `permissions`, unwired contribution processor) and
+  undesirable: admin-only gating and CSP-header rewriting are core security
+  responsibilities.
+
+## Implementation Status (POC)
+
+Implemented on the POC branch (`@apache-superset/core` mirrors the `chat`
+contribution-point pattern from #41000/#41205):
+
+- [x] `DashboardComponentDefinition` + `DashboardComponentProps` contract types
+      (`packages/superset-core/src/dashboardComponents`), added to the
+      `Contributions` interface and the package's subpath exports
+- [x] `dashboardComponents` contribution point: host `DashboardComponentsProvider`
+      registry + public `registerDashboardComponent`/`getDashboardComponents` API
+      (`src/core/dashboardComponents`), exposed on `window.superset` via
+      `ExtensionsStartup` + `Namespaces`
+- [x] Shared host component-chrome wrapper `DashboardExtensionComponent`
+      (owns Draggable/Resizable/HoverMenu/Delete; reads `resizable` from the
+      definition) behind the new `EXTENSION_TYPE`
+- [x] `componentLookup` + builder palette resolve the registry; the seven
+      behavior maps carry `EXTENSION_TYPE` leaf behavior
+- [x] Unknown-type graceful fallback (placeholder + meta preserved on save)
+- [x] Deprecation notices on `DashboardComponentsRegistry` / `DYNAMIC_TYPE`
+      (legacy path still functions)
+- [x] Reference component: the built-in iframe is now delivered **through** the
+      contribution point (`src/dashboard/extensions/iframe`), registered at
+      startup exactly as a third-party extension would; its CSP backend remains
+      in core per the companion SIP
+- [x] Tests: registry lifecycle (register/get/replace/dispose), host-wrapper
+      resolution + fallback + `updateMeta`, iframe content + CSP UX
+
+- [x] Per-component behavior policy honored by the layout engine: `resizable`,
+      `minWidth`, `isUserContent`, `validParents`, and `wrapInRow` are seeded onto
+      instance `meta` at creation and read by `componentIsResizable`,
+      `getDetailedComponentWidth`, `isDashboardEmpty`, `isValidChild`, and
+      `shouldWrapChildInRow` (the pure layout utils stay registry-free; behavior
+      round-trips in the saved layout)
+- [x] Developer docs: `extension-points/dashboard-components.md` + a
+      `contribution-types.md` section + sidebar entry, with an example extension
+
+Remaining (follow-up, not POC-blocking):
+
+- [ ] Manifest `contributions.dashboardComponents` declarative validation in the
+      Python/TS manifest schema (runtime side-effect registration works today,
+      matching how `chat` does it)
+- [ ] Remove the legacy `DashboardComponentsRegistry`/`DYNAMIC_TYPE` (major)
@@ -0,0 +1,232 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# [SIP] Proposal for a first-class iframe dashboard component with a runtime CSP allowlist
+
+> **Companion SIP:** This proposal pairs with
+> [`SIP-DASHBOARD-COMPONENT-CONTRIBUTION-POINT.md`](SIP-DASHBOARD-COMPONENT-CONTRIBUTION-POINT.md),
+> which proposes the Extensions contribution point that would let this iframe
+> component (and others) be shipped as an extension. The two are deliberately
+> separate discussions: **this** SIP covers the security-sensitive feature
+> (runtime CSP override + permissions); the companion covers the framework
+> change. They share one POC branch so the end-to-end story is demonstrable.
+
+> **Status:** Draft — tracking the implementation in `feat/csp-runtime-allowlist-iframe`.
+> This document follows the SIP issue template and is kept in sync with the branch
+> as the implementation evolves. See SIP-0
+> (<https://github.com/apache/superset/issues/5602>) for the SIP process.
+
+## Motivation
+
+Superset ships a Talisman/Content-Security-Policy (CSP) configuration that, by
+design, prevents users from embedding arbitrary external content in a dashboard.
+The default policy declares `default-src 'self'` and **no** `frame-src`
+directive, so an `<iframe>` pointing at any third-party origin is blocked by the
+browser.
+
+This is correct and secure default behavior, but it creates real friction:
+
+- There is **no first-class "iframe" dashboard component**. Users historically
+  smuggled iframes through Markdown, which is both a footgun and blocked by CSP.
+- When an embed *is* legitimately needed (an internal tool, a status page, a
+  partner widget), the only way to allow it is to **edit `TALISMAN_CONFIG` and
+  restart every Superset process**. That is a deploy-time, ops-team operation —
+  far too heavyweight for "let me embed this one dashboard from our other
+  internal app."
+- There is no in-product signal telling a user *why* their embed is blank, and
+  no path to fix it.
+
+We want to (a) make embedding a real, supported component, and (b) give trusted
+Admins a controlled, audited way to widen the CSP at runtime — without
+abandoning the secure-by-default posture that operators rely on.
+
+## Proposed Change
+
+The change has five parts.
+
+### 1. A first-class `IFRAME` dashboard layout component
+
+A new grid component (`IFRAME_TYPE`) modeled on the existing Markdown/Divider
+components. In edit mode the user pastes a URL; in view mode the component
+renders a sandboxed `<iframe>`. The component is registered through the same
+surface as every other layout element (type constant, `componentLookup`, drag
+palette, nesting/resize/width/wrap util maps).
+
+The iframe is rendered with a restrictive `sandbox` attribute
+(`allow-scripts allow-same-origin allow-popups allow-forms`).
+
+### 2. Domain flagging
+
+When the runtime-allowlist feature is enabled, the component compares the
+embedded URL's **origin** against the current allowlist (fetched from the new
+API). If the origin is not yet allowed, it shows an inline warning explaining
+that the domain is blocked by the CSP.
+
+### 3. "Enable domain in CSP" button
+
+If the current user holds the new permission (Admins by default), the warning
+includes an **Enable domain in CSP** button. Clicking it `POST`s the origin to
+the allowlist API and re-checks. Users without the permission instead see "ask
+an administrator."
+
+### 4. Permission gating
+
+Mutating the allowlist requires `can write on CSPAllowlist`. The `CSPAllowlist`
+view-menu is registered in `SupersetSecurityManager.ADMIN_ONLY_VIEW_MENUS`, so
+the capability is reserved for Admins (or a custom role explicitly granted it),
+consistent with how other trusted, security-sensitive operations are scoped.
+
+### 5. Runtime CSP override ("punched holes")
+
+A new `csp_allowlist` metadata table stores allowlist entries. An `after_request`
+hook — registered **before** flask-talisman so that, because Flask runs
+`after_request` callbacks in reverse registration order, it runs **after**
+Talisman has set the header — merges the operator-curated entries into the
+response CSP header. Entries are cached in-process with a short TTL to avoid a DB
+hit per response; a write through the API invalidates the cache in the handling
+worker, and other workers converge when their cached copy expires.
+
+The entire runtime-override path is inert unless the `CSP_RUNTIME_ALLOWLIST`
+feature flag is enabled, so the static, deploy-time policy remains the default
+and operators opt in explicitly.
+
+```
+Browser ──> Flask request
+                 │
+         Talisman after_request  (sets "Content-Security-Policy: default-src 'self'; …")
+                 │
+   merge_runtime_csp_allowlist   (if flag on: appends allowlist origins to frame-src, …)
+                 │
+            Response ──> Browser  ("…; frame-src 'self' https://embed.example")
+```
+
+#### Design decisions (resolved)
+
+- **Scope: global.** Allowlist entries apply server-wide. CSP is a single
+  per-response header; a global allowlist keeps the merge context-free and
+  avoids per-dashboard request plumbing. (Per-dashboard scoping is a possible
+  future extension.)
+- **Operator control: feature-flagged kill-switch.** The runtime override only
+  functions when `CSP_RUNTIME_ALLOWLIST` is on (default **off**). Operators who
+  want a purely static policy simply leave it off and the table is never
+  consulted.
+
+## New or Changed Public Interfaces
+
+### REST API
+
+- `GET /api/v1/csp_allowlist/` — list entries
+- `GET /api/v1/csp_allowlist/<id>` — get one
+- `POST /api/v1/csp_allowlist/` — create (validates origin + directive)
+- `PUT /api/v1/csp_allowlist/<id>` — update
+- `DELETE /api/v1/csp_allowlist/<id>` — delete
+- `DELETE /api/v1/csp_allowlist/?q=!(...)` — bulk delete
+
+All write methods require `can write on CSPAllowlist` (Admin-only by default).
+Origins are validated server-side: bare `scheme://host[:port]` only — no
+wildcards, paths, query strings, fragments, or credentials. Only a fixed set of
+directives may be widened (`frame-src`, `child-src`, `img-src`, `connect-src`,
+`media-src`, `font-src`); notably **not** `script-src`.
+
+### Model
+
+- `CSPAllowlistEntry` (`superset/models/csp.py`, table `csp_allowlist`):
+  `id`, `uuid`, `domain`, `directive` (default `frame-src`), `description`,
+  audit columns. Unique on `(domain, directive)`.
+
+### Feature flag
+
+- `CSP_RUNTIME_ALLOWLIST` (default `False`) — gates the entire runtime-override
+  path, backend and frontend.
+
+### Config
+
+- `CSP_RUNTIME_ALLOWLIST_CACHE_TTL` (default `30` seconds) — in-process cache TTL
+  for the allowlist; also settable via env var.
+
+### Frontend
+
+- New `IFRAME` dashboard layout component and its registration across the
+  dashboard util maps.
+- New `FeatureFlag.CspRuntimeAllowlist` enum member.
+
+### Security model
+
+- New `CSPAllowlist` view-menu added to `ADMIN_ONLY_VIEW_MENUS`.
+
+## New dependencies
+
+None. The implementation uses existing libraries (flask-talisman,
+Flask-AppBuilder, marshmallow, SQLAlchemy on the backend; existing
+`@superset-ui/core` components on the frontend).
+
+## Migration Plan and Compatibility
+
+- One Alembic migration adds the `csp_allowlist` table
+  (`4a50792bd265`, down-revision `3a8e6f2c1b95`). The table is empty on creation.
+- Fully backward compatible: with the feature flag off (the default), behavior is
+  identical to today — the static CSP is authoritative and the new table is never
+  read. No existing dashboards, URLs, or policies change.
+- Rollback: dropping the table and disabling the flag fully reverts the feature.
+
+### Security review notes
+
+This feature deliberately relocates a *capability* (widening the CSP) from a
+purely deploy-time operator control into a runtime, permission-gated, audited
+operation. The mitigations that keep it within Superset's trust model:
+
+- **Off by default** behind a feature flag the operator owns.
+- **Admin-only** write permission (a fully trusted principal per `SECURITY.md`).
+- **Strict origin validation** server-side — no wildcards, no `script-src`.
+- **Audit trail** via the audit mixin (`created_by` / `changed_by`).
+- The iframe is **sandboxed** and the merge can only *widen* a directive to a
+  specific origin, never relax nonce/`strict-dynamic` protections on
+  `script-src`.
+
+## Rejected Alternatives
+
+- **Dynamically reconfiguring flask-talisman at runtime.** Talisman is configured
+  once at app init. Rather than mutate its internals, we add our own
+  `after_request` hook that post-processes the header it already sets. This is
+  simpler, avoids depending on Talisman internals, and rides the same per-request
+  header machinery Talisman already uses for its nonce.
+- **Per-dashboard allowlist scoping.** More precise, but CSP is a per-response
+  header; per-dashboard scoping adds request-context complexity for marginal
+  benefit in the common case. Left as a possible future extension.
+- **"Always on" runtime override (no kill-switch).** Simpler, but moves a
+  security control fully into the app with no operator opt-out. Rejected in favor
+  of the feature-flag kill-switch.
+- **Shared/Redis-backed allowlist cache with cross-worker invalidation.**
+  Correct but heavier. A short-TTL in-process cache is good enough: writes take
+  effect immediately in the handling worker and within the TTL elsewhere, with no
+  new infrastructure dependency.
+
+## Implementation Status
+
+- [x] Feature flag `CSP_RUNTIME_ALLOWLIST` + `CSP_RUNTIME_ALLOWLIST_CACHE_TTL`
+- [x] `CSPAllowlistEntry` model + Alembic migration
+- [x] DAO, marshmallow schemas (with origin/directive validation), REST API
+- [x] Admin-only permission (`CSPAllowlist` view-menu)
+- [x] `after_request` CSP merge hook + in-process TTL cache + invalidation
+- [x] `IFRAME` dashboard component + registration across util maps
+- [x] Domain flagging + permission-gated "Enable domain in CSP" button
+- [x] Tests: backend unit (validation + merge + hook), backend integration (API),
+      frontend unit (util + component)
+- [ ] Docs (`docs/`) + `UPDATING.md` entry
+- [ ] Community/security review feedback
@@ -24,6 +24,8 @@ assists people when migrating to a new version.

 ## Next

+- `SAMPLES_ROW_LIMIT` is now the default for `/datasource/samples` requests without a valid explicit `per_page`, rather than a hard per-request ceiling; explicit limits are honored up to the existing global row-limit ceiling, matching `/chart/data` SAMPLES requests.
+
 ### OAuth2 database callback metrics include their outcome

 The unqualified `DatabaseRestApi.oauth2` StatsD counter has been replaced with
@@ -31,6 +33,7 @@ The unqualified `DatabaseRestApi.oauth2` StatsD counter has been replaced with
 `DatabaseRestApi.oauth2.error`. Update monitoring rules and dashboards that consume
 the old counter to use the outcome-specific replacements.

+- [42930](https://github.com/apache/superset/pull/42930): Dataset import data-URI fetches no longer honor an HTTP(S) proxy when `DATASET_IMPORT_ALLOW_INTERNAL_DATA_URLS` is `False` (the default): the connection is now made directly to the destination so the peer-address check validates the real target instead of a proxy's. Deployments that require an egress proxy to reach legitimate external data URLs for dataset import should set `DATASET_IMPORT_ALLOW_INTERNAL_DATA_URLS = True` or otherwise ensure those URLs resolve without one.
 - [42935](https://github.com/apache/superset/pull/42935): The MCP service now refuses to start (`MCPAuthConfigError`) when `MCP_JWT_ISSUER` trusts more than one issuer and no `MCP_USER_RESOLVER` is configured, instead of only logging a warning. This was already a documented misconfiguration (the default resolver isn't issuer-scoped, so distinct trusted issuers minting the same username/email would resolve to the same Superset user); deployments trusting multiple issuers must configure an `MCP_USER_RESOLVER` that derives its identity from the token's `iss` claim before upgrading. Single-issuer deployments are unaffected.
 - [42393](https://github.com/apache/superset/pull/42393): Exported dataset YAML now carries a `uuid` for each metric and column so that custom folder assignments (which reference metrics/columns by UUID) survive an import into another workspace. This affects any export bundle that contains datasets, not just a dataset export: chart, dashboard, database and full-asset exports all embed the same dataset YAML, so a dashboard exported from this release also fails to import into an older one even though no dataset was exported directly. As with `folders` and `currency_code_column`, the affected `datasets/` files fail schema validation (`Unknown field: uuid`) when imported into Superset releases that predate this change; regenerate or hand-edit exports for older targets in mixed-version fleets.
 - [42300](https://github.com/apache/superset/pull/42300): Timeseries charts (line/area/bar) with a Y-axis bound in effect — either an explicit `yAxisBounds` or one derived from `truncateYAxis` — now clamp out-of-range data points to that bound instead of letting ECharts drop the point (and the line segments around it) entirely. Any existing chart with a configured Y-axis bound and data outside it will look different after upgrading: a gap becomes a point pinned to the boundary. The clamp also rewrites the value ECharts reads for that point's tooltip and data label, so the displayed value is the bound rather than the true observation.
@@ -97,6 +97,54 @@ for more information on how to configure it.

 At the very least, you'll want to change `SECRET_KEY` and `SQLALCHEMY_DATABASE_URI`. Continue reading for more about each of these.

+## Localizing D3 date and time labels
+
+`BABEL_DEFAULT_LOCALE` controls Superset's application translations, while
+`D3_TIME_FORMAT` provides localized date and time names to visualizations that
+use the D3 formatter registry, including Calendar Heatmap. Configure both when
+you want the application and chart labels to use the same locale.
+
+`D3_TIME_FORMAT` accepts partial overrides. For example, Russian month names
+can be configured in `superset_config.py` as follows:
+
+```python
+BABEL_DEFAULT_LOCALE = "ru"
+
+D3_TIME_FORMAT = {
+    "months": [
+        "Январь",
+        "Февраль",
+        "Март",
+        "Апрель",
+        "Май",
+        "Июнь",
+        "Июль",
+        "Август",
+        "Сентябрь",
+        "Октябрь",
+        "Ноябрь",
+        "Декабрь",
+    ],
+    "shortMonths": [
+        "Янв",
+        "Фев",
+        "Мар",
+        "Апр",
+        "Май",
+        "Июн",
+        "Июл",
+        "Авг",
+        "Сен",
+        "Окт",
+        "Ноя",
+        "Дек",
+    ],
+}
+```
+
+Restart Superset after changing `superset_config.py` so the frontend receives
+the updated formatter configuration.
+
 ## Chart-data query timing

 Set `CHART_DATA_INCLUDE_TIMING = True` to add an optional versioned timing object
@@ -400,7 +400,7 @@ Once enabled, each user manages their own keys from their profile page:
 1. Open the user menu (top-right) and click **Info** to navigate to the User Info page
 2. Expand the **API Keys** section
 3. Click **+ API Key**
-4. Enter a name and (optionally) an expiration date
+4. Enter a name and optionally select resource scopes
 5. Copy the generated token — it is shown only once

 Only users with the `can_read` and `can_write` permissions on `ApiKey` (granted by default to Admins) can manage API keys.
@@ -415,6 +415,18 @@ Authorization: Bearer <your-api-key>

 This works for all REST API endpoints and the MCP server. The request is executed with the permissions of the user who created the key.

+#### API Key Scopes
+
+The creation dialog can restrict an API key to MCP resource actions such as
+`superset:dashboard:read` or `superset:chart:write`. A scope is an additional
+restriction: it never grants a permission that the creating user does not
+already have through Superset RBAC. Write scopes also cover update and delete
+operations for that resource; `superset:sqllab:write` covers SQL execution.
+
+Keys created without scopes retain legacy RBAC-only behavior. The scoped-key
+restrictions described here are enforced by the MCP server; regular REST API
+routes continue to apply their existing Superset RBAC checks.
+
 #### Use Cases

 - **CI/CD pipelines** — automated chart/dashboard exports and imports
@@ -129,6 +129,27 @@ chat.registerChat(

 See [Chat](./extension-points/chat.md) for implementation details.

+### Dashboard Components
+
+Extensions can add first-class layout components to the dashboard builder — elements that live in the grid alongside charts, Markdown, and tabs. The host owns the drag/resize/delete chrome, so the extension only provides the component that renders the element's content. The built-in iframe component is implemented through this contribution point.
+
+```tsx
+import { dashboardComponents } from '@apache-superset/core';
+import WeatherWidget from './WeatherWidget';
+
+dashboardComponents.registerDashboardComponent(
+  {
+    id: 'my-org.weather',
+    name: 'Weather widget',
+    icon: 'CloudOutlined',
+    defaultMeta: { width: 4, height: 50 },
+  },
+  WeatherWidget,
+);
+```
+
+See [Dashboard Components](./extension-points/dashboard-components.md) for implementation details.
+
 ## Backend

 Backend contribution types allow extensions to extend Superset's server-side capabilities. Backend contributions are registered at startup via classes and functions imported from the auto-discovered `entrypoint.py` file.
@@ -0,0 +1,155 @@
+---
+title: Dashboard Components
+sidebar_position: 4
+---
+
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# Dashboard Component Contributions
+
+Extensions can add first-class **layout components** to the dashboard builder —
+elements that sit in the grid alongside charts, Markdown, and tabs. The built-in
+iframe component is itself implemented through this contribution point.
+
+The host owns the surrounding **chrome** (the drag handle, the resize container,
+and the delete affordance), so your component only renders its content and, in
+edit mode, its own editor affordances. This keeps the contract small and stable.
+
+> This supersedes the legacy `DashboardComponentsRegistry` / `DYNAMIC_TYPE`
+> mechanism, which is deprecated.
+
+## Overview
+
+A dashboard component contribution is:
+
+| Part | Role |
+|------|------|
+| **Definition** | A descriptor declaring the component's id, palette label, icon, and layout behavior (resizable, default size, nesting). |
+| **Component** | A React component that renders the element's content and receives the [`DashboardComponentProps`](#component-contract) contract. |
+
+## The Component Contract
+
+Your component receives a small, stable set of props. It never deals with drag,
+resize, or delete — the host renders it inside that chrome.
+
+```ts
+interface DashboardComponentProps {
+  /** The layout item id of this instance. */
+  id: string;
+  /** This instance's persisted meta (round-trips in the saved layout). */
+  meta: Record<string, unknown>;
+  /** Whether the dashboard is in edit mode. */
+  editMode: boolean;
+  /** Shallow-merge a patch into this instance's persisted meta. */
+  updateMeta: (patch: Record<string, unknown>) => void;
+}
+```
+
+Persist any per-instance state in `meta` via `updateMeta`. It is saved with the
+dashboard and rehydrated on load.
+
+## Registering a Dashboard Component
+
+Call `dashboardComponents.registerDashboardComponent` from your extension's entry
+point with a definition and your component:
+
+```tsx
+import { dashboardComponents } from '@apache-superset/core';
+import WeatherWidget from './WeatherWidget';
+
+dashboardComponents.registerDashboardComponent(
+  {
+    id: 'my-org.weather',
+    name: 'Weather widget',
+    description: 'Shows the current weather for a city',
+    icon: 'CloudOutlined',
+    resizable: true,
+    defaultMeta: { width: 4, height: 50, city: 'Lisbon' },
+  },
+  WeatherWidget,
+);
+```
+
+```tsx
+// WeatherWidget.tsx
+import type { dashboardComponents } from '@apache-superset/core';
+
+type Props = dashboardComponents.DashboardComponentProps;
+
+export default function WeatherWidget({ meta, editMode, updateMeta }: Props) {
+  const city = (meta.city as string) ?? '';
+  return editMode ? (
+    <input
+      value={city}
+      onChange={e => updateMeta({ city: e.target.value })}
+      placeholder="City"
+    />
+  ) : (
+    <Forecast city={city} />
+  );
+}
+```
+
+The component appears in the dashboard builder's **Layout elements** palette and
+can be dragged onto the grid like any built-in element.
+
+## Definition Reference
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `id` | `string` | Namespaced unique id, e.g. `my-org.weather`. Selects the component for each instance. |
+| `name` | `string` | Label shown in the builder palette. |
+| `description` | `string` | Optional longer description. |
+| `icon` | `string` | A known Superset icon name (e.g. `CloudOutlined`). Falls back to a generic icon. |
+| `resizable` | `boolean` | Whether instances can be resized. Defaults to `true`. |
+| `defaultMeta` | `object` | `meta` seeded onto a new instance (e.g. `width`, `height`, and your own keys). |
+| `isUserContent` | `boolean` | Whether an instance counts as content for "is this dashboard empty?" detection. Defaults to `true`. |
+| `minWidth` | `number` | Minimum width in grid columns. Defaults to `1`. |
+| `validParents` | `string[]` | Restrict which container types may hold the component (e.g. `['GRID', 'TAB']`). Defaults to standard content-leaf placement (grid, row, column, tab). |
+| `wrapInRow` | `boolean` | Whether a drop into the grid or a tab auto-wraps the component in a row. Defaults to `true`. |
+
+The layout-relevant behavior fields are seeded onto each instance's `meta` at
+creation, so the dashboard honors them — and they round-trip in the saved layout
+even if the extension later becomes unavailable.
+
+## Graceful Degradation
+
+If a saved dashboard references a component whose extension is disabled or not
+yet loaded, the host renders a non-destructive placeholder in its place and
+preserves the instance's `meta` on save. Re-enabling the extension restores the
+component.
+
+## Dashboard Components API Reference
+
+All methods are available on the `dashboardComponents` namespace from
+`@apache-superset/core`:
+
+| Method / Event | Description |
+|----------------|-------------|
+| `registerDashboardComponent(definition, component)` | Register a component. Returns a `Disposable` to unregister. Registering the same id again replaces the previous registration. |
+| `getDashboardComponent(id)` | Returns the registered component for `id`, or `undefined`. |
+| `getDashboardComponents()` | Returns all registered components. |
+| `onDidRegisterDashboardComponent(listener)` | Subscribe to registration events. Returns a `Disposable`. |
+| `onDidUnregisterDashboardComponent(listener)` | Subscribe to unregistration events. Returns a `Disposable`. |
+
+## Next Steps
+
+- **[Contribution Types](../contribution-types.md)** — Explore other contribution types
+- **[Development](../development.md)** — Set up your development environment
@@ -49,6 +49,7 @@ module.exports = {
            'extensions/extension-points/sqllab',
            'extensions/extension-points/editors',
            'extensions/extension-points/chat',
+            'extensions/extension-points/dashboard-components',
          ],
        },
        'extensions/development',
@@ -61,11 +61,11 @@
    "@storybook/addon-docs": "^10.5.7",
    "@superset-ui/core": "^0.20.4",
    "@swc/core": "^1.15.47",
-    "antd": "^6.5.4",
-    "baseline-browser-mapping": "^2.11.12",
-    "caniuse-lite": "^1.0.30001807",
-    "docusaurus-plugin-openapi-docs": "^5.1.3",
-    "docusaurus-theme-openapi-docs": "^5.1.3",
+    "antd": "^6.6.0",
+    "baseline-browser-mapping": "^2.11.13",
+    "caniuse-lite": "^1.0.30001809",
+    "docusaurus-plugin-openapi-docs": "^5.2.0",
+    "docusaurus-theme-openapi-docs": "^5.2.0",
    "js-yaml": "^5.2.3",
    "json-bigint": "^1.0.0",
    "prism-react-renderer": "^2.4.1",
@@ -78,7 +78,7 @@
    "remark-import-partial": "^0.0.2",
    "reselect": "^5.2.0",
    "storybook": "^10.5.7",
-    "swagger-ui-react": "^5.32.12",
+    "swagger-ui-react": "^5.32.13",
    "swc-loader": "^0.2.7",
    "tinycolor2": "^1.4.2",
    "unist-util-visit": "^5.1.0"
@@ -89,14 +89,14 @@
    "@eslint/js": "^9.39.2",
    "@types/js-yaml": "^4.0.9",
    "@types/react": "^19.1.8",
-    "@typescript-eslint/eslint-plugin": "^8.66.0",
-    "@typescript-eslint/parser": "^8.66.0",
+    "@typescript-eslint/eslint-plugin": "^8.67.0",
+    "@typescript-eslint/parser": "^8.67.0",
    "eslint": "^9.39.2",
    "eslint-plugin-react": "^7.37.5",
-    "globals": "^17.9.0",
-    "oxfmt": "^0.62.0",
+    "globals": "^17.10.0",
+    "oxfmt": "^0.63.0",
    "typescript": "~6.0.3",
-    "typescript-eslint": "^8.66.0",
+    "typescript-eslint": "^8.67.0",
    "webpack": "^5.109.2"
  },
  "browserslist": {
@@ -21,6 +21,12 @@
        "lifecycle": "development",
        "description": "Enables experimental chart plugins"
      },
+      {
+        "name": "CSP_RUNTIME_ALLOWLIST",
+        "default": false,
+        "lifecycle": "development",
+        "description": "Allow users with the \"can write on CSPAllowlist\" permission (Admins by default) to punch holes in the Content Security Policy at runtime, e.g. to allow a new domain to be embedded in a dashboard iframe component. When disabled, the CSP is purely static/deploy-time and the allowlist is ignored."
+      },
      {
        "name": "CSV_UPLOAD_PYARROW_ENGINE",
        "default": false,
@@ -3407,22 +3407,26 @@
            "nullable": true,
            "type": "string"
          },
+          "description": {
+            "nullable": true,
+            "type": "string"
+          },
+          "editors": {
+            "items": {
+              "$ref": "#/components/schemas/DashboardRestApi.get_list.Subject"
+            },
+            "type": "array"
+          },
          "id": {
            "type": "integer"
          },
          "is_managed_externally": {
            "type": "boolean"
          },
-          "owners": {
-            "$ref": "#/components/schemas/DashboardRestApi.get_list.User2"
-          },
          "published": {
            "nullable": true,
            "type": "boolean"
          },
-          "roles": {
-            "$ref": "#/components/schemas/DashboardRestApi.get_list.Role"
-          },
          "slug": {
            "maxLength": 255,
            "nullable": true,
@@ -3432,10 +3436,10 @@
            "readOnly": true
          },
          "tags": {
-            "$ref": "#/components/schemas/DashboardRestApi.get_list.Tag"
-          },
-          "thumbnail_url": {
-            "readOnly": true
+            "items": {
+              "$ref": "#/components/schemas/DashboardRestApi.get_list.Tag"
+            },
+            "type": "array"
          },
          "url": {
            "readOnly": true
@@ -3444,21 +3448,46 @@
            "format": "uuid",
            "nullable": true,
            "type": "string"
+          },
+          "viewers": {
+            "items": {
+              "$ref": "#/components/schemas/DashboardRestApi.get_list.Subject1"
+            },
+            "type": "array"
          }
        },
        "type": "object"
      },
-      "DashboardRestApi.get_list.Role": {
+      "DashboardRestApi.get_list.Subject": {
        "properties": {
          "id": {
            "type": "integer"
          },
-          "name": {
-            "maxLength": 64,
+          "label": {
+            "maxLength": 255,
            "type": "string"
+          },
+          "type": {
+            "type": "integer"
          }
        },
-        "required": ["name"],
+        "required": ["label", "type"],
+        "type": "object"
+      },
+      "DashboardRestApi.get_list.Subject1": {
+        "properties": {
+          "id": {
+            "type": "integer"
+          },
+          "label": {
+            "maxLength": 255,
+            "type": "string"
+          },
+          "type": {
+            "type": "integer"
+          }
+        },
+        "required": ["label", "type"],
        "type": "object"
      },
      "DashboardRestApi.get_list.Tag": {
@@ -3511,23 +3540,6 @@
        "required": ["first_name", "last_name"],
        "type": "object"
      },
-      "DashboardRestApi.get_list.User2": {
-        "properties": {
-          "first_name": {
-            "maxLength": 64,
-            "type": "string"
-          },
-          "id": {
-            "type": "integer"
-          },
-          "last_name": {
-            "maxLength": 64,
-            "type": "string"
-          }
-        },
-        "required": ["first_name", "last_name"],
-        "type": "object"
-      },
      "DashboardRestApi.post": {
        "properties": {
          "certification_details": {
@@ -16506,7 +16518,7 @@
                    },
                    "result": {
                      "items": {
-                        "type": "object"
+                        "$ref": "#/components/schemas/DashboardRestApi.get_list"
                      },
                      "type": "array"
                    }
@@ -1142,6 +1142,11 @@
  resolved "https://registry.yarnpkg.com/@babel/runtime/-/runtime-7.29.7.tgz#12022450c45a4da6d8d8287b18a4ff2ddb23f768"
  integrity sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==

