Extension loading

Co-authored-by: Diego Pucci <diegopucci.me@gmail.com>

.claude/commands/js-to-ts.md

@@ -0,0 +1,10 @@
+# JavaScript to TypeScript Migration Command
+
+## Usage
+```
+/js-to-ts <core-filename>
+```
+- `<core-filename>` - Path to CORE file relative to `superset-frontend/` (e.g., `src/utils/common.js`, `src/middleware/loggerMiddleware.js`)
+
+## Agent Instructions
+**See:** [../projects/js-to-ts/AGENT.md](../projects/js-to-ts/AGENT.md) for complete migration guide.

.claude/projects/js-to-ts/AGENT.md

@@ -0,0 +1,684 @@
+# JavaScript to TypeScript Migration Agent Guide
+
+**Complete technical reference for converting JavaScript/JSX files to TypeScript/TSX in Apache Superset frontend.**
+
+**Agent Role:** Atomic migration unit - migrate the core file + ALL related tests/mocks as one cohesive unit. Use `git mv` to preserve history, NO `git commit`. NO global import changes. Report results upon completion.
+
+---
+
+## 🎯 Migration Principles
+
+1. **Atomic migration units** - Core file + all related tests/mocks migrate together
+2. **Zero `any` types** - Use proper TypeScript throughout
+3. **Leverage existing types** - Reuse established definitions
+4. **Type inheritance** - Derivatives extend base component types
+5. **Strategic placement** - File types for maximum discoverability
+6. **Surgical improvements** - Enhance existing types during migration
+
+---
+
+## Step 0: Dependency Check (MANDATORY)
+
+**Command:**
+```bash
+grep -E "from '\.\./.*\.jsx?'|from '\./.*\.jsx?'|from 'src/.*\.jsx?'" superset-frontend/{filename}
+```
+
+**Decision:**
+- ✅ No matches → Proceed with atomic migration (core + tests + mocks)
+- ❌ Matches found → EXIT with dependency report (see format below)
+
+---
+
+## Step 1: Identify Related Files (REQUIRED)
+
+**Atomic Migration Scope:**
+For core file `src/utils/example.js`, also migrate:
+- `src/utils/example.test.js` / `src/utils/example.test.jsx`
+- `src/utils/example.spec.js` / `src/utils/example.spec.jsx`
+- `src/utils/__mocks__/example.js`
+- Any other related test/mock files found by pattern matching
+
+**Find all related test and mock files:**
+```bash
+# Pattern-based search for related files
+basename=$(basename {filename} .js)
+dirname=$(dirname superset-frontend/{filename})
+
+# Find test files
+find "$dirname" -name "${basename}.test.js" -o -name "${basename}.test.jsx"
+find "$dirname" -name "${basename}.spec.js" -o -name "${basename}.spec.jsx"
+
+# Find mock files  
+find "$dirname" -name "__mocks__/${basename}.js"
+find "$dirname" -name "${basename}.mock.js"
+```
+
+**Migration Requirement:** All discovered related files MUST be migrated together as one atomic unit.
+
+**Test File Creation:** If NO test files exist for the core file, CREATE a minimal test file using the following pattern:
+- Location: Same directory as core file
+- Name: `{basename}.test.ts` (e.g., `DebouncedMessageQueue.test.ts`)
+- Content: Basic test structure importing and testing the main functionality
+- Use proper TypeScript types in test file
+
+---
+
+## 🗺️ Type Reference Map
+
+### From `@superset-ui/core`
+```typescript
+// Data & Query
+QueryFormData, QueryData, JsonObject, AnnotationData, AdhocMetric
+LatestQueryFormData, GenericDataType, DatasourceType, ExtraFormData
+DataMaskStateWithId, NativeFilterScope, NativeFiltersState, NativeFilterTarget
+
+// UI & Theme  
+FeatureFlagMap, LanguagePack, ColorSchemeConfig, SequentialSchemeConfig
+```
+
+### From `@superset-ui/chart-controls`
+```typescript
+Dataset, ColumnMeta, ControlStateMapping
+```
+
+### From Local Types (`src/types/`)
+```typescript
+// Authentication
+User, UserWithPermissionsAndRoles, BootstrapUser, PermissionsAndRoles
+
+// Dashboard
+Dashboard, DashboardState, DashboardInfo, DashboardLayout, LayoutItem
+ComponentType, ChartConfiguration, ActiveFilters
+
+// Charts
+Chart, ChartState, ChartStatus, ChartLinkedDashboard, Slice, SaveActionType
+
+// Data
+Datasource, Database, Owner, Role
+
+// UI Components
+TagType, FavoriteStatus, Filter, ImportResourceName
+```
+
+### From Domain Types
+```typescript
+// src/dashboard/types.ts
+RootState, ChartsState, DatasourcesState, FilterBarOrientation
+ChartCrossFiltersConfig, ActiveTabs, MenuKeys
+
+// src/explore/types.ts  
+ExplorePageInitialData, ExplorePageState, ExploreResponsePayload, OptionSortType
+
+// src/SqlLab/types.ts
+[SQL Lab specific types]
+```
+
+---
+
+## 🏗️ Type Organization Strategy
+
+### Type Placement Hierarchy
+
+1. **Component-Colocated** (90% of cases)
+   ```typescript
+   // Same file as component
+   interface MyComponentProps {
+     title: string;
+     onClick: () => void;
+   }
+   ```
+
+2. **Feature-Shared**
+   ```typescript
+   // src/[domain]/components/[Feature]/types.ts
+   export interface FilterConfiguration {
+     filterId: string;
+     targets: NativeFilterTarget[];
+   }
+   ```
+
+3. **Domain-Wide**
+   ```typescript
+   // src/[domain]/types.ts
+   export interface ExploreFormData extends QueryFormData {
+     viz_type: string;
+   }
+   ```
+
+4. **Global**
+   ```typescript
+   // src/types/[TypeName].ts
+   export interface ApiResponse<T> {
+     result: T;
+     count?: number;
+   }
+   ```
+
+### Type Discovery Commands
+```bash
+# Search existing types before creating
+find superset-frontend/src -name "types.ts" -exec grep -l "[TypeConcept]" {} \;
+grep -r "interface.*Props\|type.*Props" superset-frontend/src/
+```
+
+### Derivative Component Patterns
+
+**Rule:** Components that extend others should extend their type interfaces.
+
+```typescript
+// ✅ Base component type
+interface SelectProps {
+  value: string | number;
+  options: SelectOption[];
+  onChange: (value: string | number) => void;
+  disabled?: boolean;
+}
+
+// ✅ Derivative extends base
+interface ChartSelectProps extends SelectProps {
+  charts: Chart[];
+  onChartSelect: (chart: Chart) => void;
+}
+
+// ✅ Derivative with modified props  
+interface DatabaseSelectProps extends Omit<SelectProps, 'value' | 'onChange'> {
+  value: number;  // Narrowed type
+  onChange: (databaseId: number) => void;  // Specific signature
+}
+```
+
+**Common Patterns:**
+- **Extension:** `extends BaseProps` - adds new props
+- **Omission:** `Omit<BaseProps, 'prop'>` - removes props
+- **Modification:** `Omit<BaseProps, 'prop'> & { prop: NewType }` - changes prop type
+- **Restriction:** Override with narrower types (union → specific)
+
+---
+
+## 📋 Migration Recipe
+
+### Step 2: File Conversion
+```bash
+# Use git mv to preserve history
+git mv component.js component.ts
+git mv Component.jsx Component.tsx
+```
+
+### Step 3: Import & Type Setup
+```typescript
+// Import order (enforced by linting)
+import { FC, ReactNode } from 'react';
+import { JsonObject, QueryFormData } from '@superset-ui/core';
+import { Dataset } from '@superset-ui/chart-controls';
+import type { Dashboard } from 'src/types/Dashboard';
+```
+
+### Step 4: Function & Component Typing
+```typescript
+// Functions with proper parameter/return types
+export function processData(
+  data: Dataset[],
+  config: JsonObject
+): ProcessedData[] {
+  // implementation
+}
+
+// Component props with inheritance
+interface ComponentProps extends BaseProps {
+  data: Chart[];
+  onSelect: (id: number) => void;
+}
+
+const Component: FC<ComponentProps> = ({ data, onSelect }) => {
+  // implementation
+};
+```
+
+### Step 5: State & Redux Typing
+```typescript
+// Hooks with specific types
+const [data, setData] = useState<Chart[]>([]);
+const [selected, setSelected] = useState<number | null>(null);
+
+// Redux with existing RootState
+const mapStateToProps = (state: RootState) => ({
+  charts: state.charts,
+  user: state.user,
+});
+```
+
+---
+
+## 🧠 Type Debugging Strategies (Real-World Learnings)
+
+### The Evolution of Type Approaches
+When you hit type errors, follow this debugging evolution:
+
+#### 1. ❌ Idealized Union Types (First Attempt)
+```typescript
+// Looks clean but doesn't match reality
+type DatasourceInput = Datasource | QueryEditor;
+```
+**Problem**: Real calling sites pass variations, not exact types.
+
+#### 2. ❌ Overly Precise Types (Second Attempt)
+```typescript
+// Tried to match exact calling signatures
+type DatasourceInput =
+  | IDatasource  // From DatasourcePanel
+  | (QueryEditor & { columns: ColumnMeta[] });  // From SaveQuery
+```
+**Problem**: Too rigid, doesn't handle legacy variations.
+
+#### 3. ✅ Flexible Interface (Final Solution)
+```typescript
+// Captures what the function actually needs
+interface DatasourceInput {
+  name?: string | null;  // Allow null for compatibility
+  datasource_name?: string | null;  // Legacy variations
+  columns?: any[];  // Multiple column types accepted
+  database?: { id?: number };
+  // ... other optional properties
+}
+```
+**Success**: Works with all calling sites, focuses on function needs.
+
+### Type Debugging Process
+1. **Start with compilation errors** - they show exact mismatches
+2. **Examine actual usage** - look at calling sites, not idealized types  
+3. **Build flexible interfaces** - capture what functions need, not rigid contracts
+4. **Iterate based on downstream validation** - let calling sites guide your types
+
+---
+
+## 🚨 Anti-Patterns to Avoid
+
+```typescript
+// ❌ Never use any
+const obj: any = {};
+
+// ✅ Use proper types
+const obj: Record<string, JsonObject> = {};
+
+// ❌ Don't recreate base component props
+interface ChartSelectProps {
+  value: string;     // Duplicated from SelectProps
+  onChange: () => void;  // Duplicated from SelectProps
+  charts: Chart[];   // New prop
+}
+
+// ✅ Inherit and extend
+interface ChartSelectProps extends SelectProps {
+  charts: Chart[];   // Only new props
+}
+
+// ❌ Don't create ad-hoc type variations
+interface UserInfo {
+  name: string;
+  email: string;
+}
+
+// ✅ Extend existing types (DRY principle)
+import { User } from 'src/types/bootstrapTypes';
+type UserDisplayInfo = Pick<User, 'firstName' | 'lastName' | 'email'>;
+
+// ❌ Don't create overly rigid unions
+type StrictInput = ExactTypeA | ExactTypeB;
+
+// ✅ Create flexible interfaces for function parameters
+interface FlexibleInput {
+  // Focus on what the function actually needs
+  commonProperty: string;
+  optionalVariations?: any;  // Allow for legacy variations
+}
+```
+
+## 📍 DRY Type Guidelines (WHERE TYPES BELONG)
+
+### Type Placement Rules
+**CRITICAL**: Type variations must live close to where they belong, not scattered across files.
+
+#### ✅ Proper Type Organization
+```typescript
+// ❌ Don't create one-off interfaces in utility files
+// src/utils/datasourceUtils.ts
+interface DatasourceInput { /* custom interface */ }  // Wrong!
+
+// ✅ Use existing types or extend them in their proper domain
+// src/utils/datasourceUtils.ts
+import { IDatasource } from 'src/explore/components/DatasourcePanel';
+import { QueryEditor } from 'src/SqlLab/types';
+
+// Create flexible interface that references existing types
+interface FlexibleDatasourceInput {
+  // Properties that actually exist across variations
+}
+```
+
+#### Type Location Hierarchy
+1. **Domain Types**: `src/{domain}/types.ts` (dashboard, explore, SqlLab)
+2. **Component Types**: Co-located with components  
+3. **Global Types**: `src/types/` directory
+4. **Utility Types**: Only when they truly don't belong elsewhere
+
+#### ✅ DRY Type Patterns
+```typescript
+// ✅ Extend existing domain types
+interface SaveQueryData extends Pick<QueryEditor, 'sql' | 'dbId' | 'catalog'> {
+  columns: ColumnMeta[];  // Add what's needed
+}
+
+// ✅ Create flexible interfaces for cross-domain utilities
+interface CrossDomainInput {
+  // Common properties that exist across different source types
+  name?: string | null;  // Accommodate legacy null values
+  // Only include properties the function actually uses
+}
+```
+
+---
+
+## 🎯 PropTypes Auto-Generation (Elegant Approach)
+
+**IMPORTANT**: Superset has `babel-plugin-typescript-to-proptypes` configured to automatically generate PropTypes from TypeScript interfaces. Use this instead of manual PropTypes duplication!
+
+### ❌ Manual PropTypes Duplication (Avoid This)
+```typescript
+export interface MyComponentProps {
+  title: string;
+  count?: number;
+}
+
+// 8+ lines of manual PropTypes duplication 😱
+const propTypes = PropTypes.shape({
+  title: PropTypes.string.isRequired,
+  count: PropTypes.number,
+});
+
+export default propTypes;
+```
+
+### ✅ Auto-Generated PropTypes (Use This)
+```typescript
+import { InferProps } from 'prop-types';
+
+export interface MyComponentProps {
+  title: string;
+  count?: number;
+}
+
+// Single validator function - babel plugin auto-generates PropTypes! ✨
+export default function MyComponentValidator(props: MyComponentProps) {
+  return null; // PropTypes auto-assigned by babel-plugin-typescript-to-proptypes
+}
+
+// Optional: For consumers needing PropTypes type inference
+export type MyComponentPropsInferred = InferProps<typeof MyComponentValidator>;
+```
+
+### Migration Pattern for Type-Only Files
+
+**When migrating type-only files with manual PropTypes:**
+
+1. **Keep the TypeScript interfaces** (single source of truth)
+2. **Replace manual PropTypes** with validator function
+3. **Remove PropTypes imports** and manual shape definitions
+4. **Add InferProps import** if type inference needed
+
+**Example Migration:**
+```typescript
+// Before: 25+ lines with manual PropTypes duplication
+export interface AdhocFilterType { /* ... */ }
+const adhocFilterTypePropTypes = PropTypes.oneOfType([...]);
+
+// After: 3 lines with auto-generation
+export interface AdhocFilterType { /* ... */ }
+export default function AdhocFilterValidator(props: { filter: AdhocFilterType }) {
+  return null; // Auto-generated PropTypes by babel plugin
+}
+```
+
+### Component PropTypes Pattern
+
+**For React components, the babel plugin works automatically:**
+
+```typescript
+interface ComponentProps {
+  title: string;
+  onClick: () => void;
+}
+
+const MyComponent: FC<ComponentProps> = ({ title, onClick }) => {
+  // Component implementation
+};
+
+// PropTypes automatically generated by babel plugin - no manual work needed!
+export default MyComponent;
+```
+
+### Auto-Generation Benefits
+
+- ✅ **Single source of truth**: TypeScript interfaces drive PropTypes
+- ✅ **No duplication**: Eliminate 15-20 lines of manual PropTypes code
+- ✅ **Automatic updates**: Changes to TypeScript automatically update PropTypes
+- ✅ **Type safety**: Compile-time checking ensures PropTypes match interfaces
+- ✅ **Backward compatibility**: Existing JavaScript components continue working
+
+### Babel Plugin Configuration
+
+The plugin is already configured in `babel.config.js`:
+```javascript
+['babel-plugin-typescript-to-proptypes', { loose: true }]
+```
+
+**No additional setup required** - just use TypeScript interfaces and the plugin handles the rest!
+
+---
+
+## 🧪 Test File Migration Patterns
+
+### Test File Priority
+- **Always migrate test files** alongside production files
+- **Test files are often leaf nodes** - good starting candidates
+- **Create tests if missing** - Leverage new TypeScript types for better test coverage
+
+### Test-Specific Type Patterns
+```typescript
+// Mock interfaces for testing
+interface MockStore {
+  getState: () => Partial<RootState>;  // Partial allows minimal mocking
+}
+
+// Type-safe mocking for complex objects
+const mockDashboardInfo: Partial<DashboardInfo> as DashboardInfo = {
+  id: 123,
+  json_metadata: '{}',
+};
+
+// Sinon stub typing
+let postStub: sinon.SinonStub;
+beforeEach(() => {
+  postStub = sinon.stub(SupersetClient, 'post');
+});
+
+// Use stub reference instead of original method
+expect(postStub.callCount).toBe(1);
+expect(postStub.getCall(0).args[0].endpoint).toMatch('/api/');
+```
+
+### Test Migration Recipe
+1. **Migrate production file first** (if both need migration)
+2. **Update test imports** to point to `.ts/.tsx` files
+3. **Add proper mock typing** using `Partial<T> as T` pattern
+4. **Fix stub typing** - Use stub references, not original methods
+5. **Verify all tests pass** with TypeScript compilation
+
+---
+
+## 🔧 Type Conflict Resolution
+
+### Multiple Type Definitions Issue
+**Problem**: Same type name defined in multiple files causes compilation errors.
+
+**Example**: `DashboardInfo` defined in both:
+- `src/dashboard/reducers/types.ts` (minimal)
+- `src/dashboard/components/Header/types.ts` (different shape)  
+- `src/dashboard/types.ts` (complete - used by RootState)
+
+### Resolution Strategy
+1. **Identify the authoritative type**:
+   ```bash
+   # Find which type is used by RootState/main interfaces
+   grep -r "DashboardInfo" src/dashboard/types.ts
+   ```
+
+2. **Use import from authoritative source**:
+   ```typescript
+   // ✅ Import from main domain types
+   import { RootState, DashboardInfo } from 'src/dashboard/types';
+
+   // ❌ Don't import from component-specific files
+   import { DashboardInfo } from 'src/dashboard/components/Header/types';
+   ```
+
+3. **Mock complex types in tests**:
+   ```typescript
+   // For testing - provide minimal required fields
+   const mockInfo: Partial<DashboardInfo> as DashboardInfo = {
+     id: 123,
+     json_metadata: '{}',
+     // Only provide fields actually used in test
+   };
+   ```
+
+### Type Hierarchy Discovery Commands
+```bash
+# Find all definitions of a type
+grep -r "interface.*TypeName\|type.*TypeName" src/
+
+# Find import usage patterns
+grep -r "import.*TypeName" src/
+
+# Check what RootState uses
+grep -A 10 -B 10 "TypeName" src/*/types.ts
+```
+
+---
+
+## Agent Constraints (CRITICAL)
+
+1. **Use git mv** - Run `git mv file.js file.ts` to preserve git history, but NO `git commit`
+2. **NO global import changes** - Don't update imports across codebase
+3. **Type files OK** - Can modify existing type files to improve/align types
+4. **Single-File TypeScript Validation** (CRITICAL) - tsc has known issues with multi-file compilation:
+   - **Core Issue**: TypeScript's `tsc` has documented problems validating multiple files simultaneously in complex projects
+   - **Solution**: ALWAYS validate files one at a time using individual `tsc` calls
+   - **Command Pattern**: `cd superset-frontend && npx tscw --noEmit --allowJs --composite false --project tsconfig.json {single-file-path}`
+   - **Why**: Multi-file validation can produce false positives, miss real errors, and conflict during parallel agent execution
+5. **Downstream Impact Validation** (CRITICAL) - Your migration affects calling sites:
+   - **Find downstream files**: `find superset-frontend/src -name "*.tsx" -o -name "*.ts" | xargs grep -l "your-core-filename" 2>/dev/null || echo "No files found"`
+   - **Validate each downstream file individually**: `cd superset-frontend && npx tscw --noEmit --allowJs --composite false --project tsconfig.json {each-downstream-file}`
+   - **Fix type mismatches** you introduced in calling sites
+   - **NEVER ignore downstream errors** - they indicate your types don't match reality
+6. **Avoid Project-Wide Validation During Migration**:
+   - **NEVER use `npm run type`** during parallel agent execution - produces unreliable results
+   - **Single-file validation is authoritative** - trust individual file checks over project-wide scans
+6. **ESLint validation** - Run `npm run eslint -- --fix {file}` for each migrated file to auto-fix formatting/linting issues
+6. Zero `any` types - use proper TypeScript types
+7. Search existing types before creating new ones
+8. Follow patterns from this guide
+
+---
+
+## Success Report Format
+
+```
+SUCCESS: Atomic Migration of {core-filename}
+
+## Files Migrated (Atomic Unit)
+- Core: {core-filename} → {core-filename.ts/tsx}
+- Tests: {list-of-test-files} → {list-of-test-files.ts/tsx} OR "CREATED: {basename}.test.ts"
+- Mocks: {list-of-mock-files} → {list-of-mock-files.ts}
+- Type files modified: {list-of-type-files}
+
+## Types Created/Improved
+- {TypeName}: {location} ({scope}) - {rationale}
+- {ExistingType}: enhanced in {location} - {improvement-description}
+
+## Documentation Recommendations  
+- ADD_TO_DIRECTORY: {TypeName} - {reason}
+- NO_DOCUMENTATION: {TypeName} - {reason}
+
+## Quality Validation
+- **Single-File TypeScript Validation**: ✅ PASS - Core files individually validated
+  - Core file: `npx tscw --noEmit --allowJs --composite false --project tsconfig.json {core-file}`
+  - Test files: `npx tscw --noEmit --allowJs --composite false --project tsconfig.json {test-file}` (if exists)
+- **Downstream Impact Check**: ✅ PASS - Found {N} files importing this module, all validate individually
+  - Downstream files: {list-of-files-that-import-your-module}
+  - Individual validation: `npx tscw --noEmit --allowJs --composite false --project tsconfig.json {each-downstream-file}`
+- **ESLint validation**: ✅ PASS (using `npm run eslint -- --fix {files}` to auto-fix formatting)
+- **Zero any types**: ✅ PASS
+- **Local imports resolved**: ✅ PASS  
+- **Functionality preserved**: ✅ PASS
+- **Tests pass** (if test file): ✅ PASS
+- **Follow-up action required**: {YES/NO}
+
+## Validation Strategy Notes
+- **Single-file approach used**: Avoided multi-file tsc validation due to known TypeScript compilation issues
+- **Project-wide validation skipped**: `npm run type` not used during parallel migration to prevent false positives
+
+## Migration Learnings
+- Type conflicts encountered: {describe any multiple type definitions}
+- Mock patterns used: {describe test mocking approaches}
+- Import hierarchy decisions: {note authoritative type sources used}
+- PropTypes strategy: {AUTO_GENERATED via babel plugin | MANUAL_DUPLICATION_REMOVED | N/A}
+
+## Improvement Suggestions for Documentation
+- AGENT.md enhancement: {suggest additions to migration guide}
+- Common pattern identified: {note reusable patterns for future migrations}
+```
+
+---
+
+## Dependency Block Report Format
+
+```
+DEPENDENCY_BLOCK: Cannot migrate {filename}
+
+## Blocking Dependencies
+- {path}: {type} - {usage} - {priority}
+
+## Impact Analysis
+- Estimated types: {number}
+- Expected locations: {list}
+- Cross-domain: {YES/NO}
+
+## Recommended Order
+{ordered-list}
+```
+
+---
+
+## 📚 Quick Reference
+
+**Type Utilities:**
+- `Record<K, V>` - Object with specific key/value types
+- `Partial<T>` - All properties optional
+- `Pick<T, K>` - Subset of properties
+- `Omit<T, K>` - Exclude specific properties
+- `NonNullable<T>` - Exclude null/undefined
+
+**Event Types:**
+- `MouseEvent<HTMLButtonElement>`
+- `ChangeEvent<HTMLInputElement>`
+- `FormEvent<HTMLFormElement>`
+
+**React Types:**
+- `FC<Props>` - Functional component
+- `ReactNode` - Any renderable content
+- `CSSProperties` - Style objects
+
+---
+
+**Remember:** Every type should add value and clarity. The goal is meaningful type safety that catches bugs and improves developer experience.

