revert: roll back SQLAlchemy 2.0 upgrade (#42803)

Revert squash commit 8014f782d3 while
preserving the 86 commits subsequently merged to master. Restore SQLAlchemy
1.4.54 and Flask-SQLAlchemy 2.5.1 behavior, including compatible dialect
bounds, ORM/session handling, and warning coverage.

Requirements were regenerated with ./scripts/uv-pip-compile.sh using the
repository's Python 3.11 Docker workflow. The revert applied without textual
conflicts. Post-merge session/savepoint and DuckDB changes were retained and
verified against SQLAlchemy 1.4; no post-#42803 commit required an additional
compatibility change.

.github/workflows/bump-python-package.yml

@@ -21,6 +21,9 @@ on:
   #schedule:
   #  - cron: '0 0 * * *'  # Runs daily at midnight UTC
 
+permissions:
+  contents: read
+
 jobs:
   bump-python-package:
     runs-on: ubuntu-slim

.github/workflows/check-db-migration-confict.yml

@@ -16,6 +16,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   check_db_migration_conflict:
     name: Check DB migration conflict

.github/workflows/codeql-analysis.yml

@@ -14,6 +14,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   changes:
     runs-on: ubuntu-26.04

.github/workflows/docker.yml

@@ -51,6 +51,53 @@ jobs:
           echo "matrix_config=${MATRIX_CONFIG}" >> $GITHUB_OUTPUT
           echo $GITHUB_OUTPUT
 
+  # Runs unconditionally (no dependency on `changes`, and no build-preset
+  # matrix restriction) so a regression in the PY_VER override logic is
+  # always caught on PRs. Without this, the real docker-build job only runs
+  # when the change detector flags docker/python/frontend changes (a
+  # workflow-only edit like this one does not), and even then the PR build
+  # matrix never includes the "py311"/"py312" presets that logic protects -
+  # so a break here would otherwise first surface on a push to master.
+  pyver-override-check:
+    name: verify docker build PY_VER override
+    runs-on: ubuntu-26.04
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Setup supersetbot
+        uses: ./.github/actions/setup-supersetbot/
+      - name: Assert PY_VER override applies to every preset except py311/py312
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          # Asserts against the actual buildx command line `supersetbot docker
+          # --dry-run` would run, not just this repo's own extra-flags helper,
+          # so a regression in supersetbot itself (dropping the py311/py312
+          # PY_VER pin, or reordering args so our override no longer lands
+          # last) is caught here too, instead of only surfacing on master.
+          assert_effective_py_ver() {
+            local preset="$1" expected="$2" extra_flags command actual
+            extra_flags="$(scripts/docker-build-extra-flags.sh "$preset" dummy-tag)"
+            command="$(supersetbot docker --preset "$preset" --platform linux/amd64 --extra-flags "$extra_flags" --dry-run)"
+            # docker buildx keeps the LAST value of a repeated --build-arg key.
+            actual="$(grep -oE -- '--build-arg PY_VER=[^[:space:]]+' <<<"$command" | tail -1)"
+            if [ "$actual" != "--build-arg PY_VER=$expected" ]; then
+              echo "::error::preset '$preset' expected effective --build-arg PY_VER=$expected, got: ${actual:-<none>} (full command: $command)"
+              exit 1
+            fi
+          }
+          for preset in dev lean websocket dockerize; do
+            assert_effective_py_ver "$preset" "3.11.14-slim-trixie"
+          done
+          assert_effective_py_ver py311 "3.11-slim-bookworm"
+          assert_effective_py_ver py312 "3.12-slim-bookworm"
+          echo "PY_VER override logic verified against the assembled buildx command for all build presets"
+
   docker-build:
     name: docker-build
     needs: [setup_matrix, changes]
@@ -124,19 +171,21 @@ jobs:
           # the whole job. buildx reuses the buildkit layer cache from the
           # failed attempt, so a retry mostly re-does just the failed push.
           #
-          # supersetbot's "dev"/"lean" presets pin their own --build-arg
-          # PY_VER, which lands ahead of --extra-flags on the assembled
-          # buildx command line; docker/buildx keeps the last value for a
-          # repeated --build-arg key, so appending PY_VER here overrides
-          # supersetbot's pin and keeps the build on the Dockerfile's own
-          # supported Python version.
+          # See scripts/docker-build-extra-flags.sh for why "py311"/"py312"
+          # are excluded from the PY_VER override applied to every other
+          # preset; that logic is also exercised on every PR by the
+          # always-on pyver-override-check job below, since this job itself
+          # only runs when the change detector flags docker/python/frontend
+          # changes and the PR build matrix never includes py311/py312.
+          EXTRA_FLAGS="$(scripts/docker-build-extra-flags.sh "$BUILD_PRESET" "$IMAGE_TAG")"
+
           for attempt in 1 2 3; do
             if supersetbot docker \
               $PUSH_OR_LOAD \
               --preset "$BUILD_PRESET" \
               --context "$EVENT" \
               --context-ref "$RELEASE" $FORCE_LATEST \
-              --extra-flags "--build-arg PY_VER=3.11.14-slim-trixie --build-arg INCLUDE_CHROMIUM=false --tag $IMAGE_TAG" \
+              --extra-flags "$EXTRA_FLAGS" \
               $PLATFORM_ARG; then
               break
             fi

.github/workflows/enforce-single-migration-head.yml

@@ -33,6 +33,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   enforce-single-migration-head:
     runs-on: ubuntu-26.04

.github/workflows/frontend-bundle-size-nightly.yml

@@ -0,0 +1,135 @@
+name: Frontend bundle size (nightly baseline + analyzer)
+
+# Refreshes the bundle-size baseline that superset-frontend.yml's `bundle-size`
+# job compares PRs against, and publishes a browsable bundle-analyzer treemap
+# report of the same build. Deliberately NOT triggered on every push to
+# master: a day-old baseline/report is fine for catching relative
+# regressions on PRs and for browsing what's actually in the bundle, and
+# building the production bundle on every one of the many pushes master
+# gets per day would burn CI time for no benefit a nightly refresh doesn't
+# already cover.
+on:
+  schedule:
+    - cron: "0 6 * * *"
+  workflow_dispatch: {}
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
+env:
+  TAG: apache/superset:bundle-size-nightly-${{ github.run_id }}
+
+permissions:
+  contents: read
+
+jobs:
+  refresh-baseline:
+    runs-on: ubuntu-26.04
+    timeout-minutes: 30
+    env:
+      NETLIFY_SITE_ID: ${{ secrets.NETLIFY_BUNDLE_ANALYZER_SITE_ID }}
+    steps:
+      - name: "Checkout master"
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          ref: master
+
+      - name: Build Docker Image
+        run: |
+          docker buildx build \
+            -t $TAG \
+            --cache-from=type=registry,ref=apache/superset-cache:3.11-slim-trixie \
+            --target superset-node-ci \
+            .
+
+      # Same cache the PR-time bundle-size job restores/writes -- webpack's
+      # persistent filesystem cache turns a warm production build into ~20s
+      # instead of several minutes. See superset-frontend.yml for the
+      # matching restore step and why it's keyed this way.
+      - name: Restore webpack build cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: superset-frontend/.temp_cache
+          key: >-
+            webpack-prod-cache-${{ hashFiles('superset-frontend/package-lock.json',
+            'superset-frontend/babel.config.js', 'superset-frontend/tsconfig.json',
+            'superset-frontend/webpack.config.js') }}
+
+      # Only ever pull the last recorded data point off the cache, keyed by
+      # run ID -- `restore-keys` prefix-matches the most recently created
+      # entry. Absent on the very first run ever; benchmark-action starts a
+      # fresh history in that case.
+      - name: Restore bundle size history
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: bundle-size-history.json
+          key: bundle-size-history-${{ github.run_id }}
+          restore-keys: |
+            bundle-size-history-
+
+      # BUNDLE_ANALYZER rides along in the same build as BUNDLE_SIZE_STATS --
+      # they're independent env-gated additions in webpack.config.js (one
+      # sets `config.stats`, the other pushes plugins), so one production
+      # build produces both the numeric stats.json and the analyzer's
+      # report.html. Only report.html is mounted out, not
+      # BUNDLE_ANALYZER's sibling `statistics.html` sunburst -- that file is
+      # documented in webpack.config.js as routinely exceeding 100MB for
+      # this app (it's .gitignore'd for exactly that reason), too large to
+      # publish as a static site page.
+      - name: Build production bundle with stats and analyzer report
+        run: |
+          mkdir -p ${{ github.workspace }}/superset-frontend/bundle-stats
+          mkdir -p ${{ github.workspace }}/superset-frontend/.temp_cache
+          mkdir -p ${{ github.workspace }}/superset/static/assets
+          docker run \
+          -v ${{ github.workspace }}/superset-frontend/bundle-stats:/app/superset-frontend/bundle-stats \
+          -v ${{ github.workspace }}/superset-frontend/.temp_cache:/app/superset-frontend/.temp_cache \
+          -v ${{ github.workspace }}/superset/static/assets:/app/superset/static/assets \
+          --rm $TAG \
+          bash -c \
+          "npm i && BUNDLE_SIZE_STATS=true BUNDLE_ANALYZER=true npm run build -- --json=bundle-stats/stats.json"
+
+      - name: Summarize bundle size
+        run: |
+          node superset-frontend/scripts/bundle-size-summary.js \
+            superset-frontend/bundle-stats/stats.json > bundle-size-summary.json
+          rm -rf superset-frontend/bundle-stats
+
+      # No PR to comment on here, so comment-on-alert is off -- the job
+      # summary (summary-always) is the only surface for this run.
+      - name: Update bundle size baseline
+        uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1
+        with:
+          tool: customSmallerIsBetter
+          output-file-path: bundle-size-summary.json
+          external-data-json-path: bundle-size-history.json
+          fail-on-alert: false
+          summary-always: true
+
+      - name: Save bundle size history
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: bundle-size-history.json
+          key: bundle-size-history-${{ github.run_id }}
+
+      # Publishes the treemap to Netlify (the same host already used for
+      # superset-storybook.netlify.app and docs previews, reusing the
+      # existing NETLIFY_AUTH_TOKEN). Skipped until
+      # NETLIFY_BUNDLE_ANALYZER_SITE_ID exists -- create a new (free)
+      # Netlify site named superset-bundle-analyzer and add its site ID as
+      # that secret to turn this on; nothing else in this workflow depends
+      # on it.
+      - name: Publish bundle analyzer report to Netlify
+        if: ${{ env.NETLIFY_SITE_ID != '' }}
+        env:
+          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
+        run: |
+          mkdir -p netlify-publish
+          cp superset/static/assets/report.html netlify-publish/index.html
+          # zizmor: ignore[adhoc-packages] - netlify-cli is a one-shot CI deploy
+          # tool, not an application dependency; a global/npx install has no
+          # lockfile context. Version pinned above the floor set by other
+          # ad-hoc installs in this repo (bump deliberately when upgrading).
+          npx --yes netlify-cli@27.0.1 deploy --prod --dir=netlify-publish

.github/workflows/github-action-validator.yml

@@ -45,5 +45,8 @@ jobs:
       - name: Run Script
         run: bash .github/workflows/github-action-validator.sh
 
+      - name: Test docs-deploy freshness gate
+        run: bash .github/workflows/scripts/check-docs-deploy-freshness.test.sh
+
       - name: Check for security issues on GHA workflows
         uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2

.github/workflows/issue-creation.yml

@@ -7,6 +7,9 @@ on:
   pull_request:
     types: [opened, edited]
 
+permissions:
+  contents: read
+
 jobs:
   superbot-orglabel:
     runs-on: ubuntu-slim

.github/workflows/labeler.yml

@@ -7,6 +7,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   labeler:
     permissions:

.github/workflows/latest-release-tag.yml

@@ -3,6 +3,9 @@ on:
   release:
     types: [published] # This makes it run only when a new released is published
 
+permissions:
+  contents: read
+
 jobs:
   latest-release:
     name: Add/update tag to new release

.github/workflows/pr-lint.yml

@@ -19,6 +19,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: false
 
+permissions:
+  contents: read
+
 jobs:
   lint-check:
     runs-on: ubuntu-slim

.github/workflows/scripts/check-docs-deploy-freshness.sh

@@ -0,0 +1,49 @@
+#!/bin/bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Shared freshness gate used by the Docs Deployment workflow
+# (superset-docs-deploy.yml) both up front (check-freshness) and again right
+# before the deploy step (recheck-freshness). Writes an output declaring
+# whether BUILD_SHA is still master's current tip, so a superseded run can
+# skip cleanly instead of racing (and clobbering, or being force-cancelled
+# by) a fresher run.
+#
+# Required env vars:
+#   BUILD_SHA     - the commit SHA this run is building
+#   REPO          - "owner/repo" to query, e.g. github.repository
+#   OUTPUT_NAME   - the GITHUB_OUTPUT key to write, e.g. "is-current"
+#   GITHUB_OUTPUT - path to append outputs to (set by the Actions runner)
+# Optional env vars:
+#   EVENT_NAME    - if "workflow_dispatch", bypasses the check and always
+#                   reports current, since a manual dispatch is a deliberate,
+#                   one-off action rather than something racing other triggers
+#   GH_TOKEN      - passed through to `gh`, needed to call the GitHub API
+
+set -euo pipefail
+
+if [ "${EVENT_NAME:-}" = "workflow_dispatch" ]; then
+  echo "${OUTPUT_NAME}=true" >>"$GITHUB_OUTPUT"
+  exit 0
+fi
+
+latest_sha="$(gh api "repos/${REPO}/commits/master" --jq .sha)"
+if [ "${latest_sha}" = "${BUILD_SHA}" ]; then
+  echo "${OUTPUT_NAME}=true" >>"$GITHUB_OUTPUT"
+else
+  echo "${OUTPUT_NAME}=false" >>"$GITHUB_OUTPUT"
+  echo "::notice::master has moved on to ${latest_sha} since ${BUILD_SHA} was triggered — skipping this stale run."
+fi

.github/workflows/scripts/check-docs-deploy-freshness.test.sh

@@ -0,0 +1,100 @@
+#!/bin/bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Exercises check-docs-deploy-freshness.sh against a stubbed `gh`, covering
+# the dispatch-bypass, current-tip and stale-tip branches so the output
+# contract (is-current / still-current) can't silently regress. Run
+# directly, no extra tooling required:
+#   bash .github/workflows/scripts/check-docs-deploy-freshness.test.sh
+
+set -euo pipefail
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+script_under_test="${script_dir}/check-docs-deploy-freshness.sh"
+
+failures=0
+
+# Runs the script under test with a stubbed `gh` reporting $1 as master's
+# latest sha, asserting that GITHUB_OUTPUT ends up containing exactly $4.
+run_case() {
+  local case_name="$1"
+  local latest_sha="$2"
+  local build_sha="$3"
+  local event_name="$4"
+  local expected_line="$5"
+
+  local workdir
+  workdir="$(mktemp -d)"
+  trap 'rm -rf "${workdir}"' RETURN
+
+  # Fake `gh` that just echoes back the requested "latest" sha regardless of
+  # arguments, so the script under test never touches the network.
+  cat >"${workdir}/gh" <<EOF
+#!/bin/bash
+echo '${latest_sha}'
+EOF
+  chmod +x "${workdir}/gh"
+
+  local output_file="${workdir}/github_output"
+  : >"${output_file}"
+
+  if PATH="${workdir}:${PATH}" \
+    GITHUB_OUTPUT="${output_file}" \
+    OUTPUT_NAME="is-current" \
+    REPO="apache/superset" \
+    BUILD_SHA="${build_sha}" \
+    EVENT_NAME="${event_name}" \
+    GH_TOKEN="fake-token" \
+    bash "${script_under_test}"; then
+    :
+  else
+    echo "FAIL (${case_name}): script exited non-zero"
+    failures=$((failures + 1))
+    return
+  fi
+
+  local actual
+  actual="$(cat "${output_file}")"
+  if [ "${actual}" = "${expected_line}" ]; then
+    echo "PASS (${case_name})"
+  else
+    echo "FAIL (${case_name}): expected '${expected_line}', got '${actual}'"
+    failures=$((failures + 1))
+  fi
+}
+
+# `gh` prints "should-not-be-called" for the dispatch case above the trick:
+# it's never actually invoked since the bypass short-circuits before the
+# `gh api` call, but the fake still needs a body.
+run_case "workflow_dispatch bypasses the check" \
+  "unused" "abc123" "workflow_dispatch" \
+  "is-current=true"
+
+run_case "build sha matches master's tip" \
+  "abc123" "abc123" "push" \
+  "is-current=true"
+
+run_case "build sha is stale" \
+  "def456" "abc123" "push" \
+  "is-current=false"
+
+if [ "${failures}" -gt 0 ]; then
+  echo "${failures} case(s) failed"
+  exit 1
+fi
+
+echo "All cases passed"

.github/workflows/showtime-cleanup.yml

@@ -17,6 +17,9 @@ env:
   GITHUB_ORG: ${{ github.repository_owner }}
   GITHUB_REPO: ${{ github.event.repository.name }}
 
+permissions:
+  contents: read
+
 jobs:
   cleanup-expired:
     name: Clean up expired showtime environments

.github/workflows/showtime-trigger.yml

@@ -26,6 +26,9 @@ env:
   GITHUB_REPO: ${{ github.event.repository.name }}
   GITHUB_ACTOR: ${{ github.actor }}
 
+permissions:
+  contents: read
+
 jobs:
   sync:
     name: 🎪 Sync PR to desired state

.github/workflows/superset-docs-deploy.yml

@@ -18,16 +18,6 @@ on:
 
   workflow_dispatch: {}
 
-# Serialize deploys: the action pushes to apache/superset-site without
-# rebasing, so concurrent runs race on the final push and the loser fails
-# with `! [rejected] asf-site -> asf-site (fetch first)`. Cancel any
-# in-progress run as soon as a newer one starts — the destination repo
-# isn't touched until the final push step, so canceling mid-build is safe,
-# and the freshest content always wins.
-concurrency:
-  group: docs-deploy-asf-site
-  cancel-in-progress: true
-
 permissions:
   contents: read
   actions: read
@@ -48,17 +38,69 @@ jobs:
 
         env:
           SUPERSET_SITE_BUILD: ${{ (secrets.SUPERSET_SITE_BUILD != '' && secrets.SUPERSET_SITE_BUILD != '') || '' }}
+
+  # Master gets frequent, sometimes bursty pushes, and each one can trigger a
+  # deploy attempt. Rather than let every superseded attempt get force-killed
+  # by the build-deploy concurrency group below (which shows up as a
+  # `cancelled` — i.e. red/failing-looking — check on that commit), have each
+  # run check up front whether it's still building master's current tip and,
+  # if not, skip cleanly. Deliberately outside the docs-deploy-asf-site
+  # concurrency group so it runs immediately for every trigger without
+  # blocking or being blocked by anything.
+  check-freshness:
+    runs-on: ubuntu-26.04
+    outputs:
+      is-current: ${{ steps.check.outputs.is-current }}
+    steps:
+      # Sparse checkout: this job's only job is to be fast, so it fetches
+      # nothing but the freshness-check script itself.
+      - name: Checkout freshness-check script
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          sparse-checkout: |
+            .github/workflows/scripts
+          sparse-checkout-cone-mode: false
+      - name: "Check whether this is still master's current commit"
+        id: check
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BUILD_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+          EVENT_NAME: ${{ github.event_name }}
+          REPO: ${{ github.repository }}
+          OUTPUT_NAME: is-current
+        run: .github/workflows/scripts/check-docs-deploy-freshness.sh
+
   build-deploy:
-    needs: config
+    needs: [config, check-freshness]
+    # Only the run for master's current tip proceeds; anything superseded
+    # already skipped at check-freshness above instead of landing here.
     # For workflow_run triggers, only deploy when the triggering run originated
     # from this repository (not a fork), ensuring the checked-out code and any
     # local actions executed with deploy credentials are trusted.
     if: >-
       needs.config.outputs.has-secrets &&
+      needs.check-freshness.outputs.is-current == 'true' &&
       (github.event_name != 'workflow_run' ||
        github.event.workflow_run.head_repository.full_name == github.repository)
     name: Build & Deploy
     runs-on: ubuntu-26.04
+    # Serialize deploys: the action pushes to apache/superset-site without
+    # rebasing, so concurrent runs race on the final push and the loser fails
+    # with `! [rejected] asf-site -> asf-site (fetch first)`. Queue instead of
+    # canceling: a run that already passed check-freshness can still be
+    # sitting in the queue for a runner when a newer run starts and finishes
+    # first. cancel-in-progress would let that stale, queued run kill the
+    # newer run's in-progress deploy the moment it's finally scheduled, and
+    # then skip itself at the re-check below — losing the deploy entirely.
+    # Queuing means the stale run just waits its turn and then no-ops at the
+    # re-check, so the fresher content that already deployed is never
+    # clobbered or lost. The check-freshness gate above means it should be
+    # rare for more than one run to reach this point, so the queue stays
+    # short in practice.
+    concurrency:
+      group: docs-deploy-asf-site
+      cancel-in-progress: false
     steps:
       - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
         with:
@@ -130,7 +172,24 @@ jobs:
         working-directory: docs
         run: |
           yarn build
+      # The check-freshness job above narrows the window but doesn't close it: an
+      # older run can observe is-current=true, then sit through this build while a
+      # newer run's own freshness check also passes and it deploys and finishes
+      # first. If this (stale) run then wins entry into the concurrency group, it
+      # would overwrite the newer content that already deployed. Re-check right
+      # before the one step that actually mutates superset-site, so a stale run
+      # skips deploying instead of clobbering a fresher one that already ran.
+      - name: "Re-check freshness immediately before deploying"
+        id: recheck-freshness
+        if: github.event_name != 'workflow_dispatch'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BUILD_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+          REPO: ${{ github.repository }}
+          OUTPUT_NAME: still-current
+        run: .github/workflows/scripts/check-docs-deploy-freshness.sh
       - name: deploy docs
+        if: github.event_name == 'workflow_dispatch' || steps.recheck-freshness.outputs.still-current == 'true'
         uses: ./.github/actions/github-action-push-to-another-repository
         env:
           API_TOKEN_GITHUB: ${{ secrets.SUPERSET_SITE_BUILD }}