+"@babel/runtime@^8.0.0":
+  version "8.0.0"
+  resolved "https://registry.yarnpkg.com/@babel/runtime/-/runtime-8.0.0.tgz#d7bd513e6843662346552c2798ab895716cf97f2"
+  integrity sha512-sL6cvO2IfkSu/iU+zs2S/w01B7A8V7suXSIKEN4hPFFdZoiPGxrj5pAG0lCaqLWiEIrjKzdznIWuaLcxPR53qw==
+
 "@babel/template@^7.29.7":
  version "7.29.7"
  resolved "https://registry.yarnpkg.com/@babel/template/-/template-7.29.7.tgz#4d9d4004f645cdd304de958c725162784ecac700"
@@ -3170,100 +3175,100 @@
  resolved "https://registry.yarnpkg.com/@oxc-resolver/binding-win32-x64-msvc/-/binding-win32-x64-msvc-11.23.0.tgz#8b66dbfa7b796139e719063fc0e44084e80a1c15"
  integrity sha512-gUGJpr+Rn6zMxm5juApV0K3U845i8t47o8k+rbO0BHbi4PoJIfSPeQmrE2dgohQm2g5k6iviNFyXCGqvmaYUpw==

-"@oxfmt/binding-android-arm-eabi@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-android-arm-eabi/-/binding-android-arm-eabi-0.62.0.tgz#3f5b9d3ba944f42ad3fa2697b9fef88a8c9d4ce0"
-  integrity sha512-pdsv0C4gPjJ8H1+sd8u0BDx+yLACTL+rgeMIOL1ln4ihSnhw8CWXtYWgvcSkyTfgGBIzFKab+d8rx9Xl4en/Kw==
+"@oxfmt/binding-android-arm-eabi@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-android-arm-eabi/-/binding-android-arm-eabi-0.63.0.tgz#136176dc94fdc41e21415cc770d86f5066282e0f"
+  integrity sha512-YmRth4ZPGgEXcgmkhvANbC9uD67dxmSobW7DQuyt5tOBOKvPnIpk5SVHBj88E+7wMNRI2FhqaDbOhQFBix+b8A==

-"@oxfmt/binding-android-arm64@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-android-arm64/-/binding-android-arm64-0.62.0.tgz#4c7e2c567f645ed051be100318e9e3f716630c1b"
-  integrity sha512-WC3YQ7uS/KtDrjmqwBviwFKe9qeoi+eXx8aX1z/ffG23Md75myjrJaQqTuJvdOLPoa4EYTjDWH0dHXfwulCVog==
+"@oxfmt/binding-android-arm64@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-android-arm64/-/binding-android-arm64-0.63.0.tgz#10bc42457179210061c801122a64304619e3bdab"
+  integrity sha512-icbahX8X2X3sRamOMecvdYeZXWjPDazRDIfvWfy7Ca1nc/ZDT2Y9k5Nt7s46EqFd7NQPdgk+CM3/SgIT5LPCaQ==

-"@oxfmt/binding-darwin-arm64@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-darwin-arm64/-/binding-darwin-arm64-0.62.0.tgz#6c8007ae65ed17f9d1ecc6c680da19ec19276c67"
-  integrity sha512-GM8Yf3LjjaR1I8PD0SfeoIlwhsh9GvSF+cQ8sf624Yxnjsyumn95aFzYfKJVefblfDIiOAnZ7QVm2sa21Er/0Q==
+"@oxfmt/binding-darwin-arm64@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-darwin-arm64/-/binding-darwin-arm64-0.63.0.tgz#5f9084d9a760a1836387f8970a7f9d614ec3d909"
+  integrity sha512-WV+Ze5v5gI2qoj8jpAovt8KBTW8pjEz/AiMXXjeTQS+Bmf/MmZXTS40S8xNPDszX+W8WDv2Bbk6qKrMTtUGu1A==

-"@oxfmt/binding-darwin-x64@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-darwin-x64/-/binding-darwin-x64-0.62.0.tgz#0661a0274e8625921c5a054aeb21a36251946e6b"
-  integrity sha512-d5THp7F8bCxLqNogEXDORRsQD6dosf3EyFtnXfBer6v+8tGdcWIjoDX9WaXrrF/26zOmL8qHpPTKCEvpBDmZkQ==
+"@oxfmt/binding-darwin-x64@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-darwin-x64/-/binding-darwin-x64-0.63.0.tgz#badd4a02218a9a62319817d5c337b30159a54a21"
+  integrity sha512-CJGSBdDxXOWIpoFXHpverimCvz084KA7L483rqJ44c3jDtzv6d4qOSoR/V9ywSHfV+Ks1lwIj2P49BFhunLNAA==

-"@oxfmt/binding-freebsd-x64@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-freebsd-x64/-/binding-freebsd-x64-0.62.0.tgz#f3345001102ac3e6c2947920d6d1676e9cf97e75"
-  integrity sha512-1DnrtXGZooOZ0fHgAXZUaDQzBVh1CM2MNW4oBXyQ2aWKvCHjyljvT9fgBkOM0fEOb96X5eqtcfJ0YUVt9jj66g==
+"@oxfmt/binding-freebsd-x64@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-freebsd-x64/-/binding-freebsd-x64-0.63.0.tgz#a17261e95c8ebef1f76d8aaac746a64fdb6ba51e"
+  integrity sha512-BDfKY+KhL2078cgswBBFQPAYuxCy93bS/iC5frdSeSbTLcGrR6VC2hsuPTanoJmg84+wSyWl0wWC1eR+uTnkRg==

-"@oxfmt/binding-linux-arm-gnueabihf@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-0.62.0.tgz#ddc03bc2a899f2071d6706c06dfdec3a7f3e8b5a"
-  integrity sha512-4pQDHOYRH+Huqe0StIaWyvk2CVl/aTaqSrbZpA3/pLS2xH24ME7lBgYprhQF2fRkHBzhGGGKliwxFsDdHwx59g==
+"@oxfmt/binding-linux-arm-gnueabihf@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-0.63.0.tgz#baeee34bb08e0769af878623f442e83bc0aacd7a"
+  integrity sha512-Ov1cQEXT4mj7cojAokWSS1eoxkoyvbDfAbxNsGIKY2o36kvdAaFzPxRN6NxFRk9fD72B8oCoTTX/NuYTUWlpsg==

-"@oxfmt/binding-linux-arm-musleabihf@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-arm-musleabihf/-/binding-linux-arm-musleabihf-0.62.0.tgz#5e82208d612c4caf64ada75e129e34d1a9eefb2c"
-  integrity sha512-X0jAaZJFMCVKhB6YyWVTQ/wN2DLsBcZKSMqTS76bF6riT+XZdtg2FPEdjDvdVbunO9cG+tWiVaEs4Zs38lxYog==
+"@oxfmt/binding-linux-arm-musleabihf@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-arm-musleabihf/-/binding-linux-arm-musleabihf-0.63.0.tgz#e70d5697ec4b6bb5f87a3f019e01b3f956b8e44b"
+  integrity sha512-0LE7ro3+6L79jcMANycAZfRaC7zxr9YZ2+vEL5uMD9QlEep+rS/r1kSJsnuLl991NXJZD60euh0PC1GHrR20vw==

-"@oxfmt/binding-linux-arm64-gnu@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-0.62.0.tgz#eb379bc58aa962e753d58b4cc68ff4081bc19a5d"
-  integrity sha512-682Z8T5s8T5ATArYtsejKvbIfd8LEAXyyDkKkoZVq8HND7Vx8TYLlrDjDSeYfodMeVwHOgkj13lJYR8cj6vUSg==
+"@oxfmt/binding-linux-arm64-gnu@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-0.63.0.tgz#638a8ed4f3d256c50aeb6d2c19cfc65792c902e1"
+  integrity sha512-izPk+2Z4gjuZK32Fqh5qXoMpT/2NXzLh++ob57HiEiVSQZ1iYXu8EKMzb+K5AvWyIEXhdDIt7ADjGGtFhkT9Bw==

-"@oxfmt/binding-linux-arm64-musl@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-arm64-musl/-/binding-linux-arm64-musl-0.62.0.tgz#dc1c62510405e874bf6a53a34f548032eb6dfed7"
-  integrity sha512-lk25fAl7KWaLWVJcW0CHEXB7QlQZtx5eDkjpaGMK0hzXTjUe0Wmlu8IKuFHoviSOcEJedRTs4VE/506VqGxGew==
+"@oxfmt/binding-linux-arm64-musl@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-arm64-musl/-/binding-linux-arm64-musl-0.63.0.tgz#af5a9b787f5233f27a3360ad56235fc1b011f760"
+  integrity sha512-alPmbOuWXFXiSo+lOtv6X71C7SYMEDW2WVvywOvf9BwKgEhSNGhMTLeFVSjKUMCamcjbbgVdsWF8GN1uy8xshg==

-"@oxfmt/binding-linux-ppc64-gnu@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-0.62.0.tgz#9f9afee327090024db86b70ec81a57ad06bb2f00"
-  integrity sha512-SFyNqHQLwySceWNLhiSldx7wPXRAzP0L0WcW9GegP3uWrpZGJiZlQO85NbHAFPEfxR9PhZ9qSnZryEh7+v+4Gw==
+"@oxfmt/binding-linux-ppc64-gnu@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-0.63.0.tgz#c1a211206134a5577e355a495989e0d733218d60"
+  integrity sha512-BdzCPvolJc4AWZ+YMzgUDJcDzbQWrFjYuqBHoNHNqP1aCaluQRJNs4k3vNU5IG7vTpjf9zeD73D7MFM1TecZpg==

-"@oxfmt/binding-linux-riscv64-gnu@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-riscv64-gnu/-/binding-linux-riscv64-gnu-0.62.0.tgz#4427d42ee3bad0e55b38dc76fe14a7e5318c360c"
-  integrity sha512-KYj55C1ywJfHo6+aKDuEmUtVEdJALsC5GwayDGsI6FGz2GxFqNr/mA8nxVsNbJzm7sE5MRqTQ9ziImSzhYXysA==
+"@oxfmt/binding-linux-riscv64-gnu@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-riscv64-gnu/-/binding-linux-riscv64-gnu-0.63.0.tgz#4863f0311e5c1b88f75ef822959b3ca4fd938937"
+  integrity sha512-7sIgfLzqtNKSkMGsGVyRpHwpjNezRg2XONvUOheFZs95TSZpM0JAuPpA8KrQFsWc4wPU95roX2O69JgH8igOgw==

-"@oxfmt/binding-linux-riscv64-musl@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-riscv64-musl/-/binding-linux-riscv64-musl-0.62.0.tgz#a117f82909f075cf07c333842d89a5638429e21d"
-  integrity sha512-BhZDNo5GOU5nC378RhD0/XpvaEBHsH3HLgJp8YZX3A0InC7oivzA63HsRmiXFLtLSHAstEVrDf6fbC7Rs8Jh/A==
+"@oxfmt/binding-linux-riscv64-musl@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-riscv64-musl/-/binding-linux-riscv64-musl-0.63.0.tgz#ad05a017d12553e2f544743c4940adb552aa1d1c"
+  integrity sha512-9Tcg0y0WcVa6Mm9AgcgFMseDS+VkFJZpKZ8We9SpDY4gg5jewSwln+0sO04QLcTS1BtfDl9MwR+NfID8L7PUTg==

-"@oxfmt/binding-linux-s390x-gnu@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-0.62.0.tgz#3fac79fefe7ffc3f0a9393678ebd782aac918fcd"
-  integrity sha512-UyAFmyHkgSgUJ/wOM4p3U8AC2yAFvRH5PNBs7TnK0fObTT/XSWcdr/lAzPSWaekHaZFaMeFZyk9n93Joq3J93A==
+"@oxfmt/binding-linux-s390x-gnu@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-0.63.0.tgz#2803f539db15bc66db115888fa8f84d6531ed2b9"
+  integrity sha512-qWKC1pEOpx1qYhXaugPhHUeXwSfqEOk2wJH2LqVXGPV5iQYfdAZdt+d2XDiX4DTSWA2QDMUcFB+wEORh3Xn/sA==

-"@oxfmt/binding-linux-x64-gnu@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-x64-gnu/-/binding-linux-x64-gnu-0.62.0.tgz#8da207bef27941f0265c129d1c7c82c7cf91d1ce"
-  integrity sha512-1iYMP0leytWazFubD/WnINJuIrzRPuoL1aWEJdlGezEzDbTxcd29R4r8IUzP2oWeKst5V02uMJgR2NILlPlG6w==
+"@oxfmt/binding-linux-x64-gnu@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-x64-gnu/-/binding-linux-x64-gnu-0.63.0.tgz#c22a06a60ae2d6b3de522095e0c50a816040a033"
+  integrity sha512-S9wXYOiGSqYGS4Fx/TFsY+xDd/7dE5s+rUgbA4TsHiVF9e8J3ZcKmP7dsP/7iqLI9Wz7Ic7TzEr3mdthRCTdrA==

-"@oxfmt/binding-linux-x64-musl@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-x64-musl/-/binding-linux-x64-musl-0.62.0.tgz#e55cf9b7c8c2204fdbb5d4818f8c5ba02aa49360"
-  integrity sha512-4rA/URtJSTVNVAQz6Q8wf7SaRvOXVy+TizriT9hs/Y1XhLR/R+92uWKRQG8yFWRAIEBbFHJ6WevQcl/G9SXEfw==
+"@oxfmt/binding-linux-x64-musl@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-x64-musl/-/binding-linux-x64-musl-0.63.0.tgz#48d3eeaf8e3757f638cf92de5ee4858befc9c0a3"
+  integrity sha512-5eGyTJuMZNwBSHCivXt8Yuta6GeTYksOPXRk2MIhajiyFGQx7bjaHIwY+ZusAoFHhT157A9x6sktLjYo9D5oMQ==

-"@oxfmt/binding-openharmony-arm64@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-openharmony-arm64/-/binding-openharmony-arm64-0.62.0.tgz#4998769ee1b5894efcd6cb99729d5a75f4c09dd1"
-  integrity sha512-mSZuFHU2ar1KLUjXpI2QBQcJ1VsOB3mOCgQXuXCpKs19dgh4u+OaovNfrWDfiJb+ihJ2+f7YFcaO9bS2dlTCXA==
+"@oxfmt/binding-openharmony-arm64@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-openharmony-arm64/-/binding-openharmony-arm64-0.63.0.tgz#02be9e140ae35ba30f52bdce27612fece4a01ab3"
+  integrity sha512-Rz7hx+Dv3DoW/S6pwVAyjfFXp7/trdQ1zg+vNmsdsdDNlUccugp4XNqambSuEAeP0DaG9k72AtNyfDXCEg0AGw==

-"@oxfmt/binding-win32-arm64-msvc@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-0.62.0.tgz#e09eaabdde76c885c4f8a190518c2eb2de08548a"
-  integrity sha512-OfwuhkcjDlqC4EgDojtiV9mzpLqeB9KqTOWPOjLEYBVdDCVSxqW3qzp/xcIxsbtI0UgGCnKvAqYKyY25kf5JZw==
+"@oxfmt/binding-win32-arm64-msvc@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-0.63.0.tgz#2226eaf52b6345a2cb926499216b2486cf0dbec2"
+  integrity sha512-T/IuizKN9mr4Xw6YYnptkXRNdLkyIlUZ7c8zfTOBpoytZyJ1BAsMUvsMDEx0X4YvSMpaivm+DR8112rQfzC25g==

-"@oxfmt/binding-win32-ia32-msvc@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-win32-ia32-msvc/-/binding-win32-ia32-msvc-0.62.0.tgz#f36e306308923977365270d8b26290f4ca2fcfa5"
-  integrity sha512-P9uDDNFRzghO3X8QAzhkjKhK7JvtABsVn8UYtFX7uor12IAnwNt8nNIctvfWj1JkQU/kE+fmLRPiw7XlrIHsZw==
+"@oxfmt/binding-win32-ia32-msvc@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-win32-ia32-msvc/-/binding-win32-ia32-msvc-0.63.0.tgz#58d263bb5ecd7330c02f9dcd8cda10f66e42e74b"
+  integrity sha512-XjrO5FJ5Wl9vsAxtCP1G/eaeT6y1K2s9CICUHGE42cEjou32/J6S+B1KnrOAboj6E7uhJnwPbRSvznWcxNdA0g==

-"@oxfmt/binding-win32-x64-msvc@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-win32-x64-msvc/-/binding-win32-x64-msvc-0.62.0.tgz#bb6545e581d5ee7111084dbabeec7fe548bae418"
-  integrity sha512-dlI5SY7XYQCiCBafntWagCR6HcAJB/NpsLtdlPx8x08+Osz8Ok1HHz1GZuusegCe/VoJ6pAnF5a4pd5OZAq7qQ==
+"@oxfmt/binding-win32-x64-msvc@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-win32-x64-msvc/-/binding-win32-x64-msvc-0.63.0.tgz#02a166c8a8049c55d0096d1ba9d8e73f3a4d26a7"
+  integrity sha512-sgsHCQy432OTQH4Ikk3tZptp3GqwnhwUDuY0loBH41zyHWfMZY9v8Dy78wsnSofHejvFozZGgJgBB1A0LQRwMQ==

 "@parcel/watcher-android-arm64@2.5.6":
  version "2.5.6"
@@ -3532,13 +3537,13 @@
  dependencies:
    "@babel/runtime" "^7.24.4"

-"@rc-component/cascader@~1.17.0":
-  version "1.17.0"
-  resolved "https://registry.yarnpkg.com/@rc-component/cascader/-/cascader-1.17.0.tgz#52c0eceada2c7b4b37ebe822c19a6544b9562edf"
-  integrity sha512-3cVNG0zrQF1PoXq262L3wGCU+/YLEC1mGSVHDl577dQmA0ZKkXFbY6nwyXo+beCcM7buo49t24jkr+QZdL7O8w==
+"@rc-component/cascader@~1.22.0":
+  version "1.22.0"
+  resolved "https://registry.yarnpkg.com/@rc-component/cascader/-/cascader-1.22.0.tgz#eec0b6f4d2df5903aa12cfed321a578705926937"
+  integrity sha512-SffrA57aS9oub3VuI7ajPhJTPtaNxngSvtRhD40Rd8dwJ5vfWPSrVanWgeepdWFGBt7EHftIK5RUU0u3rCTwWw==
  dependencies:
-    "@rc-component/select" "~1.8.0"
-    "@rc-component/tree" "~1.3.2"
+    "@rc-component/select" "~1.10.0"
+    "@rc-component/tree" "~1.4.0"
    "@rc-component/util" "^1.11.1"
    clsx "^2.1.1"

@@ -3614,14 +3619,14 @@
    "@rc-component/util" "^1.11.1"
    clsx "^2.1.1"

-"@rc-component/image@~1.9.0":
-  version "1.9.0"
-  resolved "https://registry.yarnpkg.com/@rc-component/image/-/image-1.9.0.tgz#110785d735d20336afcdbac84e8fbfd059a7a44e"
-  integrity sha512-khF7w7xkBH5B1bsBcI1FSUZdkyd1aqpl2eYyILCqCzzQH3XdfehGUaZTnptyaJJfs09/R5hv9jXWyazOMFIClQ==
+"@rc-component/image@~1.10.0":
+  version "1.10.0"
+  resolved "https://registry.yarnpkg.com/@rc-component/image/-/image-1.10.0.tgz#5d7a82d20e4c91f75875ea64eb1dadd7af676b1d"
+  integrity sha512-BjeZCRQ+hw+4WAhvrw8rJvy5fckA2xpf/X2XQEOABUHvLTNB9inB98X3Mp54jYQ7g10DfWERQWHXeC4ylxp1Uw==
  dependencies:
    "@rc-component/motion" "^1.0.0"
    "@rc-component/portal" "^2.1.2"
-    "@rc-component/util" "^1.10.1"
+    "@rc-component/util" "^1.11.1"
    clsx "^2.1.1"

 "@rc-component/input-number@~1.6.2":
@@ -3633,7 +3638,7 @@
    "@rc-component/util" "^1.4.0"
    clsx "^2.1.1"

-"@rc-component/input@~1.3.0", "@rc-component/input@~1.3.1":
+"@rc-component/input@~1.3.1":
  version "1.3.1"
  resolved "https://registry.yarnpkg.com/@rc-component/input/-/input-1.3.1.tgz#230b8b59cdde8521d50f0eede63ddacb61cc0cd3"
  integrity sha512-iFvTUT9W+JC/MSin2aGAk8NqsVlTzcExNC9DZariON1IWirju9NoNeEk47an4Q8iHazkoVI/y1LnDi88+CPcig==
@@ -3642,15 +3647,27 @@
    "@rc-component/util" "^1.11.1"
    clsx "^2.1.1"

-"@rc-component/mentions@~1.10.0":
-  version "1.10.0"
-  resolved "https://registry.yarnpkg.com/@rc-component/mentions/-/mentions-1.10.0.tgz#46b1117cfb0c716b476e97f342555eccc2f41c97"
-  integrity sha512-CI1njYUVY0NjHtLhNoVmXlJyy568Sfep9Wsak6vmGjtT6uazx98djGYlCXz2xkHhEm73g91Y3MTvzUyE5avI7w==
+"@rc-component/listy@~1.2.3":
+  version "1.2.3"
+  resolved "https://registry.yarnpkg.com/@rc-component/listy/-/listy-1.2.3.tgz#e9c8ef4f409c231b44dded37e63ae2875bbe0334"
+  integrity sha512-IXiMjV5s0rczLBlfh7G5nB4M3365mrEeedjwKtf5I+Ns3PqRUsebR2h5u8CeFarsVfLUPC2I5p0h09TNoOWyvQ==
  dependencies:
-    "@rc-component/input" "~1.3.0"
+    "@rc-component/motion" "^1.1.4"
+    "@rc-component/portal" "^2.0.0"
+    "@rc-component/resize-observer" "^1.0.0"
+    "@rc-component/util" "^1.3.1"
+    "@rc-component/virtual-list" "^1.4.0"
+    clsx "^2.1.1"
+
+"@rc-component/mentions@~1.11.0":
+  version "1.11.0"
+  resolved "https://registry.yarnpkg.com/@rc-component/mentions/-/mentions-1.11.0.tgz#cee0c4710f26766ad8550d386cfec5ff86fd58d9"
+  integrity sha512-IC2qXuEBMFHxPIXEFfYWj6Sr7UiDZnOqJHCYQBbwPzopBJOPZIR6mV9U4QH1bYQRlKYlYnIsajWDMgVGgWQyWQ==
+  dependencies:
+    "@rc-component/input" "~1.3.1"
    "@rc-component/menu" "~1.4.0"
    "@rc-component/trigger" "^3.0.0"
-    "@rc-component/util" "^1.3.0"
+    "@rc-component/util" "^1.11.1"
    clsx "^2.1.1"

 "@rc-component/menu@~1.4.0", "@rc-component/menu@~1.4.1":
@@ -3724,7 +3741,7 @@
    "@rc-component/util" "^1.11.1"
    clsx "^2.1.1"

-"@rc-component/portal@^2.1.0", "@rc-component/portal@^2.1.2", "@rc-component/portal@^2.1.3", "@rc-component/portal@^2.2.0", "@rc-component/portal@^2.2.1":
+"@rc-component/portal@^2.0.0", "@rc-component/portal@^2.1.0", "@rc-component/portal@^2.1.2", "@rc-component/portal@^2.1.3", "@rc-component/portal@^2.2.0", "@rc-component/portal@^2.2.1":
  version "2.2.1"
  resolved "https://registry.yarnpkg.com/@rc-component/portal/-/portal-2.2.1.tgz#37c34b4c8cd73f53cc7072c96dd0e9ac332669ec"
  integrity sha512-ck+r1kW/JSv0wxPji3KN2ss9K6Z0qqwusw/mf/0JobXhZ8hC2ejZwCJObW/SvDi0uhA0VzmCnx0CaCci95tcmA==
@@ -3772,10 +3789,10 @@
    "@rc-component/util" "^1.3.0"
    clsx "^2.1.1"

-"@rc-component/select@~1.8.0", "@rc-component/select@~1.8.2":
-  version "1.8.2"
-  resolved "https://registry.yarnpkg.com/@rc-component/select/-/select-1.8.2.tgz#f016992dae5c57186535512d73783e2fc7e4c59e"
-  integrity sha512-HQ9zuYqjfZTlcEMWlU1GAPBajd2OHIMVHyjZSGVTCVARwkfCgvXZMTEn0cduy3L+ejAKkaZluOQvxovZoaJaQw==
+"@rc-component/select@~1.10.0":
+  version "1.10.1"
+  resolved "https://registry.yarnpkg.com/@rc-component/select/-/select-1.10.1.tgz#323b2f458a637e8e752f8341094783741c613c34"
+  integrity sha512-H+yQsl+qED9NilQ3g6zdpsMwUgwVjrcMTkNHAWRVU/MoNCYgTbDgU+MIMgZDK+rVdd2JUfI/MkysMcZZ0cyQKw==
  dependencies:
    "@rc-component/overflow" "^1.0.0"
    "@rc-component/trigger" "^3.0.0"
@@ -3807,10 +3824,10 @@
    "@rc-component/util" "^1.3.0"
    clsx "^2.1.1"

-"@rc-component/table@~1.10.4":
-  version "1.10.4"
-  resolved "https://registry.yarnpkg.com/@rc-component/table/-/table-1.10.4.tgz#8c4e33bc150aa39f579c15426421348a789de326"
-  integrity sha512-HwoTnrwc29zeoXkXGhWqzJh8FIibGUxi1jM4LtoSzmR9d5Vv5osUQpZxnXKBP8iOCvyD6BQzZm1nXJRcnrxpAg==
+"@rc-component/table@~1.11.0":
+  version "1.11.1"
+  resolved "https://registry.yarnpkg.com/@rc-component/table/-/table-1.11.1.tgz#7b5c2a7c26fd37b6a403082029b5a72fcb330a4d"
+  integrity sha512-OWdS6DMmeWb7bJBGqPxYZpQbzBlBiXZUu2sqo6Ii7Sjs9GeK1IsrXrWk26SL2c6KEseabswdxrRj7WUm9LdECw==
  dependencies:
    "@rc-component/context" "^2.0.1"
    "@rc-component/resize-observer" "^1.0.0"
@@ -3818,10 +3835,10 @@
    "@rc-component/virtual-list" "^1.0.1"
    clsx "^2.1.1"

-"@rc-component/tabs@~1.11.0":
-  version "1.11.0"
-  resolved "https://registry.yarnpkg.com/@rc-component/tabs/-/tabs-1.11.0.tgz#c157b2fadcdc2f3ab6c69d0098f73e03c6aa0c12"
-  integrity sha512-hA/drZYOVa/MMIb4M2fWf3yaTyTG4qVuIABmghvEhyfw2nBob5VTH69lMCDjSVKmgODjO6nWlCV+gVn3xBrj5Q==
+"@rc-component/tabs@~1.12.0":
+  version "1.12.0"
+  resolved "https://registry.yarnpkg.com/@rc-component/tabs/-/tabs-1.12.0.tgz#41a1a77ed1afc4f1b8b727003a058c631aceea1b"
+  integrity sha512-XL7Kqy5fnUE2WTlO1/fCGrrfNlGFebdr7JseGkEIjzcVMAtIFQJ8sqCSOmxcXstjU6fonD/4rnhZHxj7sDTajQ==
  dependencies:
    "@rc-component/dropdown" "~1.0.0"
    "@rc-component/menu" "~1.4.0"
@@ -3830,13 +3847,13 @@
    "@rc-component/util" "^1.11.1"
    clsx "^2.1.1"

-"@rc-component/tooltip@~1.4.0":
-  version "1.4.0"
-  resolved "https://registry.yarnpkg.com/@rc-component/tooltip/-/tooltip-1.4.0.tgz#c8cf15c6773218a5a36271467f06e663f99c28e7"
-  integrity sha512-8Rx5DCctIlLI4raR0I0xHjVTf1aF48+gKCNeAAo5bmF5VoR5YED+A/XEqzXv9KKqrJDRcd3Wndpxh2hyzrTtSg==
+"@rc-component/tooltip@~1.5.0":
+  version "1.5.0"
+  resolved "https://registry.yarnpkg.com/@rc-component/tooltip/-/tooltip-1.5.0.tgz#422aa0760b310e0a1d0f9f7223e7f0d455de57a2"
+  integrity sha512-agQ/+mBqrEQfTX4D3KhQ7j+ZbX4/VHjoJ7Noa2wIdZ1/FbQTOd7Sn92rp+jtCoqAVTLUgSOydePIgZ204gi2EQ==
  dependencies:
-    "@rc-component/trigger" "^3.7.1"
-    "@rc-component/util" "^1.3.0"
+    "@rc-component/trigger" "^3.10.0"
+    "@rc-component/util" "^1.11.1"
    clsx "^2.1.1"

 "@rc-component/tour@~2.4.0":
@@ -3849,27 +3866,27 @@
    "@rc-component/util" "^1.7.0"
    clsx "^2.1.1"

-"@rc-component/tree-select@~1.11.0":
-  version "1.11.0"
-  resolved "https://registry.yarnpkg.com/@rc-component/tree-select/-/tree-select-1.11.0.tgz#9080cdf1d28f2ddd6d8a4879b7aa90d3170f7db9"
-  integrity sha512-EhS0X0wtUhBfK4S5TlpSY3MR9ndPMGgujtt1PJW3Ej+ToAlnS/6ohYURtCoXBYGqazUwHmgQGVUDsfpVwhWPkg==
+"@rc-component/tree-select@~1.16.0":
+  version "1.16.1"
+  resolved "https://registry.yarnpkg.com/@rc-component/tree-select/-/tree-select-1.16.1.tgz#dcaea96e396e98108cb29cc051840d4fbdda38cc"
+  integrity sha512-a1Oi6EJhqAhdOxxupdJi6fP0RPHMKn5TcfkX2+llaQ4lF4nwfH7b6SCHcnsybaa2s+pk1yZYwVyeOYkDnEBRdg==
  dependencies:
-    "@rc-component/select" "~1.8.0"
-    "@rc-component/tree" "~1.3.2"
+    "@rc-component/select" "~1.10.0"
+    "@rc-component/tree" "~1.4.0"
    "@rc-component/util" "^1.11.1"
    clsx "^2.1.1"