.claude/projects/js-to-ts/COORDINATOR.md

@@ -0,0 +1,199 @@
+# JS-to-TS Coordinator Workflow
+
+**Role:** Strategic migration coordination - select leaf-node files, trigger agents, review results, handle integration, manage dependencies.
+
+---
+
+## 1. Core File Selection Strategy
+
+**Target ONLY Core Files**: Coordinators identify core files (production code), agents handle related tests/mocks atomically.
+
+**File Analysis Commands**:
+```bash
+# Find CORE files with no JS/JSX dependencies (exclude tests/mocks) - SIZE PRIORITIZED
+find superset-frontend/src -name "*.js" -o -name "*.jsx" | grep -v "test\|spec\|mock" | xargs wc -l | sort -n | head -20
+
+# Alternative: Get file sizes in lines with paths
+find superset-frontend/src -name "*.js" -o -name "*.jsx" | grep -v "test\|spec\|mock" | while read file; do
+  lines=$(wc -l < "$file")
+  echo "$lines $file"
+done | sort -n | head -20
+
+# Check dependencies for core files only (start with smallest)
+for file in <core-files-sorted-by-size>; do
+  echo "=== $file ($(wc -l < "$file") lines) ==="
+  grep -E "from '\.\./.*\.jsx?'|from '\./.*\.jsx?'|from 'src/.*\.jsx?'" "$file" || echo "✅ LEAF CANDIDATE"
+done
+
+# Identify heavily imported files (migrate last)  
+grep -r "from.*utils/common" superset-frontend/src/ | wc -l
+
+# Quick leaf analysis with size priority
+find superset-frontend/src -name "*.js" -o -name "*.jsx" | grep -v "test\|spec\|mock" | head -30 | while read file; do
+  deps=$(grep -E "from '\.\./.*\.jsx?'|from '\./.*\.jsx?'|from 'src/.*\.jsx?'" "$file" | wc -l)
+  lines=$(wc -l < "$file")
+  if [ "$deps" -eq 0 ]; then
+    echo "✅ LEAF: $lines lines - $file"
+  fi
+done | sort -n
+```
+
+**Priority Order** (Smallest files first for easier wins):
+1. **Small leaf files** (<50 lines) - No JS/JSX imports, quick TypeScript conversion
+2. **Medium leaf files** (50-200 lines) - Self-contained utilities and helpers  
+3. **Small dependency files** (<100 lines) - Import only already-migrated files
+4. **Larger components** (200+ lines) - Complex but well-contained functionality
+5. **Core foundational files** (utils/common.js, controls.jsx) - migrate last regardless of size
+
+**Size-First Benefits**:
+- Faster completion builds momentum
+- Earlier validation of migration patterns
+- Easier rollback if issues arise
+- Better success rate for agent learning
+
+**Migration Unit**: Each agent call migrates:
+- 1 core file (primary target)
+- All related `*.test.js/jsx` files
+- All related `*.mock.js` files  
+- All related `__mocks__/` files
+
+---
+
+## 2. Task Creation & Agent Control
+
+### Task Triggering
+When triggering the `/js-to-ts` command:
+- **Task Title**: Use the core filename as the task title (e.g., "DebouncedMessageQueue.js migration", "hostNamesConfig.js migration")
+- **Task Description**: Include the full relative path to help agent locate the file
+- **Reference**: Point agent to [AGENT.md](./AGENT.md) for technical instructions
+
+### Post-Processing Workflow
+After each agent completes:
+
+1. **Review Agent Report**: Always read and analyze the complete agent report
+2. **Share Summary**: Provide user with key highlights from agent's work:
+   - Files migrated (core + tests/mocks)
+   - Types created or improved
+   - Any validation issues or coordinator actions needed
+3. **Quality Assessment**: Evaluate agent's TypeScript implementation against criteria:
+   - ✅ **Type Usage**: Proper types used, no `any` types
+   - ✅ **Type Filing**: Types placed in correct hierarchy (component → feature → domain → global)
+   - ✅ **Side Effects**: No unintended changes to other files
+   - ✅ **Import Alignment**: Proper .ts/.tsx import extensions
+4. **Integration Decision**:
+   - **COMMIT**: If agent work is complete and high quality
+   - **FIX & COMMIT**: If minor issues need coordinator fixes
+   - **ROLLBACK**: If major issues require complete rework
+5. **Next Action**: Ask user preference - commit this work or trigger next migration
+
+---
+
+## 3. Integration Decision Framework
+
+**Automatic Integration** ✅:
+- `npm run type` passes without errors
+- Agent created clean TypeScript with proper types
+- Types appropriately filed in hierarchy
+
+**Coordinator Integration** (Fix Side-Effects) 🔧:
+- `npm run type` fails BUT agent's work is high quality
+- Good type usage, proper patterns, well-organized
+- Side-effects are manageable TypeScript compilation errors
+- **Coordinator Action**: Integrate the change, then fix global compilation issues
+
+**Rollback Only** ❌:
+- Agent introduced `any` types or poor type choices
+- Types poorly organized or conflicting with existing patterns
+- Fundamental approach issues requiring complete rework
+
+**Integration Process**:
+1. **Review**: Agent already used `git mv` to preserve history
+2. **Fix Side-Effects**: Update dependent files with proper import extensions
+3. **Resolve Types**: Fix any cascading type issues across codebase
+4. **Validate**: Ensure `npm run type` passes after fixes
+
+---
+
+## 4. Common Integration Patterns
+
+**Common Side-Effects (Expect These)**:
+- **Type import conflicts**: Multiple definitions of same type name
+- **Mock object typing**: Tests need complete type satisfaction
+- **Stub method references**: Use stub vars instead of original methods
+
+**Coordinator Fixes (Standard Process)**:
+1. **Import Resolution**:
+   ```bash
+   # Find authoritative type source
+   grep -r "TypeName" src/*/types.ts
+   # Import from domain types (src/dashboard/types.ts) not component types
+   ```
+
+2. **Test Mock Completion**:
+   ```typescript
+   // Use Partial<T> as T pattern for minimal mocking
+   const mockDashboard: Partial<DashboardInfo> as DashboardInfo = {
+     id: 123,
+     json_metadata: '{}',
+   };
+   ```
+
+3. **Stub Reference Fixes**:
+   ```typescript
+   // ✅ Use stub variable
+   expect(postStub.callCount).toBe(1);
+   // ❌ Don't use original method
+   expect(SupersetClient.post.callCount).toBe(1);
+   ```
+
+4. **Validation Commands**:
+   ```bash
+   npm run type          # TypeScript compilation
+   npm test -- filename  # Test functionality
+   git status           # Should show rename, not add/delete
+   ```
+
+---
+
+## 5. File Categories for Planning
+
+### Leaf Files (Start Here)
+**Self-contained files with minimal JS/JSX dependencies**:
+- Test files (80 files) - Usually only import the file being tested
+- Utility files without internal dependencies
+- Components importing only external libraries
+
+### Heavily Imported Files (Migrate Last)
+**Core files that many others depend on**:
+- `utils/common.js` - Core utility functions
+- `utils/reducerUtils.js` - Redux helpers  
+- `@superset-ui/core` equivalent files
+- Major state management files (`explore/store.js`, `dashboard/actions/`)
+
+### Complex Components (Middle Priority)  
+**Large files requiring careful type analysis**:
+- `components/Datasource/DatasourceEditor.jsx` (1,809 lines)
+- `explore/components/controls/AnnotationLayerControl/AnnotationLayer.jsx` (1,031 lines)
+- `explore/components/ExploreViewContainer/index.jsx` (911 lines)
+
+---
+
+## 6. Success Metrics & Continuous Improvement
+
+**Per-File Gates**:
+- ✅ `npm run type` passes after each migration
+- ✅ Zero `any` types introduced
+- ✅ All imports properly typed
+- ✅ Types filed in correct hierarchy
+
+**Linear Scheduling**:
+When agents report `DEPENDENCY_BLOCK`:
+- Queue dependencies in linear order
+- Process one file at a time to avoid conflicts
+- Handle cascading type changes between files
+
+**After Each Migration**:
+1. **Update guides** with new patterns discovered
+2. **Document coordinator fixes** that become common
+3. **Enhance agent instructions** based on recurring issues
+4. **Track success metrics** - automatic vs coordinator integration rates

.claude/projects/js-to-ts/PROJECT.md

@@ -0,0 +1,76 @@
+# JavaScript to TypeScript Migration Project
+
+Progressive migration of 219 JS/JSX files to TypeScript in Apache Superset frontend.
+
+## 📁 Project Documentation
+
+- **[AGENT.md](./AGENT.md)** - Complete technical migration guide for agents (includes type reference, patterns, validation)
+- **[COORDINATOR.md](./COORDINATOR.md)** - Strategic workflow for coordinators (file selection, task management, integration)
+
+## 🎯 Quick Start
+
+**For Agents:** Read [AGENT.md](./AGENT.md) for complete migration instructions
+**For Coordinators:** Read [COORDINATOR.md](./COORDINATOR.md) for workflow and [AGENT.md](./AGENT.md) for supervision
+
+**Command:** `/js-to-ts <filename>` - See [../../commands/js-to-ts.md](../../commands/js-to-ts.md)
+
+## 📊 Migration Progress
+
+**Scope**: 219 files total (112 JS + 107 JSX)
+- Production files: 139 (63%)  
+- Test files: 80 (37%)
+
+**Strategy**: Leaf-first migration with dependency-aware coordination
+
+### Completed Migrations ✅
+
+1. **roundDecimal** - `plugins/legacy-plugin-chart-map-box/src/utils/roundDecimal.js`
+   - Migrated core + test files
+   - Added proper TypeScript function signature with optional precision parameter
+   - All tests pass
+
+2. **timeGrainSqlaAnimationOverrides** - `src/explore/controlPanels/timeGrainSqlaAnimationOverrides.js`
+   - Migrated to TypeScript with ControlPanelState and Dataset types
+   - Added TimeGrainOverrideState interface for return type
+   - Used type guards for safe property access
+
+3. **DebouncedMessageQueue** - `src/utils/DebouncedMessageQueue.js`
+   - Migrated to TypeScript with proper generics
+   - Created DebouncedMessageQueueOptions interface
+   - **CREATED test file** with 4 comprehensive test cases
+   - Excellent class property typing with private/readonly modifiers
+
+**Files Migrated**: 3/219 (1.4%)
+**Tests Created**: 2 (roundDecimal had existing, DebouncedMessageQueue created)
+
+### Next Candidates (Leaf Nodes) 🎯
+
+**Identified leaf files with no JS/JSX dependencies:**
+- `src/utils/hostNamesConfig.js` - Domain configuration utility
+- `src/explore/controlPanels/Separator.js` - Control panel configuration  
+- `src/middleware/loggerMiddleware.js` - Logging middleware
+
+**Migration Quality**: All completed migrations have:
+- ✅ Zero `any` types
+- ✅ Proper TypeScript compilation
+- ✅ ESLint validation passed
+- ✅ Test coverage (created where missing)
+
+---
+
+## 📈 Success Metrics
+
+**Per-File Gates**:
+- ✅ `npm run type` passes after each migration
+- ✅ Zero `any` types introduced  
+- ✅ All imports properly typed
+- ✅ Types filed in correct hierarchy
+
+**Overall Progress**:
+- **Automatic Integration Rate**: 100% (3/3 migrations required no coordinator fixes)
+- **Test Coverage**: Improved (1 new test file created)
+- **Type Safety**: Enhanced with proper interfaces and generics
+
+---
+
+*This is a claudette-managed progressive refactor. All documentation and coordination resources are organized under `.claude/projects/js-to-ts/`*

.devcontainer/Dockerfile

@@ -1,5 +1,5 @@
 # Keep this in sync with the base image in the main Dockerfile (ARG PY_VER)
-FROM python:3.11.13-bookworm AS base
+FROM python:3.11.13-trixie AS base
 
 # Install system dependencies that Superset needs
 # This layer will be cached across Codespace sessions

.github/CODEOWNERS

@@ -20,7 +20,7 @@
 
 # Notify PMC members of changes to GitHub Actions
 
-/.github/ @villebro @geido @eschutho @rusackas @betodealmeida @nytai @mistercrunch @craig-rueda @kgabryje @dpgaspar
+/.github/ @villebro @geido @eschutho @rusackas @betodealmeida @nytai @mistercrunch @craig-rueda @kgabryje @dpgaspar @sadpandajoe
 
 # Notify PMC members of changes to required GitHub Actions
 
@@ -30,3 +30,13 @@
 
 **/*.geojson @villebro @rusackas
 /superset-frontend/plugins/legacy-plugin-chart-country-map/ @villebro @rusackas
+
+# Notify PMC members of changes to extension-related files
+
+/superset-core/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje
+/superset-extensions-cli/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje
+/superset/core/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje
+/superset/extensions/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje
+/superset-frontend/src/packages/superset-core/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje
+/superset-frontend/src/core/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje
+/superset-frontend/src/extensions/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje

.github/actions/change-detector/action.yml

@@ -1,24 +1,27 @@
-name: 'Change Detector'
-description: 'Detects file changes for pull request and push events'
+name: Change Detector
+description: Detects file changes for pull request and push events
 inputs:
   token:
-    description: 'GitHub token for authentication'
+    description: GitHub token for authentication
     required: true
 outputs:
   python:
-    description: 'Whether Python-related files were changed'
+    description: Whether Python-related files were changed
     value: ${{ steps.change-detector.outputs.python }}
   frontend:
-    description: 'Whether frontend-related files were changed'
+    description: Whether frontend-related files were changed
     value: ${{ steps.change-detector.outputs.frontend }}
   docker:
-    description: 'Whether docker-related files were changed'
+    description: Whether docker-related files were changed
     value: ${{ steps.change-detector.outputs.docker }}
   docs:
-    description: 'Whether docs-related files were changed'
+    description: Whether docs-related files were changed
     value: ${{ steps.change-detector.outputs.docs }}
+  superset-extensions-cli:
+    description: Whether superset-extensions-cli package-related files were changed
+    value: ${{ steps.change-detector.outputs.superset-extensions-cli }}
 runs:
-  using: 'composite'
+  using: composite
   steps:
     - name: Detect file changes
       id: change-detector

.github/copilot-instructions.md

@@ -1 +1 @@
-../LLMS.md
+../AGENTS.md

.github/dependabot.yml

@@ -5,23 +5,20 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
 
   - package-ecosystem: "npm"
     ignore:
       # not until React >= 18.0.0
       - dependency-name: "storybook"
       - dependency-name: "@storybook*"
-      # remark-gfm v4+ requires react-markdown v9+, which needs React 18
-      - dependency-name: "remark-gfm"
-      - dependency-name: "react-markdown"
       # JSDOM v30 doesn't play well with Jest v30
       # Source: https://jestjs.io/blog#known-issues
       # GH thread: https://github.com/jsdom/jsdom/issues/3492
       - dependency-name: "jest-environment-jsdom"
     directory: "/superset-frontend/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -43,21 +40,21 @@ updates:
   - package-ecosystem: "npm"
     directory: ".github/actions"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     open-pull-requests-limit: 10
     versioning-strategy: increase
 
   - package-ecosystem: "npm"
     directory: "/docs/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     open-pull-requests-limit: 10
     versioning-strategy: increase
 
   - package-ecosystem: "npm"
     directory: "/superset-websocket/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -66,7 +63,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-websocket/utils/client-ws-app/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -78,7 +75,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/plugins/legacy-plugin-chart-calendar/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -88,7 +85,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/plugins/legacy-plugin-chart-histogram/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -98,7 +95,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/plugins/legacy-plugin-chart-partition/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -108,7 +105,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/plugins/legacy-plugin-chart-world-map/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -118,7 +115,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/plugins/plugin-chart-pivot-table/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -128,7 +125,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/plugins/legacy-plugin-chart-chord/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -138,7 +135,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/plugins/legacy-plugin-chart-horizon/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -148,7 +145,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/plugins/legacy-plugin-chart-rose/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -158,7 +155,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/plugins/legacy-preset-chart-deckgl/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -168,7 +165,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/plugins/plugin-chart-table/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -178,7 +175,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/plugins/legacy-plugin-chart-country-map/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -188,7 +185,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/plugins/legacy-plugin-chart-map-box/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -198,7 +195,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/plugins/legacy-plugin-chart-sankey/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -208,7 +205,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/plugins/legacy-preset-chart-nvd3/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -218,7 +215,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/plugins/plugin-chart-word-cloud/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -228,7 +225,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/plugins/legacy-plugin-chart-event-flow/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -238,7 +235,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/plugins/legacy-plugin-chart-paired-t-test/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -248,7 +245,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/plugins/legacy-plugin-chart-sankey-loop/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -258,7 +255,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/plugins/plugin-chart-echarts/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -268,7 +265,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/plugins/preset-chart-xy/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -278,7 +275,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/plugins/legacy-plugin-chart-heatmap/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -288,7 +285,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/plugins/legacy-plugin-chart-parallel-coordinates/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -298,7 +295,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/plugins/legacy-plugin-chart-sunburst/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -308,7 +305,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/plugins/plugin-chart-handlebars/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -318,7 +315,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/packages/generator-superset/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -328,7 +325,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/packages/superset-ui-chart-controls/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -342,7 +339,7 @@ updates:
       - dependency-name: "react-markdown"
       - dependency-name: "remark-gfm"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -352,7 +349,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/packages/superset-ui-demo/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot
@@ -362,7 +359,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/superset-frontend/packages/superset-ui-switchboard/"
     schedule:
-      interval: "monthly"
+      interval: "daily"
     labels:
       - npm
       - dependabot

.github/workflows/bashlib.sh

@@ -117,19 +117,6 @@ testdata() {
   say "::endgroup::"
 }
 
-playwright_testdata() {
-  cd "$GITHUB_WORKSPACE"
-  say "::group::Load all examples for Playwright tests"
-  # must specify PYTHONPATH to make `tests.superset_test_config` importable
-  export PYTHONPATH="$GITHUB_WORKSPACE"
-  pip install -e .
-  superset db upgrade
-  superset load_test_users
-  superset load_examples
-  superset init
-  say "::endgroup::"
-}
-
 celery-worker() {
   cd "$GITHUB_WORKSPACE"
   say "::group::Start Celery worker"

.github/workflows/bump-python-package.yml

@@ -32,7 +32,7 @@ jobs:
     steps:
 
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: true
           ref: master
@@ -41,7 +41,7 @@ jobs:
         uses: ./.github/actions/setup-supersetbot/
 
       - name: Set up Python ${{ inputs.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.10"
 

.github/workflows/cancel_duplicates.yml

@@ -31,7 +31,7 @@ jobs:
 
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         if: steps.check_queued.outputs.count >= 20
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Cancel duplicate workflow runs
         if: steps.check_queued.outputs.count >= 20

.github/workflows/check-python-deps.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive

.github/workflows/check_db_migration_confict.yml

@@ -25,9 +25,9 @@ jobs:
       pull-requests: write
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: Check and notify
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ github.token }}
           script: |

.github/workflows/claude.yml

@@ -44,7 +44,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Comment access denied
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const message = `👋 Hi @${{ github.event.comment.user.login || github.event.review.user.login || github.event.issue.user.login }}!
@@ -71,7 +71,7 @@ jobs:
       id-token: write
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         fetch-depth: 1
 

.github/workflows/codeql-analysis.yml

@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Check for file changes
         id: check
@@ -41,7 +41,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -53,6 +53,6 @@ jobs:
 
       - name: Perform CodeQL Analysis
         if: steps.check.outputs.python || steps.check.outputs.frontend
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/dependency-review.yml

@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: "Dependency Review"
         uses: actions/dependency-review-action@v4
         continue-on-error: true
@@ -53,7 +53,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Python
         uses: ./.github/actions/setup-backend/

.github/workflows/docker.yml

@@ -22,7 +22,7 @@ jobs:
     steps:
       - id: set_matrix
         run: |
-          MATRIX_CONFIG=$(if [ "${{ github.event_name }}" == "pull_request" ]; then echo '["dev", "lean"]'; else echo '["dev", "lean", "py310", "websocket", "dockerize", "py311"]'; fi)
+          MATRIX_CONFIG=$(if [ "${{ github.event_name }}" == "pull_request" ]; then echo '["dev", "lean"]'; else echo '["dev", "lean", "py310", "websocket", "dockerize", "py311", "py312"]'; fi)
           echo "matrix_config=${MATRIX_CONFIG}" >> $GITHUB_OUTPUT
           echo $GITHUB_OUTPUT
 
@@ -42,7 +42,7 @@ jobs:
     steps:
 
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
 
@@ -102,7 +102,7 @@ jobs:
           docker history $IMAGE_TAG
 
       - name: docker-compose sanity check
-        if: (steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker) && (matrix.build_preset == 'dev' || matrix.build_preset == 'lean')
+        if: (steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker) && matrix.build_preset == 'dev'
         shell: bash
         run: |
           export SUPERSET_BUILD_TARGET=${{ matrix.build_preset }}
@@ -117,7 +117,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
       - name: Check for file changes

.github/workflows/embedded-sdk-release.yml

@@ -28,8 +28,8 @@ jobs:
       run:
         working-directory: superset-embedded-sdk
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
           node-version-file: './superset-embedded-sdk/.nvmrc'
           registry-url: 'https://registry.npmjs.org'

.github/workflows/embedded-sdk-test.yml

@@ -18,8 +18,8 @@ jobs:
       run:
         working-directory: superset-embedded-sdk
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
           node-version-file: './superset-embedded-sdk/.nvmrc'
           registry-url: 'https://registry.npmjs.org'

.github/workflows/ephemeral-env-pr-close.yml

@@ -1,4 +1,10 @@
-name: Cleanup ephemeral envs (PR close)
+name: Cleanup ephemeral envs (PR close) [DEPRECATED]
+
+# ⚠️  DEPRECATION NOTICE ⚠️
+# This workflow is deprecated and will be removed in a future version.
+# The new Superset Showtime workflow handles cleanup automatically.
+# See .github/workflows/showtime.yml and showtime-cleanup.yml for replacements.
+# Migration guide: https://github.com/mistercrunch/superset-showtime
 
 on:
   pull_request_target:
@@ -27,7 +33,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v5
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -63,7 +69,7 @@ jobs:
 
       - name: Comment (success)
         if: steps.describe-services.outputs.active == 'true'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{github.token}}
           script: |
@@ -71,5 +77,5 @@ jobs:
               issue_number: ${{ github.event.number }},
               owner: context.repo.owner,
               repo: context.repo.repo,
-              body: 'Ephemeral environment shutdown and build artifacts deleted.'
+              body: '⚠️ **DEPRECATED WORKFLOW** - Ephemeral environment shutdown and build artifacts deleted. Please migrate to the new Superset Showtime system for future PRs.'
             })

.github/workflows/ephemeral-env.yml

@@ -1,4 +1,12 @@
-name: Ephemeral env workflow
+name: Ephemeral env workflow [DEPRECATED]
+
+# ⚠️  DEPRECATION NOTICE ⚠️
+# This workflow is deprecated and will be removed in a future version.
+# Please use the new Superset Showtime workflow instead:
+# - Use label "🎪 trigger-start" instead of "testenv-up"
+# - Showtime provides better reliability and easier management
+# - See .github/workflows/showtime.yml for the replacement
+# - Migration guide: https://github.com/mistercrunch/superset-showtime
 
 # Example manual trigger:
 # gh workflow run ephemeral-env.yml --ref fix_ephemerals --field label_name="testenv-up" --field issue_number=666
@@ -55,7 +63,7 @@ jobs:
       - name: Get event SHA
         id: get-sha
         if: steps.eval-label.outputs.result == 'up'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -86,7 +94,7 @@ jobs:
             core.setOutput("sha", prSha);
 
       - name: Looking for feature flags in PR description
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         id: eval-feature-flags
         if: steps.eval-label.outputs.result == 'up'
         with:
@@ -108,7 +116,7 @@ jobs:
             return results;
 
       - name: Reply with confirmation comment
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         if: steps.eval-label.outputs.result == 'up'
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -126,8 +134,11 @@ jobs:
               throw new Error("Issue number is not available.");
             }
 
-            const body = `@${user} Processing your ephemeral environment request [here](${workflowUrl}).` +
-              ` Action: **${action}**.` +
+            const body = `⚠️ **DEPRECATED WORKFLOW** ⚠️\n\n@${user} This workflow is deprecated! Please use the new **Superset Showtime** system instead:\n\n` +
+              `- Replace "testenv-up" label with "🎪 trigger-start"\n` +
+              `- Better reliability and easier management\n` +
+              `- See https://github.com/mistercrunch/superset-showtime for details\n\n` +
+              `Processing your ephemeral environment request [here](${workflowUrl}). Action: **${action}**.` +
               ` More information on [how to use or configure ephemeral environments]` +
               `(https://superset.apache.org/docs/contributing/howtos/#github-ephemeral-environments)`;
 
@@ -149,7 +160,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ needs.ephemeral-env-label.outputs.sha }} : ${{steps.get-sha.outputs.sha}} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ needs.ephemeral-env-label.outputs.sha }}
           persist-credentials: false
@@ -178,7 +189,7 @@ jobs:
             --extra-flags "--build-arg INCLUDE_CHROMIUM=false"
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v5
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -209,12 +220,12 @@ jobs:
       pull-requests: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           persist-credentials: false
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v5
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -237,7 +248,7 @@ jobs:
 
       - name: Fail on missing container image
         if: steps.check-image.outcome == 'failure'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ github.token }}
           script: |
@@ -307,7 +318,7 @@ jobs:
           echo "ip=$(aws ec2 describe-network-interfaces --network-interface-ids ${{ steps.get-eni.outputs.eni }} | jq -r '.NetworkInterfaces | first | .Association.PublicIp')" >> $GITHUB_OUTPUT
       - name: Comment (success)
         if: ${{ success() }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{github.token}}
           script: |
@@ -320,7 +331,7 @@ jobs:
             });
       - name: Comment (failure)
         if: ${{ failure() }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{github.token}}
           script: |

.github/workflows/generate-FOSSA-report.yml

@@ -27,12 +27,12 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: "temurin"
           java-version: "11"

.github/workflows/github-action-validator.yml

@@ -14,10 +14,10 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: '20'
 

.github/workflows/issue_creation.yml

@@ -17,7 +17,7 @@ jobs:
     steps:
 
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
 

.github/workflows/labeler.yml

@@ -9,7 +9,7 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/labeler@v5
+    - uses: actions/labeler@v6
       with:
         sync-labels: true
 

.github/workflows/latest-release-tag.yml

@@ -12,7 +12,7 @@ jobs:
 
     steps:
     - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         persist-credentials: false
         submodules: recursive

.github/workflows/license-check.yml

@@ -15,12 +15,12 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           java-version: '11'

.github/workflows/no-hold-label.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Check for 'hold' label
-      uses: actions/github-script@v7
+      uses: actions/github-script@v8
       with:
         github-token: ${{secrets.GITHUB_TOKEN}}
         script: |

.github/workflows/pr-lint.yml

@@ -16,7 +16,7 @@ jobs:
       pull-requests: write
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive

.github/workflows/pre-commit.yml

@@ -21,7 +21,7 @@ jobs:
         python-version: ["current", "previous", "next"]
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
@@ -29,18 +29,17 @@ jobs:
         uses: ./.github/actions/setup-backend/
         with:
           python-version: ${{ matrix.python-version }}
-      - name: Setup Go
-        uses: actions/setup-go@v5
-      - name: Install helm-docs
-        # Previously `brew install norwoodj/tap/helm-docs`, but Homebrew now
-        # refuses to install from untrusted third-party taps ("Skipping
-        # norwoodj/tap because it is not trusted"), which breaks CI. Install the
-        # pinned binary directly with Go instead — this matches apache/superset
-        # upstream and keeps the version aligned with the helm-docs pre-commit
-        # hook rev in .pre-commit-config.yaml.
-        run: go install github.com/norwoodj/helm-docs/cmd/helm-docs@v1.14.2
+      - name: Enable brew and helm-docs
+        # Add brew to the path - see https://github.com/actions/runner-images/issues/6283
+        run: |
+          echo "/home/linuxbrew/.linuxbrew/bin:/home/linuxbrew/.linuxbrew/sbin" >> $GITHUB_PATH
+          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+          echo "HOMEBREW_PREFIX=$HOMEBREW_PREFIX" >>"${GITHUB_ENV}"
+          echo "HOMEBREW_CELLAR=$HOMEBREW_CELLAR" >>"${GITHUB_ENV}"
+          echo "HOMEBREW_REPOSITORY=$HOMEBREW_REPOSITORY" >>"${GITHUB_ENV}"
+          brew install norwoodj/tap/helm-docs
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: '20'
 

.github/workflows/prefer-typescript.yml

@@ -27,7 +27,7 @@ jobs:
       pull-requests: write
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive

.github/workflows/release.yml

@@ -26,7 +26,7 @@ jobs:
     name: Bump version and publish package(s)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           # pulls all commits (needed for lerna / semantic release to correctly version)
           fetch-depth: 0
@@ -42,7 +42,7 @@ jobs:
 
       - name: Install Node.js
         if: env.HAS_TAGS
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version-file: './superset-frontend/.nvmrc'
 