.github/workflows/superset-e2e.yml

@@ -26,6 +26,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   changes:
     runs-on: ubuntu-26.04

.github/workflows/superset-frontend.yml

@@ -212,3 +212,100 @@ jobs:
       - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
         with:
           expand-composite-actions: true
+
+  # Compares a PR's own bundle size against the last nightly-recorded
+  # baseline (see frontend-bundle-size-nightly.yml, which owns actually
+  # persisting new baselines). PR-only: a push to master doesn't need this
+  # check re-run against itself, and re-persisting the baseline on every
+  # push to master -- which happens many times a day -- would burn a full
+  # production build for no benefit nightly refresh doesn't already cover.
+  bundle-size:
+    needs: frontend-build
+    if: needs.frontend-build.outputs.should-run == 'true' && github.event_name == 'pull_request'
+    runs-on: ubuntu-26.04
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+
+      - name: Download Docker Image Artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: docker-image
+
+      - name: Load Docker Image
+        run: |
+          zstd -d < docker-image.tar.zst | docker load
+
+      # webpack's persistent filesystem cache (superset-frontend/webpack.config.js)
+      # turns a warm production build into ~20s instead of several minutes,
+      # but GH-hosted runners are fresh VMs with nothing carried over between
+      # jobs -- without restoring it explicitly, every single PR would pay
+      # the full cold-build cost. Keyed on the same files webpack's own
+      # `buildDependencies` invalidates on, so a stale cache is never used.
+      - name: Restore webpack build cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: superset-frontend/.temp_cache
+          key: >-
+            webpack-prod-cache-${{ hashFiles('superset-frontend/package-lock.json',
+            'superset-frontend/babel.config.js', 'superset-frontend/tsconfig.json',
+            'superset-frontend/webpack.config.js') }}
+
+      # Only ever pull the last recorded data point off the cache, keyed by
+      # run ID -- `restore-keys` prefix-matches the most recently created
+      # entry, which is always the latest nightly run. Absent before the
+      # first nightly run ever happens; benchmark-action starts a fresh
+      # history in that case.
+      - name: Restore bundle size history
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: bundle-size-history.json
+          key: bundle-size-history-${{ github.run_id }}
+          restore-keys: |
+            bundle-size-history-
+
+      - name: Build production bundle with stats
+        run: |
+          mkdir -p ${{ github.workspace }}/superset-frontend/bundle-stats
+          mkdir -p ${{ github.workspace }}/superset-frontend/.temp_cache
+          docker run \
+          -v ${{ github.workspace }}/superset-frontend/bundle-stats:/app/superset-frontend/bundle-stats \
+          -v ${{ github.workspace }}/superset-frontend/.temp_cache:/app/superset-frontend/.temp_cache \
+          --rm $TAG \
+          bash -c \
+          "npm i && BUNDLE_SIZE_STATS=true npm run build -- --json=bundle-stats/stats.json"
+
+      - name: Summarize bundle size
+        run: |
+          node superset-frontend/scripts/bundle-size-summary.js \
+            superset-frontend/bundle-stats/stats.json > bundle-size-summary.json
+          rm -rf superset-frontend/bundle-stats
+
+      # Comparison + alert only -- this job never persists. See
+      # frontend-bundle-size-nightly.yml for why.
+      #
+      # comment-on-alert is gated to same-repo PRs: on a fork PR,
+      # GITHUB_TOKEN is forced read-only regardless of the `permissions`
+      # block above, so once the alert threshold is crossed the action's
+      # `pulls.createReview` call 403s. That error isn't gated by
+      # fail-on-alert (which only governs the deliberate alert-threshold
+      # failure) -- it propagates and fails the job outright. Fork PRs
+      # still get the comparison via the job summary (summary-always).
+      - name: Compare bundle size against nightly baseline
+        uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1
+        with:
+          tool: customSmallerIsBetter
+          output-file-path: bundle-size-summary.json
+          external-data-json-path: bundle-size-history.json
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          comment-on-alert: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
+          alert-threshold: "110%"
+          fail-on-alert: false
+          summary-always: true

.github/workflows/superset-helm-release.yml

@@ -27,6 +27,9 @@ concurrency:
   group: helm-release
   cancel-in-progress: false
 
+permissions:
+  contents: read
+
 jobs:
   release:
     runs-on: ubuntu-26.04

.github/workflows/superset-playwright.yml

@@ -22,6 +22,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   changes:
     runs-on: ubuntu-26.04

.github/workflows/superset-python-presto-hive.yml

@@ -14,6 +14,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   changes:
     runs-on: ubuntu-26.04

.github/workflows/supersetbot.yml

@@ -13,6 +13,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   supersetbot:
     runs-on: ubuntu-26.04

.github/workflows/welcome-new-users.yml

@@ -5,6 +5,9 @@ on:
   pull_request_target:
     types: [opened]
 
+permissions:
+  contents: read
+
 jobs:
   welcome:
     runs-on: ubuntu-slim

README.md

@@ -31,6 +31,8 @@ under the License.
 [![Open PRs](https://img.shields.io/github/issues-pr/apache/superset)](https://github.com/apache/superset/pulls)
 [![Get on Slack](https://img.shields.io/badge/slack-join-orange.svg)](https://bit.ly/join-superset-slack)
 [![Documentation](https://img.shields.io/badge/docs-apache.org-blue.svg)](https://superset.apache.org)
+[![Storybook](https://img.shields.io/badge/storybook-live-ff4785.svg)](https://superset-storybook.netlify.app)
+[![Bundle Analyzer](https://img.shields.io/badge/bundle%20analyzer-nightly-8dd6f9.svg)](https://superset-bundle-analyzer.netlify.app)
 
 <picture width="500">
   <source

UPDATING.md

@@ -74,31 +74,6 @@ for downstream analysis but is a visible change for anyone who relied on the
 formatted text in those files. The rendered email body (the only place the
 formatting is intended for) is unaffected.
 
-### SQLAlchemy bumped to 2.0, flask-sqlalchemy to 3.1.1
-
-Superset's core ORM dependencies move from SQLAlchemy 1.4 to 2.0 and
-flask-sqlalchemy `<3.0` to 3.1.1, completing the migration tracked in
-[discussion #40273](https://github.com/apache/superset/discussions/40273).
-
-**Custom `db_engine_specs`, plugins, or extensions that import SQLAlchemy
-internals directly** should review the
-[SQLAlchemy 1.4-to-2.0 migration guide](https://docs.sqlalchemy.org/en/20/changelog/migration_20.html)
-for API changes that affect them — most 1.4 code already runs unmodified
-under 2.0's compatibility mode, but patterns like `Engine.execute()`,
-string-keyed `Row` access, and `MetaData(bind=)` are removed outright.
-
-**Several optional DB-connector extras remain capped below their
-SQLAlchemy-2.0-only releases**, either because that bump is a separate
-follow-up ([#42891](https://github.com/apache/superset/pull/42891): dremio,
-exasol, firebird, redshift, risingwave) or because the upstream dialect
-package has no SQLAlchemy 2.0 support yet at all (aurora-data-api, d1,
-kusto, solr; ocient's 2.0 compatibility is unverified). Installing one of
-these extras continues to pull a SQLAlchemy-1.4-line version of that
-dialect; each package's constraint in `pyproject.toml` documents why.
-
-No application-level configuration changes are required for deployments
-that don't touch SQLAlchemy directly.
-
 ### Soft delete is on by default, and purging is live
 
 `SOFT_DELETE` now ships **on** (`DEFAULT_FEATURE_FLAGS`), so deleting a

docs/admin_docs/configuration/configuring-superset.mdx

@@ -97,6 +97,54 @@ for more information on how to configure it.
 
 At the very least, you'll want to change `SECRET_KEY` and `SQLALCHEMY_DATABASE_URI`. Continue reading for more about each of these.
 
+## Localizing D3 date and time labels
+
+`BABEL_DEFAULT_LOCALE` controls Superset's application translations, while
+`D3_TIME_FORMAT` provides localized date and time names to visualizations that
+use the D3 formatter registry, including Calendar Heatmap. Configure both when
+you want the application and chart labels to use the same locale.
+
+`D3_TIME_FORMAT` accepts partial overrides. For example, Russian month names
+can be configured in `superset_config.py` as follows:
+
+```python
+BABEL_DEFAULT_LOCALE = "ru"
+
+D3_TIME_FORMAT = {
+    "months": [
+        "Январь",
+        "Февраль",
+        "Март",
+        "Апрель",
+        "Май",
+        "Июнь",
+        "Июль",
+        "Август",
+        "Сентябрь",
+        "Октябрь",
+        "Ноябрь",
+        "Декабрь",
+    ],
+    "shortMonths": [
+        "Янв",
+        "Фев",
+        "Мар",
+        "Апр",
+        "Май",
+        "Июн",
+        "Июл",
+        "Авг",
+        "Сен",
+        "Окт",
+        "Ноя",
+        "Дек",
+    ],
+}
+```
+
+Restart Superset after changing `superset_config.py` so the frontend receives
+the updated formatter configuration.
+
 ## Chart-data query timing
 
 Set `CHART_DATA_INCLUDE_TIMING = True` to add an optional versioned timing object