-"@rc-component/tree@~1.3.2":
-  version "1.3.2"
-  resolved "https://registry.yarnpkg.com/@rc-component/tree/-/tree-1.3.2.tgz#4b0c13564314eff61ca948c18ef923b87c9d7e44"
-  integrity sha512-bJFj46wEkpBPnWyTm18XmgAgNQ/4YvprxMOPPY2a6rmhGJYxLuNKEFiL5Qej4Qctu9wHJm8WW+v2SYskafE0kA==
+"@rc-component/tree@~1.4.0":
+  version "1.4.0"
+  resolved "https://registry.yarnpkg.com/@rc-component/tree/-/tree-1.4.0.tgz#c0031180e681389bf0bdcb867a0087525b45c8a9"
+  integrity sha512-dGsJGDJQedA0BqqVgj3F8BvHXTSZijyhTXdbAdkcx8lynzZkty/CV3Z3LOm/fxz+BCfl3dfGiAQpb7Q5XNvl0Q==
  dependencies:
    "@rc-component/motion" "^1.0.0"
    "@rc-component/util" "^1.11.1"
    "@rc-component/virtual-list" "^1.2.0"
    clsx "^2.1.1"

-"@rc-component/trigger@^3.0.0", "@rc-component/trigger@^3.10.1", "@rc-component/trigger@^3.6.15", "@rc-component/trigger@^3.7.1":
+"@rc-component/trigger@^3.0.0", "@rc-component/trigger@^3.10.0", "@rc-component/trigger@^3.10.1", "@rc-component/trigger@^3.6.15":
  version "3.10.1"
  resolved "https://registry.yarnpkg.com/@rc-component/trigger/-/trigger-3.10.1.tgz#cb28e1bc0745a2af6897dd7ec774f9b56dc88f86"
  integrity sha512-mXlDN0IXdtV8Yqqm8195ECCyrbmfvvfKvwVvSlH0+qvKD6BUF8gRhEjSy0FOcD1+CcDRHgTiX99LoxfQrmh3Cw==
@@ -3888,7 +3905,7 @@
    "@rc-component/util" "^1.11.1"
    clsx "^2.1.1"

-"@rc-component/util@^1.10.1", "@rc-component/util@^1.11.0", "@rc-component/util@^1.11.1", "@rc-component/util@^1.12.0", "@rc-component/util@^1.2.0", "@rc-component/util@^1.2.1", "@rc-component/util@^1.3.0", "@rc-component/util@^1.4.0", "@rc-component/util@^1.7.0", "@rc-component/util@^1.9.0":
+"@rc-component/util@^1.11.0", "@rc-component/util@^1.11.1", "@rc-component/util@^1.12.0", "@rc-component/util@^1.2.0", "@rc-component/util@^1.2.1", "@rc-component/util@^1.3.0", "@rc-component/util@^1.3.1", "@rc-component/util@^1.4.0", "@rc-component/util@^1.7.0", "@rc-component/util@^1.9.0":
  version "1.12.0"
  resolved "https://registry.yarnpkg.com/@rc-component/util/-/util-1.12.0.tgz#58e453585810bcb8a35ff1aafd5e01187457b86f"
  integrity sha512-AEjPL8JVdohIITaiXokyjL9WQ6tKWWjAYK9QU16tGNE9JaQABBQy+hA4H2Lup5MgXy9yY3iLrbZJheuU13hTdQ==
@@ -3906,6 +3923,16 @@
    "@rc-component/util" "^1.4.0"
    clsx "^2.1.1"

+"@rc-component/virtual-list@^1.4.0":
+  version "1.5.1"
+  resolved "https://registry.yarnpkg.com/@rc-component/virtual-list/-/virtual-list-1.5.1.tgz#71c5844a8d6bd5b3501dfb66419d3a4612b2bb18"
+  integrity sha512-boqHxdtyWC88u8quYgEO49bcBy5fzRiOcnBge+N4nLzs2k8hUQ/yw7JE9dM6yCBE4jSm5YSHVCVMS+suBuJGKA==
+  dependencies:
+    "@babel/runtime" "^8.0.0"
+    "@rc-component/resize-observer" "^1.0.1"
+    "@rc-component/util" "^1.4.0"
+    clsx "^2.1.1"
+
 "@redocly/ajv@^8.18.1":
  version "8.18.3"
  resolved "https://registry.yarnpkg.com/@redocly/ajv/-/ajv-8.18.3.tgz#a925753d9a33375219f1b2ba91aef320f9929577"
@@ -5658,110 +5685,100 @@
  dependencies:
    "@types/yargs-parser" "*"

-"@typescript-eslint/eslint-plugin@8.66.0", "@typescript-eslint/eslint-plugin@^8.66.0":
-  version "8.66.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.66.0.tgz#76e86aa5a2459fbf5bbd7a839c0dc0cce1d56224"
-  integrity sha512-p088eaGrzYz1s+7cov0aMOCkNGTJlVxF4jgubf28c8L0Cv9Rloj8YBHnv4hXLq6IIEE1AsjNWavO+k+8kP2Y0A==
+"@typescript-eslint/eslint-plugin@8.67.0", "@typescript-eslint/eslint-plugin@^8.67.0":
+  version "8.67.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.67.0.tgz#52f9f0e47d5a7571c4336e69bfeea581509ef2cf"
+  integrity sha512-Un7Heoyj65NREbKAyIrFxeM143NZpExWmy1Nep4DLeQOeLlTeumPjoNKnBrU5D5moWXbPJgRa5Uwcdu0faVNGQ==
  dependencies:
    "@eslint-community/regexpp" "^4.12.2"
-    "@typescript-eslint/scope-manager" "8.66.0"
-    "@typescript-eslint/type-utils" "8.66.0"
-    "@typescript-eslint/utils" "8.66.0"
-    "@typescript-eslint/visitor-keys" "8.66.0"
+    "@typescript-eslint/scope-manager" "8.67.0"
+    "@typescript-eslint/type-utils" "8.67.0"
+    "@typescript-eslint/utils" "8.67.0"
+    "@typescript-eslint/visitor-keys" "8.67.0"
    ignore "^7.0.5"
    natural-compare "^1.4.0"
    ts-api-utils "^2.5.0"

-"@typescript-eslint/parser@8.66.0", "@typescript-eslint/parser@^8.66.0":
-  version "8.66.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/parser/-/parser-8.66.0.tgz#88e3865ecf73b0118134e7cb831da87a961a57a1"
-  integrity sha512-X6ypGChaWYk6PBtUg2BwuTZEFFcHJAtGTVJ9/lCTOufhZ4i9fNolQNnktq+kkMCwMj7V8Svsq7+TxSDslmhE0g==
+"@typescript-eslint/parser@8.67.0", "@typescript-eslint/parser@^8.67.0":
+  version "8.67.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/parser/-/parser-8.67.0.tgz#0158022ec9927e0afcd58a8cc2ad57e01d892f5c"
+  integrity sha512-fUBfTuuEulWqX6V8+O3PtScV01tzYYRUDTAirHFKoRAt7nOzoGiPt0M/bB47wWNy0coOOcgEwAMUtBpykMxl6w==
  dependencies:
-    "@typescript-eslint/scope-manager" "8.66.0"
-    "@typescript-eslint/types" "8.66.0"
-    "@typescript-eslint/typescript-estree" "8.66.0"
-    "@typescript-eslint/visitor-keys" "8.66.0"
+    "@typescript-eslint/scope-manager" "8.67.0"
+    "@typescript-eslint/types" "8.67.0"
+    "@typescript-eslint/typescript-estree" "8.67.0"
+    "@typescript-eslint/visitor-keys" "8.67.0"
    debug "^4.4.3"

-"@typescript-eslint/project-service@8.66.0":
-  version "8.66.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/project-service/-/project-service-8.66.0.tgz#828f788895df52d9eb2b543445a3a5a13e35ab4e"
-  integrity sha512-7MthGPTt4BP69lSryqpqq8HQqxuzynssckL/jyDyk3+TNMQ3y2jFWkptCrktWvBrP+EH787Nl5N5Qpw7WZg+5g==
+"@typescript-eslint/project-service@8.67.0":
+  version "8.67.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/project-service/-/project-service-8.67.0.tgz#1552db007ca9206a1c6c7acf49e210bd17a8c56f"
+  integrity sha512-cvE8c7ulYeXN9fYuszhCeCsbzyVEXuhrRCybnBre7TUmqb5nRmBfQAwCj0O3WJFDeyAZt4VYv51vMCC9LHSdYw==
  dependencies:
-    "@typescript-eslint/tsconfig-utils" "^8.66.0"
-    "@typescript-eslint/types" "^8.66.0"
+    "@typescript-eslint/tsconfig-utils" "^8.67.0"
+    "@typescript-eslint/types" "^8.67.0"
    debug "^4.4.3"

-"@typescript-eslint/scope-manager@8.66.0":
-  version "8.66.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/scope-manager/-/scope-manager-8.66.0.tgz#4fffcc6ebd0df9fe7983c0256967567ea6f5ac63"
-  integrity sha512-8TGcH25j9zqJ/IULB/ppyhRvxA8QYfFEZ7nfbg6/BN9spDgb8fPWQXlE5l8TWBL50EtUx007uZ1o9VOwrq2/9g==
+"@typescript-eslint/scope-manager@8.67.0":
+  version "8.67.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/scope-manager/-/scope-manager-8.67.0.tgz#4d4c2da09560d10dd7d947cba2d29d14d25af16d"
+  integrity sha512-EgvsleTwS4E+WzzSvem8fAUubLwatMNF1B5hHSLQxcvs7q2dtRhGyujHwLJSYlG41niJ7GP24Aha2+0mb1b2kg==
  dependencies:
-    "@typescript-eslint/types" "8.66.0"
-    "@typescript-eslint/visitor-keys" "8.66.0"
+    "@typescript-eslint/types" "8.67.0"
+    "@typescript-eslint/visitor-keys" "8.67.0"

-"@typescript-eslint/tsconfig-utils@8.66.0":
-  version "8.66.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.66.0.tgz#3a89066c507aa30541dc176804685b4b444e1e52"
-  integrity sha512-9D5gLYZG4rOjcoag8MQ/fWI8WqA9wcPDyOGyWtWFhvM1lHRbliqUSPIY5J3zqCU1tvSwzXxnnjhQhz5Ne7mJ4g==
-
-"@typescript-eslint/tsconfig-utils@^8.66.0":
+"@typescript-eslint/tsconfig-utils@8.67.0", "@typescript-eslint/tsconfig-utils@^8.67.0":
  version "8.67.0"
  resolved "https://registry.yarnpkg.com/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.67.0.tgz#f45a3eba6b9132fb47141ec03ce2f275f1ea991d"
  integrity sha512-vV+LUSv5njUWsknE71fqKTlXUva+R76SaeORd6Zojcunk/6DvKFXONU3BrAs2H49mbygUXt6gbYunzwqNwlhdg==

-"@typescript-eslint/type-utils@8.66.0":
-  version "8.66.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/type-utils/-/type-utils-8.66.0.tgz#b2315303eca72fad9afa7be4f58f053c8f2a0479"
-  integrity sha512-LG2dWfjZQQp0ADtAu/EWJVayefGL2UEZ3CDeI44D9v3rXB/WYUqE/jpO28KrEKul5AySrmI+Zh1v6v+xW2U9+g==
+"@typescript-eslint/type-utils@8.67.0":
+  version "8.67.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/type-utils/-/type-utils-8.67.0.tgz#96bed105275559df3bcf0449b73a6414d35c59ce"
+  integrity sha512-aVWDXbRmdXO9siTfX4ditQI1T9+zVcNazT48EJCD0v40/9RIFoUgZ05CmGEq9H2gixRpjUn/iplwvlcvutJW/Q==
  dependencies:
-    "@typescript-eslint/types" "8.66.0"
-    "@typescript-eslint/typescript-estree" "8.66.0"
-    "@typescript-eslint/utils" "8.66.0"
+    "@typescript-eslint/types" "8.67.0"
+    "@typescript-eslint/typescript-estree" "8.67.0"
+    "@typescript-eslint/utils" "8.67.0"
    debug "^4.4.3"
    ts-api-utils "^2.5.0"

-"@typescript-eslint/types@8.66.0":
-  version "8.66.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/types/-/types-8.66.0.tgz#3cacab94d3b564c1d48c56eb37b89f89a6d48479"
-  integrity sha512-H6gcYaSDOyvL3AD/jHUtUFo2jqGgn/F6nuyuZSu0QTesxL+cP4dQoIMrODRofuJC09g64+WgZ6tE19Y1N2YIFQ==
-
-"@typescript-eslint/types@^8.66.0":
+"@typescript-eslint/types@8.67.0", "@typescript-eslint/types@^8.67.0":
  version "8.67.0"
  resolved "https://registry.yarnpkg.com/@typescript-eslint/types/-/types-8.67.0.tgz#4a8d00cc1faba5c14feabc60f85b7a32652f34b6"
  integrity sha512-sBtgslww8nsMYUjhdPBiSyUqSzT8uR6g93A2QXnQC8+cGdjz0CyaOdqHDRJb1AtORbZCNUJBBeFA/tNR2uQmww==

-"@typescript-eslint/typescript-estree@8.66.0":
-  version "8.66.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/typescript-estree/-/typescript-estree-8.66.0.tgz#1a38c3a97dc6c669b66d585d7f90ebc4fbb32a50"
-  integrity sha512-8/x4INiiQb10jGgXYD7116/zQ+OL84ZIFn0za68wwFHCanT/VLbBEroWht8RV8fn0/ZCAoazHLQgwUC0UQcDfg==
+"@typescript-eslint/typescript-estree@8.67.0":
+  version "8.67.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/typescript-estree/-/typescript-estree-8.67.0.tgz#116c3a47c06119c5a050e8851861d6497dd64bc2"
+  integrity sha512-EKQBCE9yNlRJYm7jdTW5AhDacDUmSwQb0FAJAmK2EKYrNXIsa2vxcSZx6PvJ/dEdI6lS+Y9W+EXckLj0iPFGcw==
  dependencies:
-    "@typescript-eslint/project-service" "8.66.0"
-    "@typescript-eslint/tsconfig-utils" "8.66.0"
-    "@typescript-eslint/types" "8.66.0"
-    "@typescript-eslint/visitor-keys" "8.66.0"
+    "@typescript-eslint/project-service" "8.67.0"
+    "@typescript-eslint/tsconfig-utils" "8.67.0"
+    "@typescript-eslint/types" "8.67.0"
+    "@typescript-eslint/visitor-keys" "8.67.0"
    debug "^4.4.3"
    minimatch "^10.2.2"
    semver "^7.7.3"
    tinyglobby "^0.2.15"
    ts-api-utils "^2.5.0"

-"@typescript-eslint/utils@8.66.0":
-  version "8.66.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/utils/-/utils-8.66.0.tgz#e277d67427043cdca2580ee91aa62921e4689969"
-  integrity sha512-jasearZPolBw5NJNYGMwxzHMF83niVWmMU1VdHzG1CyfI2VS7f7nZltnKtHcg20hW+7Uo5GfK4MeDPoU3qI8EA==
+"@typescript-eslint/utils@8.67.0":
+  version "8.67.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/utils/-/utils-8.67.0.tgz#3e478a3d69d330a1fc50c12746cc2ee0732ccfcd"
+  integrity sha512-U9D1FdwEWBwok3hxxSdhclMb0twvt9QnjIQ0VfQ1AiX2epnpSgv2ubVDsayOFyY8K6FX+AQ7E0FKWVG3iKsj1A==
  dependencies:
    "@eslint-community/eslint-utils" "^4.9.1"
-    "@typescript-eslint/scope-manager" "8.66.0"
-    "@typescript-eslint/types" "8.66.0"
-    "@typescript-eslint/typescript-estree" "8.66.0"
+    "@typescript-eslint/scope-manager" "8.67.0"
+    "@typescript-eslint/types" "8.67.0"
+    "@typescript-eslint/typescript-estree" "8.67.0"

-"@typescript-eslint/visitor-keys@8.66.0":
-  version "8.66.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/visitor-keys/-/visitor-keys-8.66.0.tgz#4c494e94745fb2724a4f37a310091e56b644d18a"
-  integrity sha512-dkKR8q+lKciskj1Y3vthHktl+3cMLWGyVUP23bRiPZ5O9BRT++4EqDDV+TVeIKBL1VXVEqrJlz8MYbcnvJcAlg==
+"@typescript-eslint/visitor-keys@8.67.0":
+  version "8.67.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/visitor-keys/-/visitor-keys-8.67.0.tgz#601d40af9acf82a28da2286f3edafc69bba9017f"
+  integrity sha512-fkv8dHRDqfGtTHuJeebdrQ7cX6Ad4WAS00rgHh9UGvMycF1mjBfsxry1XsLIFhWZ6Judlh6UdzK+TYlbpCXgnA==
  dependencies:
-    "@typescript-eslint/types" "8.66.0"
+    "@typescript-eslint/types" "8.67.0"
    eslint-visitor-keys "^5.0.0"

 "@ungap/structured-clone@^1.0.0":
@@ -6164,10 +6181,10 @@ ansis@^3.2.0:
  resolved "https://registry.yarnpkg.com/ansis/-/ansis-3.17.0.tgz#fa8d9c2a93fe7d1177e0c17f9eeb562a58a832d7"
  integrity sha512-0qWUglt9JEqLFr3w1I1pbrChn1grhaiAR2ocX1PP/flRmxgtwTzPFFFnfIlD6aMOLQZgSuCRlidD70lvx8yhzg==

-antd@^6.5.4:
-  version "6.5.4"
-  resolved "https://registry.yarnpkg.com/antd/-/antd-6.5.4.tgz#b41665e86a5f46ca761abd3b0abef7460116ca0d"
-  integrity sha512-jchA6i0rEwHjLpgC+l6HeLHP0gL4Q4yjs6Mxqt6PlhGD5ArxCj3ZH+fKFbNquCtd6Rlzzi+emfNFpP2dGLwZzg==
+antd@^6.6.0:
+  version "6.6.0"
+  resolved "https://registry.yarnpkg.com/antd/-/antd-6.6.0.tgz#8acb84c54b36594b5c1a9084c8acb6a03b79961b"
+  integrity sha512-UDwWIbpmrCHB9ZQ+bPh4vQfB6DTI2ulIyoQ0Tc9xxalFblttiNGHl3ySBD9SyV/8+gUjFzfSx1+iU1Fog2i46w==
  dependencies:
    "@ant-design/colors" "^8.0.1"
    "@ant-design/cssinjs" "^2.1.2"
@@ -6176,7 +6193,7 @@ antd@^6.5.4:
    "@ant-design/icons" "^6.3.2"
    "@ant-design/react-slick" "~2.0.0"
    "@babel/runtime" "^7.29.2"
-    "@rc-component/cascader" "~1.17.0"
+    "@rc-component/cascader" "~1.22.0"
    "@rc-component/checkbox" "~2.0.0"
    "@rc-component/collapse" "~1.2.0"
    "@rc-component/color-picker" "~3.1.1"
@@ -6184,10 +6201,11 @@ antd@^6.5.4:
    "@rc-component/drawer" "~1.4.2"
    "@rc-component/dropdown" "~1.0.3"
    "@rc-component/form" "~1.8.6"
-    "@rc-component/image" "~1.9.0"
+    "@rc-component/image" "~1.10.0"
    "@rc-component/input" "~1.3.1"
    "@rc-component/input-number" "~1.6.2"
-    "@rc-component/mentions" "~1.10.0"
+    "@rc-component/listy" "~1.2.3"
+    "@rc-component/mentions" "~1.11.0"
    "@rc-component/menu" "~1.4.1"
    "@rc-component/motion" "^1.3.3"
    "@rc-component/mutate-observer" "^2.0.1"
@@ -6199,16 +6217,16 @@ antd@^6.5.4:
    "@rc-component/rate" "~1.0.1"
    "@rc-component/resize-observer" "^1.1.2"
    "@rc-component/segmented" "~1.3.0"
-    "@rc-component/select" "~1.8.2"
+    "@rc-component/select" "~1.10.0"
    "@rc-component/slider" "~1.1.1"
    "@rc-component/steps" "~1.2.2"
    "@rc-component/switch" "~1.0.3"
-    "@rc-component/table" "~1.10.4"
-    "@rc-component/tabs" "~1.11.0"
-    "@rc-component/tooltip" "~1.4.0"
+    "@rc-component/table" "~1.11.0"
+    "@rc-component/tabs" "~1.12.0"
+    "@rc-component/tooltip" "~1.5.0"
    "@rc-component/tour" "~2.4.0"
-    "@rc-component/tree" "~1.3.2"
-    "@rc-component/tree-select" "~1.11.0"
+    "@rc-component/tree" "~1.4.0"
+    "@rc-component/tree-select" "~1.16.0"
    "@rc-component/trigger" "^3.10.1"
    "@rc-component/upload" "~1.1.1"
    "@rc-component/util" "^1.12.0"
@@ -6504,10 +6522,10 @@ base64-js@^1.3.1, base64-js@^1.5.1:
  resolved "https://registry.yarnpkg.com/base64-js/-/base64-js-1.5.1.tgz#1b1b440160a5bf7ad40b650f095963481903930a"
  integrity sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==

-baseline-browser-mapping@^2.10.38, baseline-browser-mapping@^2.11.12, baseline-browser-mapping@^2.9.19:
-  version "2.11.12"
-  resolved "https://registry.yarnpkg.com/baseline-browser-mapping/-/baseline-browser-mapping-2.11.12.tgz#42ac48770bf73d292f60ce8ba4dc5e7ebb242ec3"
-  integrity sha512-r7WnVImvVCeFpf2DOXfy41aPWzeNg3H/A2X4dKmy1QL0MSyyk/e7z8ihJ3N6Nn2PsdhkVlqnEfnUE4a05P2aTA==
+baseline-browser-mapping@^2.10.38, baseline-browser-mapping@^2.11.13, baseline-browser-mapping@^2.9.19:
+  version "2.11.13"
+  resolved "https://registry.yarnpkg.com/baseline-browser-mapping/-/baseline-browser-mapping-2.11.13.tgz#660073103c1bee93e54df55f117b7528adf6af19"
+  integrity sha512-k9HNuUVMlqVjQ9UHzfPjIqiDbWw7WqT1AoT7GL8VwvF3r0ZfArtgiSPAlmupyNquNgOJHTuH4CKYf8ttMTWBTQ==

 batch@0.6.1:
  version "0.6.1"
@@ -6745,10 +6763,10 @@ caniuse-api@^3.0.0:
    lodash.memoize "^4.1.2"
    lodash.uniq "^4.5.0"

-caniuse-lite@^1.0.0, caniuse-lite@^1.0.30001799, caniuse-lite@^1.0.30001807:
-  version "1.0.30001807"
-  resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001807.tgz#a113854941fb45b4c1f51793f4636920489079b4"
-  integrity sha512-daRXJ9EB/rdRgu7kV+TTl1YUKtlsMWblPl2sLnpg9DZae16QCegol6A1SmCE31Lm9mXC1sRWGt/krouH+/dl7Q==
+caniuse-lite@^1.0.0, caniuse-lite@^1.0.30001799, caniuse-lite@^1.0.30001809:
+  version "1.0.30001809"
+  resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001809.tgz#e6cf71f14ddfe008f114dd2a846923be3c03a07b"
+  integrity sha512-xxWVywk6a6Arlk+hymeycyn/VgqEfLDxupvhH/xiY5SJ/18kmi9o6MiO320DCUzypORHLtvh0I4i04tUhCNHNQ==

 ccount@^2.0.0:
  version "2.0.1"
@@ -7996,10 +8014,10 @@ doctrine@^2.1.0:
  dependencies:
    esutils "^2.0.2"

-docusaurus-plugin-openapi-docs@^5.1.3:
-  version "5.1.3"
-  resolved "https://registry.yarnpkg.com/docusaurus-plugin-openapi-docs/-/docusaurus-plugin-openapi-docs-5.1.3.tgz#b8cd5f8451aaf881deb1a744a8295685f1681865"
-  integrity sha512-HnpblSBdXoR39VNTIW9zWERUsMJxXOpvdQoBKyaTkUBPwCM48Z76+ndo2yO2vADq+EhWjJlfxL1DUzCrgNjThQ==
+docusaurus-plugin-openapi-docs@^5.2.0:
+  version "5.2.0"
+  resolved "https://registry.yarnpkg.com/docusaurus-plugin-openapi-docs/-/docusaurus-plugin-openapi-docs-5.2.0.tgz#8318ec90cd21fed023be57696211af7d72fd81db"
+  integrity sha512-MjrfRAMB64uvdxRVz6L9AXWe4QFjCdoBAzYs306yyI3nnXHsFj2lv2FnLA90JV9CAUZaGiYMvvkzBo2Nrkq/9w==
  dependencies:
    "@apidevtools/json-schema-ref-parser" "^15.3.3"
    "@redocly/openapi-core" "^2.25.2"
@@ -8017,10 +8035,10 @@ docusaurus-plugin-openapi-docs@^5.1.3:
    swagger2openapi "^7.0.8"
    xml-formatter "^3.6.6"

-docusaurus-theme-openapi-docs@^5.1.3:
-  version "5.1.3"
-  resolved "https://registry.yarnpkg.com/docusaurus-theme-openapi-docs/-/docusaurus-theme-openapi-docs-5.1.3.tgz#e23644a63785352abbc76e42760c0dfdff3669e1"
-  integrity sha512-npbD1QahtjAEmrOet/86i5fTmcJX4/rPhVT+c0qKjm7StUNbyqjwchSVBQuU1rB69T51JOA9TpT/y6QcB9Xjvw==
+docusaurus-theme-openapi-docs@^5.2.0:
+  version "5.2.0"
+  resolved "https://registry.yarnpkg.com/docusaurus-theme-openapi-docs/-/docusaurus-theme-openapi-docs-5.2.0.tgz#6d93a74e2e3cf0ae77d24e1c4144bd2e74a52115"
+  integrity sha512-L0b80LzaMUfr76a9EQXRPCf8nxkEz8Xo6Aknnke1UeE2oXsgoiVki6U+RTE7GmJRjO8zSNKXyckGmGmqqWuHeA==
  dependencies:
    "@hookform/error-message" "^2.0.1"
    "@reduxjs/toolkit" "^2.8.2"
@@ -8105,7 +8123,7 @@ domhandler@^5.0.2, domhandler@^5.0.3:
  dependencies:
    domelementtype "^2.3.0"

-dompurify@^3.3.3, dompurify@^3.4.12:
+dompurify@^3.3.3, dompurify@^3.4.13:
  version "3.4.13"
  resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-3.4.13.tgz#fc28949d59f92d62e28a3a764bcbeee35897a1be"
  integrity sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ==
@@ -9156,10 +9174,10 @@ globals@^14.0.0:
  resolved "https://registry.yarnpkg.com/globals/-/globals-14.0.0.tgz#898d7413c29babcf6bafe56fcadded858ada724e"
  integrity sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==

-globals@^17.9.0:
-  version "17.9.0"
-  resolved "https://registry.yarnpkg.com/globals/-/globals-17.9.0.tgz#e43f252d6bbe71508da43902a1709c8895a59f70"
-  integrity sha512-m/MvAW61QVU5VDNF1Vj8axt016h8w7L5TU1e9zlab7XIttAT2YAlCwl75K1fOqvMM9apmD7lbCIRhpfkhmxhCg==
+globals@^17.10.0:
+  version "17.10.0"
+  resolved "https://registry.yarnpkg.com/globals/-/globals-17.10.0.tgz#f9dbd847ae99e236f98b13095e2426ac3b25a45c"
+  integrity sha512-V0kztuWST2k8A/VbxAY8+L+7+Rgo3fyA24IHRLrZp7HOzJjV0gHSaZUjK9lpP/IrBSNite2tZ1prhRkinRu1CA==

 globalthis@^1.0.4:
  version "1.0.4"
@@ -10266,10 +10284,10 @@ js-levenshtein@^1.1.6:
  resolved "https://registry.yarnpkg.com/js-tokens/-/js-tokens-4.0.0.tgz#19203fb59991df98e3a287050d4647cdeaf32499"
  integrity sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==

-js-yaml@4.1.0, js-yaml@=4.3.0, js-yaml@^4.1.0, js-yaml@^4.1.1, js-yaml@^4.2.0, js-yaml@^4.3.0:
-  version "4.3.0"
-  resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.3.0.tgz#d1900572a7f7cf0b5f540c83673e60bad3436592"
-  integrity sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==
+js-yaml@4.1.0, js-yaml@=4.3.1, js-yaml@^4.1.0, js-yaml@^4.1.1, js-yaml@^4.2.0, js-yaml@^4.3.0:
+  version "4.3.1"
+  resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.3.1.tgz#01216c001d67f48e2cd560d708c7af21090a3848"
+  integrity sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==
  dependencies:
    argparse "^2.0.1"

@@ -12244,32 +12262,32 @@ oxc-resolver@^11.19.1:
    "@oxc-resolver/binding-win32-arm64-msvc" "11.23.0"
    "@oxc-resolver/binding-win32-x64-msvc" "11.23.0"