.github/workflows/showtime-cleanup.yml

@@ -0,0 +1,50 @@
+name: 🎪 Showtime Cleanup
+
+# Scheduled cleanup of expired environments
+on:
+  schedule:
+    - cron: '0 */6 * * *'  # Every 6 hours
+
+  # Manual trigger for testing
+  workflow_dispatch:
+    inputs:
+      max_age_hours:
+        description: 'Maximum age in hours before cleanup'
+        required: false
+        default: '48'
+        type: string
+
+# Common environment variables
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+  AWS_REGION: ${{ vars.AWS_REGION || 'us-west-2' }}
+  GITHUB_ORG: ${{ github.repository_owner }}
+  GITHUB_REPO: ${{ github.event.repository.name }}
+
+jobs:
+  cleanup-expired:
+    name: Clean up expired showtime environments
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - name: Install Superset Showtime
+        run: pip install superset-showtime
+
+      - name: Cleanup expired environments
+        run: |
+          MAX_AGE="${{ github.event.inputs.max_age_hours || '48' }}"
+
+          # Validate max_age is numeric
+          if [[ ! "$MAX_AGE" =~ ^[0-9]+$ ]]; then
+            echo "❌ Invalid max_age_hours format: $MAX_AGE (must be numeric)"
+            exit 1
+          fi
+
+          echo "Cleaning up environments older than ${MAX_AGE}h"
+          python -m showtime cleanup --older-than "${MAX_AGE}h"

.github/workflows/showtime-trigger.yml

@@ -0,0 +1,179 @@
+name: 🎪 Superset Showtime
+
+# Ultra-simple: just sync on any PR state change
+on:
+  pull_request_target:
+    types: [labeled, unlabeled, synchronize, closed]
+
+  # Manual testing
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'PR number to sync'
+        required: true
+        type: number
+      sha:
+        description: 'Specific SHA to deploy (optional, defaults to latest)'
+        required: false
+        type: string
+
+# Common environment variables for all jobs (non-sensitive only)
+env:
+  AWS_REGION: us-west-2
+  GITHUB_ORG: ${{ github.repository_owner }}
+  GITHUB_REPO: ${{ github.event.repository.name }}
+  GITHUB_ACTOR: ${{ github.actor }}
+
+jobs:
+  sync:
+    name: 🎪 Sync PR to desired state
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - name: Security Check - Authorize Maintainers Only
+        id: auth
+        uses: actions/github-script@v8
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          script: |
+            const actor = context.actor;
+            console.log(`🔍 Checking authorization for ${actor}`);
+
+            // Early exit for workflow_dispatch - assume authorized since it's manually triggered
+            if (context.eventName === 'workflow_dispatch') {
+              console.log(`✅ Workflow dispatch event - assuming authorized for ${actor}`);
+              core.setOutput('authorized', 'true');
+              return;
+            }
+
+            const { data: permission } = await github.rest.repos.getCollaboratorPermissionLevel({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              username: actor
+            });
+
+            console.log(`📊 Permission level for ${actor}: ${permission.permission}`);
+            const authorized = ['write', 'admin'].includes(permission.permission);
+
+            // If this is a synchronize event from unauthorized user, check if Showtime is active and set blocked label
+            if (!authorized && context.eventName === 'pull_request_target' && context.payload.action === 'synchronize') {
+              console.log(`🔒 Synchronize event detected - checking if Showtime is active`);
+
+              // Check if PR has any circus tent labels (Showtime is in use)
+              const { data: issue } = await github.rest.issues.get({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.payload.pull_request.number
+              });
+
+              const hasCircusLabels = issue.labels.some(label => label.name.startsWith('🎪 '));
+
+              if (hasCircusLabels) {
+                console.log(`🎪 Circus labels found - setting blocked label to prevent auto-deployment`);
+
+                await github.rest.issues.addLabels({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: context.payload.pull_request.number,
+                  labels: ['🎪 🔒 showtime-blocked']
+                });
+
+                console.log(`✅ Blocked label set - Showtime will detect and skip operations`);
+              } else {
+                console.log(`ℹ️ No circus labels found - Showtime not in use, skipping block`);
+              }
+            }
+
+            if (!authorized) {
+              console.log(`🚨 Unauthorized user ${actor} - skipping all operations`);
+              core.setOutput('authorized', 'false');
+              return;
+            }
+
+            console.log(`✅ Authorized maintainer: ${actor}`);
+            core.setOutput('authorized', 'true');
+
+      - name: Install Superset Showtime
+        if: steps.auth.outputs.authorized == 'true'
+        run: |
+          echo "::notice::Maintainer ${{ github.actor }} triggered deploy for PR ${{ github.event.pull_request.number || github.event.inputs.pr_number }}"
+          pip install --upgrade superset-showtime
+          showtime version
+
+      - name: Check what actions are needed
+        if: steps.auth.outputs.authorized == 'true'
+        id: check
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # Bulletproof PR number extraction
+          if [[ -n "${{ github.event.pull_request.number }}" ]]; then
+            PR_NUM="${{ github.event.pull_request.number }}"
+          elif [[ -n "${{ github.event.inputs.pr_number }}" ]]; then
+            PR_NUM="${{ github.event.inputs.pr_number }}"
+          else
+            echo "❌ No PR number found in event or inputs"
+            exit 1
+          fi
+
+          echo "Using PR number: $PR_NUM"
+
+          # Run sync check-only with optional SHA override
+          if [[ -n "${{ github.event.inputs.sha }}" ]]; then
+            OUTPUT=$(python -m showtime sync $PR_NUM --check-only --sha "${{ github.event.inputs.sha }}")
+          else
+            OUTPUT=$(python -m showtime sync $PR_NUM --check-only)
+          fi
+          echo "$OUTPUT"
+
+          # Extract the outputs we need for conditional steps
+          BUILD=$(echo "$OUTPUT" | grep "build_needed=" | cut -d'=' -f2)
+          SYNC=$(echo "$OUTPUT" | grep "sync_needed=" | cut -d'=' -f2)
+          PR_NUM_OUT=$(echo "$OUTPUT" | grep "pr_number=" | cut -d'=' -f2)
+          TARGET_SHA=$(echo "$OUTPUT" | grep "target_sha=" | cut -d'=' -f2)
+
+          echo "build_needed=$BUILD" >> $GITHUB_OUTPUT
+          echo "sync_needed=$SYNC" >> $GITHUB_OUTPUT
+          echo "pr_number=$PR_NUM_OUT" >> $GITHUB_OUTPUT
+          echo "target_sha=$TARGET_SHA" >> $GITHUB_OUTPUT
+
+      - name: Checkout PR code (only if build needed)
+        if: steps.auth.outputs.authorized == 'true' && steps.check.outputs.build_needed == 'true'
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ steps.check.outputs.target_sha }}
+          persist-credentials: false
+
+      - name: Setup Docker Environment (only if build needed)
+        if: steps.auth.outputs.authorized == 'true' && steps.check.outputs.build_needed == 'true'
+        uses: ./.github/actions/setup-docker
+        with:
+          dockerhub-user: ${{ secrets.DOCKERHUB_USER }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
+          build: "true"
+          install-docker-compose: "false"
+
+      - name: Execute sync (handles everything)
+        if: steps.auth.outputs.authorized == 'true' && steps.check.outputs.sync_needed == 'true'
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }}
+          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+        run: |
+          PR_NUM="${{ steps.check.outputs.pr_number }}"
+          TARGET_SHA="${{ steps.check.outputs.target_sha }}"
+          if [[ -n "$TARGET_SHA" ]]; then
+            python -m showtime sync $PR_NUM --sha "$TARGET_SHA"
+          else
+            python -m showtime sync $PR_NUM
+          fi

.github/workflows/superset-app-cli.yml

@@ -1,4 +1,4 @@
-name: Superset CLI tests
+name: Superset App CLI tests
 
 on:
   push:
@@ -37,7 +37,7 @@ jobs:
           - 16379:6379
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive

.github/workflows/superset-applitool-cypress.yml

@@ -51,7 +51,7 @@ jobs:
           - 16379:6379
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
@@ -63,7 +63,7 @@ jobs:
         with:
           run: testdata
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version-file: './superset-frontend/.nvmrc'
       - name: Install npm dependencies

.github/workflows/superset-applitools-storybook.yml

@@ -30,13 +30,13 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
           ref: master
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version-file: './superset-frontend/.nvmrc'
       - name: Install eyes-storybook dependencies

.github/workflows/superset-docs-deploy.yml

@@ -31,17 +31,17 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version-file: './docs/.nvmrc'
       - name: Setup Python
         uses: ./.github/actions/setup-backend/
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@v5
         with:
           distribution: 'zulu'
           java-version: '21'

.github/workflows/superset-docs-verify.yml

@@ -18,15 +18,17 @@ jobs:
     name: Link Checking
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       # Do not bump this linkinator-action version without opening
       # an ASF Infra ticket to allow the new version first!
-      - uses: JustinBeckwith/linkinator-action@v1.11.0
+      - uses: JustinBeckwith/linkinator-action@3d5ba091319fa7b0ac14703761eebb7d100e6f6d  # v1.11.0
         continue-on-error: true # This will make the job advisory (non-blocking, no red X)
         with:
-          paths: "**/*.md, **/*.mdx, !superset-frontend/CHANGELOG.md"
+          paths: "**/*.md, **/*.mdx"
           linksToSkip: >-
-            ^https://github.com/apache/(superset|incubator-superset)/(pull|issue)/\d+,
+            ^https://github.com/apache/(superset|incubator-superset)/(pull|issues)/\d+,
+            ^https://github.com/apache/(superset|incubator-superset)/commit/[a-f0-9]+,
+            superset-frontend/.*CHANGELOG\.md,
             http://localhost:8088/,
             http://127.0.0.1:3000/,
             http://localhost:9001/,
@@ -41,12 +43,12 @@ jobs:
             http://theiconic.com.au/,
             https://dev.mysql.com/doc/refman/5.7/en/innodb-limits.html,
             ^https://img\.shields\.io/.*,
-            https://vkusvill.ru/
-            https://www.linkedin.com/in/mark-thomas-b16751158/
-            https://theiconic.com.au/
-            https://wattbewerb.de/
-            https://timbr.ai/
-            https://opensource.org/license/apache-2-0
+            https://vkusvill.ru/,
+            https://www.linkedin.com/in/mark-thomas-b16751158/,
+            https://theiconic.com.au/,
+            https://wattbewerb.de/,
+            https://timbr.ai/,
+            https://opensource.org/license/apache-2-0,
             https://www.plaidcloud.com/
   build-deploy:
     name: Build & Deploy
@@ -56,12 +58,12 @@ jobs:
         working-directory: docs
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version-file: './docs/.nvmrc'
       - name: yarn install

.github/workflows/superset-e2e.yml

@@ -69,21 +69,21 @@ jobs:
       # Conditional checkout based on context
       - name: Checkout for push or pull_request event
         if: github.event_name == 'push' || github.event_name == 'pull_request'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
       - name: Checkout using ref (workflow_dispatch)
         if: github.event_name == 'workflow_dispatch' && github.event.inputs.ref != ''
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           ref: ${{ github.event.inputs.ref }}
           submodules: recursive
       - name: Checkout using PR ID (workflow_dispatch)
         if: github.event_name == 'workflow_dispatch' && github.event.inputs.pr_id != ''
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           ref: refs/pull/${{ github.event.inputs.pr_id }}/merge
@@ -109,7 +109,7 @@ jobs:
           run: testdata
       - name: Setup Node.js
         if: steps.check.outputs.python || steps.check.outputs.frontend
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version-file: './superset-frontend/.nvmrc'
       - name: Install npm dependencies
@@ -223,7 +223,7 @@ jobs:
         if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         with:
-          run: playwright_testdata
+          run: testdata
       - name: Setup Node.js
         if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: actions/setup-node@v5

.github/workflows/superset-extensions-cli.yml

@@ -0,0 +1,64 @@
+name: Superset Extensions CLI Package Tests
+
+on:
+  push:
+    branches:
+      - "master"
+      - "[0-9].[0-9]*"
+  pull_request:
+    types: [synchronize, opened, reopened, ready_for_review]
+
+# cancel previous workflow jobs for PRs
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  test-superset-extensions-cli-package:
+    runs-on: ubuntu-24.04
+    strategy:
+      matrix:
+        python-version: ["previous", "current", "next"]
+    defaults:
+      run:
+        working-directory: superset-extensions-cli
+    steps:
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+          submodules: recursive
+
+      - name: Check for file changes
+        id: check
+        uses: ./.github/actions/change-detector/
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Setup Python
+        if: steps.check.outputs.superset-extensions-cli
+        uses: ./.github/actions/setup-backend/
+        with:
+          python-version: ${{ matrix.python-version }}
+          requirements-type: dev
+
+      - name: Run pytest with coverage
+        if: steps.check.outputs.superset-extensions-cli
+        run: |
+          pytest --cov=superset_extensions_cli --cov-report=xml --cov-report=term-missing --cov-report=html -v --tb=short
+
+      - name: Upload coverage reports to Codecov
+        if: steps.check.outputs.superset-extensions-cli
+        uses: codecov/codecov-action@v5
+        with:
+          file: ./coverage.xml
+          flags: superset-extensions-cli
+          name: superset-extensions-cli-coverage
+          fail_ci_if_error: false
+
+      - name: Upload HTML coverage report
+        if: steps.check.outputs.superset-extensions-cli
+        uses: actions/upload-artifact@v4
+        with:
+          name: superset-extensions-cli-coverage-html
+          path: htmlcov/

.github/workflows/superset-frontend.yml

@@ -23,7 +23,7 @@ jobs:
       should-run: ${{ steps.check.outputs.frontend }}
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -47,7 +47,7 @@ jobs:
           git show -s --format=raw HEAD
           docker buildx build \
             -t $TAG \
-            --cache-from=type=registry,ref=apache/superset-cache:3.10-slim-bookworm \
+            --cache-from=type=registry,ref=apache/superset-cache:3.10-slim-trixie \
             --target superset-node-ci \
             .
 
@@ -73,7 +73,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Download Docker Image Artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: docker-image
 
@@ -101,7 +101,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Download Coverage Artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           pattern: coverage-artifacts-*
           path: coverage/
@@ -127,7 +127,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Download Docker Image Artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: docker-image
 
@@ -135,15 +135,15 @@ jobs:
         run: |
           docker load < docker-image.tar.gz
 
-      - name: eslint
+      - name: lint
         run: |
           docker run --rm $TAG bash -c \
-          "npm i && npm run eslint -- . --quiet"
+          "npm i && npm run lint"
 
       - name: tsc
         run: |
           docker run --rm $TAG bash -c \
-          "npm run type"
+          "npm i && npm run plugins:build && npm run type"
 
   validate-frontend:
     needs: frontend-build
@@ -151,7 +151,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Download Docker Image Artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: docker-image
 

.github/workflows/superset-helm-lint.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive

.github/workflows/superset-helm-release.yml

@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ inputs.ref || github.ref_name }}
           persist-credentials: true
@@ -101,7 +101,7 @@ jobs:
           CR_RELEASE_NAME_TEMPLATE: "superset-helm-chart-{{ .Version }}"
 
       - name: Open Pull Request
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const branchName = '${{ env.branch_name }}';

.github/workflows/superset-playwright.yml

@@ -97,10 +97,10 @@ jobs:
         if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         with:
-          run: playwright_testdata
+          run: testdata
       - name: Setup Node.js
         if: steps.check.outputs.python || steps.check.outputs.frontend
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version-file: './superset-frontend/.nvmrc'
       - name: Install npm dependencies

.github/workflows/superset-python-integrationtest.yml

@@ -41,7 +41,7 @@ jobs:
           - 16379:6379
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
@@ -99,7 +99,7 @@ jobs:
           - 16379:6379
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
@@ -152,7 +152,7 @@ jobs:
           - 16379:6379
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive

.github/workflows/superset-python-presto-hive.yml

@@ -48,7 +48,7 @@ jobs:
           - 16379:6379
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
@@ -108,7 +108,7 @@ jobs:
           - 16379:6379
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive

.github/workflows/superset-python-unittest.yml

@@ -24,7 +24,7 @@ jobs:
       PYTHONPATH: ${{ github.workspace }}
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive

.github/workflows/superset-translations.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
@@ -31,7 +31,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.check.outputs.frontend
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version-file:  './superset-frontend/.nvmrc'
       - name: Install dependencies
@@ -49,7 +49,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive

.github/workflows/superset-websocket.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
       - name: Install dependencies

.github/workflows/supersetbot.yml

@@ -26,7 +26,7 @@ jobs:
     steps:
       - name: Quickly add thumbs up!
         if: github.event_name == 'issue_comment' && contains(github.event.comment.body, '@supersetbot')
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const [owner, repo] = process.env.GITHUB_REPOSITORY.split('/')
@@ -38,7 +38,7 @@ jobs:
             });
 
       - name: "Checkout ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
 

.github/workflows/tag-release.yml

@@ -42,12 +42,12 @@ jobs:
     runs-on: ubuntu-24.04
     strategy:
       matrix:
-        build_preset: ["dev", "lean", "py310", "websocket", "dockerize", "py311"]
+        build_preset: ["dev", "lean", "py310", "websocket", "dockerize", "py311", "py312"]
       fail-fast: false
     steps:
 
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -60,7 +60,7 @@ jobs:
           build: "true"
 
       - name: Use Node.js 20
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: 20
 
@@ -107,12 +107,12 @@ jobs:
     steps:
 
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
       - name: Use Node.js 20
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: 20
 

.github/workflows/tech-debt.yml

@@ -27,10 +27,10 @@ jobs:
     name: Generate Reports
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version-file: './superset-frontend/.nvmrc'
 

.github/workflows/welcome-new-users.yml

@@ -12,7 +12,7 @@ jobs:
 
     steps:
       - name: Welcome Message
-        uses: actions/first-interaction@v2
+        uses: actions/first-interaction@v3
         continue-on-error: true
         with:
           repo-token: ${{ github.token }}

.gitignore

@@ -33,6 +33,7 @@ cover
 .env
 .envrc
 .idea
+.roo
 .mypy_cache
 .python-version
 .tox
@@ -43,7 +44,7 @@ _modules
 _static
 build
 app.db
-apache_superset.egg-info/
+*.egg-info/
 changelog.sh
 dist
 dump.rdb
@@ -60,7 +61,6 @@ tmp
 rat-results.txt
 superset/app/
 superset-websocket/config.json
-*.log
 
 # Node.js, webpack artifacts, storybook
 *.entry.js
@@ -136,6 +136,5 @@ CLAUDE.local.md
 PROJECT.md
 .aider*
 .claude_rc*
-.claude/settings.local.json
 .env.local
-*.code-workspace
+oxc-custom-build/

.pre-commit-config.yaml

@@ -23,9 +23,10 @@ repos:
     rev: v1.15.0
     hooks:
       - id: mypy
+        name: mypy (main)
         args: [--check-untyped-defs]
+        exclude: ^superset-extensions-cli/
         additional_dependencies: [
-            types-cachetools,
             types-simplejson,
             types-python-dateutil,
             types-requests,
@@ -39,6 +40,10 @@ repos:
             types-paramiko,
             types-Markdown,
           ]
+      - id: mypy
+        name: mypy (superset-extensions-cli)
+        args: [--check-untyped-defs]
+        files: ^superset-extensions-cli/
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v5.0.0
     hooks:
@@ -55,25 +60,39 @@ repos:
         args: ["--markdown-linebreak-ext=md"]
   - repo: local
     hooks:
-    - id: eslint-frontend
-      name: eslint (frontend)
-      entry: ./scripts/eslint.sh
-      language: system
-      pass_filenames: true
-      files: ^superset-frontend/.*\.(js|jsx|ts|tsx)$
-    - id: eslint-docs
-      name: eslint (docs)
-      entry: bash -c 'cd docs && FILES=$(echo "$@" | sed "s|docs/||g") && yarn eslint --fix --ext .js,.jsx,.ts,.tsx --quiet $FILES'
-      language: system
-      pass_filenames: true
-      files: ^docs/.*\.(js|jsx|ts|tsx)$
-    - id: type-checking-frontend
-      name: Type-Checking (Frontend)
-      entry: ./scripts/check-type.js package=superset-frontend excludeDeclarationDir=cypress-base
-      language: system
-      files: ^superset-frontend\/.*\.(js|jsx|ts|tsx)$
-      exclude: ^superset-frontend/cypress-base\/
-      require_serial: true
+      - id: prettier-frontend
+        name: prettier (frontend)
+        entry: bash -c 'cd superset-frontend && for file in "$@"; do npx prettier --write "${file#superset-frontend/}"; done'
+        language: system
+        pass_filenames: true
+        files: ^superset-frontend/.*\.(js|jsx|ts|tsx|css|scss|sass|json)$
+  - repo: local
+    hooks:
+      - id: oxlint-frontend
+        name: oxlint (frontend)
+        entry: ./scripts/oxlint.sh
+        language: system
+        pass_filenames: true
+        files: ^superset-frontend/.*\.(js|jsx|ts|tsx)$
+      - id: custom-rules-frontend
+        name: custom rules (frontend)
+        entry: ./scripts/check-custom-rules.sh
+        language: system
+        pass_filenames: true
+        files: ^superset-frontend/.*\.(js|jsx|ts|tsx)$
+      - id: eslint-docs
+        name: eslint (docs)
+        entry: bash -c 'cd docs && FILES=$(echo "$@" | sed "s|docs/||g") && yarn eslint --fix --quiet $FILES'
+        language: system
+        pass_filenames: true
+        files: ^docs/.*\.(js|jsx|ts|tsx)$
+      - id: type-checking-frontend
+        name: Type-Checking (Frontend)
+        entry: ./scripts/check-type.js package=superset-frontend excludeDeclarationDir=cypress-base
+        language: system
+        files: ^superset-frontend\/.*\.(js|jsx|ts|tsx)$
+        exclude: ^superset-frontend/cypress-base\/
+        require_serial: true
   # blacklist unsafe functions like make_url (see #19526)
   - repo: https://github.com/skorokithakis/blacklist-pre-commit-hook
     rev: e2f070289d8eddcaec0b580d3bde29437e7c8221
@@ -95,21 +114,24 @@ repos:
         args: [--fix]
   - repo: local
     hooks:
-    - id: pylint
-      name: pylint with custom Superset plugins
-      entry: bash
-      language: system
-      types: [python]
-      exclude: ^(tests/|superset/migrations/|scripts/|RELEASING/|docker/)
-      args:
-        - -c
-        - |
-          TARGET_BRANCH=${GITHUB_BASE_REF:-master}
-          git fetch origin "$TARGET_BRANCH"
-          BASE=$(git merge-base origin/"$TARGET_BRANCH" HEAD)
-          files=$(git diff --name-only --diff-filter=ACM "$BASE"..HEAD | grep '^superset/.*\.py$' || true)
-          if [ -n "$files" ]; then
-            pylint --rcfile=.pylintrc --load-plugins=superset.extensions.pylint --reports=no $files
-          else
-            echo "No Python files to lint."
-          fi
+      - id: pylint
+        name: pylint with custom Superset plugins
+        entry: bash
+        language: system
+        types: [python]
+        exclude: ^(tests/|superset/migrations/|scripts/|RELEASING/|docker/)
+        args:
+          - -c
+          - |
+            TARGET_BRANCH=${GITHUB_BASE_REF:-master}
+            # Only fetch if we're not in CI (CI already has all refs)
+            if [ -z "$CI" ]; then
+              git fetch --no-recurse-submodules origin "$TARGET_BRANCH" 2>/dev/null || true
+            fi
+            BASE=$(git merge-base origin/"$TARGET_BRANCH" HEAD 2>/dev/null) || BASE="HEAD"
+            files=$(git diff --name-only --diff-filter=ACM "$BASE"..HEAD 2>/dev/null | grep '^superset/.*\.py$' || true)
+            if [ -n "$files" ]; then
+              pylint --rcfile=.pylintrc --load-plugins=superset.extensions.pylint --reports=no $files
+            else
+              echo "No Python files to lint."
+            fi

.pylintrc

@@ -53,7 +53,7 @@ extension-pkg-whitelist=pyarrow
 
 [MESSAGES CONTROL]
 disable=all
-enable=disallowed-sql-import,consider-using-transaction
+enable=json-import,disallowed-sql-import,consider-using-transaction
 
 
 [REPORTS]

.rat-excludes

@@ -11,6 +11,7 @@
 .nvmrc
 .prettierrc
 .rat-excludes
+.swcrc
 .*log
 .*pyc
 .*lock
@@ -32,6 +33,8 @@ apache_superset.egg-info
 # json and csv in general cannot have comments
 .*json
 .*csv
+# jinja templates often need to be as-is
+.*j2
 # Generated doc files
 env/*
 docs/.htaccess*
@@ -80,6 +83,7 @@ intro_header.txt
 
 # for LLMs
 llm-context.md
+AGENTS.md
 LLMS.md
 CLAUDE.md
 CURSOR.md

AGENTS.md

@@ -68,7 +68,11 @@ superset/
 
 ### Apache License Headers
 - **New files require ASF license headers** - When creating new code files, include the standard Apache Software Foundation license header
-- **LLM instruction files are excluded** - Files like LLMS.md, CLAUDE.md, etc. are in `.rat-excludes` to avoid header token overhead
+- **LLM instruction files are excluded** - Files like AGENTS.md, CLAUDE.md, etc. are in `.rat-excludes` to avoid header token overhead
+
+### Code Comments
+- **Avoid time-specific language** - Don't use words like "now", "currently", "today" in code comments as they become outdated
+- **Write timeless comments** - Comments should remain accurate regardless of when they're read
 
 ## Documentation Requirements
 
@@ -149,6 +153,19 @@ curl -f http://localhost:8088/health || echo "❌ Setup required - see https://s
 - **Use negation operator**: `~Model.field` instead of `== False` to avoid ruff E712 errors
 - **Example**: `~Model.is_active` instead of `Model.is_active == False`
 
+## Pull Request Guidelines
+
+**When creating pull requests:**
+
+1. **Read the current PR template**: Always check `.github/PULL_REQUEST_TEMPLATE.md` for the latest format
+2. **Use the template sections**: Include all sections from the template (SUMMARY, BEFORE/AFTER, TESTING INSTRUCTIONS, ADDITIONAL INFORMATION)
+3. **Follow PR title conventions**: Use [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/)
+   - Format: `type(scope): description`
+   - Example: `fix(dashboard): load charts correctly`
+   - Types: `fix`, `feat`, `docs`, `style`, `refactor`, `perf`, `test`, `chore`
+
+**Important**: Always reference the actual template file at `.github/PULL_REQUEST_TEMPLATE.md` instead of using cached content, as the template may be updated over time.
+
 ## Pre-commit Validation
 
 **Use pre-commit hooks for quality validation:**

CHANGELOG.md

@@ -47,5 +47,5 @@ under the License.
 - [4.1.1](./CHANGELOG/4.1.1.md)
 - [4.1.2](./CHANGELOG/4.1.2.md)
 - [4.1.3](./CHANGELOG/4.1.3.md)
+- [4.1.4](./CHANGELOG/4.1.4.md)
 - [5.0.0](./CHANGELOG/5.0.0.md)
-- [6.0.0](./CHANGELOG/6.0.0.md)

CHANGELOG/4.1.4.md

@@ -16,6 +16,18 @@ KIND, either express or implied.  See the License for the
 specific language governing permissions and limitations
 under the License.
 -->
-<svg width="24" height="24" viewBox="5 4 15 20" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M19.8568 4.28897H4.14254C3.66843 4.28897 3.28540 4.67201 3.28540 5.14611V19.8604C3.28540 20.3345 3.66843 20.7175 4.14254 20.7175H19.8568C20.3309 20.7175 20.7139 20.3345 20.7139 19.8604V5.14611C20.7139 4.67201 20.3309 4.28897 19.8568 4.28897ZM5.21397 6.21754H7.85683V18.7889H5.21397V6.21754ZM18.7854 18.7889H8.85683V10.5746H18.7854V18.7889ZM8.85683 9.5746V6.21754H18.7854V9.5746H8.85683Z" fill="currentColor" />
-</svg>
+
+## Change Log
+
+### 4.1.4 (Thu Jul 24 08:30:04 2025 -0300)
+
+**Database Migrations**
+
+**Features**
+
+**Fixes**
+- [#34289](https://github.com/apache/superset/pull/34289) fix: Saved queries list break if one query can't be parsed (@michael-s-molina)
+- [#33059](https://github.com/apache/superset/pull/33059) fix: Adds missing __init__ file to commands/logs (@michael-s-molina)
+
+**Others**
+- [#32236](https://github.com/apache/superset/pull/32236) chore(deps): bump cryptography from 43.0.3 to 44.0.1 (@dependabot[bot])

CLAUDE.md

@@ -1 +1 @@
-LLMS.md
+AGENTS.md

CONTRIBUTING.md

@@ -5,7 +5,7 @@
  regarding copyright ownership.  The ASF licenses this file
  to you under the Apache License, Version 2.0 (the
  "License"); you may not use this file except in compliance
- with the License. You may obtain a copy of the License at
+ with the License.  You may obtain a copy of the License at
 
    http://www.apache.org/licenses/LICENSE-2.0
 
@@ -16,9 +16,23 @@
  specific language governing permissions and limitations
  under the License.
 -->
+# Contributing to Apache Superset
+
 Contributions are welcome and are greatly appreciated! Every
 little bit helps, and credit will always be given.
 