docs/docs/faq.mdx

@@ -46,13 +46,43 @@ import FAQSchema from '@site/src/components/FAQSchema';
       answer:
         'You need to register a free account at Mapbox.com, obtain an API key, and add it to your .env file at the key MAPBOX_API_KEY.',
     },
+    {
+      question: 'How to limit the timed refresh on a dashboard?',
+      answer:
+        'To exclude specific slices from the timed refresh process, add the timed_refresh_immune_slices key to the dashboard JSON Metadata field with the slice IDs to exclude.',
+    },
+    {
+      question: "Why does 'flask fab' or Superset freeze, hang, or not respond when started (my home directory is NFS mounted)?",
+      answer:
+        'By default, Superset creates and uses an SQLite database at ~/.superset/superset.db. SQLite is known to not work well if used on NFS due to broken file locking. Override the path with the SUPERSET_HOME environment variable or change SQLALCHEMY_DATABASE_URI in superset_config.py.',
+    },
+    {
+      question: 'What if the table schema changed?',
+      answer:
+        'Go to Data -> Datasets, click the edit icon next to the dataset whose schema has changed, and hit Sync columns from source from the Columns tab. The new columns will get merged.',
+    },
     {
       question: 'What database engine can I use as a backend for Superset?',
       answer:
         'Superset is tested using MySQL, PostgreSQL, and SQLite backends for storing its internal metadata. While Superset supports many databases as data sources, only these are recommended for the metadata store in production.',
     },
     {
-      question: 'Does Superset work with my database?',
+      question: 'How can I configure OAuth authentication and authorization?',
+      answer:
+        'Take a look at the Flask-AppBuilder OAuth configuration example, which shows how to configure OAuth authentication and authorization in Superset.',
+    },
+    {
+      question: 'Is there a way to force the dashboard to use specific colors?',
+      answer:
+        'It is possible on a per-dashboard basis by providing a mapping of labels to colors in the JSON Metadata attribute using the label_colors key. You can use a full hex color, a named color, or the index in the current color palette.',
+    },
+    {
+      question: 'How do I expand all chart descriptions on a dashboard by default?',
+      answer:
+        'Add the expand_all_slices key to the dashboard JSON Metadata field with a value of true. Charts that have already been manually expanded or collapsed keep that per-chart override regardless of the setting.',
+    },
+    {
+      question: 'Does Superset work with [insert database engine here]?',
       answer:
         'Superset supports any database with a Python SQLAlchemy dialect and DBAPI driver. Check the Connecting to Databases documentation for the full list of supported databases.',
     },
@@ -61,15 +91,30 @@ import FAQSchema from '@site/src/components/FAQSchema';
       answer:
         'Yes, Superset has a public REST API documented using Swagger. Enable FAB_API_SWAGGER_UI in superset_config.py to access interactive API documentation at /swagger/v1.',
     },
+    {
+      question: 'How can I see usage statistics (e.g., monthly active users)?',
+      answer:
+        'This functionality is not included with Superset, but you can extract and analyze the logs table in Superset\u2019s metadata database to see what actions have occurred.',
+    },
+    {
+      question: 'What does Hours Offset in the Edit Dataset view do?',
+      answer:
+        'In the Edit Dataset view, the hours offset lets you configure the number of hours to be added or subtracted from the time column. This can be used, for example, to convert UTC time to local time.',
+    },
     {
       question: 'Does Superset collect any telemetry data?',
       answer:
         'Superset uses Scarf by default to collect basic telemetry data to help maintainers understand version usage. Users can opt out by setting the SCARF_ANALYTICS environment variable to false.',
     },
     {
-      question: 'Does Superset have a trash bin to recover deleted assets?',
+      question: 'Does Superset have an archive panel or trash bin from which a user can recover deleted assets?',
       answer:
-        'No, there is no built-in way to recover deleted dashboards, charts, or datasets. It is recommended to take periodic backups of the metadata database and use export functionality for recovery.',
+        'No. Currently, there is no way to recover a deleted Superset dashboard, chart, dataset, or database from the UI. It is recommended to take periodic backups of the metadata database and use export functionality for recovery.',
+    },
+    {
+      question: 'I ran a security scan of the Superset container image and it showed dozens of "high" and "critical" vulnerabilities! Can you release a version of Superset without these?',
+      answer:
+        'These are dependency CVEs in software that Superset uses, mostly in the Linux kernel or Python. Superset addresses them by regularly updating dependencies and welcomes pull requests that fix dependency CVEs. The Superset security team focuses primarily on vulnerabilities in Superset itself.',
     },
   ]}
 />
@@ -214,8 +259,7 @@ frontend falls back to a built-in default of `5000` milliseconds.
 SUPERSET_DASHBOARD_MANUAL_REFRESH_STAGGER_MS = 0
 ```
 
-**Why does ‘flask fab’ or superset freeze/hang/not responding when started (my home directory is
-NFS mounted)?**
+## Why does `flask fab` or Superset freeze, hang, or not respond when started (my home directory is NFS mounted)?
 
 By default, Superset creates and uses an SQLite database at `~/.superset/superset.db`. SQLite is
 known to [not work well if used on NFS](https://www.sqlite.org/lockingv3.html) due to broken file

pyproject.toml

@@ -42,7 +42,7 @@ dependencies = [
     # ``google-auth`` 2.53+ dropped it, so Superset must declare it
     # explicitly to keep fresh ``pip install apache-superset`` working
     # without the ``base.txt`` lock file (#40962).
-    "cachetools>=7.1.6, <8",
+    "cachetools>=7.1.7, <8",
     "celery>=5.6.3, <6.0.0",
     "click>=8.4.2",
     "click-option-group",
@@ -60,11 +60,15 @@ dependencies = [
     "flask-login>=0.6.0, < 1.0",
     "flask-migrate>=4.1.0, <5.0",
     "flask-session>=0.4.0, <1.0",
-    # Bumped to 3.1.1 alongside the SQLAlchemy 2.0 core bump (discussion
-    # #40273, step 6), which resolves the session/app-context handling
-    # across Celery task boundaries that previously blocked this (see
-    # PR #42542).
-    "flask-sqlalchemy>=3.1.1, <4.0",
+    # Pinned explicitly below 3.0: 3.0.5 resolves without conflict and
+    # supports both SQLAlchemy 1.4 and 2.0, but real CI runs surfaced a
+    # structural incompatibility with Superset's current session/app-context
+    # handling across Celery task boundaries (see PR #42542) -- widespread
+    # "NoneType has no attribute X" failures and MySQL lock-wait timeouts,
+    # not just a connection-pool quirk. Needs dedicated investigation, not a
+    # driver-compat-prep bump; revisit alongside the actual SQLAlchemy 2.0
+    # core bump (discussion #40273, step 6).
+    "flask-sqlalchemy>=2.5.1, <4.0",
     "flask-wtf>=1.3.0, <2.0",
     "geopy",
     "greenlet<=3.5.4, >=3.5.4",
@@ -75,7 +79,7 @@ dependencies = [
     "humanize",
     "isodate",
     "jsonpath-ng>=1.8.0, <2",
-    "Mako>=1.2.2",
+    "Mako>=1.4.1",
     "markdown>=3.10.3",
     # marshmallow 4 compatibility: see superset/marshmallow_compatibility.py for a
     # Flask-AppBuilder workaround. Tracking issue:
@@ -111,7 +115,7 @@ dependencies = [
     "sshtunnel>=0.4.0, <0.5",
     "simplejson>=4.1.1",
     "slack_sdk>=3.43.0, <4",
-    "sqlalchemy>=2.0.0, <2.1",
+    "sqlalchemy>=1.4.43, <2", # 1.4.43 adds the python-oracledb (oracle+oracledb) dialect
     "sqlalchemy-continuum>=1.6.0, <2.0.0",
     "sqlalchemy-utils>=0.42.1, <0.43", # expanding lowerbound to work with pydoris
     "sqlglot>=30.16.0, <31", # 30.16.0 adds Trino inline UDF IF/CASE routine statement parsing
@@ -135,10 +139,10 @@ athena = ["pyathena[pandas]>=3.35.4, <4"]
 # superset/db_engine_specs/aurora.py's known_incompatibilities metadata.
 aurora-data-api = ["preset-sqlalchemy-aurora-data-api>=0.2.8,<0.3"]
 bigquery = [
-    "pandas-gbq>=0.35.0",
+    "pandas-gbq>=0.35.1",
     # 1.17.1 is likely the final release: googleapis/python-bigquery-sqlalchemy
     # was archived 2026-05-16. Both 1.17.0 and 1.17.1 support SQLAlchemy 1.4/2.0.
-    "sqlalchemy-bigquery>=1.17.1",
+    "sqlalchemy-bigquery>=1.17.2",
     "google-cloud-bigquery>=3.42.3",
 ]
 clickhouse = ["clickhouse-connect>=1.6.0, <2.0"]
@@ -160,10 +164,11 @@ databricks = [
 datafusion = ["flightsql-dbapi>=0.2.2, <0.3"]
 db2 = ["ibm-db-sa<=0.4.4, >=0.4.4"]
 denodo = ["denodo-sqlalchemy>=2.0.5,<2.1.0"]
-# sqlalchemy-dremio 3.0.5+ hard-pins sqlalchemy~=2.0.41, dropping 1.4.
-# Widened now that Superset's own SQLAlchemy 2.0 core bump has landed
-# (discussion #40273).
-dremio = ["sqlalchemy-dremio>=3.0.5, <4"]
+# sqlalchemy-dremio 3.0.5+ hard-pins sqlalchemy~=2.0.41, dropping 1.4; 3.0.4
+# is the last dual-compat release. Capped below 3.0.5 for now; widen back to
+# <4 in lockstep with Superset's own SQLAlchemy 2.0 core bump (discussion
+# #40273), not before.
+dremio = ["sqlalchemy-dremio>=1.2.1, <3.0.5"]
 # <2 was an artificial ceiling; upstream has no SQLAlchemy version cap and
 # 1.1.10 already supports SQLAlchemy 2.0 (added `import_dbapi` in 1.1.7).
 drill = ["sqlalchemy-drill>=1.1.10, <3"]
@@ -176,16 +181,17 @@ dynamodb = ["pydynamodb>=0.8.2"]
 solr = ["sqlalchemy-solr>=0.2.4.3"]
 elasticsearch = ["elasticsearch-dbapi>=0.2.13, <0.3.0"]
 # sqlalchemy-exasol cuts hard from SQLAlchemy 1.4-only (<6.0.0) to 2.0-only
-# (>=6.0.0) with no dual-compat release. Bumped now that Superset's own
-# SQLAlchemy 2.0 core bump has landed (discussion #40273).
-exasol = ["sqlalchemy-exasol>=6.0.0, <8.0"]
+# (>=6.0.0) with no dual-compat release. Capped below 6.0.0 for now; bump to
+# >=6.0.0,<8.0 in lockstep with Superset's own SQLAlchemy 2.0 core bump
+# (discussion #40273), not before.
+exasol = ["sqlalchemy-exasol>=2.4.0, <6.0.0"]
 excel = ["xlrd>=2.0.2, <2.1"]
 # Async dashboard "Export Data/Images to Excel": uploads the workbook to S3 and
 # emails a pre-signed link. boto3 is imported lazily by superset.utils.s3, so
 # installing this extra is only required to actually run exports.
 excel-export = ["boto3"]
 fastmcp = [
-    "fastmcp>=3.4.5,<4.0",
+    "fastmcp>=3.4.6,<4.0",
     # tiktoken backs the response-size-guard token estimator. Without
     # it, the middleware falls back to a coarser character-based
     # heuristic that under-counts JSON-heavy MCP responses.
@@ -193,9 +199,9 @@ fastmcp = [
 ]
 # sqlalchemy-firebird >=2.0.0 unconditionally requires SQLAlchemy 2.0 on
 # Python >=3.8 (which covers Superset's >=3.11 floor), with no dual-compat
-# release. Bumped now that Superset's own SQLAlchemy 2.0 core bump has
-# landed (discussion #40273).
-firebird = ["sqlalchemy-firebird>=2.2.0"]
+# release. Capped below 2.0.0 for now; bump to >=2.2.0 in lockstep with
+# Superset's own SQLAlchemy 2.0 core bump (discussion #40273), not before.
+firebird = ["sqlalchemy-firebird>=0.8.0, <2.0.0"]
 firebolt = ["firebolt-sqlalchemy>=1.1.2, <2"]
 gevent = ["gevent>=26.7.0"]
 gsheets = ["shillelagh[gsheetsapi]>=1.4.5, <2"]
@@ -221,7 +227,7 @@ ocient = [
     # unpinned sqlalchemy>=1.4 declared, but SQLAlchemy 2.0 support is
     # unverified. Lower confidence than the other bumps in this PR.
     "sqlalchemy-ocient>=3.0.0, <4",
-    "pyocient>=1.0.15, <4",
+    "pyocient>=3.9.0, <4",
     "shapely",
     "geojson",
 ]
@@ -234,14 +240,15 @@ presto = ["pyhive[presto]>=0.6.5"]
 trino = ["trino>=0.338.0"]
 prophet = ["prophet>=1.3.0, <2"]
 # sqlalchemy-redshift cuts hard from SQLAlchemy 1.4-only (0.8.x) to 2.0-only
-# (>=1.0.0) with no dual-compat release. Bumped now that Superset's own
-# SQLAlchemy 2.0 core bump has landed (discussion #40273).
-redshift = ["sqlalchemy-redshift>=1.0.0"]
+# (>=1.0.0) with no dual-compat release; the existing <0.9 ceiling already
+# keeps this on the 1.4-only line. Bump to >=1.0.0 in lockstep with
+# Superset's own SQLAlchemy 2.0 core bump (discussion #40273), not before.
+redshift = ["sqlalchemy-redshift>=0.8.1, <0.9"]
 # No release of sqlalchemy-risingwave has ever supported both SQLAlchemy 1.4
-# and 2.0 (version numbers don't track SQLAlchemy compat monotonically).
-# Bumped to the 2.0-only line now that Superset's own SQLAlchemy 2.0 core
-# bump has landed (discussion #40273).
-risingwave = ["sqlalchemy-risingwave>=2.0.0"]
+# and 2.0 (version numbers don't track SQLAlchemy compat monotonically); pin
+# to the newest 1.4-only release for now. Bump to >=2.0.0 in lockstep with
+# Superset's own SQLAlchemy 2.0 core bump (discussion #40273), not before.
+risingwave = ["sqlalchemy-risingwave>=1.4.1, <3.0.0"]
 shillelagh = ["shillelagh[all]>=1.4.5, <2"]
 singlestore = ["sqlalchemy-singlestoredb>=1.2.1, <2"]
 snowflake = ["snowflake-sqlalchemy>=1.11.0, <2"]

pytest.ini

@@ -23,5 +23,25 @@ python_files = *_test.py test_*.py *_tests.py *viz/utils.py
 asyncio_mode = auto
 
 # `ignore` is effectively equivalent to `-p no:warnings`.
+# Always print RemovedIn20Warning when SQLALCHEMY_WARN_20=1.
+# Additionally, raise errors for refactored RemovedIn20Warning cases to prevent regression.
 filterwarnings =
     ignore
+    always::sqlalchemy.exc.RemovedIn20Warning
+    error:Passing a string to Connection.execute\(\) is deprecated:sqlalchemy.exc.RemovedIn20Warning
+    error:"Query" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning
+    error:"ReportExecutionLog" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning
+    error:"ReportRecipients" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning
+    error:"SavedQuery" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning
+    error:"SqlaTable" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning
+    error:"SqlMetric" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning
+    error:"SSHTunnel" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning
+    error:"TableColumn" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning
+    error:"TaggedObject" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning
+    error:The autoload parameter is deprecated:sqlalchemy.exc.RemovedIn20Warning
+    error:The connection.execute\(\) method:sqlalchemy.exc.RemovedIn20Warning
+    error:The current statement is being autocommitted using implicit autocommit:sqlalchemy.exc.RemovedIn20Warning
+    error:The ``declarative_base\(\)`` function is now available:sqlalchemy.exc.RemovedIn20Warning
+    error:The Engine.execute\(\) method is considered legacy:sqlalchemy.exc.RemovedIn20Warning
+    error:The legacy calling style of select\(\) is deprecated:sqlalchemy.exc.RemovedIn20Warning
+    error:The "whens" argument to case:sqlalchemy.exc.RemovedIn20Warning

requirements/base.in

@@ -28,7 +28,7 @@ numexpr>=2.9.0
 # Security: CVE-2026-34073 (MEDIUM) - Improper Certificate Validation
 cryptography>=50.0.0,<51.0.0
 # Security: Snyk - XSS vulnerability in Mako templates
-mako>=1.3.11,<2.0.0
+mako>=1.4.1,<2.0.0
 # Security: CVE-2024-52338 (CRITICAL) - Deserialization of untrusted data in IPC/Parquet readers
 pyarrow>=24.0.0,<26.0.0
 # Security: CVE-2026-27459 - pyopenssl certificate validation

requirements/base.txt

@@ -44,7 +44,7 @@ cachelib==0.13.0
     # via
     #   flask-caching
     #   flask-session
-cachetools==7.1.6
+cachetools==7.1.7
     # via apache-superset (pyproject.toml)
 cattrs==25.1.1
     # via requests-cache
@@ -144,7 +144,7 @@ flask-migrate==4.1.0
     # via apache-superset (pyproject.toml)
 flask-session==0.8.0
     # via apache-superset (pyproject.toml)
-flask-sqlalchemy==3.1.1
+flask-sqlalchemy==2.5.1
     # via
     #   apache-superset (pyproject.toml)
     #   flask-appbuilder
@@ -207,7 +207,7 @@ kombu==5.6.2
     # via celery
 limits==5.1.0
     # via flask-limiter
-mako==1.3.12
+mako==1.4.1
     # via
     #   -r requirements/base.in
     #   apache-superset (pyproject.toml)
@@ -381,7 +381,7 @@ six==1.17.0
     #   wtforms-json
 slack-sdk==3.43.0
     # via apache-superset (pyproject.toml)
-sqlalchemy==2.0.51
+sqlalchemy==1.4.54
     # via
     #   apache-superset (pyproject.toml)
     #   alembic
@@ -419,7 +419,6 @@ typing-extensions==4.16.0
     #   pyopenssl
     #   referencing
     #   shillelagh
-    #   sqlalchemy
     #   typing-inspection
 typing-inspection==0.4.2
     # via pydantic

requirements/development.txt

@@ -99,7 +99,7 @@ cachelib==0.13.0
     #   -c requirements/base-constraint.txt
     #   flask-caching
     #   flask-session
-cachetools==7.1.6
+cachetools==7.1.7
     # via
     #   -c requirements/base-constraint.txt
     #   apache-superset
@@ -239,9 +239,9 @@ et-xmlfile==2.0.0
     #   openpyxl
 exceptiongroup==1.3.0
     # via fastmcp-slim
-fastmcp==3.4.5
+fastmcp==3.4.7
     # via apache-superset
-fastmcp-slim==3.4.5
+fastmcp-slim==3.4.7
     # via fastmcp
 filelock==3.20.3
     # via
@@ -306,7 +306,7 @@ flask-session==0.8.0
     # via
     #   -c requirements/base-constraint.txt
     #   apache-superset
-flask-sqlalchemy==3.1.1
+flask-sqlalchemy==2.5.1
     # via
     #   -c requirements/base-constraint.txt
     #   apache-superset
@@ -510,7 +510,7 @@ limits==5.1.0
     #   flask-limiter
 lz4==4.4.5
     # via trino
-mako==1.3.12
+mako==1.4.1
     # via
     #   -c requirements/base-constraint.txt
     #   alembic
@@ -640,7 +640,7 @@ pandas==2.3.3
     #   db-dtypes
     #   pandas-gbq
     #   prophet
-pandas-gbq==0.35.0
+pandas-gbq==0.35.1
     # via apache-superset
 parameterized==0.9.0
     # via apache-superset
@@ -950,7 +950,7 @@ slack-sdk==3.43.0
     #   apache-superset
 sniffio==1.3.1
     # via anyio
-sqlalchemy==2.0.51
+sqlalchemy==1.4.54
     # via
     #   -c requirements/base-constraint.txt
     #   alembic
@@ -964,7 +964,7 @@ sqlalchemy==2.0.51
     #   sqlalchemy-bigquery
     #   sqlalchemy-continuum
     #   sqlalchemy-utils
-sqlalchemy-bigquery==1.17.1
+sqlalchemy-bigquery==1.17.2
     # via apache-superset
 sqlalchemy-continuum==1.7.0
     # via
@@ -1033,7 +1033,6 @@ typing-extensions==4.16.0
     #   pyopenssl
     #   referencing
     #   shillelagh
-    #   sqlalchemy
     #   starlette
     #   typing-inspection
 typing-inspection==0.4.2

scripts/docker-build-extra-flags.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# Computes the `--extra-flags` value passed to `supersetbot docker` for a
+# given build preset. Factored out of .github/workflows/docker.yml so the
+# PY_VER override logic below can be exercised by an always-on CI check
+# (docker.yml's docker-build job only runs when the change detector's
+# docker/python/frontend outputs are true, and the PR build matrix never
+# includes py311/py312 at all, so a regression here would otherwise go
+# unnoticed until the fix actually runs on master) without duplicating -
+# and risking drift from - the logic used by the real build step.
+#
+# supersetbot's "py311"/"py312" presets pin their own --build-arg PY_VER,
+# which lands ahead of --extra-flags on the assembled buildx command line;
+# docker/buildx keeps the last value for a repeated --build-arg key, so
+# appending PY_VER here would override supersetbot's pin and silently make
+# "py311"/"py312" build the exact same image as "lean". Every other preset
+# gets the override so its build lands on the Dockerfile's own supported
+# Python version.
+#
+# Usage: docker-build-extra-flags.sh <build_preset> <image_tag>
+
+set -euo pipefail
+
+BUILD_PRESET="${1:?usage: docker-build-extra-flags.sh <build_preset> <image_tag>}"
+IMAGE_TAG="${2:?usage: docker-build-extra-flags.sh <build_preset> <image_tag>}"
+
+EXTRA_FLAGS="--build-arg INCLUDE_CHROMIUM=false --tag $IMAGE_TAG"
+if [ "$BUILD_PRESET" != "py311" ] && [ "$BUILD_PRESET" != "py312" ]; then
+  EXTRA_FLAGS="--build-arg PY_VER=3.11.14-slim-trixie $EXTRA_FLAGS"
+fi
+
+echo "$EXTRA_FLAGS"

superset-core/pyproject.toml

@@ -45,7 +45,7 @@ dependencies = [
     "isodate>=0.7.0",
     "pyarrow>=16.0.0",
     "pydantic>=2.8.0",
-    "sqlalchemy>=2.0.0,<2.1",
+    "sqlalchemy>=1.4.0,<2.0",
     "sqlalchemy-utils>=0.38.0, <0.43", # expanding lowerbound to work with pydoris
     "sqlglot>=30.8.0, <31",
     "typing-extensions>=4.0.0",

superset-embedded-sdk/package-lock.json

@@ -19,6 +19,7 @@
         "@babel/preset-typescript": "7.29.7",
         "@types/node": "^25.4.0",
         "babel-loader": "^9.1.3",
+        "jsdom": "^26.1.0",
         "tscw-config": "^1.1.2",
         "typescript": "^5.9.3",
         "vitest": "^4.0.18",
@@ -26,6 +27,27 @@
         "webpack-cli": "^5.1.4"
       }
     },
+    "node_modules/@asamuzakjp/css-color": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/@asamuzakjp/css-color/-/css-color-3.2.0.tgz",
+      "integrity": "sha512-K1A6z8tS3XsmCMM86xoWdn7Fkdn9m6RSVtocUrJYIwZnFVkng/PvkEoWtOWmP+Scc6saYWHWZYbndEEXxl24jw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@csstools/css-calc": "^2.1.3",
+        "@csstools/css-color-parser": "^3.0.9",
+        "@csstools/css-parser-algorithms": "^3.0.4",
+        "@csstools/css-tokenizer": "^3.0.3",
+        "lru-cache": "^10.4.3"
+      }
+    },
+    "node_modules/@asamuzakjp/css-color/node_modules/lru-cache": {
+      "version": "10.4.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
+      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
+      "dev": true,
+      "license": "ISC"
+    },
     "node_modules/@babel/cli": {
       "version": "7.29.7",
       "resolved": "https://registry.npmjs.org/@babel/cli/-/cli-7.29.7.tgz",
@@ -1656,6 +1678,121 @@
         "node": ">=6.9.0"
       }
     },
+    "node_modules/@csstools/color-helpers": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-5.1.0.tgz",
+      "integrity": "sha512-S11EXWJyy0Mz5SYvRmY8nJYTFFd1LCNV+7cXyAgQtOOuzb4EsgfqDufL+9esx72/eLhsRdGZwaldu/h+E4t4BA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT-0",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@csstools/css-calc": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/@csstools/css-calc/-/css-calc-2.1.4.tgz",
+      "integrity": "sha512-3N8oaj+0juUw/1H3YwmDDJXCgTB1gKU6Hc/bB502u9zR0q2vd786XJH9QfrKIEgFlZmhZiq6epXl4rHqhzsIgQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@csstools/css-parser-algorithms": "^3.0.5",
+        "@csstools/css-tokenizer": "^3.0.4"
+      }
+    },
+    "node_modules/@csstools/css-color-parser": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-3.1.0.tgz",
+      "integrity": "sha512-nbtKwh3a6xNVIp/VRuXV64yTKnb1IjTAEEh3irzS+HkKjAOYLTGNb9pmVNntZ8iVBHcWDA2Dof0QtPgFI1BaTA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@csstools/color-helpers": "^5.1.0",
+        "@csstools/css-calc": "^2.1.4"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@csstools/css-parser-algorithms": "^3.0.5",
+        "@csstools/css-tokenizer": "^3.0.4"
+      }
+    },
+    "node_modules/@csstools/css-parser-algorithms": {
+      "version": "3.0.5",
+      "resolved": "https://registry.npmjs.org/@csstools/css-parser-algorithms/-/css-parser-algorithms-3.0.5.tgz",
+      "integrity": "sha512-DaDeUkXZKjdGhgYaHNJTV9pV7Y9B3b644jCLs9Upc3VeNGg6LWARAT6O+Q+/COo+2gg/bM5rhpMAtf70WqfBdQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@csstools/css-tokenizer": "^3.0.4"
+      }
+    },
+    "node_modules/@csstools/css-tokenizer": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@csstools/css-tokenizer/-/css-tokenizer-3.0.4.tgz",
+      "integrity": "sha512-Vd/9EVDiu6PPJt9yAh6roZP6El1xHrdvIVGjyBsHR0RYwNHgL7FJPyIIW4fANJNG6FtyZfvlRPpFI4ZM/lubvw==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@discoveryjs/json-ext": {