-oxfmt@^0.62.0:
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/oxfmt/-/oxfmt-0.62.0.tgz#9945728022d26dc0a1d5bc486db112e7e340507a"
-  integrity sha512-vxgGHTmnDU9j4CX7dDBLzxgmHxfda/yPcgJkGCMUSCwRmz+euo/V08xXLNgXTeqAB9Fhf3Pe2nO1RNKLCVgphQ==
+oxfmt@^0.63.0:
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/oxfmt/-/oxfmt-0.63.0.tgz#c7338e6c43a68d5cf8dc61c08b617d77cb54e323"
+  integrity sha512-kgdDwv35wvVf6554U2Ab8Jnd0zTM+TsEQWwaB70RAjK3gICFAFGO+2Hd3Be27GMoXj3XRL9IKSNRVl7KBQL6iw==
  dependencies:
    tinypool "2.1.0"
  optionalDependencies:
-    "@oxfmt/binding-android-arm-eabi" "0.62.0"
-    "@oxfmt/binding-android-arm64" "0.62.0"
-    "@oxfmt/binding-darwin-arm64" "0.62.0"
-    "@oxfmt/binding-darwin-x64" "0.62.0"
-    "@oxfmt/binding-freebsd-x64" "0.62.0"
-    "@oxfmt/binding-linux-arm-gnueabihf" "0.62.0"
-    "@oxfmt/binding-linux-arm-musleabihf" "0.62.0"
-    "@oxfmt/binding-linux-arm64-gnu" "0.62.0"
-    "@oxfmt/binding-linux-arm64-musl" "0.62.0"
-    "@oxfmt/binding-linux-ppc64-gnu" "0.62.0"
-    "@oxfmt/binding-linux-riscv64-gnu" "0.62.0"
-    "@oxfmt/binding-linux-riscv64-musl" "0.62.0"
-    "@oxfmt/binding-linux-s390x-gnu" "0.62.0"
-    "@oxfmt/binding-linux-x64-gnu" "0.62.0"
-    "@oxfmt/binding-linux-x64-musl" "0.62.0"
-    "@oxfmt/binding-openharmony-arm64" "0.62.0"
-    "@oxfmt/binding-win32-arm64-msvc" "0.62.0"
-    "@oxfmt/binding-win32-ia32-msvc" "0.62.0"
-    "@oxfmt/binding-win32-x64-msvc" "0.62.0"
+    "@oxfmt/binding-android-arm-eabi" "0.63.0"
+    "@oxfmt/binding-android-arm64" "0.63.0"
+    "@oxfmt/binding-darwin-arm64" "0.63.0"
+    "@oxfmt/binding-darwin-x64" "0.63.0"
+    "@oxfmt/binding-freebsd-x64" "0.63.0"
+    "@oxfmt/binding-linux-arm-gnueabihf" "0.63.0"
+    "@oxfmt/binding-linux-arm-musleabihf" "0.63.0"
+    "@oxfmt/binding-linux-arm64-gnu" "0.63.0"
+    "@oxfmt/binding-linux-arm64-musl" "0.63.0"
+    "@oxfmt/binding-linux-ppc64-gnu" "0.63.0"
+    "@oxfmt/binding-linux-riscv64-gnu" "0.63.0"
+    "@oxfmt/binding-linux-riscv64-musl" "0.63.0"
+    "@oxfmt/binding-linux-s390x-gnu" "0.63.0"
+    "@oxfmt/binding-linux-x64-gnu" "0.63.0"
+    "@oxfmt/binding-linux-x64-musl" "0.63.0"
+    "@oxfmt/binding-openharmony-arm64" "0.63.0"
+    "@oxfmt/binding-win32-arm64-msvc" "0.63.0"
+    "@oxfmt/binding-win32-ia32-msvc" "0.63.0"
+    "@oxfmt/binding-win32-x64-msvc" "0.63.0"

 p-cancelable@^3.0.0:
  version "3.0.0"
@@ -15085,10 +15103,10 @@ swagger-client@^3.37.8:
    "@swagger-api/apidom-parser-adapter-openapi-yaml-3-2" "^1.12.0"
    "@swagger-api/apidom-parser-adapter-yaml-1-2" "^1.12.0"

-swagger-ui-react@^5.32.12:
-  version "5.32.12"
-  resolved "https://registry.yarnpkg.com/swagger-ui-react/-/swagger-ui-react-5.32.12.tgz#47525a26774eb02db0e6203af72f5b32fa6205cc"
-  integrity sha512-WCdkNOQyMTZDu+z356FpwVWHf1dwZgQPUjdQPh1L4r7jULaJTKKlIItXq6WsZdYeXvsHndMdxxccEQXOAroUHQ==
+swagger-ui-react@^5.32.13:
+  version "5.32.13"
+  resolved "https://registry.yarnpkg.com/swagger-ui-react/-/swagger-ui-react-5.32.13.tgz#04c96140b0a2d4ea01ebec4d4cfc655d5ed9a500"
+  integrity sha512-XIDl+Ny6kE1N8wpSPiOFrjPfAevs4GR4XmV6BT6NLMikkMFIbIVocWbA8pnKYyYXQe8Rccfli5o2zDfySw0FnQ==
  dependencies:
    "@babel/runtime-corejs3" "^7.27.1"
    "@scarf/scarf" "=1.4.0"
@@ -15097,11 +15115,11 @@ swagger-ui-react@^5.32.12:
    classnames "^2.5.1"
    css.escape "1.5.1"
    deep-extend "0.6.0"
-    dompurify "^3.4.12"
+    dompurify "^3.4.13"
    ieee754 "^1.2.1"
    immutable "^4.3.9"
    js-file-download "^0.4.12"
-    js-yaml "=4.3.0"
+    js-yaml "=4.3.1"
    lodash "^4.18.1"
    prop-types "^15.8.1"
    randexp "^0.5.3"
@@ -15467,15 +15485,15 @@ types-ramda@^0.30.1:
  dependencies:
    ts-toolbelt "^9.6.0"

-typescript-eslint@^8.66.0:
-  version "8.66.0"
-  resolved "https://registry.yarnpkg.com/typescript-eslint/-/typescript-eslint-8.66.0.tgz#0809b6d25c8a0924690ba30dc1f05607093c11fb"
-  integrity sha512-QlEbBPz/RuJ1XUHj29nm3t0F/O/cSlEnntozqPOYHnnTGAXFamnMBu5i9Vn6vhUPHGAjR+Vl+5J8vPN/BMUrJw==
+typescript-eslint@^8.67.0:
+  version "8.67.0"
+  resolved "https://registry.yarnpkg.com/typescript-eslint/-/typescript-eslint-8.67.0.tgz#1e92de09ee0ff2d96cc0848f5e9f345ea930d963"
+  integrity sha512-S2udFs8tCKEKffuJ4TB1idGUZiXdCPGi3IPBGWXarbLQ5UPXORV8QEVzJ4gCRduURMb5EkpNCdjbk0eDIuI8Yg==
  dependencies:
-    "@typescript-eslint/eslint-plugin" "8.66.0"
-    "@typescript-eslint/parser" "8.66.0"
-    "@typescript-eslint/typescript-estree" "8.66.0"
-    "@typescript-eslint/utils" "8.66.0"
+    "@typescript-eslint/eslint-plugin" "8.67.0"
+    "@typescript-eslint/parser" "8.67.0"
+    "@typescript-eslint/typescript-estree" "8.67.0"
+    "@typescript-eslint/utils" "8.67.0"

 typescript@~6.0.3:
  version "6.0.3"
@@ -18,8 +18,9 @@
 from __future__ import annotations

 import enum
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from datetime import date, datetime, time, timedelta
+from typing import Any

 import isodate
 import pyarrow as pa
@@ -90,6 +91,8 @@ class Dimension:
    definition: str | None = None
    description: str | None = None
    grain: Grain | None = None
+    verbose_name: str | None = field(default=None, compare=False)
+    metadata: dict[str, Any] = field(default_factory=dict, compare=False)


 class AggregationType(str, enum.Enum):
@@ -121,6 +124,9 @@ class Metric:
    definition: str
    description: str | None = None
    aggregation: AggregationType | None = None
+    verbose_name: str | None = field(default=None, compare=False)
+    d3format: str | None = field(default=None, compare=False)
+    metadata: dict[str, Any] = field(default_factory=dict, compare=False)


@dataclass(frozen=True)
@@ -0,0 +1,97 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+import pyarrow as pa
+from superset_core.semantic_layers.types import Dimension, Metric
+
+
+def test_dimension_metadata_is_not_part_of_identity() -> None:
+    first = Dimension(
+        "sales.region",
+        "region",
+        pa.utf8(),
+        verbose_name="Region",
+        metadata={"display_name": "Region"},
+    )
+    second = Dimension(
+        "sales.region",
+        "region",
+        pa.utf8(),
+        verbose_name="Sales region",
+        metadata={"display_name": "Sales region"},
+    )
+
+    assert first == second
+    assert {first, second} == {first}
+
+
+def test_metric_metadata_is_not_part_of_identity() -> None:
+    first = Metric(
+        "sales.total_revenue",
+        "total_revenue",
+        pa.float64(),
+        "SUM(revenue)",
+        verbose_name="Total revenue",
+        d3format="$,.2f",
+        metadata={"unit": {"kind": "currency", "code": "USD"}},
+    )
+    second = Metric(
+        "sales.total_revenue",
+        "total_revenue",
+        pa.float64(),
+        "SUM(revenue)",
+        verbose_name="Revenue",
+        d3format=",.0f",
+        metadata={"unit": {"kind": "currency", "code": "EUR"}},
+    )
+
+    assert first == second
+    assert {first, second} == {first}
+
+
+def test_metric_accepts_superset_presentation_fields() -> None:
+    metric = Metric(
+        "sales.total_revenue",
+        "total_revenue",
+        pa.float64(),
+        "SUM(revenue)",
+        verbose_name="Total revenue",
+        d3format="$,.2f",
+    )
+
+    assert metric.verbose_name == "Total revenue"
+    assert metric.d3format == "$,.2f"
+
+
+def test_dimension_accepts_superset_presentation_fields() -> None:
+    dimension = Dimension(
+        "sales.region",
+        "region",
+        pa.utf8(),
+        verbose_name="Region",
+    )
+
+    assert dimension.verbose_name == "Region"
+
+
+def test_metadata_defaults_are_not_shared() -> None:
+    first = Metric("first", "first", pa.int64(), "COUNT(*)")
+    second = Metric("second", "second", pa.int64(), "COUNT(*)")
+
+    first.metadata["display_name"] = "First"
+
+    assert second.metadata == {}
@@ -158,7 +158,7 @@
    "@visx/xychart": "^4.0.0",
    "ag-grid-community": "36.1.0",
    "ag-grid-react": "36.1.0",
-    "antd": "^6.5.4",
+    "antd": "^6.6.0",
    "chrono-node": "^2.10.1",
    "classnames": "^2.2.5",
    "content-disposition": "^2.0.1",
@@ -176,7 +176,7 @@
    "geostyler-openlayers-parser": "^5.7.1",
    "geostyler-style": "11.0.2",
    "geostyler-wfs-parser": "^3.0.1",
-    "google-auth-library": "^11.0.0",
+    "google-auth-library": "^11.0.1",
    "immer": "^11.1.16",
    "interweave": "^13.1.1",
    "jquery": "^4.0.0",
@@ -263,10 +263,10 @@
    "@storybook/test-runner": "0.24.4",
    "@svgr/webpack": "^8.1.0",
    "@swc/core": "^1.15.47",
-    "@swc/plugin-emotion": "^14.15.0",
+    "@swc/plugin-emotion": "^14.19.0",
    "@swc/plugin-transform-imports": "^12.5.0",
    "@testing-library/dom": "^10.4.1",
-    "@testing-library/jest-dom": "^7.0.0",
+    "@testing-library/jest-dom": "^7.0.1",
    "@testing-library/react": "^15.0.0",
    "@testing-library/user-event": "^12.8.3",
    "@types/content-disposition": "^0.5.9",
@@ -277,7 +277,7 @@
    "@types/json-bigint": "^1.0.4",
    "@types/lodash-es": "^4.17.12",
    "@types/mousetrap": "^1.6.15",
-    "@types/node": "^26.1.2",
+    "@types/node": "^26.2.0",
    "@types/react": "^18.3.0",
    "@types/react-dom": "^18.3.0",
    "@types/react-loadable": "^5.5.11",
@@ -289,19 +289,19 @@
    "@types/rison": "0.1.0",
    "@types/tinycolor2": "^1.4.3",
    "@types/unzipper": "^0.10.11",
-    "@typescript-eslint/eslint-plugin": "^8.66.0",
+    "@typescript-eslint/eslint-plugin": "^8.67.0",
    "@typescript-eslint/parser": "^8.63.0",
    "babel-jest": "^30.4.1",
    "babel-loader": "^10.1.1",
    "babel-plugin-dynamic-import-node": "^2.3.3",
    "babel-plugin-jsx-remove-data-test-id": "^3.0.0",
-    "baseline-browser-mapping": "^2.11.12",
+    "baseline-browser-mapping": "^2.11.13",
    "cheerio": "1.2.0",
    "concurrently": "^10.0.4",
    "copy-webpack-plugin": "^14.0.0",
    "cross-env": "^10.1.0",
    "css-loader": "^7.1.4",
-    "eslint": "^10.8.0",
+    "eslint": "^10.8.1",
    "eslint-import-resolver-alias": "^1.1.2",
    "eslint-import-resolver-typescript": "^4.4.5",
    "eslint-plugin-i18n-strings": "file:eslint-rules/eslint-plugin-i18n-strings",
@@ -331,8 +331,8 @@
    "mini-css-extract-plugin": "^2.10.2",
    "minimizer-webpack-plugin": "^5.6.1",
    "open-cli": "^9.0.0",
-    "oxfmt": "^0.62.0",
-    "oxlint": "^1.77.0",
+    "oxfmt": "^0.63.0",
+    "oxlint": "^1.78.0",
    "po2json": "^0.4.5",
    "postcss-styled-syntax": "^0.7.2",
    "process": "^0.11.10",
@@ -349,7 +349,7 @@
    "swc-loader": "^0.2.7",
    "ts-jest": "^29.4.12",
    "tscw-config": "^1.1.2",
-    "tsx": "^4.23.10",
+    "tsx": "^4.23.12",
    "typescript": "5.4.5",
    "unzipper": "^0.12.5",
    "wait-on": "^9.1.0",
@@ -35,6 +35,10 @@
      "types": "./lib/commands/index.d.ts",
      "default": "./lib/commands/index.js"
    },
+    "./dashboardComponents": {
+      "types": "./lib/dashboardComponents/index.d.ts",
+      "default": "./lib/dashboardComponents/index.js"
+    },
    "./editors": {
      "types": "./lib/editors/index.d.ts",
      "default": "./lib/editors/index.js"
@@ -130,6 +130,7 @@ export enum GenericDataType {
  String = 1,
  Temporal = 2,
  Boolean = 3,
+  MultiValue = 4,
 }

 /**
@@ -28,6 +28,7 @@

 import { Chat } from '../chat';
 import { Command } from '../commands';
+import { DashboardComponentDefinition } from '../dashboardComponents';
 import { View } from '../views';
 import { Menu } from '../menus';
 import { Editor } from '../editors';
@@ -90,4 +91,9 @@ export interface Contributions {
   * chat at a time.
   */
  chat?: Chat;
+  /**
+   * Dashboard layout components contributed by the extension. Each becomes a
+   * first-class, draggable element in the dashboard builder palette.
+   */
+  dashboardComponents?: DashboardComponentDefinition[];
 }
@@ -0,0 +1,158 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * @fileoverview Dashboard component contribution API for Superset extensions.
+ *
+ * A dashboard component is a first-class dashboard layout element (like the
+ * built-in Markdown or iframe) contributed by an extension. The extension
+ * provides a single React component that renders the element's *content*; the
+ * host owns the surrounding chrome (drag handle, resize, delete) so the
+ * contributed component stays small and the contract stable.
+ *
+ * This replaces the legacy `DashboardComponentsRegistry` / `DYNAMIC_TYPE`
+ * mechanism, which is deprecated.
+ *
+ * @example
+ * ```typescript
+ * import { dashboardComponents } from '@apache-superset/core';
+ *
+ * dashboardComponents.registerDashboardComponent(
+ *   {
+ *     id: 'acme.weather',
+ *     name: 'Weather widget',
+ *     icon: 'CloudOutlined',
+ *     resizable: true,
+ *     defaultMeta: { width: 4, height: 50 },
+ *   },
+ *   WeatherWidget,
+ * );
+ * ```
+ */
+
+import { ComponentType } from 'react';
+import type { Disposable, Event } from '../common';
+
+/**
+ * Props passed by the host to a contributed dashboard component. The host
+ * renders this component inside its own drag/resize/delete chrome, so the
+ * component only needs to render content (and, in edit mode, its own editor
+ * affordances). Persisted state lives in `meta`; mutate it via `updateMeta`.
+ */
+export interface DashboardComponentProps {
+  /** The layout item id of this component instance. */
+  id: string;
+  /** The component instance's persisted meta (round-trips in the layout). */
+  meta: Record<string, unknown>;
+  /** Whether the dashboard is in edit mode. */
+  editMode: boolean;
+  /** Shallow-merge a patch into this component's persisted meta. */
+  updateMeta: (patch: Record<string, unknown>) => void;
+}
+
+/**
+ * Declarative descriptor for a contributed dashboard component. The behavior
+ * fields replace what was historically hardcoded in the dashboard util maps
+ * (resizability, default sizing, nesting, etc.).
+ */
+export interface DashboardComponentDefinition {
+  /** Namespaced unique id, e.g. "acme.weather" or "superset.iframe". */
+  id: string;
+  /** Human-readable label shown in the builder palette. */
+  name: string;
+  /** Optional longer description. */
+  description?: string;
+  /** Icon id (a known Superset icon name) shown in the palette. */
+  icon?: string;
+  /** Whether instances can be resized. Defaults to true. */
+  resizable?: boolean;
+  /** Default `meta` seeded onto a newly created instance (e.g. width/height). */
+  defaultMeta?: Record<string, unknown>;
+  /**
+   * Whether an instance counts as user content for "is this dashboard empty?"
+   * detection. Defaults to true.
+   */
+  isUserContent?: boolean;
+  /** Minimum width in grid columns. Defaults to 1. */
+  minWidth?: number;
+  /**
+   * Restrict which container types may hold this component (e.g.
+   * `['GRID', 'TAB']`). When omitted, the component is allowed wherever a
+   * standard content leaf is allowed (grid, row, column, tab).
+   */
+  validParents?: string[];
+  /**
+   * Whether a drop into the grid or a tab auto-wraps the component in a row.
+   * Defaults to true (matching built-in content components).
+   */
+  wrapInRow?: boolean;
+}
+
+/**
+ * The subset of a definition's behavior that is seeded onto each instance's
+ * `meta` at creation, so the dashboard layout engine can honor it (and so it
+ * round-trips in the saved layout even if the extension later becomes
+ * unavailable). Read by the dashboard util maps; not part of the rendered
+ * component's concern.
+ */
+export interface DashboardComponentBehaviorMeta {
+  extensionComponentId: string;
+  resizable?: boolean;
+  isUserContent?: boolean;
+  minWidth?: number;
+  validParents?: string[];
+  wrapInRow?: boolean;
+}
+
+/**
+ * A registered dashboard component: its definition plus the React component
+ * the host renders.
+ */
+export interface RegisteredDashboardComponent {
+  definition: DashboardComponentDefinition;
+  Component: ComponentType<DashboardComponentProps>;
+}
+
+/**
+ * Registers a dashboard component. Disposing the returned Disposable
+ * unregisters it. Registering a second component with the same id replaces the
+ * first.
+ *
+ * @param definition The component descriptor (id, name, behavior).
+ * @param component The React component rendering the element's content.
+ * @returns A Disposable that unregisters the component when disposed.
+ */
+export declare function registerDashboardComponent(
+  definition: DashboardComponentDefinition,
+  component: ComponentType<DashboardComponentProps>,
+): Disposable;
+
+/** Returns the registered component for `id`, or undefined. */
+export declare function getDashboardComponent(
+  id: string,
+): RegisteredDashboardComponent | undefined;
+
+/** Returns all registered dashboard components. */
+export declare function getDashboardComponents(): RegisteredDashboardComponent[];
+
+/** Event fired when a dashboard component is registered. */
+export declare const onDidRegisterDashboardComponent: Event<DashboardComponentDefinition>;
+
+/** Event fired when a dashboard component is unregistered. */
+export declare const onDidUnregisterDashboardComponent: Event<DashboardComponentDefinition>;
@@ -20,6 +20,7 @@ export * as common from './common';
 export * as authentication from './authentication';
 export * as chat from './chat';
 export * as commands from './commands';
+export * as dashboardComponents from './dashboardComponents';
 export * as editors from './editors';
 export * as extensions from './extensions';
 export * as menus from './menus';
@@ -28,6 +28,7 @@ import {
  FieldBinaryOutlined,
  FieldStringOutlined,
  NumberOutlined,
+  UnorderedListOutlined,
 } from '@ant-design/icons';
 import { Icons } from '@superset-ui/core/components';

@@ -72,6 +73,10 @@ export function ColumnTypeLabel({ type }: ColumnTypeLabelProps) {
    typeIcon = <FieldBinaryOutlined aria-label={t('boolean type icon')} />;
  } else if (type === GenericDataType.Temporal) {
    typeIcon = <ClockCircleOutlined aria-label={t('temporal type icon')} />;
+  } else if (type === GenericDataType.MultiValue) {
+    typeIcon = (
+      <UnorderedListOutlined aria-label={t('multi-value type icon')} />
+    );
  }

  return <TypeIconWrapper>{typeIcon}</TypeIconWrapper>;
@@ -64,4 +64,21 @@ describe('ColumnOption', () => {
    renderColumnTypeLabel({ type: GenericDataType.Temporal });
    expect(screen.getByLabelText('temporal type icon')).toBeVisible();
  });
+  test('multi-value (array) type shows list icon', () => {
+    renderColumnTypeLabel({ type: GenericDataType.MultiValue });
+    expect(screen.getByLabelText('multi-value type icon')).toBeVisible();
+  });
+});
+
+describe('GenericDataType enum parity', () => {
+  // These numeric values are shared with the backend enum in
+  // superset/utils/core.py (GenericDataType). They must stay in sync because
+  // the backend serializes columns using these integers.
+  test('values match the backend contract', () => {
+    expect(GenericDataType.Numeric).toBe(0);
+    expect(GenericDataType.String).toBe(1);
+    expect(GenericDataType.Temporal).toBe(2);
+    expect(GenericDataType.Boolean).toBe(3);
+    expect(GenericDataType.MultiValue).toBe(4);
+  });
 });
@@ -103,7 +103,7 @@
    "@types/d3-time-format": "^4.0.3",
    "@types/jquery": "^4.0.1",
    "@types/lodash": "^4.17.25",
-    "@types/node": "^26.1.2",
+    "@types/node": "^26.2.0",
    "@types/prop-types": "^15.7.15",
    "@types/react-syntax-highlighter": "^15.5.13",
    "@types/react-table": "^7.7.20",
@@ -107,12 +107,14 @@ const getAllSelectOptions = () =>

 const findSelectOption = (text: string) =>
  waitFor(() =>
-    within(getElementByClassName('.rc-virtual-list')).getByText(text),
+    within(getElementByClassName('.ant-select-dropdown-list')).getByText(text),
  );

 const querySelectOption = (text: string) =>
  waitFor(() =>
-    within(getElementByClassName('.rc-virtual-list')).queryByText(text),
+    within(getElementByClassName('.ant-select-dropdown-list')).queryByText(
+      text,
+    ),
  );

 const findAllSelectOptions = () =>
@@ -644,7 +646,7 @@ test('does not add a new option if the option already exists', async () => {
  await type(option);
  await waitFor(() => {
    const array = within(
-      getElementByClassName('.rc-virtual-list'),
+      getElementByClassName('.ant-select-dropdown-list'),
    ).getAllByText(option);
    expect(array.length).toBe(1);
  });
@@ -1398,7 +1400,7 @@ test('appends page>1 results during an active search and discards them when sear
  // scrollTop via e.currentTarget in its onFallbackScroll handler, which
  // then forwards to onPopupScroll (handlePagination here).
  const holder = document.querySelector(
-    '.rc-virtual-list-holder',
+    '.ant-select-dropdown-list-holder',
  ) as HTMLElement | null;
  if (!holder) throw new Error('virtual-list holder not rendered');
  Object.defineProperty(holder, 'scrollHeight', {
@@ -93,12 +93,14 @@ const deselectAllButtonText = (length: number) =>

 const findSelectOption = (text: string) =>
  waitFor(() =>
-    within(getElementByClassName('.rc-virtual-list')).getByText(text),
+    within(getElementByClassName('.ant-select-dropdown-list')).getByText(text),
  );

 const querySelectOption = (text: string) =>
  waitFor(() =>
-    within(getElementByClassName('.rc-virtual-list')).queryByText(text),
+    within(getElementByClassName('.ant-select-dropdown-list')).queryByText(
+      text,
+    ),
  );

 const getAllSelectOptions = () =>
@@ -31,6 +31,7 @@ export enum FeatureFlag {
  AllowFullCsvExport = 'ALLOW_FULL_CSV_EXPORT',
  ChartPluginsExperimental = 'CHART_PLUGINS_EXPERIMENTAL',
  ConfirmDashboardDiff = 'CONFIRM_DASHBOARD_DIFF',
+  CspRuntimeAllowlist = 'CSP_RUNTIME_ALLOWLIST',
  CssTemplates = 'CSS_TEMPLATES',
  DashboardVirtualization = 'DASHBOARD_VIRTUALIZATION',
  DashboardVirtualizationDeferData = 'DASHBOARD_VIRTUALIZATION_DEFER_DATA',
@@ -19,19 +19,71 @@
 import { t } from '@apache-superset/core/translation';
 import { sanitizeHtml } from './html';

+export type TooltipTruncationMode = 'off' | 'end' | 'start' | 'middle';
+
+export const TRUNCATION_MAX_CHARS = 40;
+
 const TRUNCATION_STYLE = `
  max-width: 300px;
  overflow: hidden;
  text-overflow: ellipsis;
 `;

+const NOWRAP_STYLE = `
+  white-space: nowrap;
+`;
+
+/**
+ * Shortens plain text so a tooltip label stays readable, placing the ellipsis
+ * where the caller asked for it.
+ *
+ * Only 'start' and 'middle' slice. 'end' is handled by CSS in tooltipHtml, and
+ * 'off' means no truncation at all, so both return the input untouched.
+ *
+ * The input must be plain text. Callers are responsible for truncating before
+ * any markup (such as the ECharts series marker) is prepended, and before
+ * sanitization — slicing a string that already contains markup would cut into
+ * a tag.
+ */
+export function truncateLabel(
+  text: string,
+  mode: TooltipTruncationMode = 'end',
+): string {
+  if (
+    (mode !== 'start' && mode !== 'middle') ||
+    text.length <= TRUNCATION_MAX_CHARS
+  ) {
+    return text;
+  }
+  const budget = TRUNCATION_MAX_CHARS - 1;
+  if (mode === 'start') {
+    return `…${text.slice(-budget)}`;
+  }
+  const head = Math.ceil(budget / 2);
+  const tail = Math.floor(budget / 2);
+  return `${text.slice(0, head)}…${text.slice(-tail)}`;
+}
+
+function getTruncationStyle(mode: TooltipTruncationMode): string {
+  if (mode === 'end') {
+    return TRUNCATION_STYLE;
+  }
+  if (mode === 'off') {
+    return '';
+  }
+  // 'start' and 'middle' are already sliced upstream; keep them on one line.
+  return NOWRAP_STYLE;
+}
+
 export function tooltipHtml(
  data: string[][],
  title?: string,
  focusedRow?: number,
+  truncation: TooltipTruncationMode = 'end',
 ) {
+  const truncationStyle = getTruncationStyle(truncation);
  const titleRow = title
-    ? `<span style="font-weight: 700;${TRUNCATION_STYLE}">${title}</span>`
+    ? `<span style="font-weight: 700;${truncationStyle}">${title}</span>`
    : '';
  return sanitizeHtml(`
    <div>
@@ -46,7 +98,7 @@ export function tooltipHtml(
                const cellStyle = `
                  text-align: ${j > 0 ? 'right' : 'left'};
                  padding-left: ${j === 0 ? 0 : 16}px;
-                  ${TRUNCATION_STYLE}
+                  ${truncationStyle}
                `;
                return `<td style="${cellStyle}">${cell}</td>`;
              });
@@ -16,7 +16,12 @@
 * specific language governing permissions and limitations
 * under the License.
 */
-import { sanitizeHtml, tooltipHtml } from '@superset-ui/core';
+import {
+  sanitizeHtml,
+  tooltipHtml,
+  truncateLabel,
+  TRUNCATION_MAX_CHARS,
+} from '@superset-ui/core';

 const TITLE_STYLE =
  'style="font-weight: 700;max-width:300px;overflow:hidden;text-overflow:ellipsis;"';
@@ -182,3 +187,88 @@ test('should preserve table styling after sanitization (fixes ECharts tooltip fo
  expect(html).toContain('padding-left:16px');
  expect(html).toContain('max-width:300px');
 });
+
+describe('truncateLabel', () => {
+  const long = 'prod-us-east-1-service-checkout-latency-p99'; // 43 chars
+
+  test('returns text unchanged for off and end', () => {
+    expect(truncateLabel(long, 'off')).toBe(long);
+    expect(truncateLabel(long, 'end')).toBe(long);
+  });
+
+  test('defaults to end, which does not slice', () => {
+    expect(truncateLabel(long)).toBe(long);
+  });
+
+  test('truncates the start, keeping the distinguishing suffix', () => {
+    expect(truncateLabel(long, 'start')).toBe(
+      '…-us-east-1-service-checkout-latency-p99',
+    );
+    expect(truncateLabel(long, 'start')).toHaveLength(TRUNCATION_MAX_CHARS);
+  });
+
+  test('truncates the middle, keeping both ends', () => {
+    expect(truncateLabel(long, 'middle')).toBe(
+      'prod-us-east-1-servi…heckout-latency-p99',
+    );
+    expect(truncateLabel(long, 'middle')).toHaveLength(TRUNCATION_MAX_CHARS);
+  });
+
+  test('leaves text at or under the limit untouched', () => {
+    const atLimit = 'x'.repeat(TRUNCATION_MAX_CHARS);
+    expect(truncateLabel(atLimit, 'start')).toBe(atLimit);
+    expect(truncateLabel(atLimit, 'middle')).toBe(atLimit);
+    expect(truncateLabel('short', 'start')).toBe('short');
+    expect(truncateLabel('', 'middle')).toBe('');
+  });
+
+  test('truncates text one character over the limit', () => {
+    const overLimit = 'x'.repeat(TRUNCATION_MAX_CHARS + 1);
+    expect(truncateLabel(overLimit, 'start')).toBe(
+      `…${'x'.repeat(TRUNCATION_MAX_CHARS - 1)}`,
+    );
+  });
+});
+
+describe('tooltipHtml truncation modes', () => {
+  const rows = [['label', 'value']];
+
+  // sanitizeHtml normalizes spacing inside style attributes, and it does so
+  // differently across versions, so compare with whitespace stripped.
+  const styles = (
+    title: string | undefined,
+    truncation?: 'off' | 'end' | 'start' | 'middle',
+  ) => removeWhitespaces(tooltipHtml(rows, title, undefined, truncation));
+
+  test('emits the 300px cap for end and for the default', () => {
+    expect(styles('Title', 'end')).toContain('max-width:300px');
+    expect(tooltipHtml(rows, 'Title')).toBe(
+      tooltipHtml(rows, 'Title', undefined, 'end'),
+    );
+  });
+
+  test('emits no truncation style for off', () => {
+    const html = styles('Title', 'off');
+    expect(html).not.toContain('max-width');
+    expect(html).not.toContain('text-overflow');
+    expect(html).not.toContain('white-space');
+  });
+
+  test.each(['start', 'middle'] as const)(
+    'emits nowrap instead of a cap for %s',
+    mode => {
+      const html = styles('Title', mode);
+      expect(html).toContain('white-space:nowrap');
+      expect(html).not.toContain('max-width');
+    },
+  );
+
+  test('never slices cell text itself, whatever the mode', () => {
+    const longCell = 'y'.repeat(TRUNCATION_MAX_CHARS + 20);
+    (['off', 'end', 'start', 'middle'] as const).forEach(mode => {
+      expect(tooltipHtml([[longCell]], undefined, undefined, mode)).toContain(
+        longCell,
+      );
+    });
+  });
+});
@@ -47,6 +47,10 @@ export default defineConfig({
  // Retry logic - 2 retries in CI, 0 locally
  retries: process.env.CI ? 2 : 0,