-All matters related to contributions have moved to [this section of
-the official Superset documentation](https://superset.apache.org/docs/contributing/). Source for the documentation is
-[located here](https://github.com/apache/superset/tree/master/docs/docs).
+## Developer Portal
+
+All developer and contribution documentation has moved to the Apache Superset Developer Portal:
+
+**[📚 View the Developer Portal →](https://superset.apache.org/developer_portal/)**
+
+The Developer Portal includes comprehensive guides for:
+- [Contributing Overview](https://superset.apache.org/developer_portal/contributing/overview)
+- [Development Setup](https://superset.apache.org/developer_portal/contributing/development-setup)
+- [Submitting Pull Requests](https://superset.apache.org/developer_portal/contributing/submitting-pr)
+- [Contribution Guidelines](https://superset.apache.org/developer_portal/contributing/guidelines)
+- [Code Review Process](https://superset.apache.org/developer_portal/contributing/code-review)
+- [Development How-tos](https://superset.apache.org/developer_portal/contributing/howtos)
+
+Source for the Developer Portal documentation is [located here](https://github.com/apache/superset/tree/master/docs/developer_portal).

Dockerfile

@@ -18,7 +18,7 @@
 ######################################################################
 # Node stage to deal with static asset construction
 ######################################################################
-ARG PY_VER=3.11.13-slim-bookworm
+ARG PY_VER=3.11.14-slim-trixie
 
 # If BUILDPLATFORM is null, set it to 'amd64' (or leave as is otherwise).
 ARG BUILDPLATFORM=${BUILDPLATFORM:-amd64}
@@ -26,10 +26,13 @@ ARG BUILDPLATFORM=${BUILDPLATFORM:-amd64}
 # Include translations in the final build
 ARG BUILD_TRANSLATIONS="false"
 
+# Build arg to pre-populate examples DuckDB file
+ARG LOAD_EXAMPLES_DUCKDB="false"
+
 ######################################################################
 # superset-node-ci used as a base for building frontend assets and CI
 ######################################################################
-FROM --platform=${BUILDPLATFORM} node:20-bookworm-slim AS superset-node-ci
+FROM --platform=${BUILDPLATFORM} node:20-trixie-slim AS superset-node-ci
 ARG BUILD_TRANSLATIONS
 ENV BUILD_TRANSLATIONS=${BUILD_TRANSLATIONS}
 ARG DEV_MODE="false"           # Skip frontend build in dev mode
@@ -64,7 +67,7 @@ RUN --mount=type=bind,source=./superset-frontend/package.json,target=./package.j
     --mount=type=bind,source=./superset-frontend/package-lock.json,target=./package-lock.json \
     --mount=type=cache,target=/root/.cache \
     --mount=type=cache,target=/root/.npm \
-    if [ "$DEV_MODE" = "false" ]; then \
+    if [ "${DEV_MODE}" = "false" ]; then \
         npm ci; \
     else \
         echo "Skipping 'npm ci' in dev mode"; \
@@ -80,7 +83,7 @@ FROM superset-node-ci AS superset-node
 
 # Build the frontend if not in dev mode
 RUN --mount=type=cache,target=/root/.npm \
-    if [ "$DEV_MODE" = "false" ]; then \
+    if [ "${DEV_MODE}" = "false" ]; then \
         echo "Running 'npm run ${BUILD_CMD}'"; \
         npm run ${BUILD_CMD}; \
     else \
@@ -91,11 +94,10 @@ RUN --mount=type=cache,target=/root/.npm \
 COPY superset/translations /app/superset/translations
 
 # Build translations if enabled, then cleanup localization files
-RUN if [ "$BUILD_TRANSLATIONS" = "true" ]; then \
+RUN if [ "${BUILD_TRANSLATIONS}" = "true" ]; then \
         npm run build-translation; \
     fi; \
-    rm -rf /app/superset/translations/*/*/*.po; \
-    rm -rf /app/superset/translations/*/*/*.mo;
+    rm -rf /app/superset/translations/*/*/*.[po,mo];
 
 
 ######################################################################
@@ -106,15 +108,15 @@ FROM python:${PY_VER} AS python-base
 ARG SUPERSET_HOME="/app/superset_home"
 ENV SUPERSET_HOME=${SUPERSET_HOME}
 
-RUN mkdir -p $SUPERSET_HOME
+RUN mkdir -p ${SUPERSET_HOME}
 RUN useradd --user-group -d ${SUPERSET_HOME} -m --no-log-init --shell /bin/bash superset \
-    && chmod -R 1777 $SUPERSET_HOME \
-    && chown -R superset:superset $SUPERSET_HOME
+    && chmod -R 1777 ${SUPERSET_HOME} \
+    && chown -R superset:superset ${SUPERSET_HOME}
 
 # Some bash scripts needed throughout the layers
 COPY --chmod=755 docker/*.sh /app/docker/
 
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+RUN pip install --no-cache-dir --upgrade uv
 
 # Using uv as it's faster/simpler than pip
 RUN uv venv /app/.venv
@@ -134,17 +136,19 @@ RUN --mount=type=cache,target=/root/.cache/uv \
     . /app/.venv/bin/activate && /app/docker/pip-install.sh --requires-build-essential -r requirements/translations.txt
 
 COPY superset/translations/ /app/translations_mo/
-RUN if [ "$BUILD_TRANSLATIONS" = "true" ]; then \
+RUN if [ "${BUILD_TRANSLATIONS}" = "true" ]; then \
         pybabel compile -d /app/translations_mo | true; \
     fi; \
-    rm -f /app/translations_mo/*/*/*.po; \
-    rm -f /app/translations_mo/*/*/*.json;
+    rm -f /app/translations_mo/*/*/*.[po,json]
 
 ######################################################################
 # Python APP common layer
 ######################################################################
 FROM python-base AS python-common
 
+# Re-declare build arg to receive it in this stage
+ARG LOAD_EXAMPLES_DUCKDB
+
 ENV SUPERSET_HOME="/app/superset_home" \
     HOME="/app/superset_home" \
     SUPERSET_ENV="production" \
@@ -172,11 +176,11 @@ ENV PLAYWRIGHT_BROWSERS_PATH=/usr/local/share/playwright-browsers
 ARG INCLUDE_CHROMIUM="false"
 ARG INCLUDE_FIREFOX="false"
 RUN --mount=type=cache,target=${SUPERSET_HOME}/.cache/uv \
-    if [ "$INCLUDE_CHROMIUM" = "true" ] || [ "$INCLUDE_FIREFOX" = "true" ]; then \
+    if [ "${INCLUDE_CHROMIUM}" = "true" ] || [ "${INCLUDE_FIREFOX}" = "true" ]; then \
         uv pip install playwright && \
         playwright install-deps && \
-        if [ "$INCLUDE_CHROMIUM" = "true" ]; then playwright install chromium; fi && \
-        if [ "$INCLUDE_FIREFOX" = "true" ]; then playwright install firefox; fi; \
+        if [ "${INCLUDE_CHROMIUM}" = "true" ]; then playwright install chromium; fi && \
+        if [ "${INCLUDE_FIREFOX}" = "true" ]; then playwright install firefox; fi; \
     else \
         echo "Skipping browser installation"; \
     fi
@@ -198,6 +202,18 @@ RUN /app/docker/apt-install.sh \
       libecpg-dev \
       libldap2-dev
 
+# Pre-load examples DuckDB file if requested
+RUN if [ "$LOAD_EXAMPLES_DUCKDB" = "true" ]; then \
+        mkdir -p /app/data && \
+        echo "Downloading pre-built examples.duckdb..." && \
+        curl -L -o /app/data/examples.duckdb \
+            "https://raw.githubusercontent.com/apache-superset/examples-data/master/examples.duckdb" && \
+        chown -R superset:superset /app/data; \
+    else \
+        mkdir -p /app/data && \
+        chown -R superset:superset /app/data; \
+    fi
+
 # Copy compiled things from previous stages
 COPY --from=superset-node /app/superset/static/assets superset/static/assets
 
@@ -221,6 +237,10 @@ FROM python-common AS lean
 
 # Install Python dependencies using docker/pip-install.sh
 COPY requirements/base.txt requirements/
+
+# Copy superset-core package needed for editable install in base.txt
+COPY superset-core superset-core
+
 RUN --mount=type=cache,target=${SUPERSET_HOME}/.cache/uv \
     /app/docker/pip-install.sh --requires-build-essential -r requirements/base.txt
 # Install the superset package
@@ -243,6 +263,11 @@ RUN /app/docker/apt-install.sh \
 
 # Copy development requirements and install them
 COPY requirements/*.txt requirements/
+
+# Copy local packages needed for editable installs in development.txt
+COPY superset-core superset-core
+COPY superset-extensions-cli superset-extensions-cli
+
 # Install Python dependencies using docker/pip-install.sh
 RUN --mount=type=cache,target=${SUPERSET_HOME}/.cache/uv \
     /app/docker/pip-install.sh --requires-build-essential -r requirements/development.txt
@@ -260,6 +285,15 @@ USER superset
 ######################################################################
 FROM lean AS ci
 USER root
-RUN uv pip install .[postgres]
+RUN uv pip install .[postgres,duckdb]
+USER superset
+CMD ["/app/docker/entrypoints/docker-ci.sh"]
+
+######################################################################
+# Showtime image - lean + DuckDB for examples database
+######################################################################
+FROM lean AS showtime
+USER root
+RUN uv pip install .[duckdb]
 USER superset
 CMD ["/app/docker/entrypoints/docker-ci.sh"]

GEMINI.md

@@ -1 +1 @@
-LLMS.md
+AGENTS.md

GPT.md

@@ -1 +1 @@
-LLMS.md
+AGENTS.md

LINTING_ARCHITECTURE.md

@@ -0,0 +1,121 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# Superset Frontend Linting Architecture
+
+## Overview
+We use a hybrid linting approach combining OXC (fast, standard rules) with custom AST-based checks for Superset-specific patterns.
+
+## Components
+
+### 1. Primary Linter: OXC
+- **What**: Oxidation Compiler's linter (oxlint)
+- **Handles**: 95% of linting rules (standard ESLint rules, TypeScript, React, etc.)
+- **Speed**: ~50-100x faster than ESLint
+- **Config**: `oxlint.json`
+
+### 2. Custom Rule Checker
+- **What**: Node.js AST-based script
+- **Handles**: Superset-specific rules:
+  - No literal colors (use theme)
+  - No FontAwesome icons (use Icons component)
+  - No template vars in i18n
+- **Speed**: Fast enough for pre-commit
+- **Script**: `scripts/check-custom-rules.js`
+
+## Developer Workflow
+
+### Local Development
+```bash
+# Fast linting (OXC only)
+npm run lint
+
+# Full linting (OXC + custom rules)
+npm run lint:full
+
+# Auto-fix what's possible
+npm run lint-fix
+```
+
+### Pre-commit
+1. OXC runs first (via `scripts/oxlint.sh`)
+2. Custom rules check runs second (lightweight, AST-based)
+3. Both must pass for commit to succeed
+
+### CI Pipeline
+```yaml
+- name: Lint with OXC
+  run: npm run lint
+
+- name: Check custom rules
+  run: npm run check:custom-rules
+```
+
+## Why This Architecture?
+
+### ✅ Pros
+1. **No binary distribution issues** - ASF compatible
+2. **Fast performance** - OXC for bulk, lightweight script for custom
+3. **Maintainable** - Custom rules in JavaScript, not Rust
+4. **Flexible** - Can evolve as OXC adds plugin support
+5. **Cacheable** - Both OXC and Node.js are standard tools
+
+### ❌ Cons  
+1. **Two tools** - Slightly more complex than single linter
+2. **Duplicate parsing** - Files parsed twice (once by each tool)
+
+### 🔄 Migration Path
+When OXC supports JavaScript plugins:
+1. Convert `check-custom-rules.js` to OXC plugin format
+2. Consolidate back to single tool
+3. Keep same rules and developer experience
+
+## Implementation Checklist
+
+- [x] OXC for standard linting
+- [x] Pre-commit integration  
+- [ ] Custom rules script
+- [ ] Combine in npm scripts
+- [ ] Update CI pipeline
+- [ ] Developer documentation
+
+## Performance Targets
+
+| Operation | Target Time | Current |
+|-----------|------------|---------|
+| Pre-commit (changed files) | <2s | ✅ 1.5s |
+| Full lint (all files) | <10s | ✅ 8s |
+| Custom rules check | <5s | 🔄 TBD |
+
+## Caching Strategy
+
+### Local Development
+- OXC: Built-in incremental checking
+- Custom rules: Use file hash cache (similar to pytest cache)
+
+### CI
+- Cache `node_modules` (includes oxlint binary)
+- Cache custom rules results by commit hash
+- Skip unchanged files using git diff
+
+## Future Improvements
+
+1. **When OXC adds plugin support**: Migrate custom rules to OXC plugins
+2. **Consider Biome**: Another Rust-based linter with plugin support
+3. **AST sharing**: Investigate sharing AST between tools to avoid double parsing

Makefile

@@ -91,7 +91,7 @@ js-format:
 	cd superset-frontend; npm run prettier
 
 flask-app:
-	flask run -p 8088 --with-threads --reload --debugger
+	flask run -p 8088 --reload --debugger
 
 node-app:
 	cd superset-frontend; npm run dev-server

RELEASING/Dockerfile.from_local_tarball

@@ -14,7 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-FROM python:3.10-slim-bookworm
+FROM python:3.10-slim-trixie
 
 RUN useradd --user-group --create-home --no-log-init --shell /bin/bash superset
 

RELEASING/Dockerfile.from_svn_tarball

@@ -14,7 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-FROM python:3.10-slim-bookworm
+FROM python:3.10-slim-trixie
 
 RUN useradd --user-group --create-home --no-log-init --shell /bin/bash superset
 

RELEASING/Dockerfile.make_docs

@@ -14,7 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-FROM python:3.10-slim-bookworm
+FROM python:3.10-slim-trixie
 ARG VERSION
 
 RUN git clone --depth 1 --branch ${VERSION} https://github.com/apache/superset.git /superset

RELEASING/Dockerfile.make_tarball

@@ -14,7 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-FROM python:3.10-slim-bookworm
+FROM python:3.10-slim-trixie
 
 RUN apt-get update -y
 RUN apt-get install -y \

RELEASING/README.md

@@ -469,6 +469,10 @@ an account first if you don't have one, and reference your username
 while requesting access to push packages.
 
 ```bash
+# Run this first to make sure you are uploading the right version.
+# Pypi does not allow you to delete or retract once uplaoded.
+twine check dist/*
+
 twine upload dist/*
 ```
 
@@ -518,6 +522,8 @@ takes the version (ie `3.1.1`), the git reference (any SHA, tag or branch
 reference), and whether to force the `latest` Docker tag on the
 generated images.
 
+**NOTE:** If the docker image isn't built, you'll need to run this [GH action](https://github.com/apache/superset/actions/workflows/tag-release.yml) where you provide it the tag sha.
+
 ### Npm Release
 
 You might want to publish the latest @superset-ui release to npm

UPDATING.md

@@ -22,137 +22,8 @@ under the License.
 This file documents any backwards-incompatible changes in Superset and
 assists people when migrating to a new version.
 
-## 6.0.0
 ## Next
 
-### `thumbnail_url` removed from dashboard list API response
-
-The `thumbnail_url` field has been removed from `GET /api/v1/dashboard/` list responses. External consumers relying on this field must now construct the thumbnail URL client-side using `id` and `changed_on_utc`:
-
-```
-/api/v1/dashboard/{id}/thumbnail/{changed_on_utc}/
-```
-
-The thumbnail endpoint redirects to the current digest URL regardless of whether the supplied digest is exact. If the image is not yet cached, that digest URL may return `202` and trigger async generation. Using `changed_on_utc` as the digest is sufficient for cache-busting purposes.
-
-### Dataset import validates catalog against the target connection
-
-Importing a dataset now validates the `catalog` field against the target database connection. When the connection has multi-catalog disabled (`allow_multi_catalog` off) and the dataset's catalog is not the connection's default catalog, the import fails instead of silently persisting the non-default catalog. This matches the validation already enforced on the dataset update path and prevents imported datasets from querying an unintended database.
-
-If you relied on importing datasets with a non-default catalog, enable "Allow changing catalogs" on the target connection, or set the dataset's catalog to the connection's default before importing.
-
-### Dynamic Group By respects the sort toggle for display values
-
-The Dynamic Group By chart customization now orders its display values according to the "Sort display control values" toggle: ascending (A–Z), descending (Z–A), or the dataset's source order when the toggle is unset. Previously the dropdown always sorted alphabetically. Existing dashboards where the toggle was never set will show options in source order instead of A–Z; open the customization and enable the toggle to restore alphabetical ordering.
-
-### MCP Tool Observability
-
-MCP (Model Context Protocol) tools now include enhanced observability instrumentation for monitoring and debugging:
-
-**Two-layer instrumentation:**
-1. **Middleware layer** (`LoggingMiddleware`): Automatically logs all MCP tool calls with `duration_ms` and `success` status in the audit log (Action Log UI, logs table)
-2. **Sub-operation tracking**: All 19 MCP tools include granular `event_logger.log_context()` blocks for tracking individual operations like validation, database writes, and query execution
-
-**Action naming convention:**
-- Tool-level logs: `mcp_tool_call` (via middleware)
-- Sub-operation logs: `mcp.{tool_name}.{operation}` (e.g., `mcp.generate_chart.validation`, `mcp.execute_sql.query_execution`)
-
-**Querying MCP logs:**
-```sql
--- Top slowest MCP operations
-SELECT action, COUNT(*) as calls, AVG(duration_ms) as avg_ms
-FROM logs
-WHERE action LIKE 'mcp.%'
-GROUP BY action
-ORDER BY avg_ms DESC
-LIMIT 20;
-
--- MCP tool success rate
-SELECT
-    json_extract(curated_payload, '$.tool') as tool,
-    COUNT(*) as total_calls,
-    SUM(CASE WHEN json_extract(curated_payload, '$.success') = 'true' THEN 1 ELSE 0 END) as successful,
-    ROUND(100.0 * SUM(CASE WHEN json_extract(curated_payload, '$.success') = 'true' THEN 1 ELSE 0 END) / COUNT(*), 2) as success_rate
-FROM logs
-WHERE action = 'mcp_tool_call'
-GROUP BY tool
-ORDER BY total_calls DESC;
-```
-
-**Security note:** Sensitive parameters (passwords, API keys, tokens) are automatically redacted in logs as `[REDACTED]`.
-
-### Signal Cache Backend
-
-A new `SIGNAL_CACHE_CONFIG` configuration provides a unified Redis-based backend for real-time coordination features in Superset. This backend enables:
-
-- **Pub/sub messaging** for real-time event notifications between workers
-- **Atomic distributed locking** using Redis SET NX EX (more performant than database-backed locks)
-- **Event-based coordination** for background task management
-
-The signal cache is used by the Global Task Framework (GTF) for abort notifications and task completion signaling, and will eventually replace `GLOBAL_ASYNC_QUERIES_CACHE_BACKEND` as the standard signaling backend. Configuring this is recommended for Redis enabled production deployments.
-
-Example configuration in `superset_config.py`:
-```python
-SIGNAL_CACHE_CONFIG = {
-    "CACHE_TYPE": "RedisCache",
-    "CACHE_KEY_PREFIX": "signal_",
-    "CACHE_REDIS_URL": "redis://localhost:6379/1",
-    "CACHE_DEFAULT_TIMEOUT": 300,
-}
-```
-
-See `superset/config.py` for complete configuration options.
-
-### WebSocket config for GAQ with Docker
-
-[35896](https://github.com/apache/superset/pull/35896) and [37624](https://github.com/apache/superset/pull/37624) updated documentation on how to run and configure Superset with Docker. Specifically for the WebSocket configuration, a new `docker/superset-websocket/config.example.json` was added to the repo, so that users could copy it to create a `docker/superset-websocket/config.json` file. The existing `docker/superset-websocket/config.json` was removed and git-ignored, so if you're using GAQ / WebSocket make sure to:
-- Stash/backup your existing `config.json` file, to re-apply it after (will get git-ignored going forward)
-- Update the `volumes` configuration for the `superset-websocket` service in your `docker-compose.override.yml` file, to include the `docker/superset-websocket/config.json` file. For example:
-``` yaml
-services:
-  superset-websocket:
-    volumes:
-      - ./superset-websocket:/home/superset-websocket
-      - /home/superset-websocket/node_modules
-      - /home/superset-websocket/dist
-      - ./docker/superset-websocket/config.json:/home/superset-websocket/config.json:ro
-```
-
-### Example Data Loading Improvements
-
-#### New Directory Structure
-Examples are now organized by name with data and configs co-located:
-```
-superset/examples/
-├── _shared/              # Shared database & metadata configs
-├── birth_names/          # Each example is self-contained
-│   ├── data.parquet     # Dataset (Parquet format)
-│   ├── dataset.yaml     # Dataset metadata
-│   ├── dashboard.yaml   # Dashboard config (optional)
-│   └── charts/          # Chart configs (optional)
-└── ...
-```
-
-#### Simplified Parquet-based Loading
-- Auto-discovery: create `superset/examples/my_dataset/data.parquet` to add a new example
-- Parquet is an Apache project format: compressed (~27% smaller), self-describing schema
-- YAML configs define datasets, charts, and dashboards declaratively
-- Removed Python-based data generation from individual example files
-
-#### Test Data Reorganization
-- Moved `big_data.py` to `superset/cli/test_loaders.py` - better reflects its purpose as a test utility
-- Fixed inverted logic for `--load-test-data` flag (now correctly includes .test.yaml files when flag is set)
-- Clarified CLI flags:
-  - `--force` / `-f`: Force reload even if tables exist
-  - `--only-metadata` / `-m`: Create table metadata without loading data
-  - `--load-test-data` / `-t`: Include test dashboards and .test.yaml configs
-  - `--load-big-data` / `-b`: Generate synthetic stress-test data
-
-#### Bug Fixes
-- Fixed numpy array serialization for PostgreSQL (converts complex types to JSON strings)
-- Fixed KeyError for `allow_csv_upload` field in database configs (now optional with default)
-- Fixed test data loading logic that was incorrectly filtering files
-
 ### MCP Service
 
 The MCP (Model Context Protocol) service enables AI assistants and automation tools to interact programmatically with Superset.
@@ -253,7 +124,6 @@ See `superset/mcp_service/PRODUCTION.md` for deployment guides.
 
 ---
 
-- [35621](https://github.com/apache/superset/pull/35621): The default hash algorithm has changed from MD5 to SHA-256 for improved security and FedRAMP compliance. This affects cache keys for thumbnails, dashboard digests, chart digests, and filter option names. Existing cached data will be invalidated upon upgrade. To opt out of this change and maintain backward compatibility, set `HASH_ALGORITHM = "md5"` in your `superset_config.py`.
 - [33055](https://github.com/apache/superset/pull/33055): Upgrades Flask-AppBuilder to 5.0.0. The AUTH_OID authentication type has been deprecated and is no longer available as an option in Flask-AppBuilder. OpenID (OID) is considered a deprecated authentication protocol - if you are using AUTH_OID, you will need to migrate to an alternative authentication method such as OAuth, LDAP, or database authentication before upgrading.
 - [35062](https://github.com/apache/superset/pull/35062): Changed the function signature of `setupExtensions` to `setupCodeOverrides` with options as arguments.
 - [34871](https://github.com/apache/superset/pull/34871): Fixed Jest test hanging issue from Ant Design v5 upgrade. MessageChannel is now mocked in test environment to prevent rc-overflow from causing Jest to hang. Test environment only - no production impact.
@@ -272,63 +142,10 @@ Note: Pillow is now a required dependency (previously optional) to support image
 - [33116](https://github.com/apache/superset/pull/33116) In Echarts Series charts (e.g. Line, Area, Bar, etc.) charts, the `x_axis_sort_series` and `x_axis_sort_series_ascending` form data items have been renamed with `x_axis_sort` and `x_axis_sort_asc`.
   There's a migration added that can potentially affect a significant number of existing charts.
 - [32317](https://github.com/apache/superset/pull/32317) The horizontal filter bar feature is now out of testing/beta development and its feature flag `HORIZONTAL_FILTER_BAR` has been removed.
-- [31590](https://github.com/apache/superset/pull/31590) Marks the begining of intricate work around supporting dynamic Theming, and breaks support for [THEME_OVERRIDES](https://github.com/apache/superset/blob/732de4ac7fae88e29b7f123b6cbb2d7cd411b0e4/superset/config.py#L671) in favor of a new theming system based on AntD V5. Likely this will be in disrepair until settling over the 5.x lifecycle.
+- [31590](https://github.com/apache/superset/pull/31590) Marks the beginning of intricate work around supporting dynamic Theming, and breaks support for [THEME_OVERRIDES](https://github.com/apache/superset/blob/732de4ac7fae88e29b7f123b6cbb2d7cd411b0e4/superset/config.py#L671) in favor of a new theming system based on AntD V5. Likely this will be in disrepair until settling over the 5.x lifecycle.
 - [32432](https://github.com/apache/superset/pull/31260) Moves the List Roles FAB view to the frontend and requires `FAB_ADD_SECURITY_API` to be enabled in the configuration and `superset init` to be executed.
 - [34319](https://github.com/apache/superset/pull/34319) Drill to Detail and Drill By is now supported in Embedded mode, and also with the `DASHBOARD_RBAC` FF. If you don't want to expose these features in Embedded / `DASHBOARD_RBAC`, make sure the roles used for Embedded / `DASHBOARD_RBAC`don't have the required permissions to perform D2D actions.
 