       "version": "0.5.6",
       "resolved": "https://registry.npmjs.org/@discoveryjs/json-ext/-/json-ext-0.5.6.tgz",
@@ -2501,6 +2638,16 @@
         "acorn": "^8.14.0"
       }
     },
+    "node_modules/agent-base": {
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
+      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14"
+      }
+    },
     "node_modules/ajv": {
       "version": "8.20.0",
       "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
@@ -2868,6 +3015,34 @@
         "node": ">= 8"
       }
     },
+    "node_modules/cssstyle": {
+      "version": "4.6.0",
+      "resolved": "https://registry.npmjs.org/cssstyle/-/cssstyle-4.6.0.tgz",
+      "integrity": "sha512-2z+rWdzbbSZv6/rhtvzvqeZQHrBaqgogqt85sqFNbabZOuFbCVFb8kPeEtZjiKkbrm395irpNKiYeFeLiQnFPg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@asamuzakjp/css-color": "^3.2.0",
+        "rrweb-cssom": "^0.8.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/data-urls": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/data-urls/-/data-urls-5.0.0.tgz",
+      "integrity": "sha512-ZYP5VBHshaDAiVZxjbRVcFJpc+4xGgT0bK3vzy1HLN8jTO975HEbuYzZJcHoQEY5K1a0z8YayJkyVETa08eNTg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "whatwg-mimetype": "^4.0.0",
+        "whatwg-url": "^14.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/debug": {
       "version": "4.4.3",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
@@ -2886,6 +3061,13 @@
         }
       }
     },
+    "node_modules/decimal.js": {
+      "version": "10.6.0",
+      "resolved": "https://registry.npmjs.org/decimal.js/-/decimal.js-10.6.0.tgz",
+      "integrity": "sha512-YpgQiITW3JXGntzdUmyUR1V812Hn8T1YVXhCu+wO3OpS4eU9l4YdD3qjyiKdV6mvV29zapkMeD390UVEf2lkUg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/detect-libc": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
@@ -2915,6 +3097,19 @@
         "node": ">=10.13.0"
       }
     },
+    "node_modules/entities": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-6.0.1.tgz",
+      "integrity": "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=0.12"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/entities?sponsor=1"
+      }
+    },
     "node_modules/envinfo": {
       "version": "7.13.0",
       "resolved": "https://registry.npmjs.org/envinfo/-/envinfo-7.13.0.tgz",
@@ -3316,6 +3511,60 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/html-encoding-sniffer": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/html-encoding-sniffer/-/html-encoding-sniffer-4.0.0.tgz",
+      "integrity": "sha512-Y22oTqIU4uuPgEemfz7NDJz6OeKf12Lsu+QC+s3BVpda64lTiMYCyGwg5ki4vFxkMwQdeZDl2adZoqUgdFuTgQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "whatwg-encoding": "^3.1.1"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/http-proxy-agent": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
+      "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.0",
+        "debug": "^4.3.4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/https-proxy-agent": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.2",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/iconv-lite": {
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
+      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/import-local": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/import-local/-/import-local-3.1.0.tgz",
@@ -3438,6 +3687,13 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/is-potential-custom-element-name": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/is-potential-custom-element-name/-/is-potential-custom-element-name-1.0.1.tgz",
+      "integrity": "sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/isexe": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
@@ -3498,6 +3754,46 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/jsdom": {
+      "version": "26.1.0",
+      "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-26.1.0.tgz",
+      "integrity": "sha512-Cvc9WUhxSMEo4McES3P7oK3QaXldCfNWp7pl2NNeiIFlCoLr3kfq9kb1fxftiwk1FLV7CvpvDfonxtzUDeSOPg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "cssstyle": "^4.2.1",
+        "data-urls": "^5.0.0",
+        "decimal.js": "^10.5.0",
+        "html-encoding-sniffer": "^4.0.0",
+        "http-proxy-agent": "^7.0.2",
+        "https-proxy-agent": "^7.0.6",
+        "is-potential-custom-element-name": "^1.0.1",
+        "nwsapi": "^2.2.16",
+        "parse5": "^7.2.1",
+        "rrweb-cssom": "^0.8.0",
+        "saxes": "^6.0.0",
+        "symbol-tree": "^3.2.4",
+        "tough-cookie": "^5.1.1",
+        "w3c-xmlserializer": "^5.0.0",
+        "webidl-conversions": "^7.0.0",
+        "whatwg-encoding": "^3.1.1",
+        "whatwg-mimetype": "^4.0.0",
+        "whatwg-url": "^14.1.1",
+        "ws": "^8.18.0",
+        "xml-name-validator": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "canvas": "^3.0.0"
+      },
+      "peerDependenciesMeta": {
+        "canvas": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/jsesc": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-3.1.0.tgz",
@@ -3977,6 +4273,13 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/nwsapi": {
+      "version": "2.2.24",
+      "resolved": "https://registry.npmjs.org/nwsapi/-/nwsapi-2.2.24.tgz",
+      "integrity": "sha512-7YRhZ3jS45LwmSCT4b2sVFHt/WuovaktDU07QrtOBY2PXskss5a9jfmR9jptyumwXST+rFjrmppMY1KT/yn35A==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/obug": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.1.tgz",
@@ -4033,6 +4336,19 @@
         "node": ">=6"
       }
     },
+    "node_modules/parse5": {
+      "version": "7.3.0",
+      "resolved": "https://registry.npmjs.org/parse5/-/parse5-7.3.0.tgz",
+      "integrity": "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "entities": "^6.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/inikulin/parse5?sponsor=1"
+      }
+    },
     "node_modules/path-exists": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
@@ -4142,6 +4458,16 @@
         "node": "^10 || ^12 || >=14"
       }
     },
+    "node_modules/punycode": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
+      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/readdirp": {
       "version": "3.6.0",
       "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz",
@@ -4314,6 +4640,33 @@
         "@rolldown/binding-win32-x64-msvc": "1.1.3"
       }
     },
+    "node_modules/rrweb-cssom": {
+      "version": "0.8.0",
+      "resolved": "https://registry.npmjs.org/rrweb-cssom/-/rrweb-cssom-0.8.0.tgz",
+      "integrity": "sha512-guoltQEx+9aMf2gDZ0s62EcV8lsXR+0w8915TC3ITdn2YueuNjdAYh/levpU9nFaoChh9RUS5ZdQMrKfVEN9tw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/saxes": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/saxes/-/saxes-6.0.0.tgz",
+      "integrity": "sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "xmlchars": "^2.2.0"
+      },
+      "engines": {
+        "node": ">=v12.22.7"
+      }
+    },
     "node_modules/schema-utils": {
       "version": "4.3.3",
       "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-4.3.3.tgz",
@@ -4447,6 +4800,13 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/symbol-tree": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/symbol-tree/-/symbol-tree-3.2.4.tgz",
+      "integrity": "sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/tapable": {
       "version": "2.3.0",
       "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.0.tgz",
@@ -4592,6 +4952,26 @@
         "node": ">=14.0.0"
       }
     },
+    "node_modules/tldts": {
+      "version": "6.1.86",
+      "resolved": "https://registry.npmjs.org/tldts/-/tldts-6.1.86.tgz",
+      "integrity": "sha512-WMi/OQ2axVTf/ykqCQgXiIct+mSQDFdH2fkwhPwgEwvJ1kSzZRiinb0zF2Xb8u4+OqPChmyI6MEu4EezNJz+FQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tldts-core": "^6.1.86"
+      },
+      "bin": {
+        "tldts": "bin/cli.js"
+      }
+    },
+    "node_modules/tldts-core": {
+      "version": "6.1.86",
+      "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-6.1.86.tgz",
+      "integrity": "sha512-Je6p7pkk+KMzMv2XXKmAE3McmolOQFdxkKw0R8EYNr7sELW46JqnNeTX8ybPiQgvg1ymCoF8LXs5fzFaZvJPTA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/to-regex-range": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
@@ -4605,6 +4985,32 @@
         "node": ">=8.0"
       }
     },
+    "node_modules/tough-cookie": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-5.1.2.tgz",
+      "integrity": "sha512-FVDYdxtnj0G6Qm/DhNPSb8Ju59ULcup3tuJxkFb5K8Bv2pUXILbf0xZWU8PX8Ov19OXljbUyveOFwRMwkXzO+A==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "tldts": "^6.1.32"
+      },
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/tr46": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/tr46/-/tr46-5.1.1.tgz",
+      "integrity": "sha512-hdF5ZgjTqgAntKkklYw0R03MG2x/bSzTtkxmIRw/sTNV8YXsCJ1tfLAX23lhxhHJlEf3CRCOCGGWw3vI3GaSPw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "punycode": "^2.3.1"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/tscw-config": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/tscw-config/-/tscw-config-1.1.2.tgz",
@@ -4931,6 +5337,19 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
+    "node_modules/w3c-xmlserializer": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/w3c-xmlserializer/-/w3c-xmlserializer-5.0.0.tgz",
+      "integrity": "sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "xml-name-validator": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/watchpack": {
       "version": "2.5.1",
       "resolved": "https://registry.npmjs.org/watchpack/-/watchpack-2.5.1.tgz",
@@ -4944,6 +5363,16 @@
         "node": ">=10.13.0"
       }
     },
+    "node_modules/webidl-conversions": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-7.0.0.tgz",
+      "integrity": "sha512-VwddBukDzu71offAQR975unBIGqfKZpM+8ZX6ySk8nYhVoo5CYaZyzt3YBvYtRtO+aoGlqxPg/B87NGVZ/fu6g==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/webpack": {
       "version": "5.105.0",
       "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.105.0.tgz",
@@ -5070,6 +5499,44 @@
         "node": ">=10.13.0"
       }
     },
+    "node_modules/whatwg-encoding": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/whatwg-encoding/-/whatwg-encoding-3.1.1.tgz",
+      "integrity": "sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ==",
+      "deprecated": "Use @exodus/bytes instead for a more spec-conformant and faster implementation",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "iconv-lite": "0.6.3"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/whatwg-mimetype": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-4.0.0.tgz",
+      "integrity": "sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/whatwg-url": {
+      "version": "14.2.0",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-14.2.0.tgz",
+      "integrity": "sha512-De72GdQZzNTUBBChsXueQUnPKDkg/5A5zp7pFDuQAj5UFoENpiACU0wlCvzpAGnTkj++ihpKwKyYewn/XNUbKw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tr46": "^5.1.0",
+        "webidl-conversions": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/which": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
@@ -5114,6 +5581,45 @@
       "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8=",
       "dev": true
     },
+    "node_modules/ws": {
+      "version": "8.21.1",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.1.tgz",
+      "integrity": "sha512-+0NTnW77fFN/DjQi6k/Sq/Yvk4Sgajw7urW8V+asjXnRgDs9gyGkdb7EzgfhA4goXsRIZKE28fzIXBHEzhuiWw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": ">=5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/xml-name-validator": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-5.0.0.tgz",
+      "integrity": "sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/xmlchars": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz",
+      "integrity": "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/yallist": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",

superset-embedded-sdk/package.json

@@ -43,6 +43,7 @@
     "@babel/preset-typescript": "7.29.7",
     "@types/node": "^25.4.0",
     "babel-loader": "^9.1.3",
+    "jsdom": "^26.1.0",
     "tscw-config": "^1.1.2",
     "typescript": "^5.9.3",
     "vitest": "^4.0.18",

superset-embedded-sdk/src/index.test.ts

@@ -0,0 +1,213 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+// @vitest-environment jsdom
+
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import { Switchboard } from "@superset-ui/switchboard";
+import { embedDashboard } from "./index";
+
+vi.mock("@superset-ui/switchboard");
+
+function makeFakeJWT(claims: any) {
+  // not a valid jwt, but close enough for this code
+  const tokenifiedClaims = Buffer.from(JSON.stringify(claims)).toString(
+    "base64",
+  );
+  return `abc.${tokenifiedClaims}.xyz`;
+}
+
+describe("embedDashboard", () => {
+  let mountPoint: HTMLElement;
+  let mockSwitchboard: Switchboard;
+
+  beforeEach(() => {
+    mountPoint = document.createElement("div");
+    document.body.appendChild(mountPoint);
+
+    mockSwitchboard = {
+      emit: vi.fn(),
+      get: vi.fn(),
+      start: vi.fn(),
+      defineMethod: vi.fn(),
+    } as any;
+
+    // Constructor mocks must use `function`, since arrow functions cannot be
+    // invoked with `new`.
+    vi.mocked(Switchboard).mockImplementation(function () {
+      return mockSwitchboard;
+    } as any);
+
+    // Mock MessageChannel API
+    globalThis.MessageChannel = vi.fn(function (this: any) {
+      this.port1 = {};
+      this.port2 = {};
+    }) as any;
+
+    // Mock iframe load event and sandbox
+    const originalCreateElement = document.createElement.bind(document);
+    vi.spyOn(document, "createElement").mockImplementation(tagName => {
+      const element = originalCreateElement(tagName);
+      if (tagName === "iframe") {
+        // Mock sandbox DOMTokenList
+        (element as any).sandbox = {
+          add: vi.fn(),
+        };
+        // Mock contentWindow for postMessage
+        Object.defineProperty(element, "contentWindow", {
+          writable: true,
+          value: {
+            postMessage: vi.fn(),
+          },
+        });
+        setTimeout(() => {
+          element.dispatchEvent(new Event("load"));
+        }, 0);
+      }
+      return element;
+    });
+  });
+
+  afterEach(() => {
+    document.body.removeChild(mountPoint);
+    vi.restoreAllMocks();
+  });
+
+  test("setDataMask sends dataMask to iframe", async () => {
+    const fakeToken = makeFakeJWT({ exp: Date.now() / 1000 + 300 });
+    const mockFetchGuestToken = vi.fn().mockResolvedValue(fakeToken);
+    const testDataMask = {
+      "NATIVE_FILTER-1": {
+        filterState: {
+          value: ["value1", "value2"],
+        },
+      },
+    };
+
+    const dashboard = await embedDashboard({
+      id: "test-id",
+      supersetDomain: "https://superset.example.com",
+      mountPoint,
+      fetchGuestToken: mockFetchGuestToken,
+    });
+
+    dashboard.setDataMask(testDataMask);
+
+    expect(mockSwitchboard.get).toHaveBeenCalledWith("setDataMask", {
+      dataMask: testDataMask,
+    });
+  });
+
+  test("setDataMask sends empty dataMask", async () => {
+    const fakeToken = makeFakeJWT({ exp: Date.now() / 1000 + 300 });
+    const mockFetchGuestToken = vi.fn().mockResolvedValue(fakeToken);
+    const emptyDataMask = {};
+
+    const dashboard = await embedDashboard({
+      id: "test-id",
+      supersetDomain: "https://superset.example.com",
+      mountPoint,
+      fetchGuestToken: mockFetchGuestToken,
+    });
+
+    dashboard.setDataMask(emptyDataMask);
+
+    expect(mockSwitchboard.get).toHaveBeenCalledWith("setDataMask", {
+      dataMask: emptyDataMask,
+    });
+  });
+
+  test("setDataMask drops the change-trigger flags observeDataMask adds", async () => {
+    const fakeToken = makeFakeJWT({ exp: Date.now() / 1000 + 300 });
+    const mockFetchGuestToken = vi.fn().mockResolvedValue(fakeToken);
+    const observedMask = {
+      "NATIVE_FILTER-1": {
+        filterState: {
+          value: ["CA"],
+        },
+      },
+      crossFiltersChanged: false,
+      nativeFiltersChanged: true,
+    };
+
+    const dashboard = await embedDashboard({
+      id: "test-id",
+      supersetDomain: "https://superset.example.com",
+      mountPoint,
+      fetchGuestToken: mockFetchGuestToken,
+    });
+
+    dashboard.setDataMask(observedMask);
+
+    expect(mockSwitchboard.get).toHaveBeenCalledWith("setDataMask", {
+      dataMask: {
+        "NATIVE_FILTER-1": observedMask["NATIVE_FILTER-1"],
+      },
+    });
+  });
+
+  test("setDataMask sends complex dataMask with multiple filters", async () => {
+    const fakeToken = makeFakeJWT({ exp: Date.now() / 1000 + 300 });
+    const mockFetchGuestToken = vi.fn().mockResolvedValue(fakeToken);
+    const complexDataMask = {
+      "NATIVE_FILTER-1": {
+        filterState: {
+          value: ["CA", "NY"],
+        },
+      },
+      "NATIVE_FILTER-2": {
+        filterState: {
+          value: [2023, 2024],
+        },
+      },
+    };
+
+    const dashboard = await embedDashboard({
+      id: "test-id",
+      supersetDomain: "https://superset.example.com",
+      mountPoint,
+      fetchGuestToken: mockFetchGuestToken,
+    });
+
+    dashboard.setDataMask(complexDataMask);
+
+    expect(mockSwitchboard.get).toHaveBeenCalledWith("setDataMask", {
+      dataMask: complexDataMask,
+    });
+  });
+
+  test("setDataMask rejects when the embedded page does not support it", async () => {
+    const fakeToken = makeFakeJWT({ exp: Date.now() / 1000 + 300 });
+    const mockFetchGuestToken = vi.fn().mockResolvedValue(fakeToken);
+    vi.mocked(mockSwitchboard.get).mockRejectedValue(
+      new Error('Method "setDataMask" is not defined'),
+    );
+
+    const dashboard = await embedDashboard({
+      id: "test-id",
+      supersetDomain: "https://superset.example.com",
+      mountPoint,
+      fetchGuestToken: mockFetchGuestToken,
+    });
+
+    await expect(dashboard.setDataMask({})).rejects.toThrow(
+      'Method "setDataMask" is not defined',
+    );
+  });
+});

superset-embedded-sdk/src/index.ts

@@ -115,6 +115,12 @@ export type EmbeddedDashboard = {
   getActiveTabs: () => Promise<string[]>;
   observeDataMask: (callbackFn: ObserveDataMaskCallbackFn) => void;
   getDataMask: () => Promise<Record<string, any>>;
+  /**
+   * Applies a data mask to the dashboard.
+   * Rejects if the embedded Superset page does not support `setDataMask`,
+   * so a version mismatch surfaces instead of silently doing nothing.
+   */
+  setDataMask: (dataMask: Record<string, any>) => Promise<void>;
   getChartStates: () => Promise<Record<string, any>>;
   getChartDataPayloads: (params?: {
     chartId?: number;
@@ -355,6 +361,21 @@ export async function embedDashboard({
     ourPort.get<string>("getDashboardPermalink", { anchor });
   const getActiveTabs = () => ourPort.get<string[]>("getActiveTabs");
   const getDataMask = () => ourPort.get<Record<string, any>>("getDataMask");
+  // `observeDataMask` hands the host a mask with the change-trigger booleans
+  // mixed in, so feeding that payload straight back into `setDataMask` is a
+  // natural thing for a host to do. Keep only the entries that look like a
+  // filter's mask, so those flags never reach the dashboard as filter ids.
+  // Sent with `get` rather than `emit` so the iframe acknowledges the call:
+  // an embedded page that predates `setDataMask` replies with an error instead
+  // of dropping the message silently.
+  const setDataMask = (dataMask: Record<string, any>) =>
+    ourPort.get<void>("setDataMask", {
+      dataMask: Object.fromEntries(
+        Object.entries(dataMask).filter(
+          ([, mask]) => typeof mask === "object" && mask !== null,
+        ),
+      ),
+    });
   const getChartStates = () =>
     ourPort.get<Record<string, any>>("getChartStates");
   const getChartDataPayloads = (params?: { chartId?: number }) =>
@@ -396,6 +417,7 @@ export async function embedDashboard({
     getActiveTabs,
     observeDataMask,
     getDataMask,
+    setDataMask,
     getChartStates,
     getChartDataPayloads,
     setThemeConfig,

superset-frontend/package-lock.json

@@ -33,7 +33,7 @@
         "@fontsource/fira-code": "^5.3.0",
         "@fontsource/ibm-plex-mono": "^5.3.0",
         "@fontsource/inter": "^5.3.0",
-        "@googleapis/sheets": "^13.0.2",
+        "@googleapis/sheets": "^14.0.0",
         "@great-expectations/jsonforms-antd-renderers": "^2.2.10",
         "@jsonforms/core": "^3.7.0",
         "@jsonforms/react": "^3.7.0",
@@ -4142,9 +4142,9 @@
       }
     },
     "node_modules/@googleapis/sheets": {
-      "version": "13.0.2",
-      "resolved": "https://registry.npmjs.org/@googleapis/sheets/-/sheets-13.0.2.tgz",
-      "integrity": "sha512-b1tBlMcfvNEziM4DZCikLOc9iqSlgCK1e5bMKtNQIADRXr1CQmbkHV3ZBVvTsFsjLErgihqO58Itn/kzCnSZ0A==",
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/@googleapis/sheets/-/sheets-14.0.0.tgz",
+      "integrity": "sha512-fANEl4RQohsPYUWhcLSYyUyE8A8bRfvw/bp8h0t8VDQqTgdQ3itZBkty4nddtdqCAvNDpA+KM66OejVKDd6aFg==",
       "license": "Apache-2.0",
       "dependencies": {
         "googleapis-common": "^8.0.0"
@@ -33246,9 +33246,9 @@
       "license": "MIT"
     },
     "node_modules/postcss/node_modules/nanoid": {
-      "version": "3.3.16",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
-      "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
+      "version": "3.3.18",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
+      "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
       "dev": true,
       "funding": [
         {
@@ -34955,9 +34955,9 @@
       }
     },
     "node_modules/react-checkbox-tree/node_modules/nanoid": {
-      "version": "3.3.12",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
-      "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
+      "version": "3.3.18",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
+      "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
       "funding": [
         {
           "type": "github",

superset-frontend/package.json

@@ -110,7 +110,7 @@
     "@fontsource/fira-code": "^5.3.0",
     "@fontsource/ibm-plex-mono": "^5.3.0",
     "@fontsource/inter": "^5.3.0",
-    "@googleapis/sheets": "^13.0.2",
+    "@googleapis/sheets": "^14.0.0",
     "@great-expectations/jsonforms-antd-renderers": "^2.2.10",
     "@jsonforms/core": "^3.7.0",
     "@jsonforms/react": "^3.7.0",
@@ -415,6 +415,7 @@
     "minimatch@>=10": {
       "brace-expansion": ">=5.0.8"
     },
+    "nanoid@>=3 <4": "3.3.18",
     "nwsapi": "^2.2.13",
     "puppeteer": "^22.4.1",
     "tar": "^7.5.16",

superset-frontend/plugins/plugin-chart-calendar/src/Calendar.ts

@@ -22,7 +22,7 @@ import { getSequentialSchemeRegistry } from '@superset-ui/core';
 import { SupersetTheme } from '@apache-superset/core/theme';
 import { t } from '@apache-superset/core/translation';
 import CalHeatMapImport from './vendor/cal-heatmap';
-import { convertUTCTimestampToLocal } from './utils';
+import { convertUTCTimestampToLocal, getFormattedUTCTime } from './utils';
 
 // The vendor file is @ts-nocheck, so its export lacks type info.
 // Define a minimal constructor interface for use in this file.
@@ -103,6 +103,8 @@ function Calendar(element: HTMLElement, props: CalendarProps) {
   const subDomainTextFormat = showValues
     ? (_date: Date, value: number) => valueFormatter(value)
     : null;
+  const dateFormatter = (date: Date, format: string) =>
+    getFormattedUTCTime(date.getTime(), format);
 
   const metricsData = data.data;
 
@@ -166,6 +168,7 @@ function Calendar(element: HTMLElement, props: CalendarProps) {