+  // Disable capturing Git commit info as the project's history is increasingly dense
+  // and breach Playwright's default 3-seconds `git` command timeout limit
+  captureGitInfo: { commit: false, diff: false },
+
  // Reporter configuration - multiple reporters for better visibility
  reporter: process.env.CI
    ? [
@@ -22,7 +22,7 @@ import { getSequentialSchemeRegistry } from '@superset-ui/core';
 import { SupersetTheme } from '@apache-superset/core/theme';
 import { t } from '@apache-superset/core/translation';
 import CalHeatMapImport from './vendor/cal-heatmap';
-import { convertUTCTimestampToLocal } from './utils';
+import { convertUTCTimestampToLocal, getFormattedUTCTime } from './utils';

 // The vendor file is @ts-nocheck, so its export lacks type info.
 // Define a minimal constructor interface for use in this file.
@@ -103,6 +103,8 @@ function Calendar(element: HTMLElement, props: CalendarProps) {
  const subDomainTextFormat = showValues
    ? (_date: Date, value: number) => valueFormatter(value)
    : null;
+  const dateFormatter = (date: Date, format: string) =>
+    getFormattedUTCTime(date.getTime(), format);

  const metricsData = data.data;

@@ -166,6 +168,7 @@ function Calendar(element: HTMLElement, props: CalendarProps) {
      itemName: '',
      valueFormatter,
      timeFormatter,
+      dateFormatter,
      subDomainTextFormat,
    });
  });
@@ -76,6 +76,8 @@ var CalHeatMap = function () {

    timeFormatter: d => d,

+    dateFormatter: null,
+
    domain: 'hour',

    subDomain: 'min',
@@ -1990,10 +1992,14 @@ CalHeatMap.prototype = {

    if (typeof format === 'function') {
      return format(d);
-    } else {
-      var f = d3.time.format(format);
-      return f(d);
    }
+
+    if (typeof this.options.dateFormatter === 'function') {
+      return this.options.dateFormatter(d, format);
+    }
+
+    var f = d3.time.format(format);
+    return f(d);
  },

  getSubDomainTitle: function (d) {
@@ -25,9 +25,11 @@ import {
  waitFor,
 } from 'spec/helpers/testing-library';
 import { CALENDAR_TOOLTIP_CLASS } from '../src/tooltip';
+import { convertUTCTimestampToLocal } from '../src/utils';

 interface MockCalHeatMapConfig {
  itemSelector: Element;
+  dateFormatter?: (date: Date, format: string) => string;
 }

 type MetricNameInput = string | string[];
@@ -38,6 +40,7 @@ let mockInitCallCount = 0;
 let mockThrowOnInitCall: number | null = null;
 let mockDestroyCallCount = 0;
 let mockDestroyedInstanceIds: string[] = [];
+let mockDateFormatter: MockCalHeatMapConfig['dateFormatter'];

 const mockTheme = {
  colorBgElevated: '#ffffff',
@@ -56,6 +59,7 @@ jest.mock('../src/vendor/cal-heatmap', () => ({
      } = require('../src/tooltip');

      mockInitCallCount += 1;
+      mockDateFormatter = config.dateFormatter;
      if (mockThrowOnInitCall === mockInitCallCount) {
        throw new Error('Mock CalHeatMap init failure');
      }
@@ -284,9 +288,28 @@ afterEach(() => {
  mockThrowOnInitCall = null;
  mockDestroyCallCount = 0;
  mockDestroyedInstanceIds = [];
+  mockDateFormatter = undefined;
  document.body.innerHTML = '';
 });

+test('Calendar provides a timezone-safe date formatter to CalHeatMap', () => {
+  const calendarOwner = document.createElement('div');
+  document.body.appendChild(calendarOwner);
+
+  Calendar(calendarOwner, {
+    ...createCalendarProps('localized-metric'),
+    theme: mockTheme,
+  });
+
+  if (!mockDateFormatter) {
+    throw new Error('Expected Calendar to configure a date formatter');
+  }
+
+  const localDate = new Date(convertUTCTimestampToLocal(Date.UTC(2024, 0, 1)));
+
+  expect(mockDateFormatter(localDate, '%Y-%m-%d')).toBe('2024-01-01');
+});
+
 test('rerender and unmount clean up only the affected calendar tooltips', () => {
  jest.useFakeTimers();

@@ -0,0 +1,61 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import CalHeatMapImport from '../src/vendor/cal-heatmap';
+
+type DateFormatter = (date: Date, format: string) => string;
+type FunctionalDateFormat = (date: Date) => string;
+
+interface CalHeatMapInstance {
+  options: {
+    dateFormatter: DateFormatter | null;
+  };
+  formatDate(date: Date, format: string | FunctionalDateFormat): string;
+}
+
+const CalHeatMap = CalHeatMapImport as unknown as new () => CalHeatMapInstance;
+
+test('CalHeatMap delegates string date formats to the configured formatter', () => {
+  const calendar = new CalHeatMap();
+  const date = new Date(2024, 0, 1);
+  const dateFormatter = jest.fn<string, [Date, string]>(() => 'Январь');
+  calendar.options.dateFormatter = dateFormatter;
+
+  expect(calendar.formatDate(date, '%B')).toBe('Январь');
+  expect(dateFormatter).toHaveBeenCalledWith(date, '%B');
+});
+
+test('CalHeatMap preserves functional formatters over the configured formatter', () => {
+  const calendar = new CalHeatMap();
+  const date = new Date(2024, 0, 1);
+  const dateFormatter = jest.fn<string, [Date, string]>(() => 'localized');
+  const functionalFormat = jest.fn<string, [Date]>(() => 'custom');
+  calendar.options.dateFormatter = dateFormatter;
+
+  expect(calendar.formatDate(date, functionalFormat)).toBe('custom');
+  expect(functionalFormat).toHaveBeenCalledWith(date);
+  expect(dateFormatter).not.toHaveBeenCalled();
+});
+
+test('CalHeatMap keeps the D3 formatter fallback', () => {
+  const calendar = new CalHeatMap();
+  const date = new Date(2024, 0, 1);
+
+  expect(calendar.formatDate(date, '%B')).toBe('January');
+});
@@ -30,12 +30,12 @@
  },
  "dependencies": {
    "d3": "^3.5.17",
-    "prop-types": "^15.8.1",
-    "react": "^19.2.7"
+    "prop-types": "^15.8.1"
  },
  "peerDependencies": {
    "@apache-superset/core": "*",
    "@superset-ui/chart-controls": "*",
-    "@superset-ui/core": "*"
+    "@superset-ui/core": "*",
+    "react": "^18.3.0"
  }
 }
@@ -17,6 +17,10 @@
 * under the License.
 */

+import { getNumberFormatter } from '@superset-ui/core';
+import { render, fireEvent } from '../../../../spec/helpers/testing-library';
+import BigNumberVis from './BigNumberViz';
+
 /**
 * Tests for the color threshold formatter logic in BigNumberViz.
 *
@@ -83,3 +87,33 @@ describe('BigNumberViz color formatters', () => {
    expect(getColorFromValue).not.toHaveBeenCalled();
  });
 });
+
+describe('BigNumberViz context menu', () => {
+  test('invokes onContextMenu and stops the event bubbling to ancestor handlers', () => {
+    const onContextMenu = jest.fn();
+    const ancestorHandler = jest.fn();
+
+    const { container } = render(
+      <div onContextMenu={ancestorHandler}>
+        <BigNumberVis
+          width={200}
+          height={100}
+          bigNumber={42}
+          headerFormatter={getNumberFormatter()}
+          headerFontSize={0.3}
+          subheaderFontSize={0.125}
+          subtitleFontSize={0.125}
+          subtitle=""
+          refs={{}}
+          onContextMenu={onContextMenu}
+        />
+      </div>,
+    );
+
+    const headerLine = container.querySelector('.header-line');
+    fireEvent.contextMenu(headerLine!, { clientX: 10, clientY: 20 });
+
+    expect(onContextMenu).toHaveBeenCalledWith(10, 20);
+    expect(ancestorHandler).not.toHaveBeenCalled();
+  });
+});
@@ -224,6 +224,7 @@ function BigNumberVis({
    const handleContextMenu = (e: MouseEvent<HTMLDivElement>) => {
      if (onContextMenu) {
        e.preventDefault();
+        e.stopPropagation();
        onContextMenu(e.nativeEvent.clientX, e.nativeEvent.clientY);
      }
    };
@@ -390,6 +390,7 @@ export default function transformProps(chartProps: EchartsGanttChartProps) {
    [GenericDataType.String]: undefined,
    [GenericDataType.Temporal]: tooltipTimeFormatter,
    [GenericDataType.Boolean]: undefined,
+    [GenericDataType.MultiValue]: undefined,
  };

  const echartOptions: EChartsCoreOption = {
@@ -40,6 +40,7 @@ import {
  TimeseriesChartDataResponseResult,
  TimeseriesDataRecord,
  tooltipHtml,
+  truncateLabel,
  ValueFormatter,
 } from '@superset-ui/core';
 import { GenericDataType } from '@apache-superset/core/common';
@@ -207,6 +208,7 @@ export default function transformProps(
    zoomable,
    richTooltip,
    tooltipSortByMetric,
+    tooltipTruncation,
    xAxisBounds,
    xAxisLabelRotation,
    xAxisLabelInterval,
@@ -907,13 +909,19 @@ export default function transformProps(
              formatter: primarySeries.has(key)
                ? tooltipFormatter
                : tooltipFormatterSecondary,
+              truncation: tooltipTruncation,
            });
            rows.push(row);
            if (key === focusedSeries) {
              focusedRow = rows.length - 1;
            }
          });
-        return tooltipHtml(rows, tooltipFormatter(xValue), focusedRow);
+        return tooltipHtml(
+          rows,
+          truncateLabel(tooltipFormatter(xValue), tooltipTruncation),
+          focusedRow,
+          tooltipTruncation,
+        );
      },
    },
    legend: {
@@ -24,6 +24,7 @@ import {
  ContributionType,
  TimeFormatter,
  AxisType,
+  TooltipTruncationMode,
 } from '@superset-ui/core';
 import {
  BaseChartProps,
@@ -59,6 +60,7 @@ export type EchartsMixedTimeseriesFormData = QueryFormData & {
  timeGrainSqla?: TimeGranularity;
  forceMaxInterval?: boolean;
  tooltipTimeFormat?: string;
+  tooltipTruncation?: TooltipTruncationMode;
  zoomable: boolean;
  richTooltip: boolean;
  showQueryIdentifiers?: boolean;
@@ -108,6 +110,7 @@ export const DEFAULT_FORM_DATA: EchartsMixedTimeseriesFormData = {
  yAxisFormatSecondary: TIMESERIES_DEFAULTS.yAxisFormat,
  yAxisTitleSecondary: DEFAULT_TITLE_FORM_DATA.yAxisTitle,
  tooltipTimeFormat: TIMESERIES_DEFAULTS.tooltipTimeFormat,
+  tooltipTruncation: TIMESERIES_DEFAULTS.tooltipTruncation,
  xAxisBounds: TIMESERIES_DEFAULTS.xAxisBounds,
  xAxisForceCategorical: TIMESERIES_DEFAULTS.xAxisForceCategorical,
  xAxisTimeFormat: TIMESERIES_DEFAULTS.xAxisTimeFormat,
@@ -73,6 +73,7 @@ export const DEFAULT_FORM_DATA: EchartsTimeseriesFormData = {
  seriesType: EchartsTimeseriesSeriesType.Line,
  stack: false,
  tooltipTimeFormat: 'smart_date',
+  tooltipTruncation: 'end',
  xAxisTimeFormat: 'smart_date',
  xAxisNumberFormat: 'SMART_NUMBER',
  truncateXAxis: true,
@@ -30,6 +30,7 @@ import {
  DTTM_ALIAS,
  ensureIsArray,
  tooltipHtml,
+  truncateLabel,
  getCustomFormatter,
  getMetricLabel,
  getNumberFormatter,
@@ -303,6 +304,7 @@ export default function transformProps(
    tooltipSortByMetric,
    showTooltipTotal,
    showTooltipPercentage,
+    tooltipTruncation,
    truncateXAxis,
    truncateYAxis,
    xAxis: xAxisOrig,
@@ -1449,6 +1451,7 @@ export default function transformProps(
              seriesName: key,
              formatter,
              marker,
+              truncation: tooltipTruncation,
            });

            const annotationRow = annotationLayers.some(
@@ -1482,7 +1485,12 @@ export default function transformProps(
          }
          rows.push(totalRow);
        }
-        return tooltipHtml(rows, tooltipFormatter(xValue), focusedRow);
+        return tooltipHtml(
+          rows,
+          truncateLabel(tooltipFormatter(xValue), tooltipTruncation),
+          focusedRow,
+          tooltipTruncation,
+        );
      },
    },
    legend: {
@@ -25,6 +25,7 @@ import {
  QueryFormMetric,
  TimeFormatter,
  TimeGranularity,
+  TooltipTruncationMode,
 } from '@superset-ui/core';
 import {
  BaseChartProps,
@@ -82,6 +83,7 @@ export type EchartsTimeseriesFormData = QueryFormData & {
  tooltipTimeFormat?: string;
  showTooltipTotal?: boolean;
  showTooltipPercentage?: boolean;
+  tooltipTruncation?: TooltipTruncationMode;
  truncateXAxis: boolean;
  truncateYAxis: boolean;
  yAxisFormat?: string;
@@ -16,9 +16,13 @@
 * specific language governing permissions and limitations
 * under the License.
 */
-import { render, waitFor } from '../../../../spec/helpers/testing-library';
 import type { EChartsCoreOption } from 'echarts/core';
-import Echart, { isReportScreenshotMode } from './Echart';
+import { render, waitFor } from '../../../../spec/helpers/testing-library';
+import Echart, {
+  ECHARTS_HOST_CLASS,
+  ECHARTS_RENDER_FINISHED_CLASS,
+  isReportScreenshotMode,
+} from './Echart';
 import type { EchartsProps } from '../types';

 type Handler = (params: unknown) => void;
@@ -272,3 +276,31 @@ test('keeps animation enabled when not in report screenshot mode', async () => {
  const lastOptions = mockChart.setOption.mock.calls.at(-1)?.[0];
  expect(lastOptions.animation).not.toBe(false);
 });
+
+test('tags the ECharts canvas host with the readiness-gate class', async () => {
+  const { container } = render(renderEchart(), {
+    initialState,
+    useRedux: true,
+  });
+  await waitFor(() => expect(mockChart.setOption).toHaveBeenCalled());
+  expect(container.querySelector(`.${ECHARTS_HOST_CLASS}`)).not.toBeNull();
+});
+
+test('marks the host painted only on the ECharts `finished` event', async () => {
+  const { container } = render(renderEchart(), {
+    initialState,
+    useRedux: true,
+  });
+  await waitFor(() => expect(mockChart.setOption).toHaveBeenCalled());
+
+  const host = container.querySelector(`.${ECHARTS_HOST_CLASS}`) as HTMLElement;
+  expect(host).not.toBeNull();
+
+  // `setOption` ran during mount, which clears the marker; `finished` has not
+  // fired yet, so the host must NOT be flagged as painted.
+  expect(host).not.toHaveClass(ECHARTS_RENDER_FINISHED_CLASS);
+
+  // Simulate ECharts completing its draw -> the host is flagged painted.
+  trigger('finished');
+  expect(host).toHaveClass(ECHARTS_RENDER_FINISHED_CLASS);
+});
@@ -138,6 +138,15 @@ export function isReportScreenshotMode(): boolean {
  }
 }

+// Report-screenshot readiness contract (see superset/utils/screenshot_utils.py).
+// `echarts-host` marks the canvas host element; `echarts-render-finished` is
+// toggled OFF before each setOption and ON in the ECharts `finished` event --
+// the only signal that the canvas is fully painted (chartStatus/onRenderSuccess
+// both fire pre-paint). The readiness gate treats a host that lacks
+// `echarts-render-finished` as not-yet-painted so it never captures a blank chart.
+export const ECHARTS_HOST_CLASS = 'echarts-host';
+export const ECHARTS_RENDER_FINISHED_CLASS = 'echarts-render-finished';
+
 function Echart(
  {
    width,
@@ -201,6 +210,11 @@ function Echart(
          width,
          height,
        });
+        // Paint marker for the report-screenshot readiness gate. `finished`
+        // is the only event that guarantees the canvas is fully drawn.
+        chartRef.current.on('finished', () => {
+          divRef.current?.classList.add(ECHARTS_RENDER_FINISHED_CLASS);
+        });
      }
      // did mount
      handleSizeChange({ width, height });
@@ -321,6 +335,9 @@ function Echart(
            }
          )?.dataZoom
        : undefined;
+      // Clear the paint marker before (re)drawing; the `finished` handler
+      // re-adds it once the new frame is fully rendered.
+      divRef.current?.classList.remove(ECHARTS_RENDER_FINISHED_CLASS);
      chartRef.current?.setOption(themedEchartOptions, {
        notMerge,
        replaceMerge: notMerge ? undefined : ['series'],
@@ -412,7 +429,14 @@ function Echart(
    handleSizeChange({ width, height });
  }, [width, height, handleSizeChange]);

-  return <Styles ref={divRef} height={height} width={width} />;
+  return (
+    <Styles
+      ref={divRef}
+      className={ECHARTS_HOST_CLASS}
+      height={height}
+      width={width}
+    />
+  );
 }

 export default forwardRef(Echart);
@@ -315,6 +315,27 @@ const tooltipPercentageControl: ControlSetItem = {
  },
 };

+const tooltipTruncationControl: ControlSetItem = {
+  name: 'tooltipTruncation',
+  config: {
+    type: 'SelectControl',
+    freeForm: false,
+    label: t('Truncate labels'),
+    renderTrigger: true,
+    default: 'end',
+    clearable: false,
+    choices: [
+      ['off', t('Off')],
+      ['end', t('End')],
+      ['start', t('Start')],
+      ['middle', t('Middle')],
+    ],
+    description: t(
+      'Where to place the ellipsis when a tooltip label is too long. Choose Off to always show the full label, or Start when labels share a common prefix.',
+    ),
+  },
+};
+
 export const richTooltipSection: ControlSetRow[] = [
  [<ControlSubSectionHeader>{t('Tooltip')}</ControlSubSectionHeader>],
  [richTooltipControl],
@@ -322,6 +343,7 @@ export const richTooltipSection: ControlSetRow[] = [
  [tooltipPercentageControl],
  [tooltipSortByMetricControl],
  [tooltipTimeFormatControl],
+  [tooltipTruncationControl],
 ];

 const sortSeriesType: ControlSetItem = {
@@ -16,7 +16,13 @@
 * specific language governing permissions and limitations
 * under the License.
 */
-import { DataRecord, DTTM_ALIAS, ValueFormatter } from '@superset-ui/core';
+import {
+  DataRecord,
+  DTTM_ALIAS,
+  truncateLabel,
+  TooltipTruncationMode,
+  ValueFormatter,
+} from '@superset-ui/core';
 import type { OptionName, SeriesOption } from 'echarts/types/src/util/types';
 import type { TooltipMarker } from 'echarts/types/src/util/format';
 import {
@@ -91,12 +97,16 @@ export const formatForecastTooltipSeries = ({
  forecastUpper,
  marker,
  formatter,
+  truncation = 'end',
 }: ForecastValue & {
  seriesName: string;
  marker: TooltipMarker;
  formatter: ValueFormatter;
+  truncation?: TooltipTruncationMode;
 }): string[] => {
-  const name = `${marker}${sanitizeHtml(seriesName)}`;
+  // Truncate before sanitizing and before the marker is prepended: slicing a
+  // string that already contains markup would cut into the marker's tag.
+  const name = `${marker}${sanitizeHtml(truncateLabel(seriesName, truncation))}`;
  let value = typeof observation === 'number' ? formatter(observation) : '';
  // Use finite-number checks rather than truthiness so that legitimate
  // zero values (e.g. a forecast that crosses zero, or a confidence bound of
@@ -27,6 +27,7 @@ import {
  VizType,
  ChartDataResponseResult,
  TimeGranularity,
+  TooltipTruncationMode,
 } from '@superset-ui/core';
 import { GenericDataType } from '@apache-superset/core/common';
 import {
@@ -1295,3 +1296,59 @@ test('y-axis title position: non-Left sets nameLocation to end', () => {
  expect(yAxis[1].nameGap).toEqual(30);
  expect(yAxis[1].nameLocation).toEqual('end');
 });
+describe('EchartsMixedTimeseries tooltip truncation', () => {
+  const longSeriesName = 'prod-us-east-1-service-checkout-latency-p99';
+  const marker = '<span style="background-color:#1f77b4;"></span>';
+
+  const buildTooltip = (tooltipTruncation?: TooltipTruncationMode) => {
+    const chartProps = createEchartsTimeseriesTestChartProps<
+      EchartsMixedTimeseriesFormData,
+      EchartsMixedTimeseriesProps
+    >({
+      ...MIXED_TIMESERIES_CHART_PROPS_DEFAULTS,
+      defaultQueriesData: queriesData,
+      formData: {
+        ...formData,
+        ...(tooltipTruncation ? { tooltipTruncation } : {}),
+      },
+      queriesData,
+    });
+    const { echartOptions } = transformProps(chartProps);
+    const { formatter } = echartOptions.tooltip as {
+      formatter: (params: unknown) => string;
+    };
+    // richTooltip is false in this fixture, so the trigger is 'item' and the
+    // formatter receives a single param object rather than an array.
+    return formatter({
+      seriesId: longSeriesName,
+      seriesName: longSeriesName,
+      value: [599616000000, 1],
+      marker,
+    });
+  };
+
+  test('keeps full text with the CSS cap by default', () => {
+    const html = buildTooltip();
+    expect(html.replace(/\s/g, '')).toContain('max-width:300px');
+    expect(html).toContain(longSeriesName);
+  });
+
+  test('removes the cap and keeps full text when off', () => {
+    const html = buildTooltip('off');
+    expect(html).not.toContain('max-width');
+    expect(html).toContain(longSeriesName);
+  });
+
+  test('drops the shared prefix when truncating from the start', () => {
+    const html = buildTooltip('start');
+    expect(html).not.toContain('prod-us-east');
+    expect(html).toContain('latency-p99');
+    expect(html).toContain('background-color:#1f77b4');
+  });
+
+  test('keeps both ends when truncating the middle', () => {
+    const html = buildTooltip('middle');
+    expect(html).toContain('prod-us-east-1-servi…heckout-latency-p99');
+    expect(html).not.toContain(longSeriesName);
+  });
+});
@@ -32,6 +32,7 @@ import {
  TimeseriesAnnotationLayer,
  ChartDataResponseResult,
  TimeGranularity,
+  TooltipTruncationMode,
 } from '@superset-ui/core';
 import { GenericDataType } from '@apache-superset/core/common';
 import { supersetTheme } from '@apache-superset/core/theme';
@@ -2437,3 +2438,94 @@ test('honors the snake_case flag the compare-chart migration stores in params',
    [BASE_TIMESTAMP + 300000000, 2],
  ]);
 });
+describe('EchartsTimeseries tooltip truncation', () => {
+  const longSeriesName = 'prod-us-east-1-service-checkout-latency-p99';
+  const marker = '<span style="background-color:#1f77b4;"></span>';
+
+  const buildTooltip = (
+    tooltipTruncation?: TooltipTruncationMode,
+    xValue: string | number = 599616000000,
+  ) => {
+    const chartProps = new ChartProps({
+      formData: {
+        colorScheme: 'bnbColors',
+        datasource: '3__table',
+        granularity_sqla: 'ds',
+        metric: 'sum__num',
+        groupby: ['foo'],
+        viz_type: 'my_viz',
+        ...(tooltipTruncation ? { tooltipTruncation } : {}),
+      } as SqlaFormData,
+      width: 800,
+      height: 600,
+      queriesData: [
+        {
+          data: [
+            { [longSeriesName]: 1, __timestamp: 599616000000 },
+            { [longSeriesName]: 3, __timestamp: 599916000000 },
+          ],
+        },
+      ],
+      theme: supersetTheme,
+    });
+    const { echartOptions } = transformProps(
+      chartProps as EchartsTimeseriesChartProps,
+    );
+    const { formatter } = echartOptions.tooltip as {
+      formatter: (params: unknown) => string;
+    };
+    return formatter([
+      {
+        seriesId: longSeriesName,
+        seriesName: longSeriesName,
+        value: [xValue, 1],
+        marker,
+      },
+    ]);
+  };
+
+  test('applies the CSS cap and keeps full text by default', () => {
+    const html = buildTooltip();
+    expect(html).toContain(longSeriesName);
+    // sanitizeHtml normalizes spacing inside style attributes, so compare with
+    // whitespace stripped rather than hard-coding one version's formatting.
+    expect(html.replace(/\s/g, '')).toContain('max-width:300px');
+  });
+
+  test('removes the cap and keeps full text when off', () => {
+    const html = buildTooltip('off');
+    expect(html).not.toContain('max-width');
+    expect(html).toContain(longSeriesName);
+  });
+
+  test('drops the shared prefix when truncating from the start', () => {
+    const html = buildTooltip('start');
+    expect(html).not.toContain('prod-us-east');
+    expect(html).toContain('latency-p99');
+    expect(html.replace(/\s/g, '')).toContain('white-space:nowrap');
+  });
+
+  test('keeps both ends when truncating the middle', () => {
+    const html = buildTooltip('middle');
+    expect(html).toContain('prod-us-east-1-servi…heckout-latency-p99');
+    expect(html).not.toContain(longSeriesName);
+  });
+
+  test('preserves the echarts marker in every mode', () => {
+    (['off', 'end', 'start', 'middle'] as const).forEach(mode => {
+      expect(buildTooltip(mode)).toContain('background-color:#1f77b4');
+    });
+  });
+
+  test('truncates a long non-temporal x-axis title', () => {
+    const longCategory = 'prod-us-east-1-service-checkout-cohort-2026';
+    const html = buildTooltip('start', longCategory);
+    expect(html).not.toContain(longCategory);
+    expect(html).toContain('cohort-2026');
+  });
+
+  test('leaves a long title alone in the default mode', () => {
+    const longCategory = 'prod-us-east-1-service-checkout-cohort-2026';
+    expect(buildTooltip(undefined, longCategory)).toContain(longCategory);
+  });
+});
@@ -16,7 +16,11 @@
 * specific language governing permissions and limitations
 * under the License.
 */
-import { getNumberFormatter, NumberFormats } from '@superset-ui/core';
+import {
+  getNumberFormatter,
+  NumberFormats,
+  TRUNCATION_MAX_CHARS,
+} from '@superset-ui/core';
 import { SeriesOption } from 'echarts';
 import {
  extractForecastSeriesContext,
@@ -411,3 +415,52 @@ test('formatForecastTooltipSeries should skip non-finite forecast values', () =>
    }),
  ).toEqual(['<img>qwerty', '10']);
 });
+
+describe('formatForecastTooltipSeries truncation', () => {
+  const marker =
+    '<span style="display:inline-block;width:10px;height:10px;background-color:#1f77b4;"></span>';
+  const longName = 'prod-us-east-1-service-checkout-latency-p99'; // 43 chars
+  const intFormatter = getNumberFormatter(NumberFormats.INTEGER);
+
+  const format = (truncation?: 'off' | 'end' | 'start' | 'middle') =>
+    formatForecastTooltipSeries({
+      seriesName: longName,
+      observation: 1,
+      marker,
+      formatter: intFormatter,
+      ...(truncation ? { truncation } : {}),
+    })[0];
+
+  test('leaves the name intact by default and for off/end', () => {
+    expect(format()).toContain(longName);
+    expect(format('off')).toContain(longName);
+    expect(format('end')).toContain(longName);
+  });
+
+  test('slices the start of the name without harming the marker', () => {
+    const cell = format('start');
+    expect(cell).toContain(marker);
+    expect(cell).toContain('…-us-east-1-service-checkout-latency-p99');
+    expect(cell).not.toContain('prod-us-east');
+  });
+
+  test('slices the middle of the name without harming the marker', () => {
+    const cell = format('middle');
+    expect(cell).toContain(marker);
+    expect(cell).toContain('prod-us-east-1-servi…heckout-latency-p99');
+  });
+
+  test('measures the budget against the name, not the marker markup', () => {
+    // The marker alone is far longer than the budget. If truncation were
+    // applied to the concatenated cell, a short name would be mangled.
+    expect(marker.length).toBeGreaterThan(TRUNCATION_MAX_CHARS);
+    const [cell] = formatForecastTooltipSeries({
+      seriesName: 'cpu',
+      observation: 1,
+      marker,
+      formatter: intFormatter,
+      truncation: 'start',
+    });
+    expect(cell).toBe(`${marker}cpu`);
+  });
+});
@@ -33,7 +33,7 @@
    "mapbox-gl": "^3.28.1",
    "maplibre-gl": "^5.24.0",
    "react-map-gl": "^8.1.2",
-    "supercluster": "^8.0.1"
+    "supercluster": "^9.0.0"
  },
  "peerDependencies": {
    "@apache-superset/core": "*",
@@ -164,7 +164,7 @@ export async function selectOption(option: string, selectName?: string) {
  const item = await waitFor(() =>
    within(
      // eslint-disable-next-line testing-library/no-node-access
-      document.querySelector('.rc-virtual-list')!,
+      document.querySelector('.ant-select-dropdown-list')!,
    ).getByText(option),
  );
  await userEvent.click(item);
@@ -17,6 +17,7 @@
 * under the License.
 */
 import { useState } from 'react';
+import fetchMock from 'fetch-mock';
 import {
  cleanup,
  render,
@@ -35,6 +36,10 @@ import { useDrillDetailMenuItems, DrillDetailMenuItemsProps } from './index';

 /* eslint jest/expect-expect: ["warn", { "assertFunctionNames": ["expect*"] }] */

+// Opening the context menu logs an event, and an unmatched request makes
+// fetch-mock throw inside the component.
+fetchMock.post('glob:*/log/?*', {});
+
 jest.mock(
  '../DrillDetail/DrillDetailPane',
  () =>
@@ -867,7 +867,7 @@ function DatasourceEditor({
      return {
        ...metric,
        certification_details: certificationDetails || details,
-        warning_markdown: warningMarkdown || '',
+        warning_markdown: warningMarkdown || metric.warning_markdown || '',
        certified_by: certifiedBy || certifiedByMetric,
      };
    }),
@@ -1627,9 +1627,7 @@ function DatasourceEditor({
              {t(
                'Default URL to redirect to when accessing from the dataset list page. Accepts relative URLs such as',
              )}{' '}
-              <Typography.Text code>
-                /superset/dashboard/{'{id}'}/
-              </Typography.Text>
+              <Typography.Text code>/dashboard/{'{id}'}/</Typography.Text>
            </>
          }
          control={<TextControl controlId="default_endpoint" />}
@@ -71,6 +71,17 @@ test('renders Tabs', async () => {
  expect(screen.getByTestId('edit-dataset-tabs')).toBeInTheDocument();
 });