-### Breaking Changes
-
-#### APP_NAME no longer controls frontend branding
-
-The `APP_NAME` configuration variable no longer controls the browser window/tab title or other frontend branding. Application names should now be configured using the theme system with the `brandAppName` token. The `APP_NAME` config is still used for backend contexts (MCP service, logs, etc.) and serves as a fallback if `brandAppName` is not set.
-
-**Before (5.x):**
-```python
-APP_NAME = "My Custom App"
-```
-
-**After (6.0):**
-```python
-# Option 1: Use theme system (recommended)
-THEME_DEFAULT = {
-    "token": {
-        "brandAppName": "My Custom App",  # Window titles
-        "brandLogoAlt": "My Custom App",  # Logo alt text
-        "brandLogoUrl": "/static/assets/images/custom_logo.png"
-    }
-}
-
-# Option 2: Temporary fallback
-# Keep APP_NAME for now (will be used as fallback for brandAppName)
-APP_NAME = "My Custom App"
-# But you should migrate to THEME_DEFAULT.token.brandAppName
-```
-
-**Note:** For dark mode, set the same tokens in `THEME_DARK` configuration.
-
-#### CUSTOM_FONT_URLS removed
-
-The `CUSTOM_FONT_URLS` configuration option has been removed. Use the new per-theme `fontUrls` token in `THEME_DEFAULT` or database-managed themes instead.
-
-**Before (5.x):**
-```python
-CUSTOM_FONT_URLS = [
-    "https://fonts.example.com/myfont.css",
-]
-```
-
-**After (6.0):**
-```python
-THEME_DEFAULT = {
-    "token": {
-        "fontUrls": [
-            "https://fonts.example.com/myfont.css",
-        ],
-        # ... other tokens
-    }
-}
-```
-
 ## 5.0.0
 
 - [31976](https://github.com/apache/superset/pull/31976) Removed the `DISABLE_LEGACY_DATASOURCE_EDITOR` feature flag. The previous value of the feature flag was `True` and now the feature is permanently removed.

docker-compose-image-tag.yml

@@ -28,6 +28,7 @@ x-superset-image: &superset-image apachesuperset.docker.scarf.sh/apache/superset
 x-superset-volumes:
   &superset-volumes # /app/pythonpath_docker will be appended to the PYTHONPATH in the final container
   - ./docker:/app/docker
+  - ./superset-core:/app/superset-core
   - superset_home:/app/superset_home
 
 services:

docker-compose-light.yml

@@ -67,16 +67,18 @@ x-superset-volumes: &superset-volumes
   - ./superset-frontend:/app/superset-frontend
   - superset_home_light:/app/superset_home
   - ./tests:/app/tests
+  - ./extensions:/app/extensions
 x-common-build: &common-build
   context: .
   target: ${SUPERSET_BUILD_TARGET:-dev} # can use `dev` (default) or `lean`
   cache_from:
-    - apache/superset-cache:3.10-slim-bookworm
+    - apache/superset-cache:3.10-slim-trixie
   args:
     DEV_MODE: "true"
     INCLUDE_CHROMIUM: ${INCLUDE_CHROMIUM:-false}
     INCLUDE_FIREFOX: ${INCLUDE_FIREFOX:-false}
     BUILD_TRANSLATIONS: ${BUILD_TRANSLATIONS:-false}
+    LOAD_EXAMPLES_DUCKDB: ${LOAD_EXAMPLES_DUCKDB:-true}
 
 services:
   db-light:
@@ -91,9 +93,7 @@ services:
       - db_home_light:/var/lib/postgresql/data
       - ./docker/docker-entrypoint-initdb.d:/docker-entrypoint-initdb.d
     environment:
-      # Override database name to avoid conflicts
       POSTGRES_DB: superset_light
-    # Increase max connections for test runs
     command: postgres -c max_connections=200
 
   superset-light:
@@ -106,7 +106,6 @@ services:
       <<: *common-build
     command: ["/app/docker/docker-bootstrap.sh", "app"]
     restart: unless-stopped
-    # No host port mapping - accessed via webpack dev server proxy
     extra_hosts:
       - "host.docker.internal:host-gateway"
     user: *superset-user
@@ -115,15 +114,10 @@ services:
         condition: service_completed_successfully
     volumes: *superset-volumes
     environment:
-      # Override DB connection for light service
       DATABASE_HOST: db-light
       DATABASE_DB: superset_light
       POSTGRES_DB: superset_light
-      EXAMPLES_HOST: db-light
-      EXAMPLES_DB: superset_light
-      EXAMPLES_USER: superset
-      EXAMPLES_PASSWORD: superset
-      # Use light-specific config that disables Redis
+      SUPERSET__SQLALCHEMY_EXAMPLES_URI: "duckdb:////app/data/examples.duckdb"
       SUPERSET_CONFIG_PATH: /app/docker/pythonpath_dev/superset_config_docker_light.py
       GITHUB_HEAD_REF: ${GITHUB_HEAD_REF:-}
       GITHUB_SHA: ${GITHUB_SHA:-}
@@ -137,21 +131,16 @@ services:
         required: true
       - path: docker/.env-local # optional override
         required: false
+    user: *superset-user
     depends_on:
       db-light:
         condition: service_started
-    user: *superset-user
     volumes: *superset-volumes
     environment:
-      # Override DB connection for light service
       DATABASE_HOST: db-light
       DATABASE_DB: superset_light
       POSTGRES_DB: superset_light
-      EXAMPLES_HOST: db-light
-      EXAMPLES_DB: superset_light
-      EXAMPLES_USER: superset
-      EXAMPLES_PASSWORD: superset
-      # Use light-specific config that disables Redis
+      SUPERSET__SQLALCHEMY_EXAMPLES_URI: "duckdb:////app/data/examples.duckdb"
       SUPERSET_CONFIG_PATH: /app/docker/pythonpath_dev/superset_config_docker_light.py
     healthcheck:
       disable: true
@@ -174,8 +163,11 @@ services:
       SCARF_ANALYTICS: "${SCARF_ANALYTICS:-}"
       # configuring the dev-server to use the host.docker.internal to connect to the backend
       superset: "http://superset-light:8088"
+      # Webpack dev server configuration
+      WEBPACK_DEVSERVER_HOST: "${WEBPACK_DEVSERVER_HOST:-127.0.0.1}"
+      WEBPACK_DEVSERVER_PORT: "${WEBPACK_DEVSERVER_PORT:-9000}"
     ports:
-      - "127.0.0.1:${NODE_PORT:-9001}:9000"  # Parameterized port
+      - "${NODE_PORT:-9001}:9000"  # Parameterized port, accessible on all interfaces
     command: ["/app/docker/docker-frontend.sh"]
     env_file:
       - path: docker/.env # default
@@ -201,15 +193,12 @@ services:
     user: *superset-user
     volumes: *superset-volumes
     environment:
-      # Test-specific database configuration
       DATABASE_HOST: db-light
       DATABASE_DB: test
       POSTGRES_DB: test
-      # Point to test database
       SUPERSET__SQLALCHEMY_DATABASE_URI: postgresql+psycopg2://superset:superset@db-light:5432/test
-      # Use the light test config that doesn't require Redis
+      SUPERSET__SQLALCHEMY_EXAMPLES_URI: "duckdb:////app/data/examples.duckdb"
       SUPERSET_CONFIG: superset_test_config_light
-      # Python path includes test directory
       PYTHONPATH: /app/pythonpath:/app/docker/pythonpath_dev:/app
 
 volumes:

docker-compose-non-dev.yml

@@ -33,7 +33,7 @@ x-common-build: &common-build
   context: .
   target: dev
   cache_from:
-    - apache/superset-cache:3.10-slim-bookworm
+    - apache/superset-cache:3.10-slim-trixie
 
 services:
   redis:

docker-compose.yml

@@ -29,19 +29,22 @@ x-superset-volumes: &superset-volumes
   # /app/pythonpath_docker will be appended to the PYTHONPATH in the final container
   - ./docker:/app/docker
   - ./superset:/app/superset
+  - ./superset-core:/app/superset-core
   - ./superset-frontend:/app/superset-frontend
   - superset_home:/app/superset_home
   - ./tests:/app/tests
+  - superset_data:/app/data
 x-common-build: &common-build
   context: .
   target: ${SUPERSET_BUILD_TARGET:-dev} # can use `dev` (default) or `lean`
   cache_from:
-    - apache/superset-cache:3.10-slim-bookworm
+    - apache/superset-cache:3.10-slim-trixie
   args:
     DEV_MODE: "true"
     INCLUDE_CHROMIUM: ${INCLUDE_CHROMIUM:-false}
     INCLUDE_FIREFOX: ${INCLUDE_FIREFOX:-false}
     BUILD_TRANSLATIONS: ${BUILD_TRANSLATIONS:-false}
+    LOAD_EXAMPLES_DUCKDB: ${LOAD_EXAMPLES_DUCKDB:-true}
 
 services:
   nginx:
@@ -107,6 +110,8 @@ services:
       superset-init:
         condition: service_completed_successfully
     volumes: *superset-volumes
+    environment:
+      SUPERSET__SQLALCHEMY_EXAMPLES_URI: "duckdb:////app/data/examples.duckdb"
 
   superset-websocket:
     container_name: superset_websocket
@@ -158,6 +163,8 @@ services:
         condition: service_started
     user: *superset-user
     volumes: *superset-volumes
+    environment:
+      SUPERSET__SQLALCHEMY_EXAMPLES_URI: "duckdb:////app/data/examples.duckdb"
     healthcheck:
       disable: true
 
@@ -269,3 +276,5 @@ volumes:
     external: false
   redis:
     external: false
+  superset_data:
+    external: false

docker/apt-install.sh

@@ -18,7 +18,7 @@
 set -euo pipefail
 
 # Ensure this script is run as root
-if [[ $EUID -ne 0 ]]; then
+if [[ ${EUID} -ne 0 ]]; then
   echo "This script must be run as root" >&2
   exit 1
 fi
@@ -42,7 +42,7 @@ echo -e "${GREEN}Installing packages: $@${RESET}"
 apt-get install -yqq --no-install-recommends "$@"
 
 echo -e "${GREEN}Autoremoving unnecessary packages...${RESET}"
-apt-get autoremove -y
+apt-get autoremove -yqq --purge
 
 echo -e "${GREEN}Cleaning up package cache and metadata...${RESET}"
 apt-get clean

docker/docker-bootstrap.sh

@@ -21,8 +21,15 @@ set -eo pipefail
 # Make python interactive
 if [ "$DEV_MODE" == "true" ]; then
     if [ "$(whoami)" = "root" ] && command -v uv > /dev/null 2>&1; then
-      echo "Reinstalling the app in editable mode"
-      uv pip install -e .
+      # Always ensure superset-core is available
+      echo "Installing superset-core in editable mode"
+      uv pip install --no-deps -e /app/superset-core
+
+      # Only reinstall the main app for non-worker processes
+      if [ "$1" != "worker" ] && [ "$1" != "beat" ]; then
+        echo "Reinstalling the app in editable mode"
+        uv pip install -e .
+      fi
     fi
 fi
 REQUIREMENTS_LOCAL="/app/docker/requirements-local.txt"
@@ -34,7 +41,8 @@ if [ "$CYPRESS_CONFIG" == "true" ]; then
     export SUPERSET__SQLALCHEMY_DATABASE_URI=postgresql+psycopg2://superset:superset@db:5432/superset_cypress
     PORT=8081
 fi
-if [[ "$DATABASE_DIALECT" == postgres* ]] && [ "$(whoami)" = "root" ]; then
+# Skip postgres requirements installation for workers to avoid conflicts
+if [[ "$DATABASE_DIALECT" == postgres* ]] && [ "$(whoami)" = "root" ] && [ "$1" != "worker" ] && [ "$1" != "beat" ]; then
     # older images may not have the postgres dev requirements installed
     echo "Installing postgres requirements"
     if command -v uv > /dev/null 2>&1; then
@@ -72,7 +80,7 @@ case "${1}" in
     ;;
   app)
     echo "Starting web app (using development server)..."
-    flask run -p $PORT --with-threads --reload --debugger --host=0.0.0.0
+    flask run -p $PORT --reload --debugger --without-threads --host=0.0.0.0 --exclude-patterns "*/node_modules/*:*/.venv/*:*/build/*:*/__pycache__/*"
     ;;
   app-gunicorn)
     echo "Starting web app..."

docker/docker-init.sh

@@ -69,6 +69,8 @@ echo_step "3" "Complete" "Setting up roles and perms"
 if [ "$SUPERSET_LOAD_EXAMPLES" = "yes" ]; then
     # Load some data to play with
     echo_step "4" "Starting" "Loading examples"
+
+
     # If Cypress run which consumes superset_test_config – load required data for tests
     if [ "$CYPRESS_CONFIG" == "true" ]; then
         superset load_examples --load-test-data

docker/pip-install.sh

@@ -38,14 +38,14 @@ for arg in "$@"; do
 done
 
 # Install build-essential if required
-if $REQUIRES_BUILD_ESSENTIAL; then
+if ${REQUIRES_BUILD_ESSENTIAL}; then
   echo "Installing build-essential for package builds..."
   apt-get update -qq \
     && apt-get install -yqq --no-install-recommends build-essential
 fi
 
 # Choose whether to use pip cache
-if $USE_CACHE; then
+if ${USE_CACHE}; then
   echo "Using pip cache..."
   uv pip install "${ARGS[@]}"
 else
@@ -54,7 +54,7 @@ else
 fi
 
 # Remove build-essential if it was installed
-if $REQUIRES_BUILD_ESSENTIAL; then
+if ${REQUIRES_BUILD_ESSENTIAL}; then
   echo "Removing build-essential to keep the image lean..."
   apt-get autoremove -yqq --purge build-essential \
     && apt-get clean \

docker/pythonpath_dev/superset_config.py

@@ -49,12 +49,18 @@ SQLALCHEMY_DATABASE_URI = (
     f"{DATABASE_HOST}:{DATABASE_PORT}/{DATABASE_DB}"
 )
 
-SQLALCHEMY_EXAMPLES_URI = (
-    f"{DATABASE_DIALECT}://"
-    f"{EXAMPLES_USER}:{EXAMPLES_PASSWORD}@"
-    f"{EXAMPLES_HOST}:{EXAMPLES_PORT}/{EXAMPLES_DB}"
+# Use environment variable if set, otherwise construct from components
+# This MUST take precedence over any other configuration
+SQLALCHEMY_EXAMPLES_URI = os.getenv(
+    "SUPERSET__SQLALCHEMY_EXAMPLES_URI",
+    (
+        f"{DATABASE_DIALECT}://"
+        f"{EXAMPLES_USER}:{EXAMPLES_PASSWORD}@"
+        f"{EXAMPLES_HOST}:{EXAMPLES_PORT}/{EXAMPLES_DB}"
+    ),
 )
 
+
 REDIS_HOST = os.getenv("REDIS_HOST", "redis")
 REDIS_PORT = os.getenv("REDIS_PORT", "6379")
 REDIS_CELERY_DB = os.getenv("REDIS_CELERY_DB", "0")
@@ -99,7 +105,15 @@ class CeleryConfig:
 
 CELERY_CONFIG = CeleryConfig
 
-FEATURE_FLAGS = {"ALERT_REPORTS": True, "DATASET_FOLDERS": True}
+# Extensions configuration
+# For local development, point to the extensions directory
+# Note: If running in Docker, this path needs to be accessible from inside the container
+EXTENSIONS_PATH = os.getenv("EXTENSIONS_PATH", "/app/extensions")
+
+FEATURE_FLAGS = {
+    "ALERT_REPORTS": True,
+    "ENABLE_EXTENSIONS": True,
+}
 ALERT_REPORTS_NOTIFICATION_DRY_RUN = True
 WEBDRIVER_BASEURL = f"http://superset_app{os.environ.get('SUPERSET_APP_ROOT', '/')}/"  # When using docker compose baseurl should be http://superset_nginx{ENV{BASEPATH}}/  # noqa: E501
 # The base URL for the email report hyperlinks.
@@ -132,7 +146,7 @@ try:
     from superset_config_docker import *  # noqa: F403
 
     logger.info(
-        f"Loaded your Docker configuration at [{superset_config_docker.__file__}]"
+        "Loaded your Docker configuration at [%s]", superset_config_docker.__file__
     )
 except ImportError:
     logger.info("Using default Docker config...")

docs/DOCS_CLAUDE.md

@@ -0,0 +1,642 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# LLM Context Guide for Apache Superset Documentation
+
+This guide helps LLMs work with the Apache Superset documentation site built with Docusaurus 3.
+
+## 📍 Current Directory Context
+
+You are currently in the `/docs` subdirectory of the Apache Superset repository. When referencing files from the main codebase, use `../` to access the parent directory.
+
+```
+/Users/evan_1/GitHub/superset/     # Main repository root
+├── superset/                      # Python backend code
+├── superset-frontend/             # React/TypeScript frontend
+└── docs/                         # Documentation site (YOU ARE HERE)
+    ├── docs/                     # Main documentation content
+    ├── developer_portal/         # Developer guides (currently disabled)
+    ├── components/               # Component playground (currently disabled)
+    └── docusaurus.config.ts      # Site configuration
+```
+
+## 🚀 Quick Commands
+
+```bash
+# Development
+yarn start                 # Start dev server on http://localhost:3000
+yarn stop                 # Stop running dev server
+yarn build                # Build production site
+yarn serve                # Serve built site locally
+
+# Version Management (USE THESE, NOT docusaurus commands)
+yarn version:add:docs <version>              # Add new docs version
+yarn version:add:developer_portal <version>  # Add developer portal version  
+yarn version:add:components <version>        # Add components version
+yarn version:remove:docs <version>           # Remove docs version
+yarn version:remove:developer_portal <version> # Remove developer portal version
+yarn version:remove:components <version>      # Remove components version
+
+# Quality Checks
+yarn typecheck            # TypeScript validation
+yarn eslint              # Lint TypeScript/JavaScript files
+```
+
+## 📁 Documentation Structure
+
+### Main Documentation (`/docs`)
+The primary documentation lives in `/docs` with this structure:
+
+```
+docs/
+├── intro.md                # Auto-generated from ../README.md
+├── quickstart.mdx          # Getting started guide
+├── api.mdx                 # API reference with Swagger UI
+├── faq.mdx                 # Frequently asked questions
+├── installation/           # Installation guides
+│   ├── installation-methods.mdx
+│   ├── docker-compose.mdx
+│   ├── docker-builds.mdx
+│   ├── kubernetes.mdx
+│   ├── pypi.mdx
+│   └── architecture.mdx
+├── configuration/          # Configuration guides
+│   ├── configuring-superset.mdx
+│   ├── alerts-reports.mdx
+│   ├── caching.mdx
+│   ├── databases.mdx
+│   └── [more config docs]
+├── using-superset/         # User guides
+│   ├── creating-your-first-dashboard.md
+│   ├── exploring-data.mdx
+│   └── [more user docs]
+├── contributing/           # Contributor guides
+│   ├── development.mdx
+│   ├── testing-locally.mdx
+│   └── [more contributor docs]
+└── security/              # Security documentation
+    ├── security.mdx
+    └── [security guides]
+```
+
+### Developer Portal (`/developer_portal`) - Currently Disabled
+When enabled, contains developer-focused content:
+- API documentation
+- Architecture guides
+- CLI tools
+- Code examples
+
+### Component Playground (`/components`) - Currently Disabled
+When enabled, provides interactive component examples for UI development.
+
+## 📝 Documentation Standards
+
+### File Types
+- **`.md` files**: Basic Markdown documents
+- **`.mdx` files**: Markdown with JSX - can include React components
+- **`.tsx` files in `/src`**: Custom React components and pages
+
+### Frontmatter Structure
+Every documentation page should have frontmatter:
+
+```yaml
+---
+title: Page Title
+description: Brief description for SEO
+sidebar_position: 1  # Optional: controls order in sidebar
+---
+```
+
+### MDX Component Usage
+MDX files can import and use React components:
+
+```mdx
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+<Tabs>
+  <TabItem value="npm" label="npm" default>
+    ```bash
+    npm install superset
+    ```
+  </TabItem>
+  <TabItem value="yarn" label="yarn">
+    ```bash
+    yarn add superset
+    ```
+  </TabItem>
+</Tabs>
+```
+
+### Code Blocks
+Use triple backticks with language identifiers:
+
+````markdown
+```python
+def hello_world():
+    print("Hello, Superset!")
+```
+
+```sql title="Example Query"
+SELECT * FROM users WHERE active = true;
+```
+
+```bash
+# Installation command
+pip install apache-superset
+```
+````
+
+### Admonitions
+Docusaurus supports various admonition types:
+
+```markdown
+:::note
+This is a note
+:::
+
+:::tip
+This is a tip
+:::
+
+:::warning
+This is a warning
+:::
+
+:::danger
+This is a danger warning
+:::
+
+:::info
+This is an info box
+:::
+```
+
+## 🔄 Version Management
+
+### Version Configuration
+Versions are managed through `versions-config.json`:
+
+```json
+{
+  "docs": {
+    "disabled": false,
+    "lastVersion": "6.0.0",        // Default version shown
+    "includeCurrentVersion": true,  // Show "Next" version
+    "onlyIncludeVersions": ["current", "6.0.0"],
+    "versions": {
+      "current": {
+        "label": "Next",
+        "path": "",
+        "banner": "unreleased"     // Shows warning banner
+      },
+      "6.0.0": {
+        "label": "6.0.0",
+        "path": "6.0.0",
+        "banner": "none"
+      }
+    }
+  }
+}
+```
+
+### Creating New Versions
+**IMPORTANT**: Always use the custom scripts, NOT native Docusaurus commands:
+
+```bash
+# ✅ CORRECT - Updates both Docusaurus and versions-config.json
+yarn version:add:docs 6.1.0
+
+# ❌ WRONG - Only updates Docusaurus, breaks version dropdown
+yarn docusaurus docs:version 6.1.0
+```
+
+### Version Files Created
+When versioning, these files are created:
+- `versioned_docs/version-X.X.X/` - Snapshot of current docs
+- `versioned_sidebars/version-X.X.X-sidebars.json` - Sidebar config
+- `versions.json` - List of all versions
+
+## 🎨 Styling and Theming
+
+### Custom CSS
+Add custom styles in `/src/css/custom.css`:
+
+```css
+:root {
+  --ifm-color-primary: #20a7c9;
+  --ifm-code-font-size: 95%;
+}
+```
+
+### Custom Components
+Create React components in `/src/components/`:
+
+```tsx
+// src/components/FeatureCard.tsx
+import React from 'react';
+
+export default function FeatureCard({title, description}) {
+  return (
+    <div className="card">
+      <h3>{title}</h3>
+      <p>{description}</p>
+    </div>
+  );
+}
+```
+
+Use in MDX:
+
+```mdx
+import FeatureCard from '@site/src/components/FeatureCard';
+
+<FeatureCard
+  title="Fast"
+  description="Lightning fast queries"
+/>
+```
+
+## 📦 Key Dependencies
+
+- **Docusaurus 3.8.1**: Static site generator
+- **React 18.3**: UI framework
+- **Ant Design 5.26**: Component library
+- **@superset-ui/core**: Superset UI components
+- **Swagger UI React**: API documentation
+- **Prism**: Syntax highlighting
+
+## 🔗 Linking Strategies
+
+### Internal Links
+Use relative paths for internal documentation:
+
+```markdown
+[Installation Guide](./installation/docker-compose)
+[Configuration](../configuration/configuring-superset)
+```
+
+### External Links
+Always use full URLs:
+
+```markdown
+[Apache Superset GitHub](https://github.com/apache/superset)
+```
+
+### Linking to Code
+Reference code in the main repository:
+
+```markdown
+See the [main configuration file](https://github.com/apache/superset/blob/master/superset/config.py)
+```
+
+## 🛠️ Common Documentation Tasks
+
+### Adding a New Guide
+1. Create the `.mdx` file in the appropriate directory
+2. Add frontmatter with title and description
+3. Update sidebar if needed (for manual sidebar configs)
+
+### Adding API Documentation
+The API docs use Swagger UI embedded in `/docs/api.mdx`:
+
+```mdx
+import SwaggerUI from "swagger-ui-react";
+import "swagger-ui-react/swagger-ui.css";
+
+<SwaggerUI url="/api/v1/openapi.json" />
+```
+
+### Adding Interactive Examples
+Use MDX to create interactive documentation:
+
+```mdx
+import CodeBlock from '@theme/CodeBlock';
+import MyComponentExample from '!!raw-loader!../examples/MyComponent.tsx';
+
+<CodeBlock language="tsx">{MyComponentExample}</CodeBlock>
+```
+
+## 📋 Documentation Checklist
+
+When creating or updating documentation:
+
+- [ ] Clear, descriptive title in frontmatter
+- [ ] Description for SEO in frontmatter
+- [ ] Proper heading hierarchy (h1 -> h2 -> h3)
+- [ ] Code examples with language identifiers
+- [ ] Links verified (internal and external)
+- [ ] Images have alt text
+- [ ] Admonitions used for important notes
+- [ ] Tested locally with `yarn start`
+- [ ] No broken links (check with `yarn build`)
+
+## 🔍 Searching and Navigation
+
+### Sidebar Configuration
+Sidebars are configured in `/sidebars.js`:
+
+```javascript
+module.exports = {
+  CustomSidebar: [
+    {
+      type: 'doc',
+      label: 'Introduction',
+      id: 'intro',
+    },
+    {
+      type: 'category',
+      label: 'Installation',
+      items: [
+        {
+          type: 'autogenerated',
+          dirName: 'installation',
+        },
+      ],
+    },
+  ],
+};
+```
+
+### Search
+Docusaurus includes Algolia DocSearch integration configured in `docusaurus.config.ts`.
+
+## 🚫 Common Pitfalls to Avoid
+
+1. **Never use `yarn docusaurus docs:version`** - Use `yarn version:add:docs` instead
+2. **Don't edit versioned docs directly** - Edit current docs and create new version
+3. **Avoid absolute paths in links** - Use relative paths for maintainability
+4. **Don't forget frontmatter** - Every doc needs title and description
+5. **Test builds locally** - Run `yarn build` before committing
+
+## 🔧 Troubleshooting
+
+### Dev Server Issues
+```bash
+yarn stop     # Kill any running servers
+yarn clear    # Clear cache
+yarn start    # Restart
+```
+
+### Build Failures
+```bash
+# Check for broken links
+yarn build
+
+# TypeScript issues
+yarn typecheck
+
+# Linting issues
+yarn eslint
+```
+
+### Version Issues
+If versions don't appear in dropdown:
+1. Check `versions-config.json` includes the version
+2. Verify version files exist in `versioned_docs/`
+3. Restart dev server
+
+## 📚 Resources
+
+- [Docusaurus Documentation](https://docusaurus.io/docs)
+- [MDX Documentation](https://mdxjs.com/)
+- [Superset Contributing Guide](../CONTRIBUTING.md)
+- [Main Superset Documentation](https://superset.apache.org/docs/intro)
+
+## 📖 Real Examples and Patterns
+
+### Example: Configuration Documentation Pattern
+From `docs/configuration/configuring-superset.mdx`:
+
+```mdx
+---
+title: Configuring Superset
+hide_title: true
+sidebar_position: 1
+version: 1
+---
+
+# Configuring Superset
+
+## superset_config.py
+
+Superset exposes hundreds of configurable parameters through its
+[config.py module](https://github.com/apache/superset/blob/master/superset/config.py).
+
+```bash
+export SUPERSET_CONFIG_PATH=/app/superset_config.py
+```
+```
+
+**Key patterns:**
+- Links to source code for reference
+- Code blocks with bash/python examples
+- Environment variable documentation
+- Step-by-step configuration instructions
+
+### Example: Tutorial Documentation Pattern
+From `docs/using-superset/creating-your-first-dashboard.mdx`:
+
+```mdx
+import useBaseUrl from "@docusaurus/useBaseUrl";
+
+## Creating Your First Dashboard
+
+:::tip
+In addition to this site, [Preset.io](http://preset.io/) maintains an updated set of end-user
+documentation at [docs.preset.io](https://docs.preset.io/).
+:::
+
+### Connecting to a new database
+
+<img src={useBaseUrl("/img/tutorial/tutorial_01_add_database_connection.png")} width="600" />
+```
+
+**Key patterns:**
+- Import Docusaurus hooks for dynamic URLs
+- Use of admonitions (:::tip) for helpful information
+- Screenshots with useBaseUrl for proper path resolution
+- Clear section hierarchy with ### subheadings
+- Step-by-step visual guides
+
+### Example: API Documentation Pattern
+From `docs/api.mdx`:
+
+```mdx
+import SwaggerUI from "swagger-ui-react";
+import "swagger-ui-react/swagger-ui.css";
+
+## API Documentation
+
+<SwaggerUI url="/api/v1/openapi.json" />
+```
+
+**Key patterns:**
+- Embedding interactive Swagger UI
+- Importing necessary CSS
+- Direct API spec integration
+
+### Common Image Patterns
+
+```mdx
+// For images in static folder
+import useBaseUrl from "@docusaurus/useBaseUrl";
+
+<img src={useBaseUrl("/img/feature-screenshot.png")} width="600" />
+
+// With caption
+<figure>
+  <img src={useBaseUrl("/img/dashboard.png")} alt="Dashboard view" />
+  <figcaption>Superset Dashboard Interface</figcaption>
+</figure>
+```
+
+### Multi-Tab Code Examples
+
+```mdx
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+<Tabs
+  defaultValue="docker"
+  values={[
+    {label: 'Docker', value: 'docker'},
+    {label: 'Kubernetes', value: 'k8s'},
+    {label: 'PyPI', value: 'pypi'},
+  ]}>
+  <TabItem value="docker">
+    ```bash
+    docker-compose up
+    ```
+  </TabItem>
+  <TabItem value="k8s">
+    ```bash
+    kubectl apply -f superset.yaml
+    ```
+  </TabItem>
+  <TabItem value="pypi">
+    ```bash
+    pip install apache-superset
+    ```
+  </TabItem>
+</Tabs>
+```
+
+### Configuration File Examples
+
+```mdx
+```python title="superset_config.py"
+# Database connection example
+SQLALCHEMY_DATABASE_URI = 'postgresql://user:password@localhost/superset'
+
+# Security configuration
+SECRET_KEY = 'YOUR_SECRET_KEY_HERE'
+WTF_CSRF_ENABLED = True
+
+# Feature flags
+FEATURE_FLAGS = {
+    'ENABLE_TEMPLATE_PROCESSING': True,
+    'DASHBOARD_NATIVE_FILTERS': True,
+}
+```
+```
+
+### Cross-Referencing Pattern
+
+```mdx
+For detailed configuration options, see:
+- [Configuring Superset](./configuration/configuring-superset)
+- [Database Connections](./configuration/databases)
+- [Security Settings](./security/security)
+
+External resources:
+- [SQLAlchemy Documentation](https://docs.sqlalchemy.org/)
+- [Flask Configuration](https://flask.palletsprojects.com/config/)
+```
+
+### Writing Installation Guides
+
+```mdx
+## Prerequisites
+
+:::warning
+Ensure you have Python 3.9+ and Node.js 16+ installed before proceeding.
+:::
+
+## Installation Steps
+
+1. **Clone the repository**
+   ```bash
+   git clone https://github.com/apache/superset.git
+   cd superset
+   ```
+
+2. **Install Python dependencies**
+   ```bash
+   pip install -e .
+   ```
+
+3. **Initialize the database**
+   ```bash
+   superset db upgrade
+   superset init
+   ```
+
+:::tip Success Check
+Navigate to http://localhost:8088 and login with admin/admin
+:::
+```
+
+### Documenting API Endpoints
+
+```mdx
+## Chart API
+
+### GET /api/v1/chart/
+
+Returns a list of charts.
+
+**Parameters:**
+- `page` (optional): Page number
+- `page_size` (optional): Number of items per page
+
+**Example Request:**
+```bash
+curl -X GET "http://localhost:8088/api/v1/chart/" \
+  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
+```
+
+**Example Response:**
+```json
+{
+  "count": 42,
+  "result": [
+    {
+      "id": 1,
+      "slice_name": "Sales Dashboard",
+      "viz_type": "line"
+    }
+  ]
+}
+```
+```
+
+---
+
+**Note**: This documentation site serves as the primary resource for Superset users, administrators, and contributors. Always prioritize clarity, accuracy, and completeness when creating or updating documentation.