       itemName: '',
       valueFormatter,
       timeFormatter,
+      dateFormatter,
       subDomainTextFormat,
     });
   });

superset-frontend/plugins/plugin-chart-calendar/src/vendor/cal-heatmap.ts

@@ -76,6 +76,8 @@ var CalHeatMap = function () {
 
     timeFormatter: d => d,
 
+    dateFormatter: null,
+
     domain: 'hour',
 
     subDomain: 'min',
@@ -1990,10 +1992,14 @@ CalHeatMap.prototype = {
 
     if (typeof format === 'function') {
       return format(d);
-    } else {
-      var f = d3.time.format(format);
-      return f(d);
     }
+
+    if (typeof this.options.dateFormatter === 'function') {
+      return this.options.dateFormatter(d, format);
+    }
+
+    var f = d3.time.format(format);
+    return f(d);
   },
 
   getSubDomainTitle: function (d) {

superset-frontend/plugins/plugin-chart-calendar/test/ReactCalendar.test.tsx

@@ -25,9 +25,11 @@ import {
   waitFor,
 } from 'spec/helpers/testing-library';
 import { CALENDAR_TOOLTIP_CLASS } from '../src/tooltip';
+import { convertUTCTimestampToLocal } from '../src/utils';
 
 interface MockCalHeatMapConfig {
   itemSelector: Element;
+  dateFormatter?: (date: Date, format: string) => string;
 }
 
 type MetricNameInput = string | string[];
@@ -38,6 +40,7 @@ let mockInitCallCount = 0;
 let mockThrowOnInitCall: number | null = null;
 let mockDestroyCallCount = 0;
 let mockDestroyedInstanceIds: string[] = [];
+let mockDateFormatter: MockCalHeatMapConfig['dateFormatter'];
 
 const mockTheme = {
   colorBgElevated: '#ffffff',
@@ -56,6 +59,7 @@ jest.mock('../src/vendor/cal-heatmap', () => ({
       } = require('../src/tooltip');
 
       mockInitCallCount += 1;
+      mockDateFormatter = config.dateFormatter;
       if (mockThrowOnInitCall === mockInitCallCount) {
         throw new Error('Mock CalHeatMap init failure');
       }
@@ -284,9 +288,28 @@ afterEach(() => {
   mockThrowOnInitCall = null;
   mockDestroyCallCount = 0;
   mockDestroyedInstanceIds = [];
+  mockDateFormatter = undefined;
   document.body.innerHTML = '';
 });
 
+test('Calendar provides a timezone-safe date formatter to CalHeatMap', () => {
+  const calendarOwner = document.createElement('div');
+  document.body.appendChild(calendarOwner);
+
+  Calendar(calendarOwner, {
+    ...createCalendarProps('localized-metric'),
+    theme: mockTheme,
+  });
+
+  if (!mockDateFormatter) {
+    throw new Error('Expected Calendar to configure a date formatter');
+  }
+
+  const localDate = new Date(convertUTCTimestampToLocal(Date.UTC(2024, 0, 1)));
+
+  expect(mockDateFormatter(localDate, '%Y-%m-%d')).toBe('2024-01-01');
+});
+
 test('rerender and unmount clean up only the affected calendar tooltips', () => {
   jest.useFakeTimers();
 

superset-frontend/plugins/plugin-chart-calendar/test/cal-heatmap.test.ts

@@ -0,0 +1,61 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import CalHeatMapImport from '../src/vendor/cal-heatmap';
+
+type DateFormatter = (date: Date, format: string) => string;
+type FunctionalDateFormat = (date: Date) => string;
+
+interface CalHeatMapInstance {
+  options: {
+    dateFormatter: DateFormatter | null;
+  };
+  formatDate(date: Date, format: string | FunctionalDateFormat): string;
+}
+
+const CalHeatMap = CalHeatMapImport as unknown as new () => CalHeatMapInstance;
+
+test('CalHeatMap delegates string date formats to the configured formatter', () => {
+  const calendar = new CalHeatMap();
+  const date = new Date(2024, 0, 1);
+  const dateFormatter = jest.fn<string, [Date, string]>(() => 'Январь');
+  calendar.options.dateFormatter = dateFormatter;
+
+  expect(calendar.formatDate(date, '%B')).toBe('Январь');
+  expect(dateFormatter).toHaveBeenCalledWith(date, '%B');
+});
+
+test('CalHeatMap preserves functional formatters over the configured formatter', () => {
+  const calendar = new CalHeatMap();
+  const date = new Date(2024, 0, 1);
+  const dateFormatter = jest.fn<string, [Date, string]>(() => 'localized');
+  const functionalFormat = jest.fn<string, [Date]>(() => 'custom');
+  calendar.options.dateFormatter = dateFormatter;
+
+  expect(calendar.formatDate(date, functionalFormat)).toBe('custom');
+  expect(functionalFormat).toHaveBeenCalledWith(date);
+  expect(dateFormatter).not.toHaveBeenCalled();
+});
+
+test('CalHeatMap keeps the D3 formatter fallback', () => {
+  const calendar = new CalHeatMap();
+  const date = new Date(2024, 0, 1);
+
+  expect(calendar.formatDate(date, '%B')).toBe('January');
+});

superset-frontend/plugins/plugin-chart-echarts/src/Bubble/transformProps.test.ts

@@ -0,0 +1,70 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { SqlaFormData } from '@superset-ui/core';
+import transformProps from './transformProps';
+import { EchartsBubbleChartProps } from './types';
+
+const baseFormData: SqlaFormData = {
+  datasource: '1__table',
+  viz_type: 'bubble_v2',
+  entity: 'customer_name',
+  x: 'price',
+  y: 'sales',
+  size: 'count',
+};
+
+const baseChartProps = {
+  width: 400,
+  height: 400,
+  hooks: {},
+  queriesData: [
+    {
+      data: [
+        { customer_name: 'A', price: 10, sales: 100, count: 5 },
+        { customer_name: 'B', price: 20, sales: 200, count: 8 },
+      ],
+    },
+  ],
+  theme: { colorText: '#000' },
+};
+
+test('nests xAxisLabelInterval under axisLabel rather than the axis itself', () => {
+  // Regression test: xAxis.interval forces echarts' IntervalScale into a
+  // fixed-tick-spacing mode that expects a number and crashes on the
+  // 'auto'/'0' strings this control actually produces (observed as an
+  // uncaught assertion deep in echarts' axis "nice" tick calculation,
+  // reproducing on every dashboard bubble chart). The interval belongs on
+  // axisLabel, where it only controls how many labels are skipped.
+  const { echartOptions } = transformProps({
+    ...baseChartProps,
+    formData: baseFormData,
+  } as unknown as EchartsBubbleChartProps);
+
+  expect((echartOptions.xAxis as any).interval).toBeUndefined();
+  expect((echartOptions.xAxis as any).axisLabel.interval).toBe('auto');
+});
+
+test('honors an explicit xAxisLabelInterval override', () => {
+  const { echartOptions } = transformProps({
+    ...baseChartProps,
+    formData: { ...baseFormData, xAxisLabelInterval: '0' },
+  } as unknown as EchartsBubbleChartProps);
+
+  expect((echartOptions.xAxis as any).axisLabel.interval).toBe('0');
+});

superset-frontend/plugins/plugin-chart-echarts/src/Bubble/transformProps.ts

@@ -212,13 +212,16 @@ export default function transformProps(chartProps: EchartsBubbleChartProps) {
   const echartOptions: EChartsCoreOption = {
     series,
     xAxis: {
-      axisLabel: { formatter: xAxisFormatter, rotate: xAxisLabelRotation },
+      axisLabel: {
+        formatter: xAxisFormatter,
+        rotate: xAxisLabelRotation,
+        interval: xAxisLabelInterval,
+      },
       splitLine: {
         lineStyle: {
           type: 'dashed',
         },
       },
-      interval: xAxisLabelInterval,
       scale: true,
       name: bubbleXAxisTitle,
       nameLocation: 'middle',

superset-frontend/scripts/bundle-size-summary.js

@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied.  See the License for the specific language governing
+ * permissions and limitations under the License.
+ */
+
+// Reduces a webpack `--json` stats file down to the handful of headline
+// numbers worth tracking over time, in the flat array format
+// benchmark-action/github-action-benchmark expects for its
+// "customSmallerIsBetter" tool. The full stats file also includes a
+// `modules`/`chunks` graph across ~15k modules, which is enormous and not
+// useful for this purpose, so we only ever read `entrypoints`.
+//
+// Usage: node scripts/bundle-size-summary.js <path-to-stats.json>
+
+const fs = require('fs');
+
+// Entrypoints worth tracking: the two user-facing app shells. `menu`,
+// `preamble`, `theme`, and `service-worker` are small, low-variance
+// infrastructure chunks, not where bundle bloat actually shows up.
+const TRACKED_ENTRYPOINTS = ['spa', 'embedded'];
+
+function entrypointSizeByExt(entrypoint, ext) {
+  return (entrypoint.assets || [])
+    .filter(asset => asset.name.endsWith(ext))
+    .reduce((total, asset) => total + asset.size, 0);
+}
+
+function main() {
+  const statsPath = process.argv[2];
+  if (!statsPath) {
+    console.error('Usage: bundle-size-summary.js <path-to-stats.json>');
+    process.exit(1);
+  }
+
+  const stats = JSON.parse(fs.readFileSync(statsPath, 'utf8'));
+  const { entrypoints } = stats;
+  if (!entrypoints) {
+    console.error(
+      'stats.json has no `entrypoints` key -- was it built with ' +
+        '`BUNDLE_SIZE_STATS=true` set? Without it, webpack.config.js uses ' +
+        '`stats: "minimal"`, which omits `entrypoints`.',
+    );
+    process.exit(1);
+  }
+
+  const results = [];
+  TRACKED_ENTRYPOINTS.forEach(name => {
+    const entrypoint = entrypoints[name];
+    if (!entrypoint) {
+      console.error(`stats.json is missing the "${name}" entrypoint`);
+      process.exit(1);
+    }
+    results.push({
+      name: `${name} entrypoint (JS)`,
+      unit: 'bytes',
+      value: entrypointSizeByExt(entrypoint, '.js'),
+    });
+    results.push({
+      name: `${name} entrypoint (CSS)`,
+      unit: 'bytes',
+      value: entrypointSizeByExt(entrypoint, '.css'),
+    });
+  });
+
+  console.log(JSON.stringify(results, null, 2));
+}
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = { entrypointSizeByExt, main, TRACKED_ENTRYPOINTS };

superset-frontend/scripts/oxlint-metrics-uploader.js

@@ -35,6 +35,43 @@ if (SERVICE_ACCOUNT_KEY.client_email) {
 
 const DATETIME = new Date().toISOString().replace(/T/, ' ').replace(/\..+/, '');
 
+/**
+ * Turn an oxlint diagnostic code into the canonical rule id used by the metrics
+ * series.
+ *
+ * oxlint reports `<plugin>(<rule>)`, where the plugin is the linter the rule came
+ * from: `eslint(no-console)`, `react-hooks(exhaustive-deps)`, `react(jsx-key)`,
+ * `jest(no-conditional-expect)`, `oxc(erasing-op)`, and the legacy
+ * `eslint-plugin-unicorn(no-new-array)` spelling.
+ *
+ * `eslint` is the implicit namespace, so its rules keep their bare name and stay
+ * comparable with the rows recorded before the oxlint migration. Every other
+ * plugin becomes `<plugin>/<rule>`, which is the id those rules are known by in
+ * config and in the pre-migration history.
+ *
+ * @param {string | undefined} code the diagnostic's `code` field
+ * @returns {string} the rule id to record
+ */
+function parseRuleId(code) {
+  if (!code) {
+    return 'unknown';
+  }
+
+  const match = code.match(/^([\w-]+)\(([^)]+)\)$/);
+  if (!match) {
+    return code;
+  }
+
+  const [, namespace, rule] = match;
+  if (namespace === 'eslint') {
+    return rule;
+  }
+
+  // `eslint-plugin-unicorn(...)` is the same rule as `unicorn/...`
+  const plugin = namespace.replace(/^eslint-plugin-/, '');
+  return `${plugin}/${rule}`;
+}
+
 async function writeToGoogleSheet(data, range, headers, append = false) {
   if (!sheets) {
     console.log('No Google Sheets credentials, skipping upload');
@@ -101,17 +138,7 @@ async function runOxlintAndProcess() {
     // OXC JSON format has diagnostics array
     if (results.diagnostics && Array.isArray(results.diagnostics)) {
       results.diagnostics.forEach(diagnostic => {
-        // Extract rule ID from code like "eslint(no-unused-vars)" or "eslint-plugin-unicorn(no-new-array)"
-        const codeMatch = diagnostic.code?.match(
-          /^(?:eslint(?:-plugin-(\w+))?\()([^)]+)\)$/,
-        );
-        let ruleId = diagnostic.code || 'unknown';
-
-        if (codeMatch) {
-          const plugin = codeMatch[1];
-          const rule = codeMatch[2];
-          ruleId = plugin ? `${plugin}/${rule}` : rule;
-        }
+        const ruleId = parseRuleId(diagnostic.code);
 
         const file = diagnostic.filename || 'unknown';
         const line = diagnostic.labels?.[0]?.span?.line || 0;
@@ -251,5 +278,10 @@ async function runOxlintAndProcess() {
   }
 }
 
-// Run the process
-runOxlintAndProcess().catch(console.error);
+// Run the process, unless this file was imported (e.g. by a test) rather than
+// executed, in which case nothing should be linted or uploaded on import.
+if (require.main === module) {
+  runOxlintAndProcess().catch(console.error);
+}
+
+module.exports = { parseRuleId };

superset-frontend/spec/scripts/bundle-size-summary.test.js

@@ -0,0 +1,110 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+const fs = require('fs');
+const {
+  entrypointSizeByExt,
+  main,
+} = require('../../scripts/bundle-size-summary');
+
+function mockStats(entrypoints) {
+  jest
+    .spyOn(fs, 'readFileSync')
+    .mockReturnValue(JSON.stringify({ entrypoints }));
+}
+
+function mockExit() {
+  return jest.spyOn(process, 'exit').mockImplementation(() => {
+    throw new Error('process.exit called');
+  });
+}
+
+const originalArgv = process.argv;
+
+afterEach(() => {
+  jest.restoreAllMocks();
+  process.argv = originalArgv;
+});
+
+test('entrypointSizeByExt sums only assets matching the given extension', () => {
+  const entrypoint = {
+    assets: [
+      { name: 'spa.entry.js', size: 100 },
+      { name: 'spa.entry.js.map', size: 500 },
+      { name: 'spa.entry.css', size: 20 },
+    ],
+  };
+  expect(entrypointSizeByExt(entrypoint, '.js')).toBe(100);
+  expect(entrypointSizeByExt(entrypoint, '.css')).toBe(20);
+});
+
+test('entrypointSizeByExt returns 0 when the entrypoint has no assets', () => {
+  expect(entrypointSizeByExt({}, '.js')).toBe(0);
+});
+
+test('main prints byte totals for every tracked entrypoint', () => {
+  mockStats({
+    spa: { assets: [{ name: 'spa.js', size: 100 }] },
+    embedded: { assets: [{ name: 'embedded.js', size: 50 }] },
+  });
+  const logSpy = jest.spyOn(console, 'log').mockImplementation(() => {});
+  process.argv = ['node', 'bundle-size-summary.js', 'stats.json'];
+
+  main();
+
+  const printed = JSON.parse(logSpy.mock.calls[0][0]);
+  expect(printed).toEqual([
+    { name: 'spa entrypoint (JS)', unit: 'bytes', value: 100 },
+    { name: 'spa entrypoint (CSS)', unit: 'bytes', value: 0 },
+    { name: 'embedded entrypoint (JS)', unit: 'bytes', value: 50 },
+    { name: 'embedded entrypoint (CSS)', unit: 'bytes', value: 0 },
+  ]);
+});
+
+test('main exits with an error when a tracked entrypoint is missing from stats.json', () => {
+  mockStats({ spa: { assets: [] } });
+  const errorSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+  mockExit();
+  process.argv = ['node', 'bundle-size-summary.js', 'stats.json'];
+
+  expect(main).toThrow('process.exit called');
+  expect(errorSpy).toHaveBeenCalledWith(
+    expect.stringContaining('missing the "embedded" entrypoint'),
+  );
+});
+
+test('main exits with an error when stats.json has no `entrypoints` key', () => {
+  jest.spyOn(fs, 'readFileSync').mockReturnValue(JSON.stringify({}));
+  const errorSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+  mockExit();
+  process.argv = ['node', 'bundle-size-summary.js', 'stats.json'];
+
+  expect(main).toThrow('process.exit called');
+  expect(errorSpy).toHaveBeenCalledWith(
+    expect.stringContaining('no `entrypoints` key'),
+  );
+});
+
+test('main prints a usage message and exits when no stats path is given', () => {
+  const errorSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+  mockExit();
+  process.argv = ['node', 'bundle-size-summary.js'];
+
+  expect(main).toThrow('process.exit called');
+  expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('Usage:'));
+});

superset-frontend/spec/scripts/oxlint-metrics-uploader.test.js

@@ -0,0 +1,58 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+const { parseRuleId } = require('../../scripts/oxlint-metrics-uploader');
+
+test('eslint rules keep their bare name', () => {
+  expect(parseRuleId('eslint(no-console)')).toBe('no-console');
+  expect(parseRuleId('eslint(prefer-destructuring)')).toBe(
+    'prefer-destructuring',
+  );
+});
+
+test('plugin rules are recorded under plugin/rule (#42981)', () => {
+  // These are the codes oxlint actually emits. They previously fell through to
+  // the raw `react-hooks(exhaustive-deps)` string, so the rows no longer lined
+  // up with the ids the same rules were recorded under before the migration.
+  expect(parseRuleId('react-hooks(exhaustive-deps)')).toBe(
+    'react-hooks/exhaustive-deps',
+  );
+  expect(parseRuleId('react-hooks(rules-of-hooks)')).toBe(
+    'react-hooks/rules-of-hooks',
+  );
+  expect(parseRuleId('react(jsx-key)')).toBe('react/jsx-key');
+  expect(parseRuleId('jest(no-conditional-expect)')).toBe(
+    'jest/no-conditional-expect',
+  );
+  expect(parseRuleId('oxc(erasing-op)')).toBe('oxc/erasing-op');
+  expect(parseRuleId('typescript(no-explicit-any)')).toBe(
+    'typescript/no-explicit-any',
+  );
+});
+
+test('the legacy eslint-plugin- prefix still collapses to the plugin name', () => {
+  expect(parseRuleId('eslint-plugin-unicorn(no-new-array)')).toBe(
+    'unicorn/no-new-array',
+  );
+});
+
+test('an unrecognized or missing code is passed through rather than dropped', () => {
+  expect(parseRuleId('something-unparseable')).toBe('something-unparseable');
+  expect(parseRuleId(undefined)).toBe('unknown');
+  expect(parseRuleId('')).toBe('unknown');
+});

superset-frontend/src/SqlLab/reducers/sqlLab.test.ts

@@ -695,6 +695,49 @@ describe('sqlLabReducer', () => {
       );
       expect(newState.queries['sync-query'].state).toBe(QueryState.Fetching);
     });
+    test('should move an async query from running to success when polling reports it finished', () => {
+      const asyncQuery = {
+        ...query,
+        id: 'async-query',
+        state: QueryState.Running,
+        runAsync: true,
+      };
+      newState = sqlLabReducer(
+        {
+          ...newState,
+          queries: { 'async-query': asyncQuery },
+        },
+        actions.refreshQueries({
+          'async-query': {
+            ...asyncQuery,
+            state: QueryState.Success,
+          },
+        }),
+      );
+      expect(newState.queries['async-query'].state).toBe(QueryState.Success);
+    });
+    test('should downgrade a premature poller success to fetching for a running sync query', () => {
+      const syncQuery = {
+        ...query,
+        id: 'sync-running',
+        state: QueryState.Running,
+        runAsync: false,
+        results: null,
+      };
+      newState = sqlLabReducer(
+        {
+          ...newState,
+          queries: { 'sync-running': syncQuery },
+        },
+        actions.refreshQueries({
+          'sync-running': {
+            ...syncQuery,
+            state: QueryState.Success,
+          },
+        }),
+      );
+      expect(newState.queries['sync-running'].state).toBe(QueryState.Fetching);
+    });
   });
   // eslint-disable-next-line no-restricted-globals -- TODO: Migrate from describe blocks
   describe('CLEAR_INACTIVE_QUERIES', () => {

superset-frontend/src/SqlLab/reducers/sqlLab.ts

@@ -769,14 +769,15 @@ export default function sqlLabReducer(
               }),
               // race condition:
               // because of async behavior, sql lab may still poll a couple of seconds
-              // when it started fetching or finished rendering results
+              // after it started fetching or finished rendering results. Guard only
+              // against re-applying a redundant Success onto a state that's already at
+              // or past Success (Fetching/Success) — Running is strictly before
+              // Success, so an incoming Success there is new information, not a stale
+              // poll, and must be allowed through (otherwise an async query can never
+              // leave Running once observed there).
               state:
                 currentState === QueryState.Success &&
-                [
-                  QueryState.Fetching,
-                  QueryState.Success,
-                  QueryState.Running,
-                ].includes(prevState)
+                [QueryState.Fetching, QueryState.Success].includes(prevState)
                   ? prevState
                   : currentState,
             };

superset-frontend/src/components/Datasource/components/DatasourceEditor/DatasourceEditor.tsx

@@ -867,7 +867,7 @@ function DatasourceEditor({
       return {
         ...metric,
         certification_details: certificationDetails || details,
-        warning_markdown: warningMarkdown || '',
+        warning_markdown: warningMarkdown || metric.warning_markdown || '',
         certified_by: certifiedBy || certifiedByMetric,
       };
     }),

superset-frontend/src/components/Datasource/components/DatasourceEditor/tests/DatasourceEditorMetricCertification.test.tsx

@@ -0,0 +1,73 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import fetchMock from 'fetch-mock';
+import { screen, userEvent, waitFor } from 'spec/helpers/testing-library';
+import {
+  createProps,
+  DATASOURCE_ENDPOINT,
+  setupDatasourceEditorMocks,
+  cleanupAsyncOperations,
+  fastRender,
+  dismissDatasourceWarning,
+} from './DatasourceEditor.test.utils';
+
+beforeEach(() => {
+  fetchMock.get(DATASOURCE_ENDPOINT, [], { name: DATASOURCE_ENDPOINT });
+  setupDatasourceEditorMocks();
+});
+
+afterEach(async () => {
+  await cleanupAsyncOperations();
+  fetchMock.clearHistory().removeRoutes();
+});
+
+// Certifying a metric fills two adjacent fields in one visit to the expanded
+// row. Both are committed through TextControl's debounce, so the second one
+// used to land on the item as it looked before the first had been applied,
+// leaving the saved metric with details but no certifier.
+test('certifying a metric keeps both certified_by and certification_details', async () => {
+  const testProps = createProps();
+  fastRender(testProps);
+  await dismissDatasourceWarning();
+
+  await userEvent.click(await screen.findByTestId('collection-tab-Metrics'));
+  const expandToggles = await screen.findAllByLabelText(/expand row/i);
+  await userEvent.click(expandToggles[0]);
+
+  await userEvent.type(
+    await screen.findByPlaceholderText('Certified by'),
+    'Metric Certifier',
+  );
+  await userEvent.type(
+    await screen.findByPlaceholderText('Certification details'),
+    'Metric cert details',
+  );
+
+  await waitFor(() => {
+    const { calls } = testProps.onChange.mock;
+    const savedMetrics = calls[calls.length - 1]?.[0]?.metrics ?? [];
+    const saved = savedMetrics.find(metric => metric.metric_name === 'count');
+    expect(saved).toEqual(
+      expect.objectContaining({
+        certified_by: 'Metric Certifier',
+        certification_details: 'Metric cert details',
+      }),
+    );
+  });
+});

superset-frontend/src/components/Datasource/components/DatasourceEditor/tests/DatasourceEditorWarningMarkdown.test.tsx

@@ -0,0 +1,97 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import fetchMock from 'fetch-mock';
+import { screen, userEvent } from 'spec/helpers/testing-library';
+import {
+  createProps,
+  DATASOURCE_ENDPOINT,
+  setupDatasourceEditorMocks,
+  cleanupAsyncOperations,
+  fastRender,
+  dismissDatasourceWarning,
+} from './DatasourceEditor.test.utils';
+
+// Stub the Ace-backed control with a plain textarea. Ace spreads its document
+// across many spans and keeps only the keystroke buffer in its own textarea,
+// so asserting on the value the control receives is less brittle than
+// reaching into Ace's DOM.
+jest.mock('src/explore/components/controls/TextAreaControl', () => ({
+  __esModule: true,
+  default: ({
+    controlId,
+    value,
+    onChange,
+  }: {
+    controlId?: string;
+    value?: string;
+    onChange?: (value: string) => void;
+  }) => (
+    <textarea