+test('recommends a registered client route for the default URL', async () => {
+  await asyncRender(createProps());
+
+  userEvent.click(screen.getByRole('tab', { name: 'Settings' }));
+
+  expect(await screen.findByText('/dashboard/{id}/')).toBeInTheDocument();
+  expect(
+    screen.queryByText('/superset/dashboard/{id}/'),
+  ).not.toBeInTheDocument();
+});
+
 test('can sync columns from source', async () => {
  const testProps = createProps();
  await asyncRender({
@@ -0,0 +1,73 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import fetchMock from 'fetch-mock';
+import { screen, userEvent, waitFor } from 'spec/helpers/testing-library';
+import {
+  createProps,
+  DATASOURCE_ENDPOINT,
+  setupDatasourceEditorMocks,
+  cleanupAsyncOperations,
+  fastRender,
+  dismissDatasourceWarning,
+} from './DatasourceEditor.test.utils';
+
+beforeEach(() => {
+  fetchMock.get(DATASOURCE_ENDPOINT, [], { name: DATASOURCE_ENDPOINT });
+  setupDatasourceEditorMocks();
+});
+
+afterEach(async () => {
+  await cleanupAsyncOperations();
+  fetchMock.clearHistory().removeRoutes();
+});
+
+// Certifying a metric fills two adjacent fields in one visit to the expanded
+// row. Both are committed through TextControl's debounce, so the second one
+// used to land on the item as it looked before the first had been applied,
+// leaving the saved metric with details but no certifier.
+test('certifying a metric keeps both certified_by and certification_details', async () => {
+  const testProps = createProps();
+  fastRender(testProps);
+  await dismissDatasourceWarning();
+
+  await userEvent.click(await screen.findByTestId('collection-tab-Metrics'));
+  const expandToggles = await screen.findAllByLabelText(/expand row/i);
+  await userEvent.click(expandToggles[0]);
+
+  await userEvent.type(
+    await screen.findByPlaceholderText('Certified by'),
+    'Metric Certifier',
+  );
+  await userEvent.type(
+    await screen.findByPlaceholderText('Certification details'),
+    'Metric cert details',
+  );
+
+  await waitFor(() => {
+    const { calls } = testProps.onChange.mock;
+    const savedMetrics = calls[calls.length - 1]?.[0]?.metrics ?? [];
+    const saved = savedMetrics.find(metric => metric.metric_name === 'count');
+    expect(saved).toEqual(
+      expect.objectContaining({
+        certified_by: 'Metric Certifier',
+        certification_details: 'Metric cert details',
+      }),
+    );
+  });
+});
@@ -0,0 +1,97 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import fetchMock from 'fetch-mock';
+import { screen, userEvent } from 'spec/helpers/testing-library';
+import {
+  createProps,
+  DATASOURCE_ENDPOINT,
+  setupDatasourceEditorMocks,
+  cleanupAsyncOperations,
+  fastRender,
+  dismissDatasourceWarning,
+} from './DatasourceEditor.test.utils';
+
+// Stub the Ace-backed control with a plain textarea. Ace spreads its document
+// across many spans and keeps only the keystroke buffer in its own textarea,
+// so asserting on the value the control receives is less brittle than
+// reaching into Ace's DOM.
+jest.mock('src/explore/components/controls/TextAreaControl', () => ({
+  __esModule: true,
+  default: ({
+    controlId,
+    value,
+    onChange,
+  }: {
+    controlId?: string;
+    value?: string;
+    onChange?: (value: string) => void;
+  }) => (
+    <textarea
+      data-test={`mock-textarea-${controlId}`}
+      value={value ?? ''}
+      onChange={event => onChange?.(event.target.value)}
+    />
+  ),
+}));
+
+beforeEach(() => {
+  fetchMock.get(DATASOURCE_ENDPOINT, [], { name: DATASOURCE_ENDPOINT });
+  setupDatasourceEditorMocks();
+});
+
+afterEach(async () => {
+  await cleanupAsyncOperations();
+  fetchMock.clearHistory().removeRoutes();
+});
+
+// Regression test for #42704. Explore's datasource payload (SqlMetric.data on
+// the backend) exposes warning_markdown as a flattened top-level field and
+// omits the raw `extra` JSON string that the /api/v1/dataset/{id} endpoint
+// backing the Datasets page provides. Deriving warning_markdown purely from
+// `extra` therefore dropped the saved text when the modal was opened from
+// Explore, leaving the Warning field blank on reopen.
+test('keeps a pre-existing top-level warning_markdown when the metric has no extra', async () => {
+  const baseProps = createProps();
+  const testProps = {
+    ...baseProps,
+    datasource: {
+      ...baseProps.datasource,
+      metrics: [
+        {
+          ...baseProps.datasource.metrics[0],
+          warning_markdown: 'existing warning',
+          extra: undefined,
+        },
+      ],
+    },
+  };
+
+  fastRender(testProps);
+  await dismissDatasourceWarning();
+
+  const metricsTab = await screen.findByTestId('collection-tab-Metrics');
+  await userEvent.click(metricsTab);
+
+  const expandToggles = await screen.findAllByLabelText(/expand row/i);
+  await userEvent.click(expandToggles[0]);
+
+  expect(
+    await screen.findByTestId('mock-textarea-warning_markdown'),
+  ).toHaveValue('existing warning');
+});
@@ -16,7 +16,7 @@
 * specific language governing permissions and limitations
 * under the License.
 */
-import { ReactNode, useCallback } from 'react';
+import { ReactNode, useCallback, useEffect, useRef } from 'react';
 import { Divider, Form, Typography } from '@superset-ui/core/components';
 import { css } from '@apache-superset/core/theme';
 import { recurseReactClone } from '../../utils';
@@ -39,14 +39,24 @@ export default function Fieldset({
  title = null,
  compact = false,
 }: FieldsetProps) {
+  // Controls report their edits asynchronously - TextControl debounces by
+  // FAST_DEBOUNCE - so the callback that eventually fires was built during an
+  // earlier render. Spreading that render's `item` rebuilds the whole record
+  // from a snapshot taken before a sibling field committed, dropping the value
+  // the user typed first. Reading off a ref merges into the latest commit.
+  const itemRef = useRef(item);
+  useEffect(() => {
+    itemRef.current = item;
+  }, [item]);
+
  const handleChange = useCallback(
    (fieldKey: fieldKeyType, val: any) => {
      onChange?.({
-        ...item,
+        ...itemRef.current,
        [fieldKey]: val,
      });
    },
-    [onChange, item],
+    [onChange],
  );

  const propExtender = (field: { props: { fieldKey: fieldKeyType } }) => ({
@@ -0,0 +1,106 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { ComponentType } from 'react';
+import type { dashboardComponents as api } from '@apache-superset/core';
+import { Disposable } from '../models';
+import { createEventEmitter } from '../utils';
+
+type Definition = api.DashboardComponentDefinition;
+type Props = api.DashboardComponentProps;
+type Registered = api.RegisteredDashboardComponent;
+
+/**
+ * Singleton registry for contributed dashboard components. Unlike the chat
+ * provider (one active chat), this holds many components keyed by id. Built-in
+ * components register here at startup; extensions register at module-load time.
+ */
+class DashboardComponentsProvider {
+  private static instance: DashboardComponentsProvider;
+
+  private components = new Map<string, Registered>();
+
+  // Cached, referentially-stable snapshot for useSyncExternalStore; rebuilt
+  // only when the set of components changes.
+  private snapshot: Registered[] = [];
+
+  private stateSubscribers = new Set<() => void>();
+
+  private registerEmitter = createEventEmitter<Definition>();
+
+  private unregisterEmitter = createEventEmitter<Definition>();
+
+  public static getInstance(): DashboardComponentsProvider {
+    if (!DashboardComponentsProvider.instance) {
+      DashboardComponentsProvider.instance = new DashboardComponentsProvider();
+    }
+    return DashboardComponentsProvider.instance;
+  }
+
+  public subscribe = (listener: () => void): (() => void) => {
+    this.stateSubscribers.add(listener);
+    return () => this.stateSubscribers.delete(listener);
+  };
+
+  private notifyState(): void {
+    this.snapshot = Array.from(this.components.values());
+    this.stateSubscribers.forEach(fn => fn());
+  }
+
+  public registerDashboardComponent = (
+    definition: Definition,
+    component: ComponentType<Props>,
+  ): Disposable => {
+    if (this.components.has(definition.id)) {
+      // eslint-disable-next-line no-console
+      console.warn(
+        `[Superset] A dashboard component "${definition.id}" is already ` +
+          `registered; replacing it.`,
+      );
+    }
+    const entry: Registered = { definition, Component: component };
+    this.components.set(definition.id, entry);
+    this.registerEmitter.fire(definition);
+    this.notifyState();
+
+    return new Disposable(() => {
+      // Only remove if this exact registration is still the active one.
+      if (this.components.get(definition.id) === entry) {
+        this.components.delete(definition.id);
+        this.unregisterEmitter.fire(definition);
+        this.notifyState();
+      }
+    });
+  };
+
+  public getDashboardComponent = (id: string): Registered | undefined =>
+    this.components.get(id);
+
+  public getDashboardComponents = (): Registered[] => this.snapshot;
+
+  public get onDidRegisterDashboardComponent() {
+    return this.registerEmitter.subscribe;
+  }
+
+  public get onDidUnregisterDashboardComponent() {
+    return this.unregisterEmitter.subscribe;
+  }
+}
+
+export default DashboardComponentsProvider;
@@ -0,0 +1,88 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { dashboardComponents } from './index';
+
+const Noop = () => null;
+const def = (id: string) => ({ id, name: id });
+
+test('registerDashboardComponent makes a component retrievable', () => {
+  const disposable = dashboardComponents.registerDashboardComponent(
+    def('acme.widget'),
+    Noop,
+  );
+  expect(dashboardComponents.getDashboardComponent('acme.widget')).toEqual({
+    definition: def('acme.widget'),
+    Component: Noop,
+  });
+  expect(
+    dashboardComponents
+      .getDashboardComponents()
+      .some(r => r.definition.id === 'acme.widget'),
+  ).toBe(true);
+  disposable.dispose();
+});
+
+test('disposing the registration unregisters the component', () => {
+  const disposable = dashboardComponents.registerDashboardComponent(
+    def('acme.temp'),
+    Noop,
+  );
+  expect(dashboardComponents.getDashboardComponent('acme.temp')).toBeDefined();
+  disposable.dispose();
+  expect(
+    dashboardComponents.getDashboardComponent('acme.temp'),
+  ).toBeUndefined();
+});
+
+test('registering the same id twice replaces the first', () => {
+  jest.spyOn(console, 'warn').mockImplementation(() => {});
+  const A = () => null;
+  const B = () => null;
+  dashboardComponents.registerDashboardComponent(def('acme.dup'), A);
+  const second = dashboardComponents.registerDashboardComponent(
+    def('acme.dup'),
+    B,
+  );
+  expect(dashboardComponents.getDashboardComponent('acme.dup')?.Component).toBe(
+    B,
+  );
+  jest.restoreAllMocks();
+  second.dispose();
+});
+
+test('disposing a stale registration does not remove the active one', () => {
+  jest.spyOn(console, 'warn').mockImplementation(() => {});
+  const A = () => null;
+  const B = () => null;
+  const first = dashboardComponents.registerDashboardComponent(
+    def('acme.stale'),
+    A,
+  );
+  const second = dashboardComponents.registerDashboardComponent(
+    def('acme.stale'),
+    B,
+  );
+  // Disposing the superseded registration is a no-op.
+  first.dispose();
+  expect(
+    dashboardComponents.getDashboardComponent('acme.stale')?.Component,
+  ).toBe(B);
+  jest.restoreAllMocks();
+  second.dispose();
+});
@@ -0,0 +1,49 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * @fileoverview Host implementation of the `dashboardComponents` contribution
+ * type. Extensions register via `dashboardComponents.registerDashboardComponent()`
+ * and the host renders contributed components inside its own dashboard chrome.
+ *
+ * The public namespace (`dashboardComponents`) is exposed to extensions on
+ * `window.superset`. `useDashboardComponents` is host-internal and NOT part of
+ * the public `@apache-superset/core` API.
+ */
+
+import { useSyncExternalStore } from 'react';
+import type { dashboardComponents as api } from '@apache-superset/core';
+import DashboardComponentsProvider from './DashboardComponentsProvider';
+
+const provider = DashboardComponentsProvider.getInstance();
+
+/**
+ * Host-internal hook returning all registered dashboard components, re-rendering
+ * when the set changes.
+ */
+export const useDashboardComponents = () =>
+  useSyncExternalStore(provider.subscribe, provider.getDashboardComponents);
+
+export const dashboardComponents: typeof api = {
+  registerDashboardComponent: provider.registerDashboardComponent,
+  getDashboardComponent: provider.getDashboardComponent,
+  getDashboardComponents: provider.getDashboardComponents,
+  onDidRegisterDashboardComponent: provider.onDidRegisterDashboardComponent,
+  onDidUnregisterDashboardComponent: provider.onDidUnregisterDashboardComponent,
+};
@@ -29,6 +29,7 @@ export const core: typeof coreType = {
 export * from './authentication';
 export * from './chat';
 export * from './commands';
+export * from './dashboardComponents';
 export * from './editors';
 export * from './extensions';
 export * from './menus';
@@ -135,6 +135,15 @@ describe('dashboardState actions', () => {

  // eslint-disable-next-line no-restricted-globals -- TODO: Migrate from describe blocks
  describe('saveDashboardRequest', () => {
+    const findDangerToast = (dispatch: jest.Mock) =>
+      dispatch.mock.calls
+        .map(call => call[0])
+        .find(
+          action =>
+            action?.type === ADD_TOAST &&
+            action.payload.toastType === ToastType.Danger,
+        );
+
    test('should dispatch UPDATE_COMPONENTS_PARENTS_LIST action', () => {
      const { getState, dispatch } = setup({
        dashboardState: { hasUnsavedChanges: false },
@@ -227,6 +236,89 @@ describe('dashboardState actions', () => {
        const { body } = putStub.mock.calls[0][0];
        expect(body).toBe(JSON.stringify(confirmedDashboardData));
      });
+
+      test('warns about the overwrite values when a diff is detected', async () => {
+        const { getState, dispatch } = setup();
+        const thunk = saveDashboardRequest(
+          newDashboardData,
+          192,
+          SAVE_TYPE_OVERWRITE,
+        );
+        thunk(dispatch, getState);
+        await waitFor(() =>
+          expect(findDangerToast(dispatch)?.payload.text).toBe(
+            'Please confirm the overwrite values.',
+          ),
+        );
+        expect(putStub.mock.calls.length).toBe(0);
+      });
+
+      test('reports the actual error when the overwrite precheck fails', async () => {
+        getStub.mockRestore();
+        getStub = jest
+          .spyOn(SupersetClient, 'get')
+          .mockRejectedValue(new Error('precheck exploded'));
+        const { getState, dispatch } = setup();
+        const thunk = saveDashboardRequest(
+          newDashboardData,
+          192,
+          SAVE_TYPE_OVERWRITE,
+        );
+        thunk(dispatch, getState);
+        await waitFor(() =>
+          expect(findDangerToast(dispatch)?.payload.text).toContain(
+            'precheck exploded',
+          ),
+        );
+        expect(putStub.mock.calls.length).toBe(0);
+      });
+    });
+
+    // eslint-disable-next-line no-restricted-globals -- TODO: Migrate from describe blocks
+    describe('when FeatureFlag.CONFIRM_DASHBOARD_DIFF is disabled', () => {
+      beforeEach(() => {
+        mockIsFeatureEnabled.mockImplementation(() => false);
+      });
+
+      afterEach(() => {
+        mockIsFeatureEnabled.mockRestore();
+      });
+
+      test('never runs the overwrite precheck', async () => {
+        const { getState, dispatch } = setup();
+        const thunk = saveDashboardRequest(
+          newDashboardData,
+          192,
+          SAVE_TYPE_OVERWRITE,
+        );
+        thunk(dispatch, getState);
+        await waitFor(() => expect(putStub.mock.calls.length).toBe(1));
+        expect(getStub).not.toHaveBeenCalledWith(
+          expect.objectContaining({ endpoint: '/api/v1/dashboard/192' }),
+        );
+      });
+
+      // An unexpected failure used to reach the overwrite-confirm handler,
+      // which reported it as "Please confirm the overwrite values." even with
+      // the feature flag off, hiding the real error.
+      test('reports the actual error when the update throws unexpectedly', async () => {
+        putStub.mockRestore();
+        putStub = jest.spyOn(SupersetClient, 'put').mockImplementation(() => {
+          throw new Error('unexpected boom');
+        });
+        const { getState, dispatch } = setup();
+        const thunk = saveDashboardRequest(
+          newDashboardData,
+          192,
+          SAVE_TYPE_OVERWRITE,
+        );
+        thunk(dispatch, getState);
+        await waitFor(() =>
+          expect(findDangerToast(dispatch)?.payload.text).toContain(
+            'unexpected boom',
+          ),
+        );
+      });
    });

    test('should navigate to the new dashboard after Save As', async () => {
@@ -379,15 +471,6 @@ describe('dashboardState actions', () => {
    // permission-denied copy, while a 403 from outside Superset (reverse proxy,
    // WAF, SSO gateway) carries a non-JSON body and must fall back to the
    // generic status-derived toast. See #42239.
-    const findDangerToast = (dispatch: jest.Mock) =>
-      dispatch.mock.calls
-        .map(call => call[0])
-        .find(
-          action =>
-            action?.type === ADD_TOAST &&
-            action.payload.toastType === ToastType.Danger,
-        );
-
    test('maps a non-JSON 403 save failure to the generic error toast', async () => {
      const { getState, dispatch } = setup();
      putStub.mockRestore();
@@ -646,6 +646,7 @@ export function saveDashboardRequest(
    };

    const onError = async (response: Response): Promise<void> => {
+      logging.error(response);
      const { error, message } = await getClientErrorObject(response);
      let errorText = t('Sorry, an unknown error occurred');

@@ -689,64 +690,64 @@ export function saveDashboardRequest(
              }),
            };

-      const updateDashboard = (): Promise<JsonObject | void> =>
-        SupersetClient.put({
-          endpoint: `/api/v1/dashboard/${id}`,
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify(updatedDashboard),
-        })
-          .then(response => onUpdateSuccess(response))
-          .catch(response => onError(response));
-      return new Promise<void>((resolve, reject) => {
-        if (
-          !isFeatureEnabled(FeatureFlag.ConfirmDashboardDiff) ||
-          saveType === SAVE_TYPE_OVERWRITE_CONFIRMED
-        ) {
-          // skip overwrite precheck
-          resolve();
-          return;
+      const updateDashboard = async (): Promise<JsonObject | void> => {
+        try {
+          const response = await SupersetClient.put({
+            endpoint: `/api/v1/dashboard/${id}`,
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(updatedDashboard),
+          });
+          return await onUpdateSuccess(response);
+        } catch (error) {
+          return onError(error as Response);
        }
+      };

-        // precheck for overwrite items
-        SupersetClient.get({
-          endpoint: `/api/v1/dashboard/${id}`,
-        }).then((response: JsonObject) => {
+      if (
+        !isFeatureEnabled(FeatureFlag.ConfirmDashboardDiff) ||
+        saveType === SAVE_TYPE_OVERWRITE_CONFIRMED
+      ) {
+        // skip overwrite precheck
+        return updateDashboard();
+      }
+
+      // precheck for overwrite items
+      return SupersetClient.get({
+        endpoint: `/api/v1/dashboard/${id}`,
+      })
+        .then((response: JsonObject) => {
          const dashboard = (response.json as JsonObject).result as JsonObject;
          const overwriteConfirmItems = getOverwriteItems(
            dashboard,
            updatedDashboard,
          );
-          if (overwriteConfirmItems.length > 0) {
-            dispatch(
-              setOverrideConfirm({
-                updatedAt: dashboard.changed_on as string,
-                updatedBy: dashboard.changed_by_name as string,
-                overwriteConfirmItems:
-                  overwriteConfirmItems as DashboardState['overwriteConfirmMetadata'] extends
-                    | { overwriteConfirmItems: infer I }
-                    | undefined
-                    ? I
-                    : never,
-                dashboardId: id,
-                data: updatedDashboard,
-              }),
-            );
-            return reject(overwriteConfirmItems);
+          if (overwriteConfirmItems.length === 0) {
+            return updateDashboard();
          }
-          return resolve();
-        });
-      })
-        .then(updateDashboard)
-        .catch((overwriteConfirmItems: JsonObject[]) => {
-          const errorText = t('Please confirm the overwrite values.');
+          dispatch(
+            setOverrideConfirm({
+              updatedAt: dashboard.changed_on as string,
+              updatedBy: dashboard.changed_by_name as string,
+              overwriteConfirmItems:
+                overwriteConfirmItems as DashboardState['overwriteConfirmMetadata'] extends
+                  | { overwriteConfirmItems: infer I }
+                  | undefined
+                  ? I
+                  : never,
+              dashboardId: id,
+              data: updatedDashboard,
+            }),
+          );
          dispatch(
            logEvent(LOG_ACTIONS_CONFIRM_OVERWRITE_DASHBOARD_METADATA, {
              dashboard_id: id,
              items: overwriteConfirmItems,
            }),
          );
-          dispatch(addDangerToast(errorText));
-        });
+          dispatch(addDangerToast(t('Please confirm the overwrite values.')));
+          return undefined;
+        })
+        .catch(onError);
    }
    // changing the data as the endpoint requires
    if (
@@ -27,7 +27,7 @@ import {
 } from '@superset-ui/core';
 import { Dispatch } from 'redux';
 import { RootState } from 'src/dashboard/types';
-import { cloneDeep } from 'lodash-es';
+import { cloneDeep, omit } from 'lodash-es';
 import { setDataMaskForFilterChangesComplete } from 'src/dataMask/actions';
 import { HYDRATE_DASHBOARD } from './hydrate';
 import {
@@ -90,12 +90,20 @@ export const setFilterConfiguration =
    });
    try {
      const response = await updateFilters(filterChanges);
+      // chartsInScope/tabsInScope are derived from the live layout, and the
+      // response carries the persisted copy for every filter - including the
+      // ones this save never touched, whose copy is whatever was stored when
+      // the dashboard was last saved. Dropping them lets the reducers keep the
+      // scopes calculateScopes already computed for this session.
+      const savedFilters = response.result.map(
+        filter => omit(filter, ['chartsInScope', 'tabsInScope']) as Filter,
+      );
      dispatch({
        type: SET_NATIVE_FILTERS_CONFIG_COMPLETE,
-        filterChanges: response.result,
+        filterChanges: savedFilters,
        deletedIds: filterChanges.deleted,
      });
-      dispatch(nativeFiltersConfigChanged(response.result));
+      dispatch(nativeFiltersConfigChanged(savedFilters));
      dispatch(setDataMaskForFilterChangesComplete(filterChanges, oldFilters));
    } catch (err) {
      dispatch({
@@ -21,6 +21,7 @@ import tinycolor from 'tinycolor2';
 import Tabs from '@superset-ui/core/components/Tabs';
 import { t } from '@apache-superset/core/translation';
 import { css, SupersetTheme } from '@apache-superset/core/theme';
+import { useDashboardComponents } from 'src/core';
 import SliceAdder from 'src/dashboard/containers/SliceAdder';
 import dashboardComponents from 'src/visualizations/presets/dashboardComponents';
 import NewColumn from '../gridComponents/new/NewColumn';
@@ -29,6 +30,7 @@ import NewHeader from '../gridComponents/new/NewHeader';
 import NewRow from '../gridComponents/new/NewRow';
 import NewTabs from '../gridComponents/new/NewTabs';
 import NewMarkdown from '../gridComponents/new/NewMarkdown';
+import NewExtensionComponent from '../gridComponents/new/NewExtensionComponent';
 import NewDynamicComponent from '../gridComponents/new/NewDynamicComponent';

 const BUILDER_PANE_WIDTH = 374;
@@ -38,83 +40,94 @@ const TABS_KEYS = {
  LAYOUT_ELEMENTS: 'LAYOUT_ELEMENTS',
 };

-const BuilderComponentPane = ({ topOffset = 0 }) => (
-  <div
-    data-test="dashboard-builder-sidepane"
-    css={css`
-      position: sticky;
-      right: 0;
-      top: ${topOffset}px;
-      height: calc(100vh - ${topOffset}px);
-      width: ${BUILDER_PANE_WIDTH}px;
-    `}
-  >
+const BuilderComponentPane = ({ topOffset = 0 }) => {
+  const extensionComponents = useDashboardComponents();
+  return (
    <div
-      css={(theme: SupersetTheme) => css`
-        position: absolute;
-        height: 100%;
+      data-test="dashboard-builder-sidepane"
+      css={css`
+        position: sticky;
+        right: 0;
+        top: ${topOffset}px;
+        height: calc(100vh - ${topOffset}px);
        width: ${BUILDER_PANE_WIDTH}px;
-        box-shadow: -${theme.sizeUnit}px 0 ${theme.sizeUnit}px 0
-          ${tinycolor(theme.colorBorder).setAlpha(0.1).toRgbString()};
-        background-color: ${theme.colorBgBase};
      `}
    >
-      <Tabs
-        data-test="dashboard-builder-component-pane-tabs-navigation"
-        id="tabs"
+      <div
        css={(theme: SupersetTheme) => css`
-          line-height: inherit;
-          margin-top: ${theme.sizeUnit * 2}px;
+          position: absolute;
          height: 100%;
-
-          & .ant-tabs-body-holder {
-            height: 100%;
-            & .ant-tabs-body {
-              height: 100%;
-            }
-          }
+          width: ${BUILDER_PANE_WIDTH}px;
+          box-shadow: -${theme.sizeUnit}px 0 ${theme.sizeUnit}px 0
+            ${tinycolor(theme.colorBorder).setAlpha(0.1).toRgbString()};
+          background-color: ${theme.colorBgBase};
        `}
-        items={[
-          {
-            key: TABS_KEYS.CHARTS,
-            label: t('Charts'),
-            children: (
-              <div
-                css={css`
-                  height: calc(100vh - ${topOffset * 2}px);
-                `}
-              >
-                <SliceAdder />
-              </div>
-            ),
-          },
-          {
-            key: TABS_KEYS.LAYOUT_ELEMENTS,
-            label: t('Layout elements'),
-            children: (
-              <>
-                <NewTabs />
-                <NewRow />
-                <NewColumn />
-                <NewHeader />
-                <NewMarkdown />
-                <NewDivider />
-                {dashboardComponents
-                  .getAll()
-                  .map(({ key: componentKey, metadata }) => (
-                    <NewDynamicComponent
-                      key={componentKey}
-                      metadata={metadata}
-                      componentKey={componentKey}
+      >
+        <Tabs
+          data-test="dashboard-builder-component-pane-tabs-navigation"
+          id="tabs"
+          css={(theme: SupersetTheme) => css`
+            line-height: inherit;
+            margin-top: ${theme.sizeUnit * 2}px;
+            height: 100%;
+
+            & .ant-tabs-body-holder {
+              height: 100%;
+              & .ant-tabs-body {
+                height: 100%;
+              }
+            }
+          `}
+          items={[
+            {
+              key: TABS_KEYS.CHARTS,
+              label: t('Charts'),
+              children: (
+                <div
+                  css={css`
+                    height: calc(100vh - ${topOffset * 2}px);
+                  `}
+                >
+                  <SliceAdder />
+                </div>
+              ),
+            },
+            {
+              key: TABS_KEYS.LAYOUT_ELEMENTS,
+              label: t('Layout elements'),
+              children: (
+                <>
+                  <NewTabs />
+                  <NewRow />
+                  <NewColumn />
+                  <NewHeader />
+                  <NewMarkdown />
+                  <NewDivider />
+                  {/* Extensions-contributed dashboard components */}
+                  {extensionComponents.map(({ definition }) => (
+                    <NewExtensionComponent
+                      key={definition.id}
+                      definition={definition}
                    />
                  ))}
-              </>
-            ),
-          },
-        ]}
-      />
+                  {/* @deprecated legacy DashboardComponentsRegistry path */}
+                  {dashboardComponents
+                    .getAll()
+                    .map(({ key: componentKey, metadata }) => (
+                      <NewDynamicComponent
+                        key={componentKey}
+                        metadata={metadata}
+                        componentKey={componentKey}
+                      />
+                    ))}
+                </>
+              ),
+            },
+          ]}
+        />
+      </div>
    </div>
-  </div>
-);
+  );
+};