docs/README.md

@@ -21,3 +21,183 @@ This is the public documentation site for Superset, built using
 [Docusaurus 3](https://docusaurus.io/). See
 [CONTRIBUTING.md](../CONTRIBUTING.md#documentation) for documentation on
 contributing to documentation.
+
+## Version Management
+
+The Superset documentation site uses Docusaurus versioning with three independent versioned sections:
+
+- **Main Documentation** (`/docs/`) - Core Superset documentation
+- **Developer Portal** (`/developer_portal/`) - Developer guides and tutorials  
+- **Component Playground** (`/components/`) - Interactive component examples (currently disabled)
+
+Each section maintains its own version history and can be versioned independently.
+
+### Creating a New Version
+
+To create a new version for any section, use the Docusaurus version command with the appropriate plugin ID or use our automated scripts:
+
+#### Using Automated Scripts (Required)
+
+**⚠️ Important:** Always use these custom commands instead of the native Docusaurus commands. These scripts ensure that both the Docusaurus versioning system AND the `versions-config.json` file are updated correctly.
+
+```bash
+# Main Documentation
+yarn version:add:docs 1.2.0
+
+# Developer Portal
+yarn version:add:developer_portal 1.2.0
+
+# Component Playground (when enabled)
+yarn version:add:components 1.2.0
+```
+
+**Do NOT use** the native Docusaurus commands directly (`yarn docusaurus docs:version`), as they will:
+- ❌ Create version files but NOT update `versions-config.json`
+- ❌ Cause versions to not appear in dropdown menus
+- ❌ Require manual fixes to synchronize the configuration
+
+### Managing Versions
+
+#### With Automated Scripts
+The automated scripts handle all configuration updates automatically. No manual editing required!
+
+#### Manual Configuration
+If creating versions manually, you'll need to:
+
+1. **Update `versions-config.json`** (or `docusaurus.config.ts` if not using dynamic config):
+   - Add version to `onlyIncludeVersions` array
+   - Add version metadata to `versions` object
+   - Update `lastVersion` if needed
+
+2. **Files Created by Versioning**:
+   When a new version is created, Docusaurus generates:
+   - **Versioned docs folder**: `[section]_versioned_docs/version-X.X.X/`
+   - **Versioned sidebars**: `[section]_versioned_sidebars/version-X.X.X-sidebars.json`
+   - **Versions list**: `[section]_versions.json`
+
+   Note: For main docs, the prefix is omitted (e.g., `versioned_docs/` instead of `docs_versioned_docs/`)
+
+3. **Important**: After adding a version, restart the development server to see changes:
+   ```bash
+   yarn stop
+   yarn start
+   ```
+
+### Removing a Version
+
+#### Using Automated Scripts (Recommended)
+```bash
+# Main Documentation
+yarn version:remove:docs 1.0.0
+
+# Developer Portal
+yarn version:remove:developer_portal 1.0.0
+
+# Component Playground
+yarn version:remove:components 1.0.0
+```
+
+#### Manual Removal
+To manually remove a version:
+
+1. **Delete the version folder** from the appropriate location:
+   - Main docs: `versioned_docs/version-X.X.X/` (no prefix for main)
+   - Developer Portal: `developer_portal_versioned_docs/version-X.X.X/`
+   - Components: `components_versioned_docs/version-X.X.X/`
+
+2. **Delete the version metadata file**:
+   - Main docs: `versioned_sidebars/version-X.X.X-sidebars.json` (no prefix)
+   - Developer Portal: `developer_portal_versioned_sidebars/version-X.X.X-sidebars.json`
+   - Components: `components_versioned_sidebars/version-X.X.X-sidebars.json`
+
+3. **Update the versions list file**:
+   - Main docs: `versions.json`
+   - Developer Portal: `developer_portal_versions.json`
+   - Components: `components_versions.json`
+
+4. **Update configuration**:
+   - If using dynamic config: Update `versions-config.json`
+   - If using static config: Update `docusaurus.config.ts`
+
+5. **Restart the server** to see changes
+
+### Version Configuration Examples
+
+#### Main Documentation (default plugin)
+```typescript
+docs: {
+  includeCurrentVersion: true,
+  lastVersion: 'current',  // Makes /docs/ show Next version
+  onlyIncludeVersions: ['current', '1.1.0', '1.0.0'],
+  versions: {
+    current: {
+      label: 'Next',
+      path: '',  // Empty path for default routing
+      banner: 'unreleased',
+    },
+    '1.1.0': {
+      label: '1.1.0',
+      path: '1.1.0',
+      banner: 'none',
+    },
+  },
+}
+```
+
+#### Developer Portal & Components (custom plugins)
+```typescript
+{
+  id: 'developer_portal',
+  path: 'developer_portal',
+  routeBasePath: 'developer_portal',
+  includeCurrentVersion: true,
+  lastVersion: '1.1.0',  // Default version
+  onlyIncludeVersions: ['current', '1.1.0', '1.0.0'],
+  versions: {
+    current: {
+      label: 'Next',
+      path: 'next',
+      banner: 'unreleased',
+    },
+    '1.1.0': {
+      label: '1.1.0',
+      path: '1.1.0',
+      banner: 'none',
+    },
+  },
+}
+```
+
+### Best Practices
+
+1. **Version naming**: Use semantic versioning (e.g., 1.0.0, 1.1.0, 2.0.0)
+2. **Version banners**: Use `'unreleased'` for development versions, `'none'` for stable releases
+3. **Limit displayed versions**: Use `onlyIncludeVersions` to show only relevant versions
+4. **Test locally**: Always test version changes locally before deploying
+5. **Independent versioning**: Each section can have different version numbers and release cycles
+
+### Troubleshooting
+
+#### Version Not Showing After Creation
+
+If you accidentally used `yarn docusaurus docs:version` instead of `yarn version:add`:
+1. **Problem**: The version files were created but `versions-config.json` wasn't updated
+2. **Solution**: Either:
+   - Revert the changes: `git restore versions.json && rm -rf versioned_docs/ versioned_sidebars/`
+   - Then use the correct command: `yarn version:add:docs <version>`
+
+For other issues:
+- **Restart the server**: Changes to version configuration require a server restart
+- **Check config file**: Ensure `versions-config.json` includes the new version
+- **Verify files exist**: Check that versioned docs folder was created
+
+#### Broken Links in Versioned Documentation
+When creating a new version, links in the documentation are preserved as-is. Common issues:
+- **Cross-section links**: Links between sections (e.g., from developer_portal to docs) need to be version-aware
+- **Absolute vs relative paths**: Use relative paths within the same section
+- **Version-specific URLs**: Update hardcoded URLs to use version variables
+
+To fix broken links:
+1. Use `type: 'doc'` with `docId` for version-aware navigation in navbar
+2. Use relative paths within the same documentation section
+3. Test all versions after creation to identify broken links

docs/components/chart-components/bar-chart.md

@@ -0,0 +1,105 @@
+<!--
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+-->
+---
+title: Bar Chart
+sidebar_position: 1
+---
+
+# Bar Chart Component
+
+The Bar Chart component is used to visualize categorical data with rectangular bars.
+
+## Props
+
+| Prop | Type | Default | Description |
+|------|------|---------|-------------|
+| `data` | `array` | `[]` | Array of data objects to visualize |
+| `width` | `number` | `800` | Width of the chart in pixels |
+| `height` | `number` | `600` | Height of the chart in pixels |
+| `xField` | `string` | - | Field name for x-axis values |
+| `yField` | `string` | - | Field name for y-axis values |
+| `colorField` | `string` | - | Field name for color encoding |
+| `colorScheme` | `string` | `'supersetColors'` | Color scheme to use |
+| `showLegend` | `boolean` | `true` | Whether to show the legend |
+| `showGrid` | `boolean` | `true` | Whether to show grid lines |
+| `labelPosition` | `string` | `'top'` | Position of bar labels: 'top', 'middle', 'bottom' |
+
+## Examples
+
+### Basic Bar Chart
+
+```jsx
+import { BarChart } from '@superset-ui/chart-components';
+
+const data = [
+  { category: 'A', value: 10 },
+  { category: 'B', value: 20 },
+  { category: 'C', value: 15 },
+  { category: 'D', value: 25 },
+];
+
+function Example() {
+  return (
+    <BarChart
+      data={data}
+      width={800}
+      height={400}
+      xField="category"
+      yField="value"
+      colorScheme="supersetColors"
+    />
+  );
+}
+```
+
+### Grouped Bar Chart
+
+```jsx
+import { BarChart } from '@superset-ui/chart-components';
+
+const data = [
+  { category: 'A', group: 'Group 1', value: 10 },
+  { category: 'A', group: 'Group 2', value: 15 },
+  { category: 'B', group: 'Group 1', value: 20 },
+  { category: 'B', group: 'Group 2', value: 25 },
+  { category: 'C', group: 'Group 1', value: 15 },
+  { category: 'C', group: 'Group 2', value: 10 },
+];
+
+function Example() {
+  return (
+    <BarChart
+      data={data}
+      width={800}
+      height={400}
+      xField="category"
+      yField="value"
+      colorField="group"
+      colorScheme="supersetColors"
+    />
+  );
+}
+```
+
+## Best Practices
+
+- Use bar charts when comparing quantities across categories
+- Sort bars by value for better readability, unless there's a natural order to the categories
+- Use consistent colors for the same categories across different charts
+- Consider using horizontal bar charts when category labels are long

docs/components/index.md

@@ -0,0 +1,59 @@
+<!--
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+-->
+---
+title: Component Library
+sidebar_position: 1
+---
+
+# Superset Component Library
+
+Welcome to the Apache Superset Component Library documentation. This section provides comprehensive documentation for all the UI components, chart components, and layout components used in Superset.
+
+## What is the Component Library?
+
+The Component Library is a collection of reusable UI components that are used to build the Superset user interface. These components are designed to be consistent, accessible, and easy to use.
+
+## Component Categories
+
+The Component Library is organized into the following categories:
+
+### UI Components
+
+Basic UI components like buttons, inputs, dropdowns, and other form elements.
+
+### Chart Components
+
+Visualization components used to render different types of charts and graphs.
+
+### Layout Components
+
+Components used for page layout, such as containers, grids, and navigation elements.
+
+## Versioning
+
+The Component Library documentation follows its own versioning scheme, independent from the main Superset documentation. This allows us to update the component documentation as the components evolve, without affecting the main documentation.
+
+## Getting Started
+
+Browse the sidebar to explore the different components available in the library. Each component documentation includes:
+
+- Component description and purpose
+- Props and configuration options
+- Usage examples
+- Best practices

docs/components/layout-components/grid.md

@@ -0,0 +1,113 @@
+<!--
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+-->
+---
+title: Grid
+sidebar_position: 1
+---
+
+# Grid Component
+
+The Grid component provides a flexible layout system for arranging content in rows and columns.
+
+## Props
+
+| Prop | Type | Default | Description |
+|------|------|---------|-------------|
+| `gutter` | `number` or `[number, number]` | `0` | Grid spacing between items, can be a single number or [horizontal, vertical] |
+| `columns` | `number` | `12` | Number of columns in the grid |
+| `justify` | `string` | `'start'` | Horizontal alignment: 'start', 'center', 'end', 'space-between', 'space-around' |
+| `align` | `string` | `'top'` | Vertical alignment: 'top', 'middle', 'bottom' |
+| `wrap` | `boolean` | `true` | Whether to wrap items when they overflow |
+
+### Row Props
+
+| Prop | Type | Default | Description |
+|------|------|---------|-------------|
+| `gutter` | `number` or `[number, number]` | `0` | Spacing between items in the row |
+| `justify` | `string` | `'start'` | Horizontal alignment for this row |
+| `align` | `string` | `'top'` | Vertical alignment for this row |
+
+### Col Props
+
+| Prop | Type | Default | Description |
+|------|------|---------|-------------|
+| `span` | `number` | - | Number of columns the grid item spans |
+| `offset` | `number` | `0` | Number of columns the grid item is offset |
+| `xs`, `sm`, `md`, `lg`, `xl` | `number` or `object` | - | Responsive props for different screen sizes |
+
+## Examples
+
+### Basic Grid
+
+```jsx
+import { Grid, Row, Col } from '@superset-ui/core';
+
+function Example() {
+  return (
+    <Grid>
+      <Row gutter={16}>
+        <Col span={8}>
+          <div>Column 1</div>
+        </Col>
+        <Col span={8}>
+          <div>Column 2</div>
+        </Col>
+        <Col span={8}>
+          <div>Column 3</div>
+        </Col>
+      </Row>
+    </Grid>
+  );
+}
+```
+
+### Responsive Grid
+
+```jsx
+import { Grid, Row, Col } from '@superset-ui/core';
+
+function Example() {
+  return (
+    <Grid>
+      <Row gutter={[16, 24]}>
+        <Col xs={24} sm={12} md={8} lg={6}>
+          <div>Responsive Column 1</div>
+        </Col>
+        <Col xs={24} sm={12} md={8} lg={6}>
+          <div>Responsive Column 2</div>
+        </Col>
+        <Col xs={24} sm={12} md={8} lg={6}>
+          <div>Responsive Column 3</div>
+        </Col>
+        <Col xs={24} sm={12} md={8} lg={6}>
+          <div>Responsive Column 4</div>
+        </Col>
+      </Row>
+    </Grid>
+  );
+}
+```
+
+## Best Practices
+
+- Use the Grid system for complex layouts that need to be responsive
+- Specify column widths for different screen sizes to ensure proper responsive behavior
+- Use gutters to create appropriate spacing between grid items
+- Keep the grid structure consistent throughout your application
+- Consider using the grid system for dashboard layouts to ensure consistent spacing and alignment

docs/components/test.mdx

@@ -0,0 +1,35 @@
+<!--
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+-->
+---
+title: Test
+---
+
+import { StoryExample } from '../src/components/StorybookWrapper';
+
+# Test
+
+This is a test using our custom StorybookWrapper component.
+
+<StoryExample
+  component={() => (
+    <div style={{ padding: '10px', background: '#f0f0f0', borderRadius: '4px' }}>
+      This is a simple example component
+    </div>
+  )}
+/>

docs/components/ui-components/button.mdx

@@ -0,0 +1,146 @@
+<!--
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+-->
+---
+title: Button Component
+sidebar_position: 1
+---
+
+import { StoryExample, StoryWithControls } from '../../src/components/StorybookWrapper';
+import { Button } from '../../../superset-frontend/packages/superset-ui-core/src/components/Button';
+
+# Button Component
+
+The Button component is a fundamental UI element used throughout Superset for user interactions.
+
+## Basic Usage
+
+The default button with primary styling:
+<StoryExample
+  component={() => (
+    <Button buttonStyle="primary" onClick={() => console.log('Clicked!')}>
+      Click Me
+    </Button>
+  )}
+/>
+
+## Interactive Example
+
+<StoryWithControls
+  component={({ buttonStyle, buttonSize, label, disabled }) => (
+    <Button
+      buttonStyle={buttonStyle}
+      buttonSize={buttonSize}
+      disabled={disabled}
+      onClick={() => console.log('Clicked!')}
+    >
+      {label}
+    </Button>
+  )}
+  props={{
+    buttonStyle: 'primary',
+    buttonSize: 'default',
+    label: 'Click Me',
+    disabled: false
+  }}
+  controls={[
+    {
+      name: 'buttonStyle',
+      label: 'Button Style',
+      type: 'select',
+      options: ['primary', 'secondary', 'tertiary', 'success', 'warning', 'danger', 'default', 'link', 'dashed']
+    },
+    {
+      name: 'buttonSize',
+      label: 'Button Size',
+      type: 'select',
+      options: ['default', 'small', 'xsmall']
+    },
+    {
+      name: 'label',
+      label: 'Button Text',
+      type: 'text'
+    },
+    {
+      name: 'disabled',
+      label: 'Disabled',
+      type: 'boolean'
+    }
+  ]}
+/>
+
+## Props
+
+| Prop | Type | Default | Description |
+|------|------|---------|-------------|
+| `buttonStyle` | `'primary' \| 'secondary' \| 'tertiary' \| 'success' \| 'warning' \| 'danger' \| 'default' \| 'link' \| 'dashed'` | `'default'` | Button style |
+| `buttonSize` | `'default' \| 'small' \| 'xsmall'` | `'default'` | Button size |
+| `disabled` | `boolean` | `false` | Whether the button is disabled |
+| `cta` | `boolean` | `false` | Whether the button is a call-to-action button |
+| `tooltip` | `ReactNode` | - | Tooltip content |
+| `placement` | `TooltipProps['placement']` | - | Tooltip placement |
+| `onClick` | `function` | - | Callback when button is clicked |
+| `href` | `string` | - | Turns button into an anchor link |
+| `target` | `string` | - | Target attribute for anchor links |
+
+## Usage
+
+```jsx
+import Button from 'src/components/Button';
+
+function MyComponent() {
+  return (
+    <Button
+      buttonStyle="primary"
+      onClick={() => console.log('Button clicked')}
+    >
+      Click Me
+    </Button>
+  );
+}
+```
+
+## Button Styles
+
+Superset provides a variety of button styles for different purposes:
+
+- **Primary**: Used for primary actions
+- **Secondary**: Used for secondary actions
+- **Tertiary**: Used for less important actions
+- **Success**: Used for successful or confirming actions
+- **Warning**: Used for actions that require caution
+- **Danger**: Used for destructive actions
+- **Link**: Used for navigation
+- **Dashed**: Used for adding new items or features
+
+## Button Sizes
+
+Buttons come in three sizes:
+
+- **Default**: Standard size for most use cases
+- **Small**: Compact size for tight spaces
+- **XSmall**: Extra small size for very limited spaces
+
+## Best Practices
+
+- Use primary buttons for the main action in a form or page
+- Use secondary buttons for alternative actions
+- Use danger buttons for destructive actions
+- Limit the number of primary buttons on a page to avoid confusion
+- Use consistent button styles throughout your application
+- Add tooltips to buttons when their purpose might not be immediately clear

docs/components/versions.json

@@ -0,0 +1 @@
+[]

docs/components_versions.json

@@ -0,0 +1 @@
+[]