+      data-test={`mock-textarea-${controlId}`}
+      value={value ?? ''}
+      onChange={event => onChange?.(event.target.value)}
+    />
+  ),
+}));
+
+beforeEach(() => {
+  fetchMock.get(DATASOURCE_ENDPOINT, [], { name: DATASOURCE_ENDPOINT });
+  setupDatasourceEditorMocks();
+});
+
+afterEach(async () => {
+  await cleanupAsyncOperations();
+  fetchMock.clearHistory().removeRoutes();
+});
+
+// Regression test for #42704. Explore's datasource payload (SqlMetric.data on
+// the backend) exposes warning_markdown as a flattened top-level field and
+// omits the raw `extra` JSON string that the /api/v1/dataset/{id} endpoint
+// backing the Datasets page provides. Deriving warning_markdown purely from
+// `extra` therefore dropped the saved text when the modal was opened from
+// Explore, leaving the Warning field blank on reopen.
+test('keeps a pre-existing top-level warning_markdown when the metric has no extra', async () => {
+  const baseProps = createProps();
+  const testProps = {
+    ...baseProps,
+    datasource: {
+      ...baseProps.datasource,
+      metrics: [
+        {
+          ...baseProps.datasource.metrics[0],
+          warning_markdown: 'existing warning',
+          extra: undefined,
+        },
+      ],
+    },
+  };
+
+  fastRender(testProps);
+  await dismissDatasourceWarning();
+
+  const metricsTab = await screen.findByTestId('collection-tab-Metrics');
+  await userEvent.click(metricsTab);
+
+  const expandToggles = await screen.findAllByLabelText(/expand row/i);
+  await userEvent.click(expandToggles[0]);
+
+  expect(
+    await screen.findByTestId('mock-textarea-warning_markdown'),
+  ).toHaveValue('existing warning');
+});

superset-frontend/src/components/Datasource/components/Fieldset/index.tsx

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { ReactNode, useCallback } from 'react';
+import { ReactNode, useCallback, useEffect, useRef } from 'react';
 import { Divider, Form, Typography } from '@superset-ui/core/components';
 import { css } from '@apache-superset/core/theme';
 import { recurseReactClone } from '../../utils';
@@ -39,14 +39,24 @@ export default function Fieldset({
   title = null,
   compact = false,
 }: FieldsetProps) {
+  // Controls report their edits asynchronously - TextControl debounces by
+  // FAST_DEBOUNCE - so the callback that eventually fires was built during an
+  // earlier render. Spreading that render's `item` rebuilds the whole record
+  // from a snapshot taken before a sibling field committed, dropping the value
+  // the user typed first. Reading off a ref merges into the latest commit.
+  const itemRef = useRef(item);
+  useEffect(() => {
+    itemRef.current = item;
+  }, [item]);
+
   const handleChange = useCallback(
     (fieldKey: fieldKeyType, val: any) => {
       onChange?.({
-        ...item,
+        ...itemRef.current,
         [fieldKey]: val,
       });
     },
-    [onChange, item],
+    [onChange],
   );
 
   const propExtender = (field: { props: { fieldKey: fieldKeyType } }) => ({

superset-frontend/src/dashboard/actions/nativeFilters.ts

@@ -27,7 +27,7 @@ import {
 } from '@superset-ui/core';
 import { Dispatch } from 'redux';
 import { RootState } from 'src/dashboard/types';
-import { cloneDeep } from 'lodash-es';
+import { cloneDeep, omit } from 'lodash-es';
 import { setDataMaskForFilterChangesComplete } from 'src/dataMask/actions';
 import { HYDRATE_DASHBOARD } from './hydrate';
 import {
@@ -90,12 +90,20 @@ export const setFilterConfiguration =
     });
     try {
       const response = await updateFilters(filterChanges);
+      // chartsInScope/tabsInScope are derived from the live layout, and the
+      // response carries the persisted copy for every filter - including the
+      // ones this save never touched, whose copy is whatever was stored when
+      // the dashboard was last saved. Dropping them lets the reducers keep the
+      // scopes calculateScopes already computed for this session.
+      const savedFilters = response.result.map(
+        filter => omit(filter, ['chartsInScope', 'tabsInScope']) as Filter,
+      );
       dispatch({
         type: SET_NATIVE_FILTERS_CONFIG_COMPLETE,
-        filterChanges: response.result,
+        filterChanges: savedFilters,
         deletedIds: filterChanges.deleted,
       });
-      dispatch(nativeFiltersConfigChanged(response.result));
+      dispatch(nativeFiltersConfigChanged(savedFilters));
       dispatch(setDataMaskForFilterChangesComplete(filterChanges, oldFilters));
     } catch (err) {
       dispatch({

superset-frontend/src/dashboard/components/PropertiesModal/PropertiesModal.test.tsx

@@ -528,6 +528,57 @@ describe('PropertiesModal', () => {
     });
   });
 
+  test('preserves certification fields on save without opening Certification section', async () => {
+    // Accordion Collapse only mounts the active panel, so certifiedBy /
+    // certificationDetails FormItems are unregistered until Certification is
+    // opened. onFinish must use getFieldsValue(true) to read store values for
+    // unregistered fields; otherwise save clears certified_by to null.
+    const put = jest.spyOn(SupersetCore.SupersetClient, 'put');
+    put.mockResolvedValue({
+      json: {
+        result: {
+          dashboard_title: 'dashboard_title',
+          slug: 'slug',
+          json_metadata: 'json_metadata',
+          editors: 'editors',
+        },
+      },
+    } as any);
+    mockedIsFeatureEnabled.mockReturnValue(false);
+    const props = createProps();
+    const propsWithDashboardInfo = {
+      ...props,
+      dashboardInfo: {
+        ...dashboardInfo,
+        json_metadata: mockedJsonMetadata,
+      },
+    };
+    render(<PropertiesModal {...propsWithDashboardInfo} />, {
+      useRedux: true,
+    });
+    await screen.findByTestId('dashboard-edit-properties-form');
+
+    // Only General information fields are mounted; Certification inputs are not.
+    expect(screen.getAllByRole('textbox')).toHaveLength(3);
+    expect(screen.queryByText('Certified by')).not.toBeInTheDocument();
+
+    await userEvent.click(screen.getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => {
+      expect(props.onSubmit).toHaveBeenCalledTimes(1);
+    });
+    const submitCall = props.onSubmit.mock.calls[0][0];
+    expect(submitCall.certifiedBy).toBe('John Doe');
+    expect(submitCall.certificationDetails).toBe('Sample certification');
+
+    expect(put).toHaveBeenCalled();
+    const putRequest = put.mock.calls[0][0];
+    expect(typeof putRequest.body).toBe('string');
+    const putBody = JSON.parse(putRequest.body as string);
+    expect(putBody.certified_by).toBe('John Doe');
+    expect(putBody.certification_details).toBe('Sample certification');
+  });
+
   test('submitting with onlyApply:true', async () => {
     mockedIsFeatureEnabled.mockReturnValue(false);
     const props = createProps();

superset-frontend/src/dashboard/components/PropertiesModal/index.tsx

@@ -307,7 +307,7 @@ const PropertiesModal = ({
       slug,
       certifiedBy,
       certificationDetails,
-    } = form.getFieldsValue();
+    } = form.getFieldsValue(true);
     let currentJsonMetadata = jsonMetadata;
 
     // validate currentJsonMetadata

superset-frontend/src/embedded/api.test.ts

@@ -0,0 +1,155 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { DataMaskStateWithId } from '@superset-ui/core';
+
+// Mock factories must build their own jest.fn()s: jest.mock calls are hoisted
+// above this file's declarations, so a factory closing over a const would read
+// it before initialization.
+jest.mock('@apache-superset/core/utils', () => ({
+  logging: { debug: jest.fn(), warn: jest.fn(), error: jest.fn() },
+}));
+
+jest.mock('../views/store', () => ({
+  store: { dispatch: jest.fn(), getState: jest.fn(), subscribe: jest.fn() },
+}));
+
+// eslint-disable-next-line import/first
+import { embeddedApi } from './api';
+// eslint-disable-next-line import/first
+import { updateDataMask } from '../dataMask/actions';
+
+const { logging: mockLogging } = jest.requireMock(
+  '@apache-superset/core/utils',
+);
+const { store: mockStore } = jest.requireMock('../views/store');
+const mockDispatch = mockStore.dispatch;
+const mockGetState = mockStore.getState;
+
+const nativeFilterMask = { filterState: { value: ['CA'] } };
+const crossFilterMask = { filterState: { value: [2024] } };
+
+// `dashboardInfo.id` is only set once HYDRATE_DASHBOARD lands, so it doubles as
+// the "dashboard is hydrated" signal setDataMask waits for.
+function stateWithFilters(filterIds: string[]) {
+  return {
+    dashboardInfo: { id: 1 },
+    dataMask: Object.fromEntries(filterIds.map(id => [id, { id }])),
+  };
+}
+
+beforeEach(() => {
+  jest.clearAllMocks();
+});
+
+test('setDataMask dispatches an update for each known filter', () => {
+  mockGetState.mockReturnValue(
+    stateWithFilters(['NATIVE_FILTER-1', 'NATIVE_FILTER-2']),
+  );
+
+  embeddedApi.setDataMask({
+    dataMask: {
+      'NATIVE_FILTER-1': nativeFilterMask,
+      'NATIVE_FILTER-2': crossFilterMask,
+    } as unknown as DataMaskStateWithId,
+  });
+
+  expect(mockDispatch).toHaveBeenCalledTimes(2);
+  expect(mockDispatch).toHaveBeenCalledWith(
+    updateDataMask('NATIVE_FILTER-1', nativeFilterMask),
+  );
+  expect(mockDispatch).toHaveBeenCalledWith(
+    updateDataMask('NATIVE_FILTER-2', crossFilterMask),
+  );
+  expect(mockLogging.warn).not.toHaveBeenCalled();
+});
+
+test('setDataMask ignores filter ids the dashboard does not know', () => {
+  mockGetState.mockReturnValue(stateWithFilters(['NATIVE_FILTER-1']));
+
+  embeddedApi.setDataMask({
+    dataMask: {
+      'NATIVE_FILTER-1': nativeFilterMask,
+      'NATIVE_FILTER-from-another-dashboard': crossFilterMask,
+    } as unknown as DataMaskStateWithId,
+  });
+
+  expect(mockDispatch).toHaveBeenCalledTimes(1);
+  expect(mockDispatch).toHaveBeenCalledWith(
+    updateDataMask('NATIVE_FILTER-1', nativeFilterMask),
+  );
+  expect(mockLogging.warn).toHaveBeenCalledWith(
+    expect.stringContaining('unknown filter ids'),
+    'NATIVE_FILTER-from-another-dashboard',
+  );
+});
+
+test('setDataMask ignores the change-trigger flags observeDataMask emits', () => {
+  mockGetState.mockReturnValue(stateWithFilters(['NATIVE_FILTER-1']));
+
+  embeddedApi.setDataMask({
+    dataMask: {
+      'NATIVE_FILTER-1': nativeFilterMask,
+      crossFiltersChanged: false,
+      nativeFiltersChanged: true,
+    } as unknown as DataMaskStateWithId,
+  });
+
+  expect(mockDispatch).toHaveBeenCalledTimes(1);
+  expect(mockDispatch).toHaveBeenCalledWith(
+    updateDataMask('NATIVE_FILTER-1', nativeFilterMask),
+  );
+});
+
+test('setDataMask dispatches nothing when no filter id is known', () => {
+  mockGetState.mockReturnValue(stateWithFilters([]));
+
+  embeddedApi.setDataMask({
+    dataMask: {
+      'NATIVE_FILTER-1': nativeFilterMask,
+    } as unknown as DataMaskStateWithId,
+  });
+
+  expect(mockDispatch).not.toHaveBeenCalled();
+  expect(mockLogging.warn).toHaveBeenCalled();
+});
+
+test('setDataMask queues the mask until the dashboard hydrates', () => {
+  let notifyStoreSubscribers = () => {};
+  mockStore.subscribe.mockImplementation((listener: () => void) => {
+    notifyStoreSubscribers = listener;
+    return jest.fn();
+  });
+  mockGetState.mockReturnValue({ dataMask: {} });
+
+  embeddedApi.setDataMask({
+    dataMask: {
+      'NATIVE_FILTER-1': nativeFilterMask,
+    } as unknown as DataMaskStateWithId,
+  });
+
+  expect(mockDispatch).not.toHaveBeenCalled();
+  expect(mockLogging.warn).not.toHaveBeenCalled();
+
+  mockGetState.mockReturnValue(stateWithFilters(['NATIVE_FILTER-1']));
+  notifyStoreSubscribers();
+
+  expect(mockDispatch).toHaveBeenCalledWith(
+    updateDataMask('NATIVE_FILTER-1', nativeFilterMask),
+  );
+});

superset-frontend/src/embedded/api.tsx

@@ -17,12 +17,15 @@
  * under the License.
  */
 import { DataMaskStateWithId, JsonObject } from '@superset-ui/core';
+import { logging } from '@apache-superset/core/utils';
 import getBootstrapData from 'src/utils/getBootstrapData';
+import { batch } from 'react-redux';
 import { store } from '../views/store';
 import { getDashboardPermalink as getDashboardPermalinkUtil } from '../utils/urlUtils';
 import { DashboardChartStates } from '../dashboard/types/chartState';
 import { hasStatefulCharts } from '../dashboard/util/chartStateConverter';
 import { getChartDataPayloads as getChartDataPayloadsUtil } from './utils';
+import { updateDataMask } from '../dataMask/actions';
 
 const bootstrapData = getBootstrapData();
 
@@ -40,6 +43,7 @@ type EmbeddedSupersetApi = {
   getChartDataPayloads: (params?: {
     chartId?: number;
   }) => Promise<Record<string, JsonObject>>;
+  setDataMask: ({ dataMask }: { dataMask: DataMaskStateWithId }) => void;
 };
 
 const getScrollSize = (): Size => ({
@@ -83,6 +87,58 @@ const getActiveTabs = () => store?.getState()?.dashboardState?.activeTabs || [];
 
 const getDataMask = () => store?.getState()?.dataMask || {};
 
+const isDashboardHydrated = () => Boolean(store?.getState()?.dashboardInfo?.id);
+
+const applyDataMask = (dataMask: DataMaskStateWithId) => {
+  // The dashboard's own data mask holds an entry for every native filter and
+  // every cross-filter-capable chart, so it doubles as the set of filter ids
+  // this dashboard can accept. Anything else — a filter id from a different
+  // dashboard, or the change-trigger flags that `observeDataMask` emits
+  // alongside the mask — would otherwise be inserted as a bogus filter and
+  // treated as a globally scoped filter by the active-filter derivation.
+  const knownFilterIds = new Set(Object.keys(getDataMask()));
+  const entries = Object.entries(dataMask);
+  const applicable = entries.filter(([id]) => knownFilterIds.has(id));
+  const ignored = entries.filter(([id]) => !knownFilterIds.has(id));
+
+  if (ignored.length) {
+    logging.warn(
+      '[superset] setDataMask ignored unknown filter ids:',
+      ignored.map(([id]) => id).join(', '),
+    );
+  }
+
+  batch(() => {
+    applicable.forEach(([filterId, mask]) => {
+      store?.dispatch(updateDataMask(filterId, mask));
+    });
+  });
+};
+
+// A mask requested before the dashboard hydrates cannot be applied yet: the
+// store holds no filter entries to validate the ids against, and hydration
+// would replace anything dispatched in the meantime. Hold the request and
+// replay it once hydration lands.
+let queuedDataMask: DataMaskStateWithId | undefined;
+let unsubscribeFromHydration: (() => void) | undefined;
+
+const setDataMask = ({ dataMask }: { dataMask: DataMaskStateWithId }) => {
+  if (isDashboardHydrated()) {
+    applyDataMask(dataMask);
+    return;
+  }
+
+  queuedDataMask = { ...queuedDataMask, ...dataMask };
+  unsubscribeFromHydration ??= store?.subscribe(() => {
+    if (!isDashboardHydrated()) return;
+    unsubscribeFromHydration?.();
+    unsubscribeFromHydration = undefined;
+    const pending = queuedDataMask;
+    queuedDataMask = undefined;
+    if (pending) applyDataMask(pending);
+  });
+};
+
 const getChartStates = () =>
   store?.getState()?.dashboardState?.chartStates || {};
 
@@ -102,4 +158,5 @@ export const embeddedApi: EmbeddedSupersetApi = {
   getDataMask,
   getChartStates,
   getChartDataPayloads,
+  setDataMask,
 };

superset-frontend/src/embedded/index.tsx

@@ -298,6 +298,7 @@ window.addEventListener('message', function embeddedPageInitializer(event) {
     Switchboard.defineMethod('getActiveTabs', embeddedApi.getActiveTabs);
     Switchboard.defineMethod('getDataMask', embeddedApi.getDataMask);
     Switchboard.defineMethod('getChartStates', embeddedApi.getChartStates);
+    Switchboard.defineMethod('setDataMask', embeddedApi.setDataMask);
     Switchboard.defineMethod(
       'getChartDataPayloads',
       embeddedApi.getChartDataPayloads,

superset-frontend/src/explore/components/ExploreChartHeader/ExploreChartHeader.test.tsx

@@ -43,6 +43,10 @@ import path from 'path';
 
 const chartEndpoint = 'glob:*api/v1/chart/*';
 
+const EDIT_PROPERTIES_INITIAL_STATE = {
+  explore: { can_overwrite: true, can_add: true },
+};
+
 fetchMock.get(chartEndpoint, { json: 'foo' });
 
 window.featureFlags = {
@@ -170,7 +174,10 @@ describe('ExploreChartHeader', () => {
 
   test('Cancelling changes to the properties should reset previous properties', async () => {
     const props = createProps();
-    render(<ExploreHeader {...props} />, { useRedux: true });
+    render(<ExploreHeader {...props} />, {
+      useRedux: true,
+      initialState: EDIT_PROPERTIES_INITIAL_STATE,
+    });
     const newChartName = 'New chart name';
     const prevChartName = props.sliceName;
 
@@ -626,6 +633,7 @@ describe('Additional actions tests', () => {
     const props = createProps();
     render(<ExploreHeader {...props} />, {
       useRedux: true,
+      initialState: EDIT_PROPERTIES_INITIAL_STATE,
     });
 
     userEvent.click(screen.getByLabelText('Menu actions trigger'));
@@ -720,6 +728,7 @@ describe('Additional actions tests', () => {
     const props = createProps();
     render(<ExploreHeader {...props} />, {
       useRedux: true,
+      initialState: EDIT_PROPERTIES_INITIAL_STATE,
     });
     expect(props.actions.redirectSQLLab).toHaveBeenCalledTimes(0);
     userEvent.click(screen.getByLabelText('Menu actions trigger'));

superset-frontend/src/explore/components/useExploreAdditionalActionsMenu/index.tsx

@@ -279,6 +279,7 @@ interface ExploreState {
     chartStates?: Record<number, JsonObject>;
     can_export_image?: boolean;
     can_overwrite?: boolean;
+    can_add?: boolean;
   };
   common?: {
     conf?: {
@@ -335,17 +336,30 @@ export const useExploreAdditionalActionsMenu = (
   const canOverwrite = useSelector<ExploreState, boolean>(
     state => state.explore?.can_overwrite ?? false,
   );
+  // Mirrors the `can_write` permission on the `Chart` view, the same
+  // permission `ChartRestApi.put` (and `restore_version`) require. An editor
+  // who satisfies `canOverwriteSlice` but lacks it would still be turned away
+  // by the API, so the properties editor stays hidden for them too.
+  const canWriteChart = useSelector<ExploreState, boolean>(
+    state => state.explore?.can_add ?? false,
+  );
   const user = useSelector<
     ExploreState,
     UserWithPermissionsAndRoles | undefined
   >(state => state.user);
-  // `can_overwrite` alone hides version history on any chart without explicit
-  // editors — every seeded chart — even from admins. Same predicate SaveModal
-  // uses, so a user who can save a chart can also see its history.
+  // `can_overwrite` alone hides version history (and edit-properties) on any
+  // chart without explicit editors — every seeded chart — even from admins.
+  // Same predicate SaveModal uses, so a user who can save a chart can also
+  // see its history and edit its properties.
   const canModifySlice = useMemo(
     () => canOverwriteSlice({ slice, user, canOverwrite }),
     [slice, user, canOverwrite],
   );
+  // `canModifySlice` alone governs version history, whose own read-only
+  // listing needs no write permission (only its restore action does, and
+  // that's gated server-side). Editing properties, however, always PUTs the
+  // chart, so it additionally needs the write permission above.
+  const canEditProperties = canModifySlice && canWriteChart;
 
   const dataExportDisabled = !canDownloadCSV;
   const imageExportDisabled = !canExportImage;
@@ -601,7 +615,7 @@ export const useExploreAdditionalActionsMenu = (
     const menuItems = [];
 
     // Edit chart properties
-    if (slice) {
+    if (slice && canEditProperties) {
       menuItems.push({
         key: MENU_KEYS.EDIT_PROPERTIES,
         label: t('Edit chart properties'),
@@ -1084,6 +1098,7 @@ export const useExploreAdditionalActionsMenu = (
   }, [
     addDangerToast,
     canDownloadCSV,
+    canEditProperties,
     canModifySlice,
     copyLink,
     dashboards,

superset-frontend/src/explore/components/useExploreAdditionalActionsMenu/useExploreAdditionalActionsMenu.test.tsx

@@ -27,6 +27,7 @@ import {
   getExportScreenshotMenuItems,
 } from './index';
 import * as exploreUtils from 'src/explore/exploreUtils';
+import { Slice } from 'src/types/Chart';
 
 jest.mock('src/explore/exploreUtils', () => ({
   __esModule: true,
@@ -74,13 +75,22 @@ jest.mock('@superset-ui/core', () => ({
   })),
 }));
 
+jest.mock('src/utils/getBootstrapData', () => ({
+  __esModule: true,
+  default: jest.fn(() => ({
+    common: {
+      user_subjects: [1],
+    },
+  })),
+}));
+
 const defaultProps = {
   latestQueryFormData: {
     datasource: '1__table',
     viz_type: 'pivot_table_v2',
   },
   canDownloadCSV: true,
-  slice: { slice_id: 1, slice_name: 'Test Chart' },
+  slice: { slice_id: 1, slice_name: 'Test Chart' } as unknown as Slice,
   ownState: {},
   dashboards: [],
   onOpenInEditor: jest.fn(),
@@ -113,6 +123,63 @@ beforeEach(() => {
   mockExportChart.mockResolvedValue(undefined);
 });
 
+test('hides Edit chart properties from a user who is not an owner/editor of the chart (regression #38884)', async () => {
+  render(
+    <TestComponent
+      {...defaultProps}
+      slice={
+        {
+          slice_id: 1,
+          slice_name: 'Test Chart',
+          editors: [2],
+        } as unknown as Slice
+      }
+    />,
+    { useRedux: true },
+  );
+
+  expect(await screen.findByText('Data Export Options')).toBeInTheDocument();
+  expect(screen.queryByText('Edit chart properties')).not.toBeInTheDocument();
+});
+
+test('shows Edit chart properties for a chart editor with chart write permission', async () => {
+  render(
+    <TestComponent
+      {...defaultProps}
+      slice={
+        {
+          slice_id: 1,
+          slice_name: 'Test Chart',
+          editors: [1],
+        } as unknown as Slice
+      }
+    />,
+    { useRedux: true, initialState: { explore: { can_add: true } } },
+  );
+
+  expect(await screen.findByText('Data Export Options')).toBeInTheDocument();
+  expect(screen.getByText('Edit chart properties')).toBeInTheDocument();
+});
+
+test('hides Edit chart properties from a chart editor lacking chart write permission', async () => {
+  render(
+    <TestComponent
+      {...defaultProps}
+      slice={
+        {
+          slice_id: 1,
+          slice_name: 'Test Chart',
+          editors: [1],
+        } as unknown as Slice
+      }
+    />,
+    { useRedux: true, initialState: { explore: { can_add: false } } },
+  );
+
+  expect(await screen.findByText('Data Export Options')).toBeInTheDocument();
+  expect(screen.queryByText('Edit chart properties')).not.toBeInTheDocument();
+});
+
 test('shows 413 error toast when exportCSV fails with 413', async () => {
   mockExportChart.mockRejectedValue({ status: 413 });
 

superset-frontend/webpack.config.js

@@ -738,4 +738,14 @@ const smp = new SpeedMeasurePlugin({
   disable: !measure,
 });
 
+// Emits per-asset/entrypoint sizes via `--json` (the default `stats: 'minimal'`
+// above omits both). Not `normal`/`detailed` stats: those also serialize the
+// full ~15k-module dependency graph, which is hundreds of MB for this app --
+// large enough to exceed Node's max string length when read back with
+// `fs.readFileSync`. Used by scripts/bundle-size-summary.js in CI.
+// e.g. BUNDLE_SIZE_STATS=true npm run build -- --json=stats.json
+if (process.env.BUNDLE_SIZE_STATS) {
+  config.stats = { all: false, assets: true, entrypoints: true };
+}
+
 module.exports = smp.wrap(config);

superset/charts/data/api.py

@@ -22,7 +22,7 @@ import re
 from datetime import datetime
 from typing import Any, Callable, TYPE_CHECKING
 
-from flask import current_app as app, g, make_response, request, Response
+from flask import current_app as app, make_response, request, Response