 export default BuilderComponentPane;
@@ -468,7 +468,7 @@ function SliceAdder({
          <AutoSizer>
            {({ height, width }: { height: number; width: number }) => (
              <List
-                style={{ width, height }}
+                style={{ width, height, maxHeight: height }}
                rowCount={filteredSlices.length}
                rowHeight={DEFAULT_CELL_HEIGHT}
                rowProps={listRowProps}
@@ -0,0 +1,106 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { screen, render } from 'spec/helpers/testing-library';
+import { dashboardComponents } from 'src/core';
+import newComponentFactory from 'src/dashboard/util/newComponentFactory';
+import {
+  EXTENSION_TYPE,
+  DASHBOARD_GRID_TYPE,
+} from 'src/dashboard/util/componentTypes';
+import DashboardExtensionComponent, {
+  DashboardExtensionComponentProps,
+} from './DashboardExtensionComponent';
+
+const makeComponent = (extensionComponentId?: string) => {
+  const component = newComponentFactory(EXTENSION_TYPE);
+  component.meta.extensionComponentId = extensionComponentId;
+  return component;
+};
+
+const baseProps = (
+  overrides: Partial<DashboardExtensionComponentProps> = {},
+): DashboardExtensionComponentProps => ({
+  id: 'ext-id',
+  parentId: 'parentId',
+  component: makeComponent('acme.demo'),
+  parentComponent: newComponentFactory(DASHBOARD_GRID_TYPE),
+  index: 0,
+  depth: 1,
+  editMode: false,
+  availableColumnCount: 12,
+  columnWidth: 50,
+  onResizeStart: jest.fn(),
+  onResize: jest.fn(),
+  onResizeStop: jest.fn(),
+  deleteComponent: jest.fn(),
+  handleComponentDrop: jest.fn(),
+  updateComponents: jest.fn(),
+  ...overrides,
+});
+
+const setup = (props: Partial<DashboardExtensionComponentProps> = {}) =>
+  render(<DashboardExtensionComponent {...baseProps(props)} />, {
+    useRedux: true,
+    useDnd: true,
+  });
+
+test('renders the registered contributed component', () => {
+  const disposable = dashboardComponents.registerDashboardComponent(
+    { id: 'acme.demo', name: 'Acme Demo' },
+    () => <div data-test="acme-demo-content">Acme content</div>,
+  );
+  setup();
+  expect(screen.getByTestId('acme-demo-content')).toBeInTheDocument();
+  disposable.dispose();
+});
+
+test('renders a graceful placeholder when the component is not registered', () => {
+  setup({ component: makeComponent('not.installed') });
+  expect(
+    screen.getByTestId('dashboard-component-extension-missing'),
+  ).toBeInTheDocument();
+  expect(
+    screen.getByText(/requires the "not.installed" extension/),
+  ).toBeInTheDocument();
+});
+
+test('passes editMode and an updateMeta that patches the instance meta', () => {
+  const updateComponents = jest.fn();
+  let captured: ((patch: Record<string, unknown>) => void) | undefined;
+  const disposable = dashboardComponents.registerDashboardComponent(
+    { id: 'acme.meta', name: 'Acme Meta' },
+    ({ editMode, updateMeta }) => {
+      captured = updateMeta;
+      return <div>{editMode ? 'editing' : 'viewing'}</div>;
+    },
+  );
+  setup({
+    component: makeComponent('acme.meta'),
+    editMode: true,
+    updateComponents,
+  });
+  expect(screen.getByText('editing')).toBeInTheDocument();
+  captured?.({ url: 'https://x.com' });
+  expect(updateComponents).toHaveBeenCalledTimes(1);
+  const updated = Object.values(updateComponents.mock.calls[0][0])[0] as {
+    meta: { url: string };
+  };
+  expect(updated.meta.url).toBe('https://x.com');
+  disposable.dispose();
+});
@@ -0,0 +1,193 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * Host wrapper for Extensions-contributed dashboard components (EXTENSION_TYPE).
+ *
+ * This component owns the shared dashboard "chrome" — the drag handle, resize
+ * container, and delete affordance — and renders the contributed component
+ * resolved from the `dashboardComponents` registry, passing it the stable
+ * `DashboardComponentProps` contract. Contributed components therefore only
+ * render content; they never re-implement layout chrome.
+ *
+ * If the referenced component is not registered (e.g. its extension is disabled
+ * or not yet loaded), a non-destructive placeholder is rendered and the
+ * instance's `meta` is preserved on save.
+ */
+import { useCallback } from 'react';
+import type { ResizeStartCallback, ResizeCallback } from 're-resizable';
+
+import { t } from '@apache-superset/core/translation';
+import { styled } from '@apache-superset/core/theme';
+
+import { useDashboardComponents } from 'src/core';
+import DeleteComponentButton from 'src/dashboard/components/DeleteComponentButton';
+import { Draggable } from 'src/dashboard/components/dnd/DragDroppable';
+import HoverMenu from 'src/dashboard/components/menu/HoverMenu';
+import ResizableContainer from 'src/dashboard/components/resizable/ResizableContainer';
+import type { LayoutItem } from 'src/dashboard/types';
+import type { DropResult } from 'src/dashboard/components/dnd/dragDroppableConfig';
+import { ROW_TYPE } from 'src/dashboard/util/componentTypes';
+import {
+  GRID_MIN_COLUMN_COUNT,
+  GRID_MIN_ROW_UNITS,
+  GRID_BASE_UNIT,
+} from 'src/dashboard/util/constants';
+
+export interface DashboardExtensionComponentProps {
+  id: string;
+  parentId: string;
+  component: LayoutItem;
+  parentComponent: LayoutItem;
+  index: number;
+  depth: number;
+  editMode: boolean;
+
+  availableColumnCount: number;
+  columnWidth: number;
+  onResizeStart: ResizeStartCallback;
+  onResize: ResizeCallback;
+  onResizeStop: ResizeCallback;
+
+  deleteComponent: (id: string, parentId: string) => void;
+  handleComponentDrop: (dropResult: DropResult) => void;
+  updateComponents: (components: Record<string, LayoutItem>) => void;
+}
+
+const Placeholder = styled.div`
+  ${({ theme }) => `
+    width: 100%;
+    height: 100%;
+    min-height: ${theme.sizeUnit * 25}px;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    text-align: center;
+    padding: ${theme.sizeUnit * 4}px;
+    color: ${theme.colorTextTertiary};
+    border: 1px dashed ${theme.colorBorder};
+  `}
+`;
+
+export default function DashboardExtensionComponent(
+  props: DashboardExtensionComponentProps,
+) {
+  const {
+    component,
+    parentComponent,
+    index,
+    depth,
+    editMode,
+    availableColumnCount,
+    columnWidth,
+    onResizeStart,
+    onResize,
+    onResizeStop,
+    deleteComponent,
+    handleComponentDrop,
+    updateComponents,
+  } = props;
+
+  // Subscribe to the registry so a component that registers after this renders
+  // (e.g. a lazily-loaded extension) replaces the placeholder once available.
+  const registered = useDashboardComponents();
+  const extensionComponentId = component.meta.extensionComponentId as
+    | string
+    | undefined;
+  const entry = registered.find(r => r.definition.id === extensionComponentId);
+
+  const handleDeleteComponent = useCallback(() => {
+    deleteComponent(component.id, parentComponent.id);
+  }, [component.id, deleteComponent, parentComponent.id]);
+
+  const updateMeta = useCallback(
+    (patch: Record<string, unknown>) => {
+      updateComponents({
+        [component.id]: {
+          ...component,
+          meta: { ...component.meta, ...patch },
+        },
+      });
+    },
+    [component, updateComponents],
+  );
+
+  const resizable = entry?.definition.resizable ?? true;
+  const widthMultiple = component.meta.width ?? GRID_MIN_COLUMN_COUNT;
+  const ContributedComponent = entry?.Component;
+
+  return (
+    <Draggable
+      component={component}
+      parentComponent={parentComponent}
+      orientation={parentComponent.type === ROW_TYPE ? 'column' : 'row'}
+      index={index}
+      depth={depth}
+      onDrop={handleComponentDrop}
+      editMode={editMode}
+    >
+      {({ dragSourceRef }: { dragSourceRef: React.Ref<HTMLDivElement> }) => (
+        <ResizableContainer
+          id={component.id}
+          adjustableWidth={resizable && parentComponent.type === ROW_TYPE}
+          adjustableHeight={resizable}
+          widthStep={columnWidth}
+          widthMultiple={widthMultiple}
+          heightStep={GRID_BASE_UNIT}
+          heightMultiple={component.meta.height ?? GRID_MIN_ROW_UNITS}
+          minWidthMultiple={GRID_MIN_COLUMN_COUNT}
+          minHeightMultiple={GRID_MIN_ROW_UNITS}
+          maxWidthMultiple={availableColumnCount + widthMultiple}
+          onResizeStart={onResizeStart}
+          onResize={onResize}
+          onResizeStop={onResizeStop}
+          editMode={editMode}
+        >
+          <div
+            ref={dragSourceRef}
+            className="dashboard-component dashboard-component-extension"
+            data-test="dashboard-component-extension"
+            id={component.id}
+          >
+            {editMode && (
+              <HoverMenu position="top">
+                <DeleteComponentButton onDelete={handleDeleteComponent} />
+              </HoverMenu>
+            )}
+            {ContributedComponent ? (
+              <ContributedComponent
+                id={component.id}
+                meta={component.meta}
+                editMode={editMode}
+                updateMeta={updateMeta}
+              />
+            ) : (
+              <Placeholder data-test="dashboard-component-extension-missing">
+                {t(
+                  'This component requires the "%(id)s" extension, which is not available.',
+                  { id: extensionComponentId ?? t('unknown') },
+                )}
+              </Placeholder>
+            )}
+          </div>
+        </ResizableContainer>
+      )}
+    </Draggable>
+  );
+}
@@ -22,6 +22,7 @@ import {
  COLUMN_TYPE,
  DIVIDER_TYPE,
  HEADER_TYPE,
+  EXTENSION_TYPE,
  ROW_TYPE,
  TAB_TYPE,
  TABS_TYPE,
@@ -33,6 +34,7 @@ import Markdown from './Markdown';
 import Column from './Column';
 import Divider from './Divider';
 import Header from './Header';
+import DashboardExtensionComponent from './DashboardExtensionComponent';
 import Row from './Row';
 import Tab from './Tab';
 import Tabs from './Tabs';
@@ -44,6 +46,7 @@ export const componentLookup = {
  [COLUMN_TYPE]: Column,
  [DIVIDER_TYPE]: Divider,
  [HEADER_TYPE]: Header,
+  [EXTENSION_TYPE]: DashboardExtensionComponent,
  [ROW_TYPE]: Row,
  [TAB_TYPE]: Tab,
  [TABS_TYPE]: Tabs,
@@ -0,0 +1,71 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import type { dashboardComponents as dashboardComponentsApi } from '@apache-superset/core';
+import { Icons } from '@superset-ui/core/components';
+import { EXTENSION_TYPE } from '../../../util/componentTypes';
+import { NEW_EXTENSION_ID } from '../../../util/constants';
+import DraggableNewComponent from './DraggableNewComponent';
+
+type Definition = dashboardComponentsApi.DashboardComponentDefinition;
+
+/**
+ * Palette drag source for an Extensions-contributed dashboard component. Drops a
+ * new EXTENSION_TYPE instance whose `meta.extensionComponentId` selects the
+ * contributed component, seeded with the definition's `defaultMeta`.
+ */
+export default function NewExtensionComponent({
+  definition,
+}: {
+  definition: Definition;
+}) {
+  const IconComponent =
+    (definition.icon &&
+      (Icons as Record<string, (typeof Icons)[keyof typeof Icons]>)[
+        definition.icon
+      ]) ||
+    Icons.AppstoreOutlined;
+
+  // Seed the layout-relevant behavior onto the instance meta so the (pure)
+  // dashboard util maps can honor it without coupling to the component registry,
+  // and so it round-trips in the saved layout even if the extension is later
+  // unavailable. Only defined fields are seeded to keep meta tidy.
+  const behaviorMeta: Record<string, unknown> = {
+    extensionComponentId: definition.id,
+  };
+  if (definition.resizable !== undefined)
+    behaviorMeta.resizable = definition.resizable;
+  if (definition.isUserContent !== undefined)
+    behaviorMeta.isUserContent = definition.isUserContent;
+  if (definition.minWidth !== undefined)
+    behaviorMeta.minWidth = definition.minWidth;
+  if (definition.validParents !== undefined)
+    behaviorMeta.validParents = definition.validParents;
+  if (definition.wrapInRow !== undefined)
+    behaviorMeta.wrapInRow = definition.wrapInRow;
+
+  return (
+    <DraggableNewComponent
+      id={`${NEW_EXTENSION_ID}-${definition.id}`}
+      type={EXTENSION_TYPE}
+      label={definition.name}
+      IconComponent={IconComponent}
+      meta={{ ...behaviorMeta, ...definition.defaultMeta }}
+    />
+  );
+}
@@ -16,8 +16,20 @@
 * specific language governing permissions and limitations
 * under the License.
 */
+import {
+  ChartCustomizationType,
+  type ChartCustomization,
+} from '@superset-ui/core';
 import { LabeledValue } from '@superset-ui/core/components';
-import { createLabelSortComparator } from './GroupByFilterCard';
+import { render, screen } from 'spec/helpers/testing-library';
+import GroupByFilterCard, {
+  createLabelSortComparator,
+} from './GroupByFilterCard';
+
+jest.mock('src/utils/cachedSupersetGet', () => ({
+  // Never resolves, pinning the card in its column-loading state.
+  cachedSupersetGet: jest.fn(() => new Promise(() => {})),
+}));

 const apple: LabeledValue = { value: 'a', label: 'Apple' };
 const banana: LabeledValue = { value: 'b', label: 'Banana' };
@@ -39,3 +51,27 @@ test('preserves source order when sortAscending is unset', () => {
  expect(compare(apple, banana)).toBe(0);
  expect(compare(banana, apple)).toBe(0);
 });
+
+const groupByCustomization: ChartCustomization = {
+  id: 'groupby-1',
+  name: 'Group By',
+  filterType: 'filter_groupby',
+  type: ChartCustomizationType.ChartCustomization,
+  targets: [{ datasetId: 1 }],
+  scope: { rootPath: [], excluded: [] },
+  controlValues: {},
+  defaultDataMask: {},
+};
+
+test('renders the column-loading spinner small and muted', async () => {
+  render(<GroupByFilterCard customizationItem={groupByCustomization} />, {
+    useRedux: true,
+    initialState: {
+      dataMask: {},
+      nativeFilters: { filters: {} },
+    },
+  });
+  const spinner = await screen.findByTestId('loading-indicator');
+  expect(spinner).toHaveClass('inline');
+  expect(spinner).toHaveStyle({ opacity: 0.25, width: '40px' });
+});
@@ -645,7 +645,7 @@ const GroupByFilterCard: FC<GroupByFilterCardProps> = ({

      {loading && (
        <div style={{ textAlign: 'center', marginTop: 8 }}>
-          <Loading position="inline" />
+          <Loading position="inline" size="s" muted />
        </div>
      )}
    </div>
@@ -76,7 +76,7 @@ const typeIntoSelect = async (text: string) => {
 const findOption = (text: string) =>
  waitFor(() => {
    // eslint-disable-next-line testing-library/no-node-access
-    const virtualList = document.querySelector('.rc-virtual-list');
+    const virtualList = document.querySelector('.ant-select-dropdown-list');
    if (!virtualList) {
      throw new Error('Virtual list not found');
    }
@@ -72,3 +72,13 @@ test('omits datasourceType when undefined', () => {
  });
  expect(target).not.toHaveProperty('datasourceType');
 });
+
+test('omits datasourceType when there is no dataset', () => {
+  // The modal stamps a hidden ``datasourceType`` field on every filter form,
+  // including dataset-less types. Without a dataset there is nothing for it to
+  // describe, and emitting it would diverge from the ``{}`` target the import
+  // and seed paths write.
+  expect(
+    buildNativeFilterTarget({ datasourceType: DatasourceType.Table }),
+  ).toEqual({});
+});
@@ -33,9 +33,9 @@ export interface TargetFormInputs {
 * Build the ``NativeFilterTarget`` carried by a native filter or chart
 * customization from its form inputs.
 *
- * Consolidates what used to live in three places — ``filterTransformer``,
- * ``customizationTransformer``, and ``createHandleSave`` — so changes to the
- * target shape only need to happen here.
+ * Consolidates what used to live in ``filterTransformer`` and
+ * ``customizationTransformer`` so changes to the target shape only need to
+ * happen here.
 */
 export function buildNativeFilterTarget(
  formInputs: TargetFormInputs,
@@ -49,7 +49,11 @@ export function buildNativeFilterTarget(
        : formInputs.dataset;
  }

-  if (formInputs.datasourceType) {
+  // ``datasourceType`` describes the selected dataset, so it only belongs on a
+  // target that has one. Emitting it for a dataset-less filter (e.g.
+  // ``filter_time``) would make a UI save serialize a target the import and
+  // seed paths write as ``{}``.
+  if (formInputs.dataset != null && formInputs.datasourceType) {
    target.datasourceType = formInputs.datasourceType;
  }

@@ -0,0 +1,102 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { ChartCustomization, ChartCustomizationType } from '@superset-ui/core';
+import { ChartCustomizationsFormItem } from '../types';
+import { transformCustomizationForSave } from './customizationTransformer';
+
+const baseFormItem = {
+  type: ChartCustomizationType.ChartCustomization,
+  scope: { rootPath: ['ROOT_ID'], excluded: [] },
+  controlValues: {},
+  requiredFirst: {},
+  defaultValue: null,
+  defaultDataMask: { filterState: {}, extraFormData: {} },
+  sortMetric: null,
+  description: '',
+  // form-only field that must never leak into the saved customization
+  defaultValueQueriesData: null,
+} as unknown as ChartCustomizationsFormItem;
+
+test('serializes a dataset-less customization into a full ChartCustomization', () => {
+  // Customization plugins declaring ``datasourceCount: 0`` render no dataset
+  // control, so their form item carries neither ``dataset`` nor ``targets``.
+  const formItem = {
+    ...baseFormItem,
+    name: 'Layer visibility',
+    filterType: 'customization_deckgl_layer_visibility',
+  } as unknown as ChartCustomizationsFormItem;
+
+  const result = transformCustomizationForSave(
+    'CHART_CUSTOMIZATION-abc',
+    formItem,
+  ) as ChartCustomization;
+
+  expect(result.targets).toEqual([{}]);
+  expect(result.defaultDataMask).toBeDefined();
+  expect(result.removed).toBe(false);
+  expect(result).not.toHaveProperty('defaultValueQueriesData');
+});
+
+test('serializes a dataset-backed customization into a full ChartCustomization', () => {
+  const formItem = {
+    ...baseFormItem,
+    name: 'Group by',
+    filterType: 'customization_dynamic_group_by',
+    dataset: { value: 42, label: 'sales' },
+    column: 'region',
+  } as unknown as ChartCustomizationsFormItem;
+
+  const result = transformCustomizationForSave(
+    'CHART_CUSTOMIZATION-def',
+    formItem,
+  ) as ChartCustomization;
+
+  expect(result.targets).toEqual([
+    { datasetId: 42, column: { name: 'region' } },
+  ]);
+  expect(result).not.toHaveProperty('defaultValueQueriesData');
+});
+
+test('passes an already-saved ChartCustomization through untouched', () => {
+  const saved: ChartCustomization = {
+    id: 'CHART_CUSTOMIZATION-ghi',
+    name: 'Group by',
+    filterType: 'customization_dynamic_group_by',
+    type: ChartCustomizationType.ChartCustomization,
+    targets: [{ datasetId: 42, column: { name: 'region' } }],
+    defaultDataMask: { filterState: {}, extraFormData: {} },
+    controlValues: {},
+    scope: { rootPath: ['ROOT_ID'], excluded: [] },
+    description: '  needs trim  ',
+    chartsInScope: [1, 2],
+    tabsInScope: ['TAB-1'],
+  };
+
+  const result = transformCustomizationForSave(
+    'CHART_CUSTOMIZATION-ghi',
+    saved,
+  ) as ChartCustomization;
+
+  expect(result.targets).toEqual([
+    { datasetId: 42, column: { name: 'region' } },
+  ]);
+  expect(result.chartsInScope).toEqual([1, 2]);
+  expect(result.tabsInScope).toEqual(['TAB-1']);
+  expect(result.description).toBe('needs trim');
+});
@@ -69,7 +69,10 @@ function isDividerType(
 function isFormInput(
  formInputs: ChartCustomizationFormOrSaved,
 ): formInputs is ChartCustomizationsFormItem {
-  return 'dataset' in formInputs && typeof formInputs.dataset === 'object';
+  // Mirrors `filterTransformer`: a saved customization always carries a
+  // serialized `targets` array, and dataset-less types (e.g. the deck.gl layer
+  // visibility customization) have no `dataset` to discriminate on.
+  return !('targets' in formInputs);
 }

 function transformCustomizationDivider(
@@ -0,0 +1,156 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { DatasourceType, Filter, NativeFilterType } from '@superset-ui/core';
+import { NativeFiltersFormItem } from '../types';
+import { transformFilterForSave } from './filterTransformer';
+
+const baseFormItem = {
+  type: NativeFilterType.NativeFilter,
+  scope: { rootPath: ['ROOT_ID'], excluded: [] },
+  controlValues: {},
+  requiredFirst: {},
+  defaultValue: null,
+  defaultDataMask: { filterState: {}, extraFormData: {} },
+  description: '',
+  // form-only fields that must never leak into the saved filter
+  defaultValueQueriesData: null,
+} as unknown as NativeFiltersFormItem;
+
+test('serializes a dataset-less filter (filter_time) into a full Filter', () => {
+  // A ``filter_time`` filter has no dataset/column controls, so its form item
+  // carries neither a ``dataset`` nor a ``targets`` key. It must still be
+  // transformed like any other native filter rather than persisted verbatim.
+  const formItem: NativeFiltersFormItem = {
+    ...baseFormItem,
+    name: 'Time Range',
+    filterType: 'filter_time',
+    dependencies: ['NATIVE_FILTER-parent'],
+    // the modal stamps this on every filter form, dataset or not
+    datasourceType: DatasourceType.Table,
+  };
+
+  const result = transformFilterForSave(
+    'NATIVE_FILTER-abc',
+    formItem,
+  ) as Filter;
+
+  // Keys the bug used to strip are present and well-formed. The target matches
+  // the ``{}`` the import and seed paths write, so one logical filter has one
+  // serialization regardless of provenance.
+  expect(result.targets).toEqual([{}]);
+  expect(result.defaultDataMask).toBeDefined();
+  expect(result.cascadeParentIds).toEqual(['NATIVE_FILTER-parent']);
+
+  // Form-only keys must not leak into the persisted config.
+  expect(result).not.toHaveProperty('defaultValueQueriesData');
+  expect(result).not.toHaveProperty('dependencies');
+  // Empty requiredFirst collapses to undefined instead of the raw form object.
+  expect(result.requiredFirst).toBeUndefined();
+
+  // A dataset-less filter has no sort metric control, so the persisted document
+  // must not gain a ``sortMetric`` key it never had. Asserted on the serialized
+  // form because ``undefined`` values survive in the object but not in JSON.
+  expect(JSON.parse(JSON.stringify(result))).not.toHaveProperty('sortMetric');
+
+  expect(result.name).toBe('Time Range');
+  expect(result.filterType).toBe('filter_time');
+});
+
+test('serializes a dataset-backed filter (filter_select) into a full Filter', () => {
+  const formItem: NativeFiltersFormItem = {
+    ...baseFormItem,
+    name: 'Region',
+    filterType: 'filter_select',
+    dataset: { value: 42, label: 'sales' },
+    column: 'region',
+    dependencies: [],
+  };
+
+  const result = transformFilterForSave(
+    'NATIVE_FILTER-def',
+    formItem,
+  ) as Filter;
+
+  expect(result.targets).toEqual([
+    { datasetId: 42, column: { name: 'region' } },
+  ]);
+  expect(result.defaultDataMask).toBeDefined();
+  expect(result.cascadeParentIds).toEqual([]);
+  expect(result).not.toHaveProperty('defaultValueQueriesData');
+});
+
+test('passes an already-saved Filter through untouched (aside from trimming)', () => {
+  // Values coming from the stored filter config map (e.g. cascade-parent
+  // cleanup) already carry a ``targets`` array and must be preserved as-is.
+  const savedFilter: Filter = {
+    id: 'NATIVE_FILTER-ghi',
+    name: 'Time Range',
+    filterType: 'filter_time',
+    type: NativeFilterType.NativeFilter,
+    targets: [{}],
+    defaultDataMask: { filterState: {}, extraFormData: {} },
+    cascadeParentIds: ['NATIVE_FILTER-parent'],
+    controlValues: {},
+    scope: { rootPath: ['ROOT_ID'], excluded: [] },
+    description: '  needs trim  ',
+    chartsInScope: [1, 2],
+    tabsInScope: ['TAB-1'],
+  };
+
+  const result = transformFilterForSave(
+    'NATIVE_FILTER-ghi',
+    savedFilter,
+  ) as Filter;
+
+  expect(result.targets).toEqual([{}]);
+  expect(result.cascadeParentIds).toEqual(['NATIVE_FILTER-parent']);
+  expect(result.chartsInScope).toEqual([1, 2]);
+  expect(result.tabsInScope).toEqual(['TAB-1']);
+  expect(result.description).toBe('needs trim');
+});
+
+test('rebuilds a saved filter whose targets were already stripped', () => {
+  // Dashboards affected by this bug hold ``filter_time`` entries with no
+  // ``targets``. They no longer match the saved-filter branch, so they take the
+  // form-item path and are repaired on the next save. ``cascadeParentIds`` is
+  // read from the form's ``dependencies``, which such an entry does not carry —
+  // the same write that stripped ``targets`` stripped ``cascadeParentIds`` too.
+  const strippedFilter = {
+    id: 'NATIVE_FILTER-jkl',
+    name: 'Time Range',
+    filterType: 'filter_time',
+    type: NativeFilterType.NativeFilter,
+    scope: { rootPath: ['ROOT_ID'], excluded: [] },
+    controlValues: { timeShift: false },
+    description: '',
+    requiredFirst: { 'NATIVE_FILTER-jkl': true },
+    defaultValueQueriesData: null,
+  } as unknown as NativeFiltersFormItem;
+
+  const result = transformFilterForSave(
+    'NATIVE_FILTER-jkl',
+    strippedFilter,
+  ) as Filter;
+
+  expect(result.targets).toEqual([{}]);
+  expect(result.defaultDataMask).toBeDefined();
+  expect(result.requiredFirst).toBe(true);
+  expect(result.cascadeParentIds).toEqual([]);
+  expect(result).not.toHaveProperty('defaultValueQueriesData');
+});
@@ -67,7 +67,10 @@ function isDividerType(
 function isFormInput(
  formInputs: NativeFilterFormOrSaved,
 ): formInputs is NativeFiltersFormItem {
-  return 'dataset' in formInputs;
+  // A saved filter always carries a serialized `targets` array; a form item
+  // never does. Keying this off `dataset` misclassified filter types with no
+  // dataset control (e.g. `filter_time`) as already saved.
+  return !('targets' in formInputs);
 }

 function transformDivider(
@@ -115,7 +118,7 @@ function transformFormInput(
    adhoc_filters: formInputs.adhoc_filters,
    time_range: formInputs.time_range,
    granularity_sqla: formInputs.granularity_sqla,
-    sortMetric: formInputs.sortMetric ?? null,
+    sortMetric: formInputs.sortMetric,
    requiredFirst: formInputs.requiredFirst
      ? Object.values(formInputs.requiredFirst).find(rf => rf)
      : undefined,
@@ -18,21 +18,15 @@
 */
 import type { FormInstance } from '@superset-ui/core/components';
 import { nanoid } from 'nanoid';
-import { getInitialDataMask } from 'src/dataMask/reducer';
 import {
  FilterConfiguration,
  NativeFilterType,
-  NativeFilterTarget,
-  Filter,
-  Divider,
  ChartCustomizationType,
  ChartCustomizationConfiguration,
  ChartCustomization,
  ChartCustomizationDivider,
 } from '@superset-ui/core';
 import { logging } from '@apache-superset/core/utils';
-import { DASHBOARD_ROOT_ID } from 'src/dashboard/util/constants';
-import { buildNativeFilterTarget } from './transformers/buildTarget';
 import {
  ChartCustomizationsForm,
  FilterChangesType,
@@ -101,70 +95,6 @@ export const validateForm = async (
  }
 };