docs/developer_portal/contributing/code-review.md

@@ -0,0 +1,339 @@
+---
+title: Code Review Process
+sidebar_position: 4
+---
+
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# Code Review Process
+
+Understand how code reviews work in Apache Superset and how to participate effectively.
+
+## Overview
+
+Code review is a critical part of maintaining code quality and sharing knowledge across the team. Every change to Superset goes through peer review before merging.
+
+## For Authors
+
+### Preparing for Review
+
+#### Before Requesting Review
+- [ ] Self-review your changes
+- [ ] Ensure CI checks pass
+- [ ] Add comprehensive tests
+- [ ] Update documentation
+- [ ] Fill out PR template completely
+- [ ] Add screenshots for UI changes
+
+#### Self-Review Checklist
+```bash
+# View your changes
+git diff upstream/master
+
+# Check for common issues:
+# - Commented out code
+# - Debug statements (console.log, print)
+# - TODO comments that should be addressed
+# - Hardcoded values that should be configurable
+# - Missing error handling
+# - Performance implications
+```
+
+### Requesting Review
+
+#### Auto-Assignment
+GitHub will automatically request reviews based on CODEOWNERS file.
+
+#### Manual Assignment
+For specific expertise, request additional reviewers:
+- Frontend changes: Tag frontend experts
+- Backend changes: Tag backend experts
+- Security changes: Tag security team
+- Database changes: Tag database experts
+
+#### Review Request Message
+```markdown
+@reviewer This PR implements [feature]. Could you please review:
+1. The approach taken in [file]
+2. Performance implications of [change]
+3. Security considerations for [feature]
+
+Thanks!
+```
+
+### Responding to Feedback
+
+#### Best Practices
+- **Be receptive**: Reviews improve code quality
+- **Ask questions**: Clarify if feedback is unclear
+- **Explain decisions**: Share context for your choices
+- **Update promptly**: Address feedback in timely manner
+
+#### Comment Responses
+```markdown
+# Acknowledging
+"Good catch! Fixed in [commit hash]"
+
+# Explaining
+"I chose this approach because [reason]. Would you prefer [alternative]?"
+
+# Questioning
+"Could you elaborate on [concern]? I'm not sure I understand the issue."
+
+# Disagreeing respectfully
+"I see your point, but I think [current approach] because [reason]. What do you think?"
+```
+
+## For Reviewers
+
+### Review Responsibilities
+
+#### What to Review
+1. **Correctness**: Does the code do what it claims?
+2. **Design**: Is the approach appropriate?
+3. **Clarity**: Is the code readable and maintainable?
+4. **Testing**: Are tests comprehensive?
+5. **Performance**: Any performance concerns?
+6. **Security**: Any security issues?
+7. **Documentation**: Is it well documented?
+
+### Review Checklist
+
+#### Functionality
+- [ ] Feature works as described
+- [ ] Edge cases are handled
+- [ ] Error handling is appropriate
+- [ ] Backwards compatibility maintained
+
+#### Code Quality
+- [ ] Follows project conventions
+- [ ] No code duplication
+- [ ] Clear variable/function names
+- [ ] Appropriate abstraction levels
+- [ ] SOLID principles followed
+
+#### Testing
+- [ ] Unit tests for business logic
+- [ ] Integration tests for APIs
+- [ ] E2E tests for critical paths
+- [ ] Tests are maintainable
+- [ ] Good test coverage
+
+#### Security
+- [ ] Input validation
+- [ ] SQL injection prevention
+- [ ] XSS prevention
+- [ ] CSRF protection
+- [ ] Authentication/authorization checks
+- [ ] No sensitive data in logs
+
+#### Performance
+- [ ] Database queries optimized
+- [ ] No N+1 queries
+- [ ] Appropriate caching
+- [ ] Frontend bundle size impact
+- [ ] Memory usage considerations
+
+### Providing Feedback
+
+#### Effective Comments
+
+```python
+# ✅ Good: Specific and actionable
+"This query could cause N+1 problems. Consider using
+`select_related('user')` to fetch users in a single query."
+
+# ❌ Bad: Vague
+"This doesn't look right."
+```
+
+```typescript
+// ✅ Good: Suggests improvement
+"Consider using useMemo here to prevent unnecessary
+re-renders when dependencies haven't changed."
+
+// ❌ Bad: Just criticism
+"This is inefficient."
+```
+
+#### Comment Types
+
+**Use GitHub's comment types:**
+- **Comment**: General feedback or questions
+- **Approve**: Changes look good
+- **Request Changes**: Must be addressed before merge
+
+**Prefix conventions:**
+- `nit:` Minor issue (non-blocking)
+- `suggestion:` Recommended improvement
+- `question:` Seeking clarification
+- `blocker:` Must be fixed
+- `praise:` Highlighting good work
+
+#### Examples
+
+```markdown
+nit: Consider renaming `getData` to `fetchUserData` for clarity
+
+suggestion: This could be simplified using Array.reduce()
+
+question: Is this intentionally not handling the error case?
+
+blocker: This SQL is vulnerable to injection. Please use parameterized queries.
+
+praise: Excellent test coverage! 👍
+```
+
+## Review Process
+
+### Timeline
+
+#### Expected Response Times
+- **Initial review**: Within 2-3 business days
+- **Follow-up review**: Within 1-2 business days
+- **Critical fixes**: ASAP (tag in Slack)
+
+#### Escalation
+If no response after 3 days:
+1. Ping reviewer in PR comments
+2. Ask in #development Slack channel
+3. Tag @apache/superset-committers
+
+### Approval Requirements
+
+#### Minimum Requirements
+- **1 approval** from a committer for minor changes
+- **2 approvals** for significant features
+- **3 approvals** for breaking changes
+
+#### Special Cases
+- **Security changes**: Require security team review
+- **API changes**: Require API team review
+- **Database migrations**: Require database expert review
+- **UI/UX changes**: Require design review
+
+### Merge Process
+
+#### Who Can Merge
+- Committers with write access
+- After all requirements met
+- CI checks must pass
+
+#### Merge Methods
+- **Squash and merge**: Default for feature PRs
+- **Rebase and merge**: For clean history
+- **Create merge commit**: Rarely used
+
+#### Merge Checklist
+- [ ] All CI checks green
+- [ ] Required approvals obtained
+- [ ] No unresolved conversations
+- [ ] PR title follows conventions
+- [ ] Milestone set (if applicable)
+
+## Review Etiquette
+
+### Do's
+- ✅ Be kind and constructive
+- ✅ Acknowledge time and effort
+- ✅ Provide specific examples
+- ✅ Suggest solutions
+- ✅ Praise good work
+- ✅ Consider cultural differences
+- ✅ Focus on the code, not the person
+
+### Don'ts
+- ❌ Use harsh or dismissive language
+- ❌ Bikeshed on minor preferences
+- ❌ Review when tired or frustrated
+- ❌ Make personal attacks
+- ❌ Ignore the PR description
+- ❌ Demand perfection
+
+## Becoming a Reviewer
+
+### Path to Reviewer
+1. **Contribute regularly**: Submit quality PRs
+2. **Participate in discussions**: Share knowledge
+3. **Review others' code**: Start with comments
+4. **Build expertise**: Focus on specific areas
+5. **Get nominated**: By existing committers
+
+### Reviewer Expectations
+- Review PRs in your area of expertise
+- Respond within reasonable time
+- Mentor new contributors
+- Maintain high standards
+- Stay current with best practices
+
+## Advanced Topics
+
+### Reviewing Large PRs
+
+#### Strategy
+1. **Request splitting**: Ask to break into smaller PRs
+2. **Review in phases**:
+   - Architecture/approach first
+   - Implementation details second
+   - Tests and docs last
+3. **Use draft reviews**: Save comments and submit together
+
+### Cross-Team Reviews
+
+#### When Needed
+- Changes affecting multiple teams
+- Shared components/libraries
+- API contract changes
+- Database schema changes
+
+### Performance Reviews
+
+#### Tools
+```python
+# Backend performance
+import cProfile
+import pstats
+
+# Profile the code
+cProfile.run('function_to_profile()', 'stats.prof')
+stats = pstats.Stats('stats.prof')
+stats.sort_stats('cumulative').print_stats(10)
+```
+
+```typescript
+// Frontend performance
+// Use React DevTools Profiler
+// Chrome DevTools Performance tab
+// Lighthouse audits
+```
+
+## Resources
+
+### Internal
+- [Coding Guidelines](../guidelines/design-guidelines)
+- [Testing Guide](../testing/overview)
+- [Extension Architecture](../extensions/architecture)
+
+### External
+- [Google's Code Review Guide](https://google.github.io/eng-practices/review/)
+- [Best Practices for Code Review](https://smartbear.com/learn/code-review/best-practices-for-peer-code-review/)
+- [The Art of Readable Code](https://www.oreilly.com/library/view/the-art-of/9781449318482/)
+
+Next: [Reporting issues effectively](./issue-reporting)

docs/developer_portal/contributing/guidelines.md

@@ -0,0 +1,415 @@
+---
+title: Contribution Guidelines
+sidebar_position: 4
+---
+
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# Contribution Guidelines
+
+## Pull Request Guidelines
+
+A philosophy we would like to strongly encourage is
+
+> Before creating a PR, create an issue.
+
+The purpose is to separate problem from possible solutions.
+
+**Bug fixes:** If you're only fixing a small bug, it's fine to submit a pull request right away but we highly recommend filing an issue detailing what you're fixing. This is helpful in case we don't accept that specific fix but want to keep track of the issue. Please keep in mind that the project maintainers reserve the rights to accept or reject incoming PRs, so it is better to separate the issue and the code to fix it from each other. In some cases, project maintainers may request you to create a separate issue from PR before proceeding.
+
+**Refactor:** For small refactors, it can be a standalone PR itself detailing what you are refactoring and why. If there are concerns, project maintainers may request you to create a `#SIP` for the PR before proceeding.
+
+**Feature/Large changes:** If you intend to change the public API, or make any non-trivial changes to the implementation, we require you to file a new issue as `#SIP` (Superset Improvement Proposal). This lets us reach an agreement on your proposal before you put significant effort into it. You are welcome to submit a PR along with the SIP (sometimes necessary for demonstration), but we will not review/merge the code until the SIP is approved.
+
+In general, small PRs are always easier to review than large PRs. The best practice is to break your work into smaller independent PRs and refer to the same issue. This will greatly reduce turnaround time.
+
+If you wish to share your work which is not ready to merge yet, create a [Draft PR](https://github.blog/2019-02-14-introducing-draft-pull-requests/). This will enable maintainers and the CI runner to prioritize mature PR's.
+
+Finally, never submit a PR that will put master branch in broken state. If the PR is part of multiple PRs to complete a large feature and cannot work on its own, you can create a feature branch and merge all related PRs into the feature branch before creating a PR from feature branch to master.
+
+### Protocol
+
+#### Authoring
+
+- Fill in all sections of the PR template.
+- Title the PR with one of the following semantic prefixes (inspired by [Karma](http://karma-runner.github.io/0.10/dev/git-commit-msg.html])):
+
+  - `feat` (new feature)
+  - `fix` (bug fix)
+  - `docs` (changes to the documentation)
+  - `style` (formatting, missing semi colons, etc; no application logic change)
+  - `refactor` (refactoring code)
+  - `test` (adding missing tests, refactoring tests; no application logic change)
+  - `chore` (updating tasks etc; no application logic change)
+  - `perf` (performance-related change)
+  - `build` (build tooling, Docker configuration change)
+  - `ci` (test runner, GitHub Actions workflow changes)
+  - `other` (changes that don't correspond to the above -- should be rare!)
+  - Examples:
+    - `feat: export charts as ZIP files`
+    - `perf(api): improve API info performance`
+    - `fix(chart-api): cached-indicator always shows value is cached`
+
+- Add prefix `[WIP]` to title if not ready for review (WIP = work-in-progress). We recommend creating a PR with `[WIP]` first and remove it once you have passed CI test and read through your code changes at least once.
+- If you believe your PR contributes a potentially breaking change, put a `!` after the semantic prefix but before the colon in the PR title, like so: `feat!: Added foo functionality to bar`
+- **Screenshots/GIFs:** Changes to user interface require before/after screenshots, or GIF for interactions
+  - Recommended capture tools ([Kap](https://getkap.co/), [LICEcap](https://www.cockos.com/licecap/), [Skitch](https://download.cnet.com/Skitch/3000-13455_4-189876.html))
+  - If no screenshot is provided, the committers will mark the PR with `need:screenshot` label and will not review until screenshot is provided.
+- **Dependencies:** Be careful about adding new dependency and avoid unnecessary dependencies.
+  - For Python, include it in `pyproject.toml` denoting any specific restrictions and
+    in `requirements.txt` pinned to a specific version which ensures that the application
+    build is deterministic.
+  - For TypeScript/JavaScript, include new libraries in `package.json`
+- **Tests:** The pull request should include tests, either as doctests, unit tests, or both. Make sure to resolve all errors and test failures. See [Testing](./howtos#testing) for how to run tests.
+- **Documentation:** If the pull request adds functionality, the docs should be updated as part of the same PR.
+- **CI:** Reviewers will not review the code until all CI tests are passed. Sometimes there can be flaky tests. You can close and open PR to re-run CI test. Please report if the issue persists. After the CI fix has been deployed to `master`, please rebase your PR.
+- **Code coverage:** Please ensure that code coverage does not decrease.
+- Remove `[WIP]` when ready for review. Please note that it may be merged soon after approved so please make sure the PR is ready to merge and do not expect more time for post-approval edits.
+- If the PR was not ready for review and inactive for > 30 days, we will close it due to inactivity. The author is welcome to re-open and update.
+
+#### Reviewing
+
+- Use constructive tone when writing reviews.
+- If there are changes required, state clearly what needs to be done before the PR can be approved.
+- If you are asked to update your pull request with some changes there's no need to create a new one. Push your changes to the same branch.
+- The committers reserve the right to reject any PR and in some cases may request the author to file an issue.
+
+#### Test Environments
+
+- Members of the Apache GitHub org can launch an ephemeral test environment directly on a pull request by creating a comment containing (only) the command `/testenv up`.
+  - Note that org membership must be public in order for this validation to function properly.
+- Feature flags may be set for a test environment by specifying the flag name (prefixed with `FEATURE_`) and value after the command.
+  - Format: `/testenv up FEATURE_<feature flag name>=true|false`
+  - Example: `/testenv up FEATURE_DASHBOARD_NATIVE_FILTERS=true`
+  - Multiple feature flags may be set in single command, separated by whitespace
+- A comment will be created by the workflow script with the address and login information for the ephemeral environment.
+- Test environments may be created once the Docker build CI workflow for the PR has completed successfully.
+- Test environments do not currently update automatically when new commits are added to a pull request.
+- Test environments do not currently support async workers, though this is planned.
+- Running test environments will be shutdown upon closing the pull request.
+
+You can also access per-PR ephemeral environment directly using the following URL pattern:
+`https://pr-{PR_NUMBER}.superset.apache.org`
+
+#### Merging
+
+- At least one approval is required for merging a PR.
+- PR is usually left open for at least 24 hours before merging.
+- After the PR is merged, [close the corresponding issue(s)](https://help.github.com/articles/closing-issues-using-keywords/).
+
+#### Post-merge Responsibility
+
+- Project maintainers may contact the PR author if new issues are introduced by the PR.
+- Project maintainers may revert your changes if a critical issue is found, such as breaking master branch CI.
+
+## Managing Issues and PRs
+
+To handle issues and PRs that are coming in, committers read issues/PRs and flag them with labels to categorize and help contributors spot where to take actions, as contributors usually have different expertises.
+
+Triaging goals
+
+- **For issues:** Categorize, screen issues, flag required actions from authors.
+- **For PRs:** Categorize, flag required actions from authors. If PR is ready for review, flag required actions from reviewers.
+
+First, add **Category labels (a.k.a. hash labels)**. Every issue/PR must have one hash label (except spam entry). Labels that begin with `#` defines issue/PR type:
+
+| Label           | for Issue                                                                                                               | for PR                                                                                                                                            |
+| --------------- | ----------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `#bug`          | Bug report                                                                                                              | Bug fix                                                                                                                           |
+| `#code-quality` | Describe problem with code, architecture or productivity                                                                | Refactor, tests, tooling                                                                                                          |
+| `#feature`      | New feature request                                                                                                     | New feature implementation                                                                                                        |
+| `#refine`       | Propose improvement such as adjusting padding or refining UI style, excluding new features, bug fixes, and refactoring. | Implementation of improvement such as adjusting padding or refining UI style, excluding new features, bug fixes, and refactoring. |
+| `#doc`          | Documentation                                                                                                           | Documentation                                                                                                                     |
+| `#question`     | Troubleshooting: Installation, Running locally, Ask how to do something. Can be changed to `#bug` later.                | N/A                                                                                                                               |
+| `#SIP`          | Superset Improvement Proposal                                                                                           | N/A                                                                                                                               |
+| `#ASF`          | Tasks related to Apache Software Foundation policy                                                                      | Tasks related to Apache Software Foundation policy                                                                                |
+
+Then add other types of labels as appropriate.
+
+- **Descriptive labels (a.k.a. dot labels):** These labels that begin with `.` describe the details of the issue/PR, such as `.ui`, `.js`, `.install`, `.backend`, etc. Each issue/PR can have zero or more dot labels.
+- **Need labels:** These labels have pattern `need:xxx`, which describe the work required to progress, such as `need:rebase`, `need:update`, `need:screenshot`.
+- **Risk labels:** These labels have pattern `risk:xxx`, which describe the potential risk on adopting the work, such as `risk:db-migration`. The intention was to better understand the impact and create awareness for PRs that need more rigorous testing.
+- **Status labels:** These labels describe the status (`abandoned`, `wontfix`, `cant-reproduce`, etc.) Issue/PRs that are rejected or closed without completion should have one or more status labels.
+- **Version labels:** These have the pattern `vx.x` such as `v0.28`. Version labels on issues describe the version the bug was reported on. Version labels on PR describe the first release that will include the PR.
+
+Committers may also update title to reflect the issue/PR content if the author-provided title is not descriptive enough.
+
+If the PR passes CI tests and does not have any `need:` labels, it is ready for review, add label `review` and/or `design-review`.
+
+If an issue/PR has been inactive for at least 30 days, it will be closed. If it does not have any status label, add `inactive`.
+
+When creating a PR, if you're aiming to have it included in a specific release, please tag it with the version label. For example, to have a PR considered for inclusion in Superset 1.1 use the label `v1.1`.
+
+## Revert Guidelines
+
+Reverting changes that are causing issues in the master branch is a normal and expected part of the development process. In an open source community, the ramifications of a change cannot always be fully understood. With that in mind, here are some considerations to keep in mind when considering a revert:
+
+- **Availability of the PR author:** If the original PR author or the engineer who merged the code is highly available and can provide a fix in a reasonable time frame, this would counter-indicate reverting.
+- **Severity of the issue:** How severe is the problem on master? Is it keeping the project from moving forward? Is there user impact? What percentage of users will experience a problem?
+- **Size of the change being reverted:** Reverting a single small PR is a much lower-risk proposition than reverting a massive, multi-PR change.
+- **Age of the change being reverted:** Reverting a recently-merged PR will be more acceptable than reverting an older PR. A bug discovered in an older PR is unlikely to be causing widespread serious issues.
+- **Risk inherent in reverting:** Will the reversion break critical functionality? Is the medicine more dangerous than the disease?
+- **Difficulty of crafting a fix:** In the case of issues with a clear solution, it may be preferable to implement and merge a fix rather than a revert.
+
+Should you decide that reverting is desirable, it is the responsibility of the Contributor performing the revert to:
+
+- **Contact the interested parties:** The PR's author and the engineer who merged the work should both be contacted and informed of the revert.
+- **Provide concise reproduction steps:** Ensure that the issue can be clearly understood and duplicated by the original author of the PR.
+- **Put the revert through code review:** The revert must be approved by another committer.
+
+**Revert liberally to keep `master` stable**:
+- Build failures
+- Test failures
+- Critical bugs in production
+- Security vulnerabilities
+
+**How to revert**:
+1. Use GitHub's revert button when possible
+2. Create a PR with clear explanation
+3. Tag the original author
+4. Work with them on a fix
+
+## Design Guidelines
+
+### Capitalization Guidelines
+
+#### Sentence case
+
+Use sentence-case capitalization for everything in the UI (except these **).
+
+Sentence case is predominantly lowercase. Capitalize only the initial character of the first word, and other words that require capitalization, like:
+
+- **Proper nouns.** Objects in the product _are not_ considered proper nouns e.g. dashboards, charts, saved queries etc. Proprietary feature names eg. SQL Lab, Preset Manager _are_ considered proper nouns
+- **Acronyms** (e.g. CSS, HTML)
+- When referring to **UI labels that are themselves capitalized** from sentence case (e.g. page titles - Dashboards page, Charts page, Saved queries page, etc.)
+- User input that is reflected in the UI. E.g. a user-named a dashboard tab
+
+**Sentence case vs. Title case:**
+Title case: "A Dog Takes a Walk in Paris"
+Sentence case: "A dog takes a walk in Paris"
+
+**Why sentence case?**
+
+- It's generally accepted as the quickest to read
+- It's the easiest form to distinguish between common and proper nouns
+
+**Good examples:**
+- "Select a database"
+- "Create new chart"
+- "View all dashboards"
+
+**Bad examples:**
+- "Select a Database"
+- "Create New Chart"
+- "View All Dashboards"
+
+#### How to refer to UI elements
+
+When writing about a UI element, use the same capitalization as used in the UI.
+
+For example, if an input field is labeled "Name" then you refer to this as the "Name input field". Similarly, if a button has the label "Save" in it, then it is correct to refer to the "Save button".
+
+Where a product page is titled "Settings", you refer to this in writing as follows:
+"Edit your personal information on the Settings page".
+
+Often a product page will have the same title as the objects it contains. In this case, refer to the page as it appears in the UI, and the objects as common nouns:
+
+- Upload a dashboard on the Dashboards page
+- Go to Dashboards
+- View dashboard
+- View all dashboards
+- Upload CSS templates on the CSS templates page
+- Queries that you save will appear on the Saved queries page
+- Create custom queries in SQL Lab then create dashboards
+
+When writing about UI elements:
+- Use **bold** for clickable elements: "Click **Save**"
+- Use quotes for text fields: 'Enter "My Dashboard" in the name field'
+- Be specific about element types: button, link, dropdown, etc.
+
+#### **Exceptions to sentence case
+
+Only use title case for:
+- Product names (Apache Superset)
+- Proper nouns
+- Acronyms (SQL, API, CSV)
+- Input labels, buttons and UI tabs are all caps
+- User input values (e.g. column names, SQL Lab tab names) should be in their original case
+
+## Programming Language Conventions
+
+### Python
+
+We use:
+- **[Ruff](https://docs.astral.sh/ruff/)** for linting and formatting
+- **[Mypy](http://mypy-lang.org/)** for type checking
+
+Python code should:
+- Follow PEP 8
+- Use type hints for all new code
+- Use descriptive variable names
+- Include docstrings for modules, classes, and functions
+- Handle exceptions appropriately
+- Avoid global variables
+
+Parameters in the `config.py` (which are accessible via the Flask app.config dictionary) are
+assumed to always be defined and thus should be accessed directly via,
+
+```python
+blueprints = app.config["BLUEPRINTS"]
+```
+
+rather than,
+
+```python
+blueprints = app.config.get("BLUEPRINTS")
+```
+
+or similar as the later will cause typing issues. The former is of type `List[Callable]`
+whereas the later is of type `Optional[List[Callable]]`.
+
+#### Typing / Type Hints
+
+All new Python code should include type hints:
+
+To ensure clarity, consistency, all readability, _all_ new functions should use
+[type hints](https://docs.python.org/3/library/typing.html) and include a
+docstring.
+
+Note per [PEP-484](https://www.python.org/dev/peps/pep-0484/#exceptions) no
+syntax for listing explicitly raised exceptions is proposed and thus the
+recommendation is to put this information in a docstring, i.e.,
+
+```python
+import math
+from typing import List, Optional, Dict, Any, Union
+
+
+def sqrt(x: Union[float, int]) -> Union[float, int]:
+    """
+    Return the square root of x.
+
+    :param x: A number
+    :returns: The square root of the given number
+    :raises ValueError: If the number is negative
+    """
+
+    return math.sqrt(x)
+
+
+def process_data(
+    data: List[Dict[str, Any]],
+    filter_empty: bool = True
+) -> Optional[Dict[str, Any]]:
+    """
+    Process a list of data dictionaries.
+
+    Args:
+        data: List of dictionaries containing data
+        filter_empty: Whether to filter empty entries
+
+    Returns:
+        Processed data dictionary or None if no valid data
+    """
+    if not data:
+        return None
+
+    # Process data...
+    return processed_data
+```
+
+Use `mypy` to check types:
+```bash
+mypy superset
+```
+
+### TypeScript
+
+We use:
+- **ESLint** for linting
+- **Prettier** for formatting  
+- **TypeScript** strict mode
+
+TypeScript is fully supported and is the recommended language for writing all new frontend
+components. When modifying existing functions/components, migrating to TypeScript is
+appreciated, but not required. Examples of migrating functions/components to TypeScript can be
+found in [#9162](https://github.com/apache/superset/pull/9162) and [#9180](https://github.com/apache/superset/pull/9180).
+
+TypeScript code should:
+- Avoid `any` types - use proper TypeScript types
+- Use functional components with hooks for React
+- Include JSDoc comments for complex functions
+- Use consistent naming conventions
+- Handle errors appropriately
+
+Example:
+```typescript
+interface User {
+  id: number;
+  name: string;
+  email?: string;
+}
+
+export function processUser(user: User): string {
+  // Avoid using 'any'
+  const { name, email } = user;
+  return email ? `${name} <${email}>` : name;
+}
+```
+
+## Additional Guidelines
+
+### Commit Messages
+
+- Use clear, descriptive commit messages
+- Start with a verb in imperative mood
+- Reference issue numbers when applicable
+
+Good: "Fix dashboard filter bug when dataset is deleted"
+Bad: "Fixed stuff"
+
+### Code Review Etiquette
+
+- Be respectful and constructive
+- Focus on the code, not the person
+- Provide specific suggestions for improvement
+- Acknowledge good work
+- Be open to different approaches
+
+### Documentation
+
+- Update docs for any user-facing changes
+- Include code examples where helpful
+- Keep language clear and concise
+- Test documentation changes locally
+
+### Security
+
+- Never commit secrets or credentials
+- Validate all user input
+- Use parameterized queries for SQL
+- Follow OWASP guidelines
+- Report security issues privately to private@superset.apache.org
+
+## Questions?
+
+If you have questions about these guidelines, ask in:
+- [Slack #development](https://apache-superset.slack.com)
+- [GitHub Discussions](https://github.com/apache/superset/discussions)