 from flask_appbuilder.api import expose, protect
 from flask_babel import gettext as _
 from marshmallow import ValidationError
@@ -37,6 +37,7 @@ from superset.charts.data.dashboard_filter_context import (
     DashboardFilterContext,
     get_dashboard_filter_context,
 )
+from superset.charts.data.form_data import set_form_data
 from superset.charts.data.query_context_cache_loader import QueryContextCacheLoader
 from superset.charts.schemas import ChartDataQueryContextSchema
 from superset.commands.chart.data.create_async_job_command import (
@@ -214,7 +215,7 @@ class ChartDataRestApi(ChartRestApi):
         # templating pulls form data from the request globally, so this
         # fallback ensures it has the filters and extra_form_data applied
         # when used in get_sqla_query which constructs the final query.
-        g.form_data = json_body
+        set_form_data(json_body)
 
         try:
             query_context = self._create_query_context_from_form(json_body)
@@ -410,7 +411,7 @@ class ChartDataRestApi(ChartRestApi):
             cached_data = self._load_query_context_form_from_cache(cache_key)
             # Set form_data in Flask Global as it is used as a fallback
             # for async queries with jinja context
-            g.form_data = cached_data
+            set_form_data(cached_data)
             query_context = self._create_query_context_from_form(cached_data)
             command = ChartDataCommand(query_context)
             command.validate()

superset/charts/data/form_data.py

@@ -0,0 +1,63 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+from __future__ import annotations
+
+from typing import Any, TYPE_CHECKING
+
+from flask import g
+
+if TYPE_CHECKING:
+    from superset.common.query_context import QueryContext
+    from superset.common.query_object import QueryObject
+
+
+def set_form_data(form_data: dict[str, Any]) -> None:
+    """Expose chart data request fields to Jinja template macros."""
+    g.form_data = form_data
+
+
+def _serialize_query(
+    query: QueryObject,
+    form_data: dict[str, Any],
+) -> dict[str, Any]:
+    """Serialize query fields consumed by the Jinja form-data fallback."""
+    query_data = dict(query.to_dict())
+    query_data["filters"] = query.filter
+    if query.time_range is not None:
+        query_data["time_range"] = query.time_range
+    if url_params := form_data.get("url_params"):
+        query_data["url_params"] = url_params
+    return query_data
+
+
+def set_query_context_form_data(
+    query_context: QueryContext,
+    datasource_id: int,
+    datasource_type: str,
+) -> None:
+    """Expose a programmatically-created query like a chart data API request."""
+    form_data = query_context.form_data or {}
+    set_form_data(
+        {
+            "datasource": {"id": datasource_id, "type": datasource_type},
+            "queries": [
+                _serialize_query(query, form_data) for query in query_context.queries
+            ],
+            "form_data": form_data,
+        }
+    )

superset/cli/export_example.py

@@ -155,7 +155,7 @@ def export_example(  # noqa: C901
 
     # Find the dashboard
     if dashboard_id:
-        dashboard = db.session.get(Dashboard, dashboard_id)
+        dashboard = db.session.query(Dashboard).get(dashboard_id)
     elif dashboard_slug:
         dashboard = db.session.query(Dashboard).filter_by(slug=dashboard_slug).first()
     else:

superset/commands/database/oauth2.py

@@ -21,6 +21,7 @@ from functools import partial
 from typing import cast
 from uuid import UUID
 
+from superset import db
 from superset.commands.base import BaseCommand
 from superset.commands.database.exceptions import DatabaseNotFoundError
 from superset.daos.database import DatabaseUserOAuth2TokensDAO
@@ -96,6 +97,11 @@ class OAuth2StoreTokenCommand(BaseCommand):
             database_id=self._state["database_id"],
         ):
             DatabaseUserOAuth2TokensDAO.delete([existing])
+            # flush the delete before inserting the replacement -- the unit
+            # of work otherwise emits INSERTs before DELETEs within a single
+            # flush, which would trip the (user_id, database_id) unique
+            # index below on the old row.
+            db.session.flush()
 
         # store tokens
         expiration = datetime.now() + timedelta(seconds=token_response["expires_in"])

superset/commands/dataset/duplicate.py

@@ -65,7 +65,7 @@ class DuplicateDatasetCommand(CreateMixin, BaseCommand):
         database_id = self._base_model.database_id
         table_name = self._properties["table_name"]
         editors = self._properties["editors"]
-        database = db.session.get(Database, database_id)
+        database = db.session.query(Database).get(database_id)
         if not database:
             raise SupersetErrorException(
                 SupersetError(

superset/commands/importers/v1/examples.py

@@ -69,7 +69,7 @@ def transpile_virtual_dataset_sql(config: dict[str, Any], database_id: int) -> N
     if not sql:
         return
 
-    database = db.session.get(Database, database_id)
+    database = db.session.query(Database).get(database_id)
     if not database:
         logger.warning("Database %s not found, skipping SQL transpilation", database_id)
         return

superset/commands/importers/v1/utils.py

@@ -318,27 +318,39 @@ def import_tag(
 
     for tag_name in target_tag_names:
         try:
-            tag = existing_tags.get(tag_name)
+            # Isolate each tag operation in a SAVEPOINT so a failure (e.g. a
+            # concurrent unique-constraint violation) rolls back only the failed
+            # tag and leaves the session usable for the remaining tags, instead
+            # of poisoning the session with a pending-rollback state.
+            with db_session.begin_nested():
+                tag = existing_tags.get(tag_name)
 
-            # If tag does not exist, create it
-            if tag is None:
-                description = tag_descriptions.get(tag_name, None)
-                tag = Tag(name=tag_name, description=description, type="custom")
-                db_session.add(tag)
-                existing_tags[tag_name] = tag  # Update the existing_tags dictionary
+                # If tag does not exist, create it
+                if tag is None:
+                    description = tag_descriptions.get(tag_name, None)
+                    tag = Tag(name=tag_name, description=description, type="custom")
+                    db_session.add(tag)
+                    existing_tags[tag_name] = tag  # Update the existing_tags dictionary
 
-            # Ensure the association with the object
-            tagged_object = (
-                db_session.query(TaggedObject)
-                .filter_by(object_id=object_id, object_type=object_type, tag_id=tag.id)
-                .first()
-            )
-            if not tagged_object:
-                new_tagged_object = TaggedObject(
-                    tag_id=tag.id, object_id=object_id, object_type=object_type
+                # Ensure the association with the object
+                tagged_object = (
+                    db_session.query(TaggedObject)
+                    .filter_by(
+                        object_id=object_id, object_type=object_type, tag_id=tag.id
+                    )
+                    .first()
                 )
-                db_session.add(new_tagged_object)
+                if not tagged_object:
+                    new_tagged_object = TaggedObject(
+                        tag_id=tag.id, object_id=object_id, object_type=object_type
+                    )
+                    db_session.add(new_tagged_object)
 
+            # Only record the tag as imported once the SAVEPOINT has been
+            # released (and its pending inserts flushed) without error; the
+            # nested block's own flush can still fail on a concurrent
+            # unique-constraint violation, in which case this line must not
+            # run.
             new_tag_ids.append(tag.id)
 
         except SQLAlchemyError as err:
@@ -349,7 +361,9 @@ def import_tag(
                 object_id,
                 err,
             )
-            continue  # No need for manual rollback, handled by transaction decorator
+            # The SAVEPOINT was rolled back by begin_nested(); the session is
+            # still usable for the remaining tags.
+            continue
 
     # Remove old tags not in the new config
     for tag in existing_assocs:

superset/commands/sql_lab/results.py

@@ -21,6 +21,7 @@ from typing import Any, cast
 
 from flask import current_app as app
 from flask_babel import gettext as __
+from jinja2.exceptions import TemplateError
 
 from superset import db, results_backend, results_backend_use_msgpack
 from superset.commands.base import BaseCommand
@@ -98,6 +99,15 @@ class SqlExecutionResultsCommand(BaseCommand):
                 ),
                 status=403,
             ) from ex
+        except TemplateError as ex:
+            raise SupersetErrorException(
+                SupersetError(
+                    message=str(ex),
+                    error_type=SupersetErrorType.GENERIC_COMMAND_ERROR,
+                    level=ErrorLevel.ERROR,
+                ),
+                status=400,
+            ) from ex
 
         # Now fetch results from backend (query exists, so this is a valid request)
         read_from_results_backend_start = now_as_float()

superset/connectors/sqla/models.py

@@ -2528,16 +2528,6 @@ class RowLevelSecurityFilter(Model, AuditMixinNullable):
         Enum(
             *[filter_type.value for filter_type in utils.RowLevelSecurityFilterType],
             name="filter_type_enum",
-            # No migration has ever created a native "filter_type_enum" type in
-            # Postgres - the 2020-09-15 migration that added this column only
-            # ever created a plain VARCHAR. That mismatch was harmless under
-            # SQLAlchemy 1.4, but SQLAlchemy 2.0's postgresql "insertmanyvalues"
-            # feature casts every bound parameter to its column type's DDL name
-            # (`p2::filter_type_enum`) even for a single-row INSERT, which fails
-            # outright since the type doesn't exist. native_enum=False keeps
-            # this a plain VARCHAR (with a CHECK constraint) so the type
-            # actually matches what's really in the database.
-            native_enum=False,
         ),
     )
     group_key = Column(String(255), nullable=True)

superset/daos/dashboard.py

@@ -34,11 +34,12 @@ from superset.commands.dashboard.exceptions import (
     DashboardUpdateFailedError,
 )
 from superset.daos.base import BaseDAO, ColumnOperator, ColumnOperatorEnum
-from superset.dashboards.filters import DashboardAccessFilter, is_uuid
+from superset.dashboards.filter_scope import derive_metadata_scopes
+from superset.dashboards.filters import DashboardAccessFilter
 from superset.exceptions import SupersetSecurityException
 from superset.extensions import db
 from superset.models.core import FavStar, FavStarClassName
-from superset.models.dashboard import Dashboard, id_or_slug_filter
+from superset.models.dashboard import Dashboard, id_or_slug_filter, is_uuid
 from superset.models.embedded_dashboard import EmbeddedDashboard
 from superset.models.helpers import skip_visibility_filter
 from superset.models.slice import Slice
@@ -531,15 +532,6 @@ class DashboardDAO(BaseDAO[Dashboard]):
         dash.params = original_dash.params
         cls.set_dash_metadata(dash, metadata, old_to_new_slice_ids)
         db.session.add(dash)
-        # Flush so the returned dashboard always has a real, persisted
-        # identity (dash.id populated) regardless of what the caller does
-        # next. Without this, whether `dash` ends up with a usable id was an
-        # accident of whatever query the caller happened to run afterward
-        # (autoflush would catch it) - the duplicate_slices=True path leaked
-        # this: it flushes internally per-cloned-slice already, and simple
-        # test/caller code that queries the DB again incidentally
-        # autoflushes too, masking that the plain-copy path never did.
-        db.session.flush()
         return dash
 
     @classmethod
@@ -547,7 +539,9 @@ class DashboardDAO(BaseDAO[Dashboard]):
         cls, id: str
     ) -> dict[str, list[dict[str, Any]]]:
         dashboard = cls.get_by_id_or_slug(id)
-        metadata = json.loads(dashboard.json_metadata or "{}")
+        metadata = derive_metadata_scopes(
+            dashboard, json.loads(dashboard.json_metadata or "{}")
+        )
         native_filter_configuration = metadata.get("native_filter_configuration", [])
 
         tab_filters = defaultdict(list)
@@ -617,6 +611,13 @@ class DashboardDAO(BaseDAO[Dashboard]):
             metadata["native_filter_configuration"] = updated_configuration
             dashboard.json_metadata = json.dumps(metadata)
 
+            # The client rebuilds its in-scope state from this response, so hand
+            # back derived scopes rather than the stored caches, which are stale
+            # for every filter the caller did not touch.
+            updated_configuration = derive_metadata_scopes(dashboard, metadata)[
+                "native_filter_configuration"
+            ]
+
         return updated_configuration
 
     @classmethod

superset/daos/dataset.py

@@ -630,7 +630,7 @@ class DatasetDAO(BaseDAO[SqlaTable]):
         dataset = DatasetDAO.find_by_id(dataset_id)
         if not dataset:
             return None
-        return db.session.get(SqlMetric, metric_id)
+        return db.session.query(SqlMetric).get(metric_id)
 
     @staticmethod
     def get_table_by_name(database_id: int, table_name: str) -> SqlaTable | None:

superset/dashboards/api.py

@@ -91,6 +91,7 @@ from superset.commands.importers.v1.utils import get_contents_from_bundle
 from superset.commands.purge import PurgeArchivedCommand, SoftDeleteBinding
 from superset.constants import MODEL_API_RW_METHOD_PERMISSION_MAP, RouteMethod
 from superset.daos.dashboard import DashboardDAO, EmbeddedDashboardDAO
+from superset.dashboards.filter_scope import derive_json_metadata
 from superset.dashboards.filters import (
     DashboardAccessFilter,
     DashboardCertifiedFilter,
@@ -653,6 +654,12 @@ class DashboardRestApi(
             schema = self.dashboard_get_response_schema
 
         result = schema.dump(dash)
+        if json_metadata := result.get("json_metadata"):
+            # The stored scope caches (``chartsInScope``, ``tabsInScope``,
+            # ``chart_configuration``) go stale as soon as the layout changes;
+            # derive them so callers see the same document the dashboard client
+            # computes for itself.
+            result["json_metadata"] = derive_json_metadata(dash, json_metadata)
         if "charts" in result:
             # Only name the member charts the caller can access, consistent with
             # the per-object narrowing applied to the dashboard's datasets and

superset/dashboards/filter_scope.py

@@ -0,0 +1,275 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+"""Derive filter-scope caches in ``json_metadata`` from the dashboard layout.
+
+``chartsInScope`` / ``tabsInScope`` on a native filter, and the ``chartsInScope``
+lists inside ``chart_configuration`` / ``global_chart_configuration``, are
+denormalized caches of the authoritative ``scope`` plus ``position_json``. They
+are written when a dashboard is saved and are never revisited afterwards, so a
+dashboard that has charts added or removed - or that was seeded, exported or
+imported - carries scope arrays naming charts it does not contain.
+
+The dashboard client already ignores the stored values and recomputes them from
+the live layout on every load, which is why the JSON Metadata panel and
+``GET /api/v1/dashboard/{id}`` disagreed on a dashboard nobody had ever saved.
+Deriving them on read makes the API agree with the client and keeps integrations
+that read ``native_filter_configuration`` from receiving dangling chart ids.
+
+The rules mirror the client (``superset-frontend/src/dashboard/util``):
+``calculateScopes``, ``getChartIdsInFilterScope``, ``findTabsWithChartsInScope``
+and ``getCrossFiltersConfiguration``.
+"""
+
+from __future__ import annotations
+
+import re
+from typing import Any, TYPE_CHECKING
+
+from superset.utils import json
+
+if TYPE_CHECKING:
+    from superset.models.dashboard import Dashboard
+
+CHART_TYPE = "CHART"
+TAB_TYPE = "TAB"
+NATIVE_FILTER_DIVIDER_PREFIX = "NATIVE_FILTER_DIVIDER-"
+DIVIDER_TYPES = frozenset({"DIVIDER", "CHART_CUSTOMIZATION_DIVIDER"})
+
+# ``chart-<chartId>-layer-<layerIndex>``, the per-layer scope keys a deck.gl
+# multi-layer chart contributes to ``scope.selectedLayers``.
+LAYER_SELECTION_RE = re.compile(r"^chart-(\d+)-layer-(\d+)$")
+
+ChartLayoutItems = dict[int, list[dict[str, Any]]]
+
+
+def build_chart_layout_items(position_data: dict[str, Any]) -> ChartLayoutItems:
+    """Map each chart id in the layout to the layout items that render it."""
+    chart_layout_items: ChartLayoutItems = {}
+    for item in position_data.values():
+        if not isinstance(item, dict) or item.get("type") != CHART_TYPE:
+            continue
+        chart_id = item.get("meta", {}).get("chartId")
+        if isinstance(chart_id, int):
+            chart_layout_items.setdefault(chart_id, []).append(item)
+    return chart_layout_items
+
+
+def get_chart_ids_in_scope(
+    scope: dict[str, Any],
+    chart_ids: list[int],
+    chart_layout_items: ChartLayoutItems,
+) -> list[int]:
+    """Charts covered by ``scope``, in ``chart_ids`` order."""
+    excluded = set(scope.get("excluded") or [])
+    root_path = set(scope.get("rootPath") or [])
+
+    def in_scope(chart_id: int) -> bool:
+        if chart_id in excluded:
+            return False
+        return any(
+            parent in root_path
+            for layout_item in chart_layout_items.get(chart_id, [])
+            for parent in layout_item.get("parents") or []
+        )
+
+    selected_layers = scope.get("selectedLayers") or []
+    if not selected_layers:
+        return [chart_id for chart_id in chart_ids if in_scope(chart_id)]
+
+    # A layer selection targets its chart directly, and suppresses the
+    # rootPath/excluded test for that chart.
+    charts_with_layer_selections = set()
+    targeted: list[int] = []
+    chart_id_set = set(chart_ids)
+    for selection_key in selected_layers:
+        if match := LAYER_SELECTION_RE.match(str(selection_key)):
+            chart_id = int(match.group(1))
+            charts_with_layer_selections.add(chart_id)
+            if chart_id in chart_id_set and chart_id not in targeted:
+                targeted.append(chart_id)
+
+    return targeted + [
+        chart_id
+        for chart_id in chart_ids
+        if chart_id not in charts_with_layer_selections
+        and chart_id not in targeted
+        and in_scope(chart_id)
+    ]
+
+
+def get_tabs_in_scope(
+    charts_in_scope: list[int],
+    chart_layout_items: ChartLayoutItems,
+) -> list[str]:
+    """Tabs holding at least one of ``charts_in_scope``."""
+    tabs_in_scope: list[str] = []
+    seen: set[str] = set()
+    for chart_id in charts_in_scope:
+        for layout_item in chart_layout_items.get(chart_id, []):
+            for parent in layout_item.get("parents") or []:
+                if parent.startswith(f"{TAB_TYPE}-") and parent not in seen:
+                    seen.add(parent)
+                    tabs_in_scope.append(parent)
+    return tabs_in_scope
+
+
+def _is_divider(item: dict[str, Any]) -> bool:
+    return (
+        str(item.get("id", "")).startswith(NATIVE_FILTER_DIVIDER_PREFIX)
+        or item.get("type") in DIVIDER_TYPES
+    )
+
+
+def _derive_item_scopes(
+    items: list[Any],
+    chart_ids: list[int],
+    chart_layout_items: ChartLayoutItems,
+) -> list[Any]:
+    """Restamp ``chartsInScope`` / ``tabsInScope`` on scoped config items.
+
+    Items without a usable ``scope`` are returned untouched: legacy chart
+    customizations target a chart directly and only gain a ``scope`` once the
+    client migrates them, so overwriting their cache here would drop targeting
+    the client still needs.
+    """
+    derived = []
+    for item in items:
+        if not isinstance(item, dict):
+            derived.append(item)
+            continue
+        if _is_divider(item):
+            derived.append({**item, "chartsInScope": [], "tabsInScope": []})
+            continue
+        scope = item.get("scope")
+        if not isinstance(scope, dict) or not isinstance(scope.get("excluded"), list):
+            derived.append(item)
+            continue
+        charts_in_scope = get_chart_ids_in_scope(scope, chart_ids, chart_layout_items)
+        derived.append(
+            {
+                **item,
+                "chartsInScope": charts_in_scope,
+                "tabsInScope": get_tabs_in_scope(charts_in_scope, chart_layout_items),
+            }
+        )
+    return derived
+
+
+def _derive_cross_filter_scopes(
+    metadata: dict[str, Any],
+    chart_ids: list[int],
+    chart_layout_items: ChartLayoutItems,
+) -> None:
+    global_config = metadata.get("global_chart_configuration")
+    global_charts_in_scope = chart_ids
+    if isinstance(global_config, dict) and isinstance(global_config.get("scope"), dict):
+        global_charts_in_scope = get_chart_ids_in_scope(
+            global_config["scope"], chart_ids, chart_layout_items
+        )
+        metadata["global_chart_configuration"] = {
+            **global_config,
+            "chartsInScope": global_charts_in_scope,
+        }
+
+    chart_configuration = metadata.get("chart_configuration")
+    if not isinstance(chart_configuration, dict):
+        return
+
+    derived_configuration = {}
+    for key, config in chart_configuration.items():
+        try:
+            chart_id = int(key)
+        except (TypeError, ValueError):
+            derived_configuration[key] = config
+            continue
+        # Config for a chart no longer on the dashboard is dead weight; the
+        # client drops it on load for the same reason.
+        if chart_id not in chart_layout_items:
+            continue
+        if not isinstance(config, dict):
+            derived_configuration[key] = config
+            continue
+        cross_filters = config.get("crossFilters")
+        if not isinstance(cross_filters, dict):
+            derived_configuration[key] = config
+            continue
+        scope = cross_filters.get("scope")
+        if isinstance(scope, dict):
+            charts_in_scope = get_chart_ids_in_scope(
+                scope, chart_ids, chart_layout_items
+            )
+        else:
+            # Anything that is not an explicit scope object points at the
+            # dashboard-wide scope, which never includes the emitting chart.
+            charts_in_scope = [cid for cid in global_charts_in_scope if cid != chart_id]
+        derived_configuration[key] = {
+            **config,
+            "crossFilters": {**cross_filters, "chartsInScope": charts_in_scope},
+        }
+
+    metadata["chart_configuration"] = derived_configuration
+
+
+def derive_scopes(
+    metadata: dict[str, Any],
+    position_data: dict[str, Any],
+    chart_ids: list[int],
+) -> dict[str, Any]:
+    """Return ``metadata`` with every derived scope cache recomputed.
+
+    ``chart_ids`` orders the resulting ``chartsInScope`` arrays and should be the
+    dashboard's chart ids as the client sees them, so that the API and the JSON
+    Metadata panel produce byte-identical documents.
+    """
+    derived = dict(metadata)