-export const createHandleSave =
-  (
-    saveForm: Function,
-    filterChanges: FilterChangesType,
-    values: NativeFiltersForm,
-    filterConfigMap: Record<string, Filter | Divider>,
-  ) =>
-  async () => {
-    const transformFilter = (id: string) => {
-      const formInputs = values.filters?.[id] || filterConfigMap[id];
-      if (!formInputs) {
-        return undefined;
-      }
-      if (formInputs.type === NativeFilterType.Divider) {
-        return {
-          id,
-          type: NativeFilterType.Divider,
-          scope: {
-            rootPath: [DASHBOARD_ROOT_ID],
-            excluded: [],
-          },
-          title: formInputs.title,
-          description: formInputs.description,
-        };
-      }
-
-      const target: Partial<NativeFilterTarget> =
-        buildNativeFilterTarget(formInputs);
-
-      return {
-        id,
-        adhoc_filters: formInputs.adhoc_filters,
-        time_range: formInputs.time_range,
-        controlValues: formInputs.controlValues ?? {},
-        granularity_sqla: formInputs.granularity_sqla,
-        ...(formInputs.time_grains?.length
-          ? { time_grains: formInputs.time_grains }
-          : {}),
-        requiredFirst: Object.values(formInputs.requiredFirst ?? {}).find(
-          rf => rf,
-        ),
-        name: formInputs.name,
-        filterType: formInputs.filterType,
-        targets: [target],
-        defaultDataMask: formInputs.defaultDataMask ?? getInitialDataMask(),
-        cascadeParentIds: formInputs.dependencies || [],
-        scope: formInputs.scope,
-        sortMetric: formInputs.sortMetric,
-        type: formInputs.type,
-        description: (formInputs.description || '').trim(),
-      };
-    };
-
-    const transformedModified = filterChanges.modified
-      .map(transformFilter)
-      .filter(Boolean);
-
-    const newFilterChanges = {
-      ...filterChanges,
-      modified: transformedModified,
-    };
-    await saveForm(newFilterChanges);
-  };
-
 export const createHandleRemoveItem =
  (
    setRemovedFilters: (
@@ -0,0 +1,150 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import {
+  screen,
+  render,
+  userEvent,
+  fireEvent,
+  waitFor,
+} from 'spec/helpers/testing-library';
+import { isFeatureEnabled } from '@superset-ui/core';
+import {
+  addCspAllowlistEntry,
+  fetchCspAllowlist,
+} from 'src/dashboard/util/cspAllowlist';
+import IframeContent from './IframeContent';
+
+jest.mock('@superset-ui/core', () => ({
+  ...jest.requireActual('@superset-ui/core'),
+  isFeatureEnabled: jest.fn(() => true),
+}));
+
+jest.mock('src/dashboard/util/cspAllowlist', () => ({
+  ...jest.requireActual('src/dashboard/util/cspAllowlist'),
+  fetchCspAllowlist: jest.fn(),
+  addCspAllowlistEntry: jest.fn(),
+}));
+
+const mockedFetch = fetchCspAllowlist as jest.Mock;
+const mockedAdd = addCspAllowlistEntry as jest.Mock;
+const mockedFeature = isFeatureEnabled as jest.Mock;
+
+const adminState = {
+  user: { roles: { Admin: [['can_write', 'CSPAllowlist']] } },
+};
+const gammaState = {
+  user: { roles: { Gamma: [['can_read', 'Dashboard']] } },
+};
+
+const setup = (
+  {
+    url = 'https://example.com',
+    editMode = false,
+    updateMeta = jest.fn(),
+  }: { url?: string; editMode?: boolean; updateMeta?: jest.Mock } = {},
+  initialState: object = adminState,
+) =>
+  render(
+    <IframeContent
+      id="iframe-id"
+      meta={{ url }}
+      editMode={editMode}
+      updateMeta={updateMeta}
+    />,
+    { useRedux: true, initialState },
+  );
+
+beforeEach(() => {
+  mockedFeature.mockReturnValue(true);
+  mockedFetch.mockResolvedValue(new Set<string>());
+  mockedAdd.mockResolvedValue(undefined);
+});
+
+afterEach(() => jest.clearAllMocks());
+
+test('renders an iframe with the configured URL', () => {
+  setup();
+  expect(screen.getByTitle('Embedded content')).toHaveAttribute(
+    'src',
+    'https://example.com',
+  );
+});
+
+test('sandboxes the iframe without allow-same-origin', () => {
+  setup();
+  const sandbox = screen.getByTitle('Embedded content').getAttribute('sandbox');
+  expect(sandbox).toContain('allow-scripts');
+  expect(sandbox).not.toContain('allow-same-origin');
+});
+
+test('renders an empty placeholder when no URL is configured', () => {
+  setup({ url: '' });
+  expect(screen.queryByTitle('Embedded content')).not.toBeInTheDocument();
+  expect(screen.getByText('No URL configured')).toBeInTheDocument();
+});
+
+test('saves the URL via updateMeta on blur in edit mode', async () => {
+  const updateMeta = jest.fn();
+  setup({ editMode: true, updateMeta });
+  const input = screen.getByTestId('dashboard-iframe-url-input');
+  await userEvent.clear(input);
+  await userEvent.type(input, 'https://new.example.com');
+  fireEvent.blur(input);
+  await waitFor(() =>
+    expect(updateMeta).toHaveBeenCalledWith({ url: 'https://new.example.com' }),
+  );
+});
+
+test('flags a non-allowlisted domain and offers Enable for admins', async () => {
+  mockedFetch.mockResolvedValue(new Set<string>());
+  setup({ editMode: true });
+  expect(
+    await screen.findByText('This domain is not allowed to be embedded'),
+  ).toBeInTheDocument();
+  await userEvent.click(screen.getByTestId('dashboard-iframe-enable-csp'));
+  expect(mockedAdd).toHaveBeenCalledWith('https://example.com');
+});
+
+test('does not flag an already-allowlisted domain', async () => {
+  mockedFetch.mockResolvedValue(new Set<string>(['https://example.com']));
+  setup({ editMode: true });
+  await waitFor(() => expect(mockedFetch).toHaveBeenCalled());
+  expect(
+    screen.queryByText('This domain is not allowed to be embedded'),
+  ).not.toBeInTheDocument();
+});
+
+test('hides Enable for users without the CSP permission', async () => {
+  setup({ editMode: true }, gammaState);
+  expect(
+    await screen.findByText('This domain is not allowed to be embedded'),
+  ).toBeInTheDocument();
+  expect(
+    screen.queryByTestId('dashboard-iframe-enable-csp'),
+  ).not.toBeInTheDocument();
+});
+
+test('never flags domains when the feature flag is disabled', async () => {
+  mockedFeature.mockReturnValue(false);
+  setup({ editMode: true });
+  await waitFor(() => expect(mockedFetch).not.toHaveBeenCalled());
+  expect(
+    screen.queryByText('This domain is not allowed to be embedded'),
+  ).not.toBeInTheDocument();
+});
@@ -0,0 +1,215 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * Built-in "iframe" dashboard component, delivered through the
+ * `dashboardComponents` Extensions contribution point. This renders only the
+ * element's *content* and editor — the host (DashboardExtensionComponent) owns
+ * the drag/resize/delete chrome.
+ *
+ * The component also surfaces the runtime CSP allowlist UX (companion SIP):
+ * when the embedded origin is not allowed, it flags it and offers permitted
+ * admins an "Enable domain in CSP" action.
+ */
+import { useCallback, useEffect, useState } from 'react';
+import { useSelector } from 'react-redux';
+
+import { t } from '@apache-superset/core/translation';
+import { styled } from '@apache-superset/core/theme';
+import { FeatureFlag, isFeatureEnabled } from '@superset-ui/core';
+import type { dashboardComponents as dashboardComponentsApi } from '@apache-superset/core';
+import { Alert } from '@apache-superset/core/components';
+import { Button, Input } from '@superset-ui/core/components';
+
+import { useToasts } from 'src/components/MessageToasts/withToasts';
+import { findPermission } from 'src/utils/findPermission';
+import type { RootState } from 'src/dashboard/types';
+import {
+  addCspAllowlistEntry,
+  CSP_ALLOWLIST_PERMISSION,
+  CSP_ALLOWLIST_VIEW,
+  fetchCspAllowlist,
+  getOrigin,
+  isEmbeddableUrl,
+} from 'src/dashboard/util/cspAllowlist';
+
+type DashboardComponentProps = dashboardComponentsApi.DashboardComponentProps;
+
+const IframeStyles = styled.div`
+  ${({ theme }) => `
+    width: 100%;
+    height: 100%;
+    display: flex;
+    flex-direction: column;
+    gap: ${theme.sizeUnit * 2}px;
+    padding: ${theme.sizeUnit * 2}px;
+
+    .dashboard-iframe-frame {
+      flex: 1;
+      width: 100%;
+      border: 0;
+      min-height: ${theme.sizeUnit * 25}px;
+    }
+
+    .dashboard-iframe-empty {
+      flex: 1;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      color: ${theme.colorTextTertiary};
+      border: 1px dashed ${theme.colorBorder};
+    }
+  `}
+`;
+
+export default function IframeContent({
+  meta,
+  editMode,
+  updateMeta,
+}: DashboardComponentProps) {
+  const { addSuccessToast, addDangerToast } = useToasts();
+  const roles = useSelector((state: RootState) => state.user?.roles);
+  const cspFeatureEnabled = isFeatureEnabled(FeatureFlag.CspRuntimeAllowlist);
+  const canManageCsp =
+    cspFeatureEnabled &&
+    findPermission(CSP_ALLOWLIST_PERMISSION, CSP_ALLOWLIST_VIEW, roles);
+
+  const url = (meta.url as string) ?? '';
+  const [draftUrl, setDraftUrl] = useState(url);
+  const [allowlist, setAllowlist] = useState<Set<string> | null>(null);
+  const [enabling, setEnabling] = useState(false);
+
+  const origin = getOrigin(url);
+
+  const refreshAllowlist = useCallback(() => {
+    if (!cspFeatureEnabled) {
+      return;
+    }
+    fetchCspAllowlist()
+      .then(setAllowlist)
+      .catch(() => setAllowlist(new Set()));
+  }, [cspFeatureEnabled]);
+
+  useEffect(() => {
+    refreshAllowlist();
+  }, [refreshAllowlist]);
+
+  useEffect(() => {
+    setDraftUrl(url);
+  }, [url]);
+
+  const handleSaveUrl = useCallback(() => {
+    const trimmed = draftUrl.trim();
+    if (trimmed === url) {
+      return;
+    }
+    updateMeta({ url: trimmed });
+  }, [draftUrl, updateMeta, url]);
+
+  const handleEnableDomain = useCallback(() => {
+    if (!origin) {
+      return;
+    }
+    setEnabling(true);
+    addCspAllowlistEntry(origin)
+      .then(() => {
+        addSuccessToast(
+          t('%(origin)s is now allowed to be embedded.', { origin }),
+        );
+        refreshAllowlist();
+      })
+      .catch(() =>
+        addDangerToast(t('Failed to allow %(origin)s in the CSP.', { origin })),
+      )
+      .finally(() => setEnabling(false));
+  }, [addDangerToast, addSuccessToast, origin, refreshAllowlist]);
+
+  const domainFlagged =
+    cspFeatureEnabled &&
+    !!origin &&
+    allowlist !== null &&
+    !allowlist.has(origin);
+
+  return (
+    <IframeStyles data-test="dashboard-iframe">
+      {editMode && (
+        <Input
+          aria-label={t('Embed URL')}
+          data-test="dashboard-iframe-url-input"
+          placeholder={t('Paste a URL to embed, e.g. https://example.com')}
+          value={draftUrl}
+          onChange={e => setDraftUrl(e.target.value)}
+          onBlur={handleSaveUrl}
+          onPressEnter={handleSaveUrl}
+        />
+      )}
+      {domainFlagged && (
+        <Alert
+          type="warning"
+          showIcon
+          closable={false}
+          message={t('This domain is not allowed to be embedded')}
+          description={
+            canManageCsp
+              ? t(
+                  '%(origin)s is blocked by the Content Security Policy. ' +
+                    'Enable it to allow this content to load.',
+                  { origin },
+                )
+              : t(
+                  '%(origin)s is blocked by the Content Security Policy. ' +
+                    'Ask an administrator to allow this domain.',
+                  { origin },
+                )
+          }
+          action={
+            canManageCsp ? (
+              <Button
+                buttonStyle="primary"
+                buttonSize="small"
+                loading={enabling}
+                onClick={handleEnableDomain}
+                data-test="dashboard-iframe-enable-csp"
+              >
+                {t('Enable domain in CSP')}
+              </Button>
+            ) : undefined
+          }
+        />
+      )}
+      {isEmbeddableUrl(url) ? (
+        <iframe
+          className="dashboard-iframe-frame"
+          src={url}
+          title={t('Embedded content')}
+          // No `allow-same-origin`: combined with `allow-scripts` it would let an
+          // allowlisted-then-compromised origin script its way out of its own
+          // sandbox (same-origin DOM/storage access) for third-party embeds.
+          sandbox="allow-scripts allow-popups allow-forms"
+        />
+      ) : (
+        <div className="dashboard-iframe-empty">
+          {editMode
+            ? t('Enter a URL above to embed content')
+            : t('No URL configured')}
+        </div>
+      )}
+    </IframeStyles>
+  );
+}
@@ -0,0 +1,42 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { t } from '@apache-superset/core/translation';
+import { dashboardComponents } from 'src/core';
+import IframeContent from './IframeContent';
+
+export const IFRAME_COMPONENT_ID = 'superset.iframe';
+
+/**
+ * Registers the built-in iframe as a first-class dashboard component through the
+ * Extensions `dashboardComponents` contribution point. Core registers it the
+ * same way a third-party extension would, demonstrating the contract end to end.
+ */
+export default function registerIframeComponent() {
+  dashboardComponents.registerDashboardComponent(
+    {
+      id: IFRAME_COMPONENT_ID,
+      name: t('Embed / Iframe'),
+      description: t('Embed external content via a URL'),
+      icon: 'LinkOutlined',
+      resizable: true,
+      defaultMeta: { width: 4, height: 50, url: '' },
+    },
+    IframeContent,
+  );
+}
@@ -210,6 +210,7 @@ const actionHandlers: Record<
    const wrapInRow = shouldWrapChildInRow({
      parentType: destination.type,
      childType: dragging.type,
+      childMeta: dragging.meta,
    });

    if (wrapInRow) {
@@ -286,8 +286,14 @@ export type LayoutItemMeta = {
  headerSize?: string;
  /** Markdown source code for markdown components */
  code?: string;
+  /** Embedded URL for iframe components */
+  url?: string;
  /** Background style value for columns and rows */
  background?: string;
+  /** Extension-contributed components opt out of resizing via this flag */
+  resizable?: boolean;
+  /** Extension-contributed components opt out of default row-wrapping via this flag */
+  wrapInRow?: boolean;
  /** Allow additional meta properties used by different component types */
  [key: string]: unknown;
 };
@@ -24,6 +24,7 @@ import {
  DASHBOARD_ROOT_TYPE,
  DIVIDER_TYPE,
  HEADER_TYPE,
+  EXTENSION_TYPE,
  MARKDOWN_TYPE,
  ROW_TYPE,
  TABS_TYPE,
@@ -40,7 +41,7 @@ const notResizable = [
  TAB_TYPE,
 ];

-const resizable = [COLUMN_TYPE, CHART_TYPE, MARKDOWN_TYPE];
+const resizable = [COLUMN_TYPE, CHART_TYPE, EXTENSION_TYPE, MARKDOWN_TYPE];

 // eslint-disable-next-line no-restricted-globals -- TODO: Migrate from describe blocks
 describe('componentIsResizable', () => {
@@ -19,11 +19,20 @@
 import {
  COLUMN_TYPE,
  CHART_TYPE,
+  EXTENSION_TYPE,
  MARKDOWN_TYPE,
  DYNAMIC_TYPE,
 } from './componentTypes';

-export default function componentIsResizable(entity: { type: string }) {
+export default function componentIsResizable(entity: {
+  type: string;
+  meta?: { resizable?: boolean };
+}) {
+  // Extension-contributed components opt out of resizing via their definition,
+  // seeded onto meta at creation.
+  if (entity.type === EXTENSION_TYPE) {
+    return entity.meta?.resizable !== false;
+  }
  return (
    [COLUMN_TYPE, CHART_TYPE, MARKDOWN_TYPE, DYNAMIC_TYPE].indexOf(
      entity.type,
@@ -23,12 +23,17 @@ export const DASHBOARD_GRID_TYPE = 'GRID';
 export const DASHBOARD_ROOT_TYPE = 'ROOT';
 export const DIVIDER_TYPE = 'DIVIDER';
 export const HEADER_TYPE = 'HEADER';
+// First-class Extensions-contributed dashboard component (see the
+// `dashboardComponents` contribution point in @apache-superset/core). The
+// concrete component is selected by `meta.extensionComponentId`.
+export const EXTENSION_TYPE = 'EXTENSION';
 export const MARKDOWN_TYPE = 'MARKDOWN';
 export const NEW_COMPONENT_SOURCE_TYPE = 'NEW_COMPONENT_SOURCE';
 export const ROW_TYPE = 'ROW';
 export const TABS_TYPE = 'TABS';
 export const TAB_TYPE = 'TAB';
-// Dynamic type proposes lazy loading of custom dashboard components that can be added in separate repository
+// @deprecated Legacy lazy-loaded custom component registry (DashboardComponentsRegistry).
+// Superseded by EXTENSION_TYPE + the `dashboardComponents` Extensions contribution point.
 export const DYNAMIC_TYPE = 'DYNAMIC';

 export default {
@@ -39,6 +44,7 @@ export default {
  DASHBOARD_ROOT_TYPE,
  DIVIDER_TYPE,
  HEADER_TYPE,
+  EXTENSION_TYPE,
  MARKDOWN_TYPE,
  NEW_COMPONENT_SOURCE_TYPE,
  ROW_TYPE,
@@ -27,6 +27,7 @@ export const NEW_CHART_ID = 'NEW_CHART_ID';
 export const NEW_COLUMN_ID = 'NEW_COLUMN_ID';
 export const NEW_DIVIDER_ID = 'NEW_DIVIDER_ID';
 export const NEW_HEADER_ID = 'NEW_HEADER_ID';
+export const NEW_EXTENSION_ID = 'NEW_EXTENSION_ID';
 export const NEW_MARKDOWN_ID = 'NEW_MARKDOWN_ID';
 export const NEW_ROW_ID = 'NEW_ROW_ID';
 export const NEW_TAB_ID = 'NEW_TAB_ID';
@@ -0,0 +1,88 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { SupersetClient } from '@superset-ui/core';
+import {
+  addCspAllowlistEntry,
+  CSP_ALLOWLIST_ENDPOINT,
+  fetchCspAllowlist,
+  getOrigin,
+  isEmbeddableUrl,
+} from './cspAllowlist';
+
+test('getOrigin extracts the bare origin from a URL', () => {
+  expect(getOrigin('https://example.com/path?q=1#frag')).toBe(
+    'https://example.com',
+  );
+  expect(getOrigin('https://example.com:8443/x')).toBe(
+    'https://example.com:8443',
+  );
+  expect(getOrigin('http://localhost:9000')).toBe('http://localhost:9000');
+});
+
+test('getOrigin returns null for empty or unparseable URLs', () => {
+  expect(getOrigin('')).toBeNull();
+  expect(getOrigin(undefined)).toBeNull();
+  expect(getOrigin('not a url')).toBeNull();
+  expect(getOrigin('example.com')).toBeNull();
+});
+
+test('isEmbeddableUrl is true only for absolute http(s) URLs', () => {
+  expect(isEmbeddableUrl('https://example.com')).toBe(true);
+  expect(isEmbeddableUrl('http://example.com/embed')).toBe(true);
+  expect(isEmbeddableUrl('ftp://example.com')).toBe(false);
+  // built via concatenation to avoid a literal javascript: URL in source
+  expect(isEmbeddableUrl(`${'java'}${'script'}:alert(1)`)).toBe(false);
+  expect(isEmbeddableUrl('')).toBe(false);
+  expect(isEmbeddableUrl(undefined)).toBe(false);
+});
+
+test('fetchCspAllowlist returns the set of origins for frame-src', async () => {
+  const getSpy = jest.spyOn(SupersetClient, 'get').mockResolvedValue({
+    json: {
+      result: [
+        { domain: 'https://a.com', directive: 'frame-src' },
+        { domain: 'https://b.com', directive: 'frame-src' },
+        { domain: 'https://c.com', directive: 'img-src' },
+      ],
+    },
+  } as any);
+
+  const allowlist = await fetchCspAllowlist();
+  expect(getSpy).toHaveBeenCalledWith({ endpoint: CSP_ALLOWLIST_ENDPOINT });
+  expect(allowlist.has('https://a.com')).toBe(true);
+  expect(allowlist.has('https://b.com')).toBe(true);
+  // img-src entries are excluded from the frame-src set
+  expect(allowlist.has('https://c.com')).toBe(false);
+
+  getSpy.mockRestore();
+});
+
+test('addCspAllowlistEntry posts the origin with the frame-src directive', async () => {
+  const postSpy = jest
+    .spyOn(SupersetClient, 'post')
+    .mockResolvedValue({} as any);
+
+  await addCspAllowlistEntry('https://example.com');
+  expect(postSpy).toHaveBeenCalledWith({
+    endpoint: CSP_ALLOWLIST_ENDPOINT,
+    jsonPayload: { domain: 'https://example.com', directive: 'frame-src' },
+  });
+
+  postSpy.mockRestore();
+});
@@ -0,0 +1,79 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { SupersetClient } from '@superset-ui/core';
+
+export const CSP_ALLOWLIST_ENDPOINT = '/api/v1/csp_allowlist/';
+export const DEFAULT_EMBED_DIRECTIVE = 'frame-src';
+
+/** FAB requires `can write on CSPAllowlist`; Admins hold it by default. */
+export const CSP_ALLOWLIST_PERMISSION = 'can_write';
+export const CSP_ALLOWLIST_VIEW = 'CSPAllowlist';
+
+interface CSPAllowlistResult {
+  result?: { domain: string; directive: string }[];
+}
+
+/**
+ * Return the bare origin (scheme://host[:port]) of a URL, or null if the URL is
+ * empty or cannot be parsed. Mirrors the server-side `is_valid_csp_origin`
+ * canonicalization so the UX check matches what the backend will accept.
+ */
+export function getOrigin(url?: string | null): string | null {
+  if (!url) {
+    return null;
+  }
+  try {
+    const { origin } = new URL(url);
+    // URL parses things like "mailto:" to an opaque origin of "null"
+    return origin && origin !== 'null' ? origin : null;
+  } catch {
+    return null;
+  }
+}
+
+/** True only for absolute http(s) URLs that resolve to a concrete origin. */
+export function isEmbeddableUrl(url?: string | null): boolean {
+  const origin = getOrigin(url);
+  return !!origin && /^https?:\/\//.test(origin);
+}
+
+/** Fetch the set of origins currently allowed for the given CSP directive. */
+export async function fetchCspAllowlist(
+  directive: string = DEFAULT_EMBED_DIRECTIVE,
+): Promise<Set<string>> {
+  const response = await SupersetClient.get({
+    endpoint: CSP_ALLOWLIST_ENDPOINT,
+  });
+  const json = response.json as CSPAllowlistResult;
+  const origins = (json.result ?? [])
+    .filter(entry => entry.directive === directive)
+    .map(entry => entry.domain);
+  return new Set(origins);
+}
+
+/** Add a new allowlist entry (punch a hole in the CSP) for the given origin. */
+export async function addCspAllowlistEntry(
+  domain: string,
+  directive: string = DEFAULT_EMBED_DIRECTIVE,
+): Promise<void> {
+  await SupersetClient.post({
+    endpoint: CSP_ALLOWLIST_ENDPOINT,
+    jsonPayload: { domain, directive },
+  });
+}
@@ -0,0 +1,123 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import componentIsResizable from './componentIsResizable';
+import isValidChild from './isValidChild';
+import shouldWrapChildInRow from './shouldWrapChildInRow';
+import isDashboardEmpty from './isDashboardEmpty';
+import getDetailedComponentWidth from './getDetailedComponentWidth';
+import {
+  EXTENSION_TYPE,
+  DASHBOARD_GRID_TYPE,
+  TAB_TYPE,
+  COLUMN_TYPE,
+} from './componentTypes';
+
+test('componentIsResizable honors meta.resizable for extension components', () => {
+  expect(componentIsResizable({ type: EXTENSION_TYPE })).toBe(true);
+  expect(
+    componentIsResizable({ type: EXTENSION_TYPE, meta: { resizable: true } }),
+  ).toBe(true);
+  expect(
+    componentIsResizable({ type: EXTENSION_TYPE, meta: { resizable: false } }),
+  ).toBe(false);
+});
+
+test('isValidChild restricts extension parents via meta.validParents', () => {
+  // Allowed in GRID when GRID is listed
+  expect(
+    isValidChild({
+      parentType: DASHBOARD_GRID_TYPE,
+      childType: EXTENSION_TYPE,
+      parentDepth: 1,
+      childMeta: { validParents: [DASHBOARD_GRID_TYPE] },
+    }),
+  ).toBe(true);
+  // Forbidden in COLUMN when only GRID is listed
+  expect(
+    isValidChild({
+      parentType: COLUMN_TYPE,
+      childType: EXTENSION_TYPE,
+      parentDepth: 4,
+      childMeta: { validParents: [DASHBOARD_GRID_TYPE] },
+    }),
+  ).toBe(false);
+  // No restriction → standard leaf behavior (allowed in GRID at depth 1)
+  expect(
+    isValidChild({
+      parentType: DASHBOARD_GRID_TYPE,
+      childType: EXTENSION_TYPE,
+      parentDepth: 1,
+    }),
+  ).toBe(true);
+});
+
+test('shouldWrapChildInRow honors meta.wrapInRow for extension components', () => {
+  expect(
+    shouldWrapChildInRow({
+      parentType: DASHBOARD_GRID_TYPE,
+      childType: EXTENSION_TYPE,
+    }),
+  ).toBe(true);
+  expect(
+    shouldWrapChildInRow({
+      parentType: DASHBOARD_GRID_TYPE,
+      childType: EXTENSION_TYPE,
+      childMeta: { wrapInRow: false },
+    }),
+  ).toBe(false);
+});
+
+test('isDashboardEmpty respects meta.isUserContent for extension components', () => {
+  const userContent = {
+    a: { type: EXTENSION_TYPE, meta: { isUserContent: true } },
+  };
+  const nonUserContent = {
+    a: { type: EXTENSION_TYPE, meta: { isUserContent: false } },
+  };
+  expect(isDashboardEmpty(userContent)).toBe(false);
+  // An extension that opts out of being user content leaves the dashboard empty
+  expect(isDashboardEmpty(nonUserContent)).toBe(true);
+  // Default (no flag) counts as user content
+  expect(isDashboardEmpty({ a: { type: EXTENSION_TYPE, meta: {} } })).toBe(
+    false,
+  );
+});
+
+test('getDetailedComponentWidth honors meta.minWidth for extension components', () => {
+  const withMin = getDetailedComponentWidth({
+    component: { type: EXTENSION_TYPE, meta: { minWidth: 3 } } as any,
+  });
+  expect(withMin.minimumWidth).toBe(3);
+  const withoutMin = getDetailedComponentWidth({
+    component: { type: EXTENSION_TYPE, meta: {} } as any,
+  });
+  expect(withoutMin.minimumWidth).toBe(1);
+});
+
+test('extension nesting still respects container depth limits', () => {
+  // Even when validParents allows TAB, the depth gate still applies.
+  expect(
+    isValidChild({
+      parentType: TAB_TYPE,
+      childType: EXTENSION_TYPE,
+      parentDepth: 999,
+      childMeta: { validParents: [TAB_TYPE] },
+    }),
+  ).toBe(false);
+});
@@ -21,6 +21,7 @@ import { GRID_MIN_COLUMN_COUNT, GRID_COLUMN_COUNT } from './constants';
 import {
  ROW_TYPE,
  COLUMN_TYPE,
+  EXTENSION_TYPE,
  MARKDOWN_TYPE,
  CHART_TYPE,
  DYNAMIC_TYPE,
@@ -105,6 +106,11 @@ export default function getDetailedComponentWidth({
        );
      }
    });
+  } else if (component.type === EXTENSION_TYPE) {
+    // Extension-contributed components may declare a minimum width (grid
+    // columns) in their definition, seeded onto meta at creation.
+    const minWidth = component.meta?.minWidth as number | undefined;
+    result.minimumWidth = minWidth ?? GRID_MIN_COLUMN_COUNT;
  } else if (
    component.type === DYNAMIC_TYPE ||
    component.type === MARKDOWN_TYPE ||
@@ -81,6 +81,7 @@ export default function getDropPosition(
  const draggingItem = monitor.getItem() as {
    id: string;
    type: string;
+    meta?: { validParents?: string[] };
  } | null;

  // if dropped self on self, do nothing
@@ -92,6 +93,7 @@ export default function getDropPosition(
    parentType: component.type,
    parentDepth: componentDepth,
    childType: draggingItem.type,
+    childMeta: draggingItem.meta,
  });

  const parentType = parentComponent?.type;
@@ -103,6 +105,7 @@ export default function getDropPosition(
    parentType,
    parentDepth,
    childType: draggingItem.type,
+    childMeta: draggingItem.meta,
  });

  if (!validChild && !validSibling) {
@@ -16,17 +16,31 @@
 * specific language governing permissions and limitations
 * under the License.
 */
-import { CHART_TYPE, MARKDOWN_TYPE, DYNAMIC_TYPE } from './componentTypes';
+import {
+  CHART_TYPE,
+  EXTENSION_TYPE,
+  MARKDOWN_TYPE,
+  DYNAMIC_TYPE,
+} from './componentTypes';

 const USER_CONTENT_COMPONENT_TYPE: string[] = [
  CHART_TYPE,
+  EXTENSION_TYPE,
  MARKDOWN_TYPE,
  DYNAMIC_TYPE,
 ];
 export default function isDashboardEmpty(layout: any): boolean {
-  // has at least one chart or markdown component
+  // has at least one chart, markdown, or contributed user-content component
  return !Object.values(layout).some(
-    ({ type }: { type?: string }) =>
-      type && USER_CONTENT_COMPONENT_TYPE.includes(type),
+    ({ type, meta }: { type?: string; meta?: { isUserContent?: boolean } }) => {
+      if (!type || !USER_CONTENT_COMPONENT_TYPE.includes(type)) {
+        return false;
+      }
+      // Extension components may opt out of counting as user content.
+      if (type === EXTENSION_TYPE && meta?.isUserContent === false) {
+        return false;
+      }
+      return true;
+    },
  );
 }
@@ -39,6 +39,7 @@ import {
  DASHBOARD_ROOT_TYPE,
  DIVIDER_TYPE,
  HEADER_TYPE,
+  EXTENSION_TYPE,
  MARKDOWN_TYPE,
  ROW_TYPE,
  TABS_TYPE,
@@ -64,6 +65,7 @@ const parentMaxDepthLookup: Record<string, Record<string, number>> = {
  [DASHBOARD_GRID_TYPE]: {
    [CHART_TYPE]: depthOne,
    [DYNAMIC_TYPE]: depthOne,
+    [EXTENSION_TYPE]: depthOne,
    [MARKDOWN_TYPE]: depthOne,
    [COLUMN_TYPE]: depthOne,
    [DIVIDER_TYPE]: depthOne,
@@ -75,6 +77,7 @@ const parentMaxDepthLookup: Record<string, Record<string, number>> = {
  [ROW_TYPE]: {
    [CHART_TYPE]: depthFour,
    [DYNAMIC_TYPE]: depthFour,
+    [EXTENSION_TYPE]: depthFour,
    [MARKDOWN_TYPE]: depthFour,
    [COLUMN_TYPE]: depthFour,
  },
@@ -86,6 +89,7 @@ const parentMaxDepthLookup: Record<string, Record<string, number>> = {
  [TAB_TYPE]: {
    [CHART_TYPE]: depthFive,
    [DYNAMIC_TYPE]: depthFive,
+    [EXTENSION_TYPE]: depthFive,
    [MARKDOWN_TYPE]: depthFive,
    [COLUMN_TYPE]: depthThree,
    [DIVIDER_TYPE]: depthFive,
@@ -97,6 +101,7 @@ const parentMaxDepthLookup: Record<string, Record<string, number>> = {
  [COLUMN_TYPE]: {
    [CHART_TYPE]: depthFive,
    [HEADER_TYPE]: depthFive,
+    [EXTENSION_TYPE]: depthFive,
    [MARKDOWN_TYPE]: depthFive,
    [ROW_TYPE]: depthThree,
    [DIVIDER_TYPE]: depthThree,
@@ -108,6 +113,7 @@ const parentMaxDepthLookup: Record<string, Record<string, number>> = {
  [DYNAMIC_TYPE]: {},
  [DIVIDER_TYPE]: {},
  [HEADER_TYPE]: {},
+  [EXTENSION_TYPE]: {},
  [MARKDOWN_TYPE]: {},
 };

@@ -115,14 +121,29 @@ interface IsValidChildProps {
  parentType?: string;
  childType?: string;
  parentDepth?: unknown;
+  /**
+   * The child's meta, when available (e.g. during a drag). Extension-contributed
+   * components may declare `validParents` to restrict which container types may
+   * hold them; the restriction is seeded onto meta at creation.
+   */
+  childMeta?: { validParents?: string[] };
 }

 export default function isValidChild(child: IsValidChildProps): boolean {
-  const { parentType, childType, parentDepth } = child;
+  const { parentType, childType, parentDepth, childMeta } = child;
  if (!parentType || !childType || typeof parentDepth !== 'number') {
    return false;
  }

+  // Per-component parent restriction for extension components.
+  if (
+    childType === EXTENSION_TYPE &&
+    Array.isArray(childMeta?.validParents) &&
+    !childMeta.validParents.includes(parentType)
+  ) {
+    return false;
+  }
+
  const maxParentDepth: number | undefined =
    parentMaxDepthLookup[parentType]?.[childType];

@@ -24,6 +24,7 @@ import {
  COLUMN_TYPE,
  DIVIDER_TYPE,
  HEADER_TYPE,
+  EXTENSION_TYPE,
  MARKDOWN_TYPE,
  ROW_TYPE,
  TABS_TYPE,
@@ -56,6 +57,7 @@ const typeToDefaultMetaData: Record<string, LayoutItemMeta | null> = {
    headerSize: MEDIUM_HEADER,
    background: BACKGROUND_TRANSPARENT,
  },
+  [EXTENSION_TYPE]: { width: GRID_DEFAULT_CHART_WIDTH, height: 50 },
  [MARKDOWN_TYPE]: { width: GRID_DEFAULT_CHART_WIDTH, height: 50 },
  [ROW_TYPE]: { background: BACKGROUND_TRANSPARENT },
  [TABS_TYPE]: null,
--- a/Show More
+++ b/Show More