docs/developer_portal/contributing/howtos.md

@@ -0,0 +1,528 @@
+---
+title: Development How-tos
+sidebar_position: 7
+---
+
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# Development How-tos
+
+This guide contains specific instructions for common development tasks in Superset.
+
+## Contributing to Documentation
+
+The documentation site is built using [Docusaurus](https://docusaurus.io/). All documentation lives in the `docs` folder, written in Markdown format.
+
+### Local Development
+
+To set up your local environment for documentation development:
+
+```bash
+cd docs
+npm install
+npm run start
+```
+
+The site will be available at http://localhost:3000
+
+### Build
+
+To create a production build:
+
+```bash
+npm run build
+npm run serve  # Test the build locally
+```
+
+### Deployment
+
+Documentation is automatically deployed when changes are merged to master.
+
+## Creating Visualization Plugins
+
+Visualization plugins allow you to add custom chart types to Superset. They are built as npm packages that integrate with the Superset frontend.
+
+### Prerequisites
+
+- Node.js 18+
+- npm or yarn
+- A local Superset development environment
+
+### Creating a simple Hello World viz plugin
+
+1. **Install the Superset Yeoman generator**:
+```bash
+npm install -g @superset-ui/generator-superset
+```
+
+2. **Create a new plugin**:
+```bash
+mkdir superset-plugin-chart-hello-world
+cd superset-plugin-chart-hello-world
+yo @superset-ui/superset
+```
+
+3. **Follow the prompts**:
+- Package name: `superset-plugin-chart-hello-world`
+- Chart type: Choose your preferred type
+- Include storybook: Yes (recommended for development)
+
+4. **Develop your plugin**:
+The generator creates a complete plugin structure with TypeScript, React components, and build configuration.
+
+5. **Test your plugin locally**:
+```bash
+npm run dev
+```
+
+6. **Link to your local Superset**:
+```bash
+npm link
+# In your Superset frontend directory:
+npm link superset-plugin-chart-hello-world
+```
+
+7. **Import and register in Superset**:
+Edit `superset-frontend/src/visualizations/presets/MainPreset.js` to include your plugin.
+
+## Testing
+
+### Python Testing
+
+Run Python tests using pytest:
+
+```bash
+# Run all tests
+pytest
+
+# Run specific test file
+pytest tests/unit_tests/test_specific.py
+
+# Run with coverage
+pytest --cov=superset
+
+# Run only unit tests
+pytest tests/unit_tests
+
+# Run only integration tests  
+pytest tests/integration_tests
+```
+
+#### Testing with local Presto connections
+
+To test against Presto:
+
+```bash
+# Start Presto locally using Docker
+docker run -p 8080:8080 \
+  --name presto \
+  -d prestodb/presto
+
+# Configure in superset_config.py
+SQLALCHEMY_DATABASE_URI = 'presto://localhost:8080/hive/default'
+```
+
+### Frontend Testing
+
+Run frontend tests using Jest:
+
+```bash
+cd superset-frontend
+
+# Run all tests
+npm run test
+
+# Run with coverage
+npm run test -- --coverage
+
+# Run in watch mode
+npm run test -- --watch
+
+# Run specific test file
+npm run test -- MyComponent.test.tsx
+```
+
+### E2E Integration Testing
+
+We support both Playwright (recommended) and Cypress for end-to-end testing.
+
+#### Playwright (Recommended - NEW)
+
+Playwright is our new E2E testing framework, gradually replacing Cypress.
+
+```bash
+# Navigate to frontend directory
+cd superset-frontend
+
+# Run all Playwright tests
+npm run playwright:test
+# or: npx playwright test
+
+# Run with interactive UI for debugging
+npm run playwright:ui
+# or: npx playwright test --ui
+
+# Run in headed mode (see browser)
+npm run playwright:headed
+# or: npx playwright test --headed
+
+# Run specific test file
+npx playwright test tests/auth/login.spec.ts
+
+# Run with debug mode (step through tests)
+npm run playwright:debug tests/auth/login.spec.ts
+# or: npx playwright test --debug tests/auth/login.spec.ts
+
+# Generate test report
+npm run playwright:report
+```
+
+#### Cypress (DEPRECATED - will be removed)
+
+Cypress is being phased out in favor of Playwright but is still available:
+
+```bash
+# Set base URL for Cypress
+export CYPRESS_BASE_URL='http://localhost:8088'
+export CYPRESS_DATABASE=test
+export CYPRESS_USERNAME=admin
+export CYPRESS_PASSWORD=admin
+
+# Navigate to Cypress directory
+cd superset-frontend/cypress-base
+
+# Run interactively
+npm run cypress-debug
+
+# Run headless (like CI)
+npm run cypress-run-chrome
+
+# Run specific file
+npm run cypress-run-chrome -- --spec "cypress/e2e/dashboard/dashboard.test.ts"
+```
+
+### Debugging Server App
+
+For debugging the Flask backend:
+
+#### Using PyCharm/IntelliJ
+
+1. Create a new Python configuration
+2. Set script path to `superset/app.py`
+3. Set environment variables:
+   - `FLASK_ENV=development`
+   - `SUPERSET_CONFIG_PATH=/path/to/superset_config.py`
+4. Set breakpoints and run in debug mode
+
+#### Using VS Code
+
+1. Add to `.vscode/launch.json`:
+```json
+{
+  "version": "0.2.0",
+  "configurations": [
+    {
+      "name": "Python: Flask",
+      "type": "python",
+      "request": "launch",
+      "module": "flask",
+      "env": {
+        "FLASK_APP": "superset/app.py",
+        "FLASK_ENV": "development"
+      },
+      "args": ["run", "--no-debugger", "--no-reload"],
+      "jinja": true
+    }
+  ]
+}
+```
+
+2. Set breakpoints and press F5 to debug
+
+### Storybook
+
+Storybook is used for developing and testing UI components in isolation:
+
+```bash
+cd superset-frontend
+
+# Start Storybook
+npm run storybook
+
+# Build static Storybook
+npm run build-storybook
+```
+
+Access Storybook at http://localhost:6006
+
+## Contributing Translations
+
+Superset uses Flask-Babel for internationalization.
+
+### Enabling language selection
+
+Edit `superset_config.py`:
+
+```python
+LANGUAGES = {
+    'en': {'flag': 'us', 'name': 'English'},
+    'fr': {'flag': 'fr', 'name': 'French'},
+    'zh': {'flag': 'cn', 'name': 'Chinese'},
+}
+```
+
+### Creating a new language dictionary
+
+```bash
+# Initialize a new language
+pybabel init -i superset/translations/messages.pot -d superset/translations -l de
+```
+
+### Extracting new strings for translation
+
+```bash
+# Extract Python strings
+pybabel extract -F babel.cfg -o superset/translations/messages.pot -k lazy_gettext superset
+
+# Extract JavaScript strings
+npm run build-translation
+```
+
+### Updating language files
+
+```bash
+# Update all language files with new strings
+pybabel update -i superset/translations/messages.pot -d superset/translations
+```
+
+### Applying translations
+
+```bash
+# Frontend
+cd superset-frontend
+npm run build-translation
+
+# Backend
+pybabel compile -d superset/translations
+```
+
+## Linting
+
+### Python
+
+We use Ruff for Python linting and formatting:
+
+```bash
+# Auto-format using ruff
+ruff format .
+
+# Lint check with ruff
+ruff check .
+
+# Lint fix with ruff
+ruff check --fix .
+```
+
+Pre-commit hooks run automatically on `git commit` if installed.
+
+### TypeScript
+
+We use ESLint and Prettier for TypeScript:
+
+```bash
+cd superset-frontend
+
+# Run eslint checks
+npm run lint
+
+# Run tsc (typescript) checks
+npm run type
+
+# Fix lint issues
+npm run lint-fix
+
+# Format with Prettier
+npm run prettier
+```
+
+## GitHub Ephemeral Environments
+
+For every PR, an ephemeral environment is automatically deployed for testing.
+
+Access pattern: `https://pr-{PR_NUMBER}.superset.apache.org`
+
+Features:
+- Automatically deployed on PR creation/update
+- Includes sample data
+- Destroyed when PR is closed
+- Useful for UI/UX review
+
+## Tips and Tricks
+
+### Using Docker for Development
+
+```bash
+# Rebuild specific service
+docker compose build superset
+
+# View logs
+docker compose logs -f superset
+
+# Execute commands in container
+docker compose exec superset bash
+
+# Reset database
+docker compose down -v
+docker compose up
+```
+
+### Hot Reloading
+
+**Frontend**: Webpack dev server provides hot module replacement automatically.
+
+**Backend**: Use Flask debug mode:
+```bash
+FLASK_ENV=development superset run -p 8088 --with-threads --reload
+```
+
+### Performance Profiling
+
+For Python profiling:
+```python
+# In superset_config.py
+PROFILING = True
+```
+
+For React profiling:
+- Use React DevTools Profiler
+- Enable performance marks in Chrome DevTools
+
+### Database Migrations
+
+```bash
+# Create a new migration
+superset db migrate -m "Description of changes"
+
+# Apply migrations
+superset db upgrade
+
+# Downgrade
+superset db downgrade
+```
+
+### Useful Aliases
+
+Add to your shell profile:
+
+```bash
+alias sdev='FLASK_ENV=development superset run -p 8088 --with-threads --reload'
+alias stest='pytest tests/unit_tests'
+alias slint='pre-commit run --all-files'
+alias sfront='cd superset-frontend && npm run dev-server'
+```
+
+## Common Issues and Solutions
+
+### Node/npm Issues
+
+```bash
+# Clear npm cache
+npm cache clean --force
+
+# Reinstall dependencies
+rm -rf node_modules package-lock.json
+npm install
+```
+
+### Python Environment Issues
+
+```bash
+# Recreate virtual environment
+deactivate
+rm -rf venv
+python3 -m venv venv
+source venv/bin/activate
+pip install -r requirements/development.txt
+pip install -e .
+```
+
+### Database Issues
+
+```bash
+# Reset local database
+superset db downgrade -r base
+superset db upgrade
+superset init
+```
+
+### Port Already in Use
+
+```bash
+# Find process using port
+lsof -i :8088
+# Kill process
+kill -9 [PID]
+```
+
+## Reporting Security Vulnerabilities
+
+Please report security vulnerabilities to **private@superset.apache.org**.
+
+In the event a community member discovers a security flaw in Superset, it is important to follow the [Apache Security Guidelines](https://www.apache.org/security/committers.html) and release a fix as quickly as possible before public disclosure. Reporting security vulnerabilities through the usual GitHub Issues channel is not ideal as it will publicize the flaw before a fix can be applied.
+
+## SQL Lab Async Configuration
+
+It's possible to configure a local database to operate in `async` mode, to work on `async` related features.
+
+To do this, you'll need to:
+
+- Add an additional database entry. We recommend you copy the connection string from the database labeled `main`, and then enable `SQL Lab` and the features you want to use. Don't forget to check the `Async` box
+- Configure a results backend, here's a local `FileSystemCache` example, not recommended for production, but perfect for testing (stores cache in `/tmp`)
+
+  ```python
+  from flask_caching.backends.filesystemcache import FileSystemCache
+  RESULTS_BACKEND = FileSystemCache('/tmp/sqllab')
+  ```
+
+- Start up a celery worker
+
+  ```bash
+  celery --app=superset.tasks.celery_app:app worker -O fair
+  ```
+
+Note that:
+- for changes that affect the worker logic, you'll have to restart the `celery worker` process for the changes to be reflected.
+- The message queue used is a `sqlite` database using the `SQLAlchemy` experimental broker. Ok for testing, but not recommended in production
+- In some cases, you may want to create a context that is more aligned to your production environment, and use the similar broker as well as results backend configuration
+
+## Async Chart Queries
+
+It's possible to configure database queries for charts to operate in `async` mode. This is especially useful for dashboards with many charts that may otherwise be affected by browser connection limits. To enable async queries for dashboards and Explore, the following dependencies are required:
+
+- Redis 5.0+ (the feature utilizes [Redis Streams](https://redis.io/topics/streams-intro))
+- Cache backends enabled via the `CACHE_CONFIG` and `DATA_CACHE_CONFIG` config settings
+- Celery workers configured and running to process async tasks
+
+## Need Help?
+
+- Check the [FAQ](https://superset.apache.org/docs/frequently-asked-questions)
+- Ask in [Slack](https://apache-superset.slack.com)
+- Search [GitHub Issues](https://github.com/apache/superset/issues)
+- Post in [GitHub Discussions](https://github.com/apache/superset/discussions)

docs/developer_portal/contributing/issue-reporting.md

@@ -0,0 +1,418 @@
+---
+title: Issue Reporting
+sidebar_position: 5
+---
+
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# Issue Reporting
+
+Learn how to effectively report bugs and request features for Apache Superset.
+
+## Before Opening an Issue
+
+### Pre-Issue Checklist
+
+1. **Search Existing Issues**
+   ```
+   Search: https://github.com/apache/superset/issues
+   - Use keywords from your error message
+   - Check both open and closed issues
+   - Look for similar problems
+   ```
+
+2. **Check Documentation**
+   - [User Documentation](https://superset.apache.org/docs/intro)
+   - [FAQ](https://superset.apache.org/docs/frequently-asked-questions)
+   - [Configuration Guide](https://superset.apache.org/docs/configuration/configuring-superset)
+
+3. **Verify Version**
+   ```bash
+   # Check Superset version
+   superset version
+
+   # Try latest version
+   pip install --upgrade apache-superset
+   ```
+
+4. **Reproduce Consistently**
+   - Can you reproduce the issue?
+   - Does it happen every time?
+   - What specific actions trigger it?
+
+## Bug Reports
+
+### Bug Report Template
+
+```markdown
+### Bug Description
+A clear and concise description of the bug.
+
+### How to Reproduce
+1. Go to '...'
+2. Click on '...'
+3. Scroll down to '...'
+4. See error
+
+### Expected Behavior
+What you expected to happen.
+
+### Actual Behavior
+What actually happened. Include error messages.
+
+### Screenshots/Videos
+If applicable, add screenshots or recordings.
+
+### Environment
+- Superset version: [e.g., 3.0.0]
+- Python version: [e.g., 3.9.7]
+- Node version: [e.g., 18.17.0]
+- Database: [e.g., PostgreSQL 14]
+- Browser: [e.g., Chrome 120]
+- OS: [e.g., Ubuntu 22.04]
+
+### Additional Context
+- Using Docker: Yes/No
+- Configuration overrides:
+- Feature flags enabled:
+- Authentication method:
+```
+
+### What Makes a Good Bug Report
+
+#### ✅ Good Example
+```markdown
+### Bug Description
+When filtering a dashboard with a date range filter, charts using
+SQL Lab datasets don't update, while charts using regular datasets do.
+
+### How to Reproduce
+1. Create a dashboard with 2 charts:
+   - Chart A: Uses a SQL Lab virtual dataset
+   - Chart B: Uses a regular table dataset
+2. Add a date range filter (last 30 days)
+3. Apply the filter
+4. Chart B updates, Chart A shows no change
+
+### Expected Behavior
+Both charts should filter to show last 30 days of data.
+
+### Actual Behavior
+Only Chart B updates. Chart A still shows all data.
+No error messages in browser console or server logs.
+
+### Screenshots
+[Dashboard before filter]: attachment1.png
+[Dashboard after filter]: attachment2.png
+[Network tab showing requests]: attachment3.png
+
+### Environment
+- Superset version: 3.0.0
+- Python version: 3.9.16
+- Database: PostgreSQL 14.9
+- Browser: Chrome 120.0.6099.71
+- OS: macOS 14.2
+```
+
+#### ❌ Poor Example
+```markdown
+Dashboard filters don't work. Please fix.
+```
+
+### Required Information
+
+#### Error Messages
+```python
+# Include full error traceback
+Traceback (most recent call last):
+  File "...", line X, in function
+    error details
+SupersetException: Detailed error message
+```
+
+#### Logs
+```bash
+# Backend logs
+docker logs superset_app 2>&1 | tail -100
+
+# Or from development
+tail -f ~/.superset/superset.log
+```
+
+#### Browser Console
+```javascript
+// Include JavaScript errors
+// Chrome: F12 → Console tab
+// Include network errors
+// Chrome: F12 → Network tab
+```
+
+#### Configuration
+```python
+# Relevant config from superset_config.py
+FEATURE_FLAGS = {
+    "ENABLE_TEMPLATE_PROCESSING": True,
+    # ... other flags
+}
+```
+
+## Feature Requests
+
+### Feature Request Template
+
+```markdown
+### Is your feature request related to a problem?
+A clear description of the problem you're trying to solve.
+
+### Describe the solution you'd like
+A clear description of what you want to happen.
+
+### Describe alternatives you've considered
+Other solutions or features you've considered.
+
+### Additional context
+Any other context, mockups, or examples.
+
+### Are you willing to contribute?
+- [ ] Yes, I can implement this feature
+- [ ] Yes, I can help test
+- [ ] No, but I can provide feedback
+```
+
+### Good Feature Requests Include
+
+1. **Clear Use Case**
+   ```markdown
+   As a [type of user], I want [feature] so that [benefit].
+
+   Example:
+   As a data analyst, I want to schedule dashboard screenshots
+   so that I can automatically send reports to stakeholders.
+   ```
+
+2. **Mockups/Designs**
+   - UI mockups
+   - Workflow diagrams
+   - API specifications
+
+3. **Impact Analysis**
+   - Who benefits?
+   - How many users affected?
+   - Performance implications?
+
+## Security Issues
+
+### 🔴 IMPORTANT: Security Vulnerabilities
+
+**DO NOT** create public issues for security vulnerabilities!
+
+Instead:
+1. Email: security@apache.org
+2. Subject: `[Superset] Security Vulnerability`
+3. Include:
+   - Description of vulnerability
+   - Steps to reproduce
+   - Potential impact
+   - Suggested fix (if any)
+
+### Security Issue Template
+
+```markdown
+Send to: security@apache.org
+
+### Vulnerability Description
+[Describe the security issue]
+
+### Type
+- [ ] SQL Injection
+- [ ] XSS
+- [ ] CSRF
+- [ ] Authentication Bypass
+- [ ] Information Disclosure
+- [ ] Other: [specify]
+
+### Affected Versions
+[List affected versions]
+
+### Steps to Reproduce
+[Detailed steps - be specific]
+
+### Impact
+[What can an attacker do?]
+
+### Suggested Fix
+[If you have suggestions]
+```
+
+## Issue Labels
+
+### Priority Labels
+- `P0`: Critical - System unusable
+- `P1`: High - Major feature broken
+- `P2`: Medium - Important but workaround exists
+- `P3`: Low - Nice to have
+
+### Type Labels
+- `bug`: Something isn't working
+- `feature`: New feature request
+- `enhancement`: Improvement to existing feature
+- `documentation`: Documentation improvements
+- `question`: Question about usage
+
+### Component Labels
+- `dashboard`: Dashboard functionality
+- `sqllab`: SQL Lab
+- `explore`: Chart builder
+- `visualization`: Chart types
+- `api`: REST API
+- `security`: Security related
+
+### Status Labels
+- `needs-triage`: Awaiting review
+- `confirmed`: Bug confirmed
+- `in-progress`: Being worked on
+- `blocked`: Blocked by dependency
+- `stale`: No activity for 30+ days
+
+## Issue Lifecycle
+
+### 1. Creation
+- User creates issue with template
+- Auto-labeled as `needs-triage`
+
+### 2. Triage
+- Maintainer reviews within 7 days
+- Labels applied (priority, type, component)
+- Questions asked if needed
+
+### 3. Confirmation
+- Bug reproduced or feature discussed
+- Label changed to `confirmed`
+- Assigned to milestone if applicable
+
+### 4. Development
+- Contributor claims issue
+- Label changed to `in-progress`
+- PR linked to issue
+
+### 5. Resolution
+- PR merged
+- Issue auto-closed
+- Or manually closed with explanation
+
+## Following Up
+
+### If No Response
+
+After 7 days without response:
+```markdown
+@apache/superset-committers This issue hasn't been triaged yet.
+Could someone please take a look?
+```
+
+### Providing Updates
+
+```markdown
+Update: I found that this only happens when [condition].
+Here's additional debugging information: [details]
+```
+
+### Issue Staleness
+
+- Bot marks stale after 30 days of inactivity
+- Closes after 7 more days without activity
+- To keep open: Comment with updates
+
+## Tips for Success
+
+### Do's
+- ✅ Search before creating
+- ✅ Use templates
+- ✅ Provide complete information
+- ✅ Include screenshots/videos
+- ✅ Be responsive to questions
+- ✅ Test with latest version
+- ✅ One issue per report
+
+### Don'ts
+- ❌ "+1" or "me too" comments (use reactions)
+- ❌ Multiple issues in one report
+- ❌ Vague descriptions
+- ❌ Screenshots of text (copy/paste instead)
+- ❌ Private/sensitive data in reports
+- ❌ Demanding immediate fixes
+
+## Useful Commands
+
+### Gathering System Info
+
+```bash
+# Full environment info
+python -c "
+import sys
+import superset
+import sqlalchemy
+import pandas
+import numpy
+
+print(f'Python: {sys.version}')
+print(f'Superset: {superset.__version__}')
+print(f'SQLAlchemy: {sqlalchemy.__version__}')
+print(f'Pandas: {pandas.__version__}')
+print(f'NumPy: {numpy.__version__}')
+"
+
+# Database versions
+superset shell
+>>> from superset import db
+>>> print(db.engine.dialect.server_version_info)
+```
+
+### Creating Minimal Reproductions
+
+```python
+# Create test script
+# minimal_repro.py
+from superset import create_app
+
+app = create_app()
+with app.app_context():
+    # Your reproduction code here
+    pass
+```
+
+## Getting Help
+
+### Before Creating an Issue
+
+1. **Slack**: Ask in #troubleshooting
+2. **GitHub Discussions**: Search/ask questions
+3. **Stack Overflow**: Tag `apache-superset`
+4. **Mailing List**: user@superset.apache.org
+
+### Issue Not a Bug?
+
+Consider:
+- **Feature Request**: Use feature request template
+- **Question**: Use GitHub Discussions
+- **Configuration Help**: Ask in Slack
+- **Development Help**: See [Contributing Guide](./overview)
+
+Next: [Understanding the release process](./release-process)

docs/developer_portal/contributing/overview.md

@@ -0,0 +1,166 @@
+---
+title: Overview
+sidebar_position: 1
+---
+
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# Contributing
+
+Superset is an [Apache Software foundation](https://www.apache.org/theapacheway/index.html) project.
+The core contributors (or committers) to Superset communicate primarily in the following channels (which can be joined by anyone):
+
+- [Mailing list](https://lists.apache.org/list.html?dev@superset.apache.org)
+- [Apache Superset Slack community](http://bit.ly/join-superset-slack)
+- [GitHub issues](https://github.com/apache/superset/issues)
+- [GitHub pull requests](https://github.com/apache/superset/pulls)
+- [GitHub discussions](https://github.com/apache/superset/discussions)
+- [Superset Community Calendar](https://superset.apache.org/community)
+
+More references:
+
+- [Superset Wiki (code guidelines and additional resources)](https://github.com/apache/superset/wiki)
+
+## Orientation
+
+Here's a list of repositories that contain Superset-related packages:
+
+- [apache/superset](https://github.com/apache/superset)
+  is the main repository containing the `apache_superset` Python package
+  distributed on
+  [pypi](https://pypi.org/project/apache_superset/). This repository
+  also includes Superset's main TypeScript/JavaScript bundles and react apps under
+  the [superset-frontend](https://github.com/apache/superset/tree/master/superset-frontend)
+  folder.
+- [github.com/apache-superset](https://github.com/apache-superset) is the
+  GitHub organization under which we manage Superset-related
+  small tools, forks and Superset-related experimental ideas.
+
+## Types of Contributions
+
+### Report Bug
+
+The best way to report a bug is to file an issue on GitHub. Please include:
+
+- Your operating system name and version.
+- Superset version.
+- Detailed steps to reproduce the bug.
+- Any details about your local setup that might be helpful in troubleshooting.
+
+When posting Python stack traces, please quote them using
+[Markdown blocks](https://help.github.com/articles/creating-and-highlighting-code-blocks/).
+
+_Please note that feature requests opened as GitHub Issues will be moved to Discussions._
+
+### Submit Ideas or Feature Requests
+
+The best way is to start an ["Ideas" Discussion thread](https://github.com/apache/superset/discussions/categories/ideas) on GitHub:
+
+- Explain in detail how it would work.
+- Keep the scope as narrow as possible, to make it easier to implement.
+- Remember that this is a volunteer-driven project, and that your contributions are as welcome as anyone's :)
+
+To propose large features or major changes to codebase, and help usher in those changes, please create a **Superset Improvement Proposal (SIP)**. See template from [SIP-0](https://github.com/apache/superset/issues/5602)
+
+### Fix Bugs
+
+Look through the GitHub issues. Issues tagged with `#bug` are
+open to whoever wants to implement them.
+
+### Implement Features
+
+Look through the GitHub issues. Issues tagged with
+`#feature` are open to whoever wants to implement them.
+
+### Improve Documentation
+
+Superset could always use better documentation,
+whether as part of the official Superset docs,
+in docstrings, `docs/*.rst` or even on the web as blog posts or
+articles. See [Documentation](./howtos#contributing-to-documentation) for more details.
+
+### Add Translations
+
+If you are proficient in a non-English language, you can help translate
+text strings from Superset's UI. You can jump into the existing
+language dictionaries at
+`superset/translations/<language_code>/LC_MESSAGES/messages.po`, or
+even create a dictionary for a new language altogether.
+See [Translating](./howtos#contributing-translations) for more details.
+
+### Ask Questions
+
+There is a dedicated [`apache-superset` tag](https://stackoverflow.com/questions/tagged/apache-superset) on [StackOverflow](https://stackoverflow.com/). Please use it when asking questions.
+
+## Types of Contributors
+
+Following the project governance model of the Apache Software Foundation (ASF), Apache Superset has a specific set of contributor roles:
+
+### PMC Member
+
+A Project Management Committee (PMC) member is a person who has been elected by the PMC to help manage the project. PMC members are responsible for the overall health of the project, including community development, release management, and project governance. PMC members are also responsible for the technical direction of the project.
+
+For more information about Apache Project PMCs, please refer to https://www.apache.org/foundation/governance/pmcs.html
+
+### Committer
+
+A committer is a person who has been elected by the PMC to have write access (commit access) to the code repository. They can modify the code, documentation, and website and accept contributions from others.
+
+The official list of committers and PMC members can be found [here](https://projects.apache.org/committee.html?superset).
+
+### Contributor
+
+A contributor is a person who has contributed to the project in any way, including but not limited to code, tests, documentation, issues, and discussions.
+
+> You can also review the Superset project's guidelines for PMC member promotion here: https://github.com/apache/superset/wiki/Guidelines-for-promoting-Superset-Committers-to-the-Superset-PMC
+
+### Security Team
+
+The security team is a selected subset of PMC members, committers and non-committers who are responsible for handling security issues.
+
+New members of the security team are selected by the PMC members in a vote. You can request to be added to the team by sending a message to private@superset.apache.org. However, the team should be small and focused on solving security issues, so the requests will be evaluated on a case-by-case basis and the team size will be kept relatively small, limited to only actively security-focused contributors.
+
+This security team must follow the [ASF vulnerability handling process](https://apache.org/security/committers.html#asf-project-security-for-committers).
+
+Each new security issue is tracked as a JIRA ticket on the [ASF's JIRA Superset security project](https://issues.apache.org/jira/secure/RapidBoard.jspa?rapidView=588&projectKey=SUPERSETSEC)
+
+Security team members must:
+
+- Have an [ICLA](https://www.apache.org/licenses/contributor-agreements.html) signed with Apache Software Foundation.
+- Not reveal information about pending and unfixed security issues to anyone (including their employers) unless specifically authorised by the security team members, e.g., if the security team agrees that diagnosing and solving an issue requires the involvement of external experts.
+
+A release manager, the contributor overseeing the release of a specific version of Apache Superset, is by default a member of the security team.  However, they are not expected to be active in assessing, discussing, and fixing security issues.
+
+Security team members should also follow these general expectations:
+
+- Actively participate in assessing, discussing, fixing, and releasing security issues in Superset.
+- Avoid discussing security fixes in public forums. Pull request (PR) descriptions should not contain any information about security issues. The corresponding JIRA ticket should contain a link to the PR.
+- Security team members who contribute to a fix may be listed as remediation developers in the CVE report, along with their job affiliation (if they choose to include it).
+
+## Getting Started
+
+Ready to contribute? Here's how to get started:
+
+1. **[Set up your environment](./development-setup)** - Get Superset running locally
+2. **[Find something to work on](#types-of-contributions)** - Pick an issue or feature
+3. **[Submit your contribution](./submitting-pr)** - Create a pull request
+4. **[Follow guidelines](./guidelines)** - Ensure code quality
+
+Welcome to the Apache Superset community! 🚀