+    chart_layout_items = build_chart_layout_items(position_data)
+
+    for key in ("native_filter_configuration", "chart_customization_config"):
+        config = derived.get(key)
+        if isinstance(config, list):
+            derived[key] = _derive_item_scopes(config, chart_ids, chart_layout_items)
+
+    _derive_cross_filter_scopes(derived, chart_ids, chart_layout_items)
+    return derived
+
+
+def derive_metadata_scopes(
+    dashboard: Dashboard,
+    metadata: dict[str, Any],
+) -> dict[str, Any]:
+    """``derive_scopes`` for a dashboard model's parsed ``json_metadata``."""
+    return derive_scopes(
+        metadata,
+        dashboard.position,
+        [slc.id for slc in dashboard.slices],
+    )
+
+
+def derive_json_metadata(dashboard: Dashboard, json_metadata: str) -> str:
+    """``derive_metadata_scopes`` over a raw ``json_metadata`` string.
+
+    Metadata that does not parse as a JSON object is handed back untouched -
+    reading a dashboard is not the place to start rejecting documents that have
+    always been served as-is.
+    """
+    try:
+        metadata = json.loads(json_metadata)
+    except (TypeError, ValueError):
+        return json_metadata
+    if not isinstance(metadata, dict):
+        return json_metadata
+    return json.dumps(derive_metadata_scopes(dashboard, metadata))

superset/dashboards/filters.py

@@ -16,26 +16,26 @@
 # under the License.
 from typing import Any
 
-from flask import current_app, g
+from flask import current_app
 from flask_babel import lazy_gettext as _
 from sqlalchemy import and_, or_
 from sqlalchemy.orm.query import Query
 
-from superset import db, is_feature_enabled, security_manager
+from superset import db, security_manager
 from superset.connectors.sqla.models import SqlaTable
 from superset.models.core import Database
-from superset.models.dashboard import Dashboard, is_uuid
-from superset.models.embedded_dashboard import EmbeddedDashboard
+from superset.models.dashboard import Dashboard
 from superset.models.slice import Slice
-from superset.security.guest_token import GuestTokenResourceType, GuestUser
 from superset.subjects.filters import (
     EditableFilter,
-    subject_relation_exists_for_current_user,
 )
 from superset.subjects.models import dashboard_editors, dashboard_viewers
 from superset.tags.filters import BaseTagIdFilter, BaseTagNameFilter
 from superset.utils.core import get_user_id
-from superset.utils.filters import get_dataset_access_filters
+from superset.utils.filters import (
+    get_dataset_access_filters,
+    guest_embedded_dashboard_filter,
+)
 from superset.views.base import BaseFilter
 from superset.views.base_api import BaseFavoriteFilter
 from superset.views.filters import BaseDeletedRecencyFilter, BaseDeletedStateFilter
@@ -110,20 +110,20 @@ class DashboardAccessFilter(BaseFilter):  # pylint: disable=too-few-public-metho
     """
     List dashboards with the following criteria:
 
-    When ``ENABLE_VIEWERS`` is on:
-        1. Those where the user is an editor (published or not)
-        2. Those where the user is a viewer (published only)
-        3. Those with no viewers → fall back to dataset-based access (published only)
-        4. Embedded dashboard access (preserved as-is)
-
-    When ``ENABLE_VIEWERS`` is off (legacy):
-        1. Those which the user is an editor of
-        2. Those which have been published (if they have access to at least one slice)
-
-    If the user is an admin then show all dashboards.
+        1. Embedded guests: only the dashboards in their token, nothing else
+        2. Admins: all dashboards
+        3. Editors: their dashboards (published or not)
+        4. Viewers: published dashboards
+        5. Dashboards with no viewers → fall back to dataset-based access
+           (published only)
     """
 
     def apply(self, query: Query, value: Any) -> Query:
+        # Guests are scoped to their token's dashboards only, never widened by
+        # the role paths below (mirrors ChartFilter).
+        if (guest_condition := guest_embedded_dashboard_filter()) is not None:
+            return query.filter(guest_condition)
+
         if security_manager.is_admin():
             return query
 
@@ -192,91 +192,8 @@ class DashboardAccessFilter(BaseFilter):  # pylint: disable=too-few-public-metho
             if user_id:
                 filters.append(Dashboard.id.in_(extra_dashboards_filter(user_id)))
 
-        # (D) Embedded: preserved as-is
-        if is_feature_enabled("EMBEDDED_SUPERSET") and security_manager.is_guest_user(
-            g.user
-        ):
-            guest_user: GuestUser = g.user
-            embedded_dashboard_ids = [
-                r["id"]
-                for r in guest_user.resources
-                if r["type"] == GuestTokenResourceType.DASHBOARD.value
-            ]
-            condition = (
-                Dashboard.embedded.any(
-                    EmbeddedDashboard.uuid.in_(embedded_dashboard_ids)
-                )
-                if any(is_uuid(id_) for id_ in embedded_dashboard_ids)
-                else Dashboard.id.in_(embedded_dashboard_ids)
-            )
-            filters.append(condition)
-
         return query.filter(or_(*filters)) if filters else query
 
-    def _apply_legacy(self, query: Query) -> Query:
-        datasource_perm_query = (
-            db.session.query(Dashboard.id)
-            .join(Dashboard.slices, isouter=True)
-            .join(SqlaTable, Slice.datasource_id == SqlaTable.id)
-            .join(Database, SqlaTable.database_id == Database.id)
-            .filter(
-                and_(
-                    Dashboard.published.is_(True),
-                    get_dataset_access_filters(
-                        Slice,
-                        security_manager.can_access_all_datasources(),
-                    ),
-                )
-            )
-        )
-
-        # Editors query
-        editor_ids_query = db.session.query(dashboard_editors.c.dashboard_id).filter(
-            subject_relation_exists_for_current_user(dashboard_editors)
-        )
-
-        feature_flagged_filters = []
-        if is_feature_enabled("EMBEDDED_SUPERSET") and security_manager.is_guest_user(
-            g.user
-        ):
-            guest_user: GuestUser = g.user
-            embedded_dashboard_ids = [
-                r["id"]
-                for r in guest_user.resources
-                if r["type"] == GuestTokenResourceType.DASHBOARD.value
-            ]
-
-            # TODO (embedded): only use uuid filter once uuids are rolled out
-            condition = (
-                Dashboard.embedded.any(
-                    EmbeddedDashboard.uuid.in_(embedded_dashboard_ids)
-                )
-                if any(is_uuid(id_) for id_ in embedded_dashboard_ids)
-                else Dashboard.id.in_(embedded_dashboard_ids)
-            )
-
-            feature_flagged_filters.append(condition)
-
-        extra_access_filters = []
-        extra_filters = current_app.config.get("EXTRA_ACCESS_QUERY_FILTERS", {})
-        if extra_dashboards_filter := extra_filters.get("dashboards"):
-            user_id = get_user_id()
-            if user_id:
-                extra_access_filters.append(
-                    Dashboard.id.in_(extra_dashboards_filter(user_id))
-                )
-
-        query = query.filter(
-            or_(
-                Dashboard.id.in_(editor_ids_query),
-                Dashboard.id.in_(datasource_perm_query),
-                *feature_flagged_filters,
-                *extra_access_filters,
-            )
-        )
-
-        return query
-
 
 class DashboardEditableFilter(EditableFilter):  # pylint: disable=too-few-public-methods
     """Filter for dashboards the user can edit."""

superset/databases/utils.py

@@ -20,7 +20,6 @@ from __future__ import annotations
 from typing import Any, TYPE_CHECKING
 
 from sqlalchemy.engine.url import make_url, URL
-from sqlalchemy.exc import NoSuchTableError
 
 from superset.commands.database.exceptions import DatabaseInvalidError
 from superset.sql.parse import Table
@@ -73,42 +72,17 @@ def get_table_metadata(database: Any, table: Table) -> TableMetadataResponse:
     :return: Dict table metadata ready for API response
     """
     keys = []
-    table_missing = False
-    try:
-        # get_columns is the table-existence check: SQLAlchemy 2.0's sqlite
-        # dialect raises NoSuchTableError from reflection for a table that
-        # doesn't exist - 1.4's sqlite dialect silently returned empty
-        # results instead, which this API has always relied on to answer
-        # with an empty-but-200 payload for sqlite specifically (other
-        # backends' dialects already raised on missing tables pre-2.0, so
-        # they're unaffected and still surface as the 422 below). Only
-        # sqlite gets the graceful fallback, matching that pre-existing,
-        # dialect-driven difference in behavior between backends. Only this
-        # first call is guarded, so a NoSuchTableError raised later while
-        # reflecting fks/indexes/comments for a table confirmed to exist
-        # still propagates instead of being mistaken for a missing table.
-        columns = database.get_columns(table)
-    except NoSuchTableError:
-        if database.backend != "sqlite":
-            raise
-        table_missing = True
-        columns = []
-    if not table_missing:
-        primary_key = database.get_pk_constraint(table)
-        foreign_keys = get_foreign_keys_metadata(database, table)
-        indexes = get_indexes_metadata(database, table)
-        table_comment = database.get_table_comment(table)
-    else:
-        primary_key = {"constrained_columns": None, "name": None}
-        foreign_keys = []
-        indexes = []
-        table_comment = None
+    columns = database.get_columns(table)
+    primary_key = database.get_pk_constraint(table)
     if primary_key and primary_key.get("constrained_columns"):
         primary_key["column_names"] = primary_key.pop("constrained_columns")
         primary_key["type"] = "pk"
         keys += [primary_key]
+    foreign_keys = get_foreign_keys_metadata(database, table)
+    indexes = get_indexes_metadata(database, table)
     keys += foreign_keys + indexes
     payload_columns: list[TableMetadataColumnsResponse] = []
+    table_comment = database.get_table_comment(table)
     for col in columns:
         dtype = get_col_type(col)
         payload_columns.append(
@@ -128,12 +102,7 @@ def get_table_metadata(database: Any, table: Table) -> TableMetadataResponse:
             show_cols=True if columns else False,
             indent=True,
             cols=columns,
-            # A missing table has no partitions to look up, and asking
-            # anyway would just re-trigger the same NoSuchTableError via
-            # select_star()'s own internal database.get_columns() fallback
-            # (it re-fetches columns itself whenever `cols` is empty and
-            # either show_cols or latest_partition is set).
-            latest_partition=not table_missing,
+            latest_partition=True,
         ),
         "primaryKey": primary_key,
         "foreignKeys": foreign_keys,

superset/db_engine_specs/base.py

@@ -2918,19 +2918,17 @@ class BasicParametersMixin:
         else:
             query.update(cls.encryption_disable_parameters)
 
-        # SQLAlchemy 2.0 made URL.__str__() hide the password by default
-        # (it rendered in full under 1.4); render_as_string(hide_password=
-        # False) is required here since this URI is stored/used to actually
-        # connect, not just displayed.
-        return URL.create(
-            f"{cls.engine}+{cls.default_driver}".rstrip("+"),  # type: ignore
-            username=parameters.get("username"),
-            password=parameters.get("password"),
-            host=parameters["host"],
-            port=parameters["port"],
-            database=parameters["database"],
-            query=query,
-        ).render_as_string(hide_password=False)
+        return str(
+            URL.create(
+                f"{cls.engine}+{cls.default_driver}".rstrip("+"),  # type: ignore
+                username=parameters.get("username"),
+                password=parameters.get("password"),
+                host=parameters["host"],
+                port=parameters["port"],
+                database=parameters["database"],
+                query=query,
+            )
+        )
 
     @classmethod
     def get_parameters_from_uri(  # pylint: disable=unused-argument

superset/db_engine_specs/clickhouse.py

@@ -487,19 +487,17 @@ class ClickHouseConnectEngineSpec(BasicParametersMixin, ClickHouseEngineSpec):
         if not url_params.get("database"):
             url_params["database"] = "__default__"
 
-        # SQLAlchemy 2.0 made URL.__str__() hide the password by default
-        # (it rendered in full under 1.4); render_as_string(hide_password=
-        # False) is required here since this URI is stored/used to actually
-        # connect, not just displayed.
-        return URL.create(
-            f"{cls.engine}+{cls.default_driver}",
-            username=url_params.get("username"),
-            password=url_params.get("password"),
-            host=url_params.get("host"),
-            port=url_params.get("port"),
-            database=url_params.get("database"),
-            query=url_params.get("query"),
-        ).render_as_string(hide_password=False)
+        return str(
+            URL.create(
+                f"{cls.engine}+{cls.default_driver}",
+                username=url_params.get("username"),
+                password=url_params.get("password"),
+                host=url_params.get("host"),
+                port=url_params.get("port"),
+                database=url_params.get("database"),
+                query=url_params.get("query"),
+            )
+        )
 
     @classmethod
     def get_parameters_from_uri(

superset/db_engine_specs/couchbase.py

@@ -176,11 +176,7 @@ class CouchbaseEngineSpec(BasicParametersMixin, BaseEngineSpec):
                 query=query_params,
             )
         print(uri)
-        # SQLAlchemy 2.0 made URL.__str__() hide the password by default
-        # (it rendered in full under 1.4); render_as_string(hide_password=
-        # False) is required here since this URI is stored/used to actually
-        # connect, not just displayed.
-        return uri.render_as_string(hide_password=False)
+        return str(uri)
 
     @classmethod
     def get_parameters_from_uri(

superset/db_engine_specs/databend.py

@@ -282,19 +282,17 @@ class DatabendEngineSpec(BasicParametersMixin, DatabendBaseEngineSpec):
             else cls.encryption_disable_parameters
         )
 
-        # SQLAlchemy 2.0 made URL.__str__() hide the password by default
-        # (it rendered in full under 1.4); render_as_string(hide_password=
-        # False) is required here since this URI is stored/used to actually
-        # connect, not just displayed.
-        return URL.create(
-            cls.engine,
-            username=parameters.get("username"),
-            password=parameters.get("password"),
-            host=parameters.get("host"),
-            port=parameters.get("port"),
-            database=parameters.get("database") or "__default__",
-            query=query,
-        ).render_as_string(hide_password=False)
+        return str(
+            URL.create(
+                cls.engine,
+                username=parameters.get("username"),
+                password=parameters.get("password"),
+                host=parameters.get("host"),
+                port=parameters.get("port"),
+                database=parameters.get("database") or "__default__",
+                query=query,
+            )
+        )
 
     @classmethod
     def _encryption_from_tls_parameters(

superset/db_engine_specs/databricks.py

@@ -669,19 +669,17 @@ class DatabricksNativeEngineSpec(DatabricksDynamicBaseEngineSpec):
                 )
             query.update(cls.encryption_parameters)
 
-        # SQLAlchemy 2.0 made URL.__str__() hide the password by default
-        # (it rendered in full under 1.4); render_as_string(hide_password=
-        # False) is required here since this URI is stored/used to actually
-        # connect, not just displayed.
-        return URL.create(
-            f"{cls.engine}+{cls.default_driver}".rstrip("+"),
-            username="token",
-            password=parameters.get("access_token"),
-            host=parameters["host"],
-            port=parameters["port"],
-            database=parameters["database"],
-            query=query,
-        ).render_as_string(hide_password=False)
+        return str(
+            URL.create(
+                f"{cls.engine}+{cls.default_driver}".rstrip("+"),
+                username="token",
+                password=parameters.get("access_token"),
+                host=parameters["host"],
+                port=parameters["port"],
+                database=parameters["database"],
+                query=query,
+            )
+        )
 
     @classmethod
     def get_parameters_from_uri(  # type: ignore
@@ -898,18 +896,16 @@ class DatabricksPythonConnectorEngineSpec(DatabricksDynamicBaseEngineSpec):
         if parameters.get("encryption"):
             query.update(cls.encryption_parameters)
 
-        # SQLAlchemy 2.0 made URL.__str__() hide the password by default
-        # (it rendered in full under 1.4); render_as_string(hide_password=
-        # False) is required here since this URI is stored/used to actually
-        # connect, not just displayed.
-        return URL.create(
-            cls.engine,
-            username="token",
-            password=parameters.get("access_token"),
-            host=parameters["host"],
-            port=parameters["port"],
-            query=query,
-        ).render_as_string(hide_password=False)
+        return str(
+            URL.create(
+                cls.engine,
+                username="token",
+                password=parameters.get("access_token"),
+                host=parameters["host"],
+                port=parameters["port"],
+                query=query,
+            )
+        )
 
     @classmethod
     def get_parameters_from_uri(  # type: ignore

superset/db_engine_specs/duckdb.py

@@ -125,11 +125,7 @@ class DuckDBParametersMixin:
         ):
             return MotherDuckEngineSpec.build_sqlalchemy_uri(parameters)
 
-        # SQLAlchemy 2.0 made URL a strict NamedTuple - the raw URL(...)
-        # constructor now requires username/password/host/port to be passed
-        # explicitly (they used to default to None). URL.create() keeps
-        # those optional, matching the pre-2.0 URL(...) behavior used here.
-        return str(URL.create(drivername=cls.engine, database=database, query=query))
+        return str(URL(drivername=cls.engine, database=database, query=query))
 
     @classmethod
     def get_parameters_from_uri(  # pylint: disable=unused-argument
@@ -414,14 +410,8 @@ class MotherDuckEngineSpec(DuckDBEngineSpec):
                 f"Need MotherDuck token to connect to database '{database}'."
             )
 
-        # SQLAlchemy 2.0 made URL a strict NamedTuple - the raw URL(...)
-        # constructor now requires username/password/host/port to be passed
-        # explicitly (they used to default to None). URL.create() keeps
-        # those optional, matching the pre-2.0 URL(...) behavior used here.
         return str(
-            URL.create(
-                drivername=DuckDBEngineSpec.engine, database=database, query=query
-            )
+            URL(drivername=DuckDBEngineSpec.engine, database=database, query=query)
         )
 
     @classmethod

superset/db_engine_specs/snowflake.py

@@ -356,21 +356,19 @@ class SnowflakeEngineSpec(PostgresBaseEngineSpec):
             dict[str, Any]
         ] = None,
     ) -> str:
-        # SQLAlchemy 2.0 made URL.__str__() hide the password by default
-        # (it rendered in full under 1.4); render_as_string(hide_password=
-        # False) is required here since this URI is stored/used to actually
-        # connect, not just displayed.
-        return URL.create(
-            "snowflake",
-            username=parameters.get("username"),
-            password=parameters.get("password"),
-            host=parameters.get("account"),
-            database=parameters.get("database"),
-            query={
-                "role": parameters.get("role"),
-                "warehouse": parameters.get("warehouse"),
-            },
-        ).render_as_string(hide_password=False)
+        return str(
+            URL.create(
+                "snowflake",
+                username=parameters.get("username"),
+                password=parameters.get("password"),
+                host=parameters.get("account"),
+                database=parameters.get("database"),
+                query={
+                    "role": parameters.get("role"),
+                    "warehouse": parameters.get("warehouse"),
+                },
+            )
+        )
 
     @classmethod
     def get_parameters_from_uri(

superset/examples/world_health/charts/Life_Expectancy_VS_Rural.yaml

@@ -41,27 +41,44 @@ params:
     filterOptionName: 2745eae5
     operator: NOT IN
     subject: country_code
-  compare_lag: '10'
-  compare_suffix: o10Y
-  country_fieldtype: cca3
+  color_scheme: supersetColors
   entity: country_name
   granularity_sqla: year
-  groupby: []
-  limit: 0
-  markup_type: markdown
+  legendOrientation: top
+  legendType: scroll
   max_bubble_size: '50'
-  row_limit: 50000
+  opacity: 0.6
+  order_desc: true
+  row_limit: 500
   series: region
-  show_bubbles: true
-  since: '2011-01-01'
-  size: sum__SP_POP_TOTL
-  time_range: '2014-01-01 : 2014-01-02'
-  until: '2011-01-02'
-  viz_type: bubble
-  x: sum__SP_RUR_TOTL_ZS
-  y: sum__SP_DYN_LE00_IN
+  show_legend: true
+  size:
+    aggregate: SUM
+    column:
+      column_name: SP_POP_TOTL
+    expressionType: SIMPLE
+    label: SUM(SP_POP_TOTL)
+    optionName: metric_size_life_expectancy_vs_rural
+  time_range: '2011-01-01 : 2011-01-02'
+  tooltipSizeFormat: SMART_NUMBER
+  truncateXAxis: true
+  viz_type: bubble_v2
+  x:
+    aggregate: SUM
+    column:
+      column_name: SP_RUR_TOTL_ZS
+    expressionType: SIMPLE
+    label: SUM(SP_RUR_TOTL_ZS)
+    optionName: metric_x_life_expectancy_vs_rural
+  y:
+    aggregate: SUM
+    column:
+      column_name: SP_DYN_LE00_IN
+    expressionType: SIMPLE
+    label: SUM(SP_DYN_LE00_IN)
+    optionName: metric_y_life_expectancy_vs_rural
 query_context: null
 slice_name: Life Expectancy VS Rural %
 uuid: c18faec9-ec43-4d36-8b66-4c8b1372020f
 version: 1.0.0
-viz_type: bubble
+viz_type: bubble_v2

superset/extensions/__init__.py

@@ -154,19 +154,7 @@ async_query_manager: AsyncQueryManager = LocalProxy(
 cache_manager = CacheManager()
 celery_app = celery.Celery()
 csrf = CSRFProtect()
-
-# Flask-SQLAlchemy 3.x scopes db.session by the identity of the current Flask
-# app-context object (id(app_ctx)) rather than by thread/greenlet identity like
-# 2.x did. Superset's codebase (and its test fixtures) widely assumes a single
-# shared session per thread across nested `app.app_context()` blocks, often
-# relying on that implicit sharing instead of an explicit commit. Restoring the
-# 2.x scopefunc here keeps that assumption valid under FSA 3.x.
-try:
-    from greenlet import getcurrent as _session_scopefunc
-except ImportError:
-    from threading import get_ident as _session_scopefunc
-
-db = get_sqla_class()(session_options={"scopefunc": _session_scopefunc})
+db = get_sqla_class()()
 
 # make_versioned() MUST be called immediately after db is constructed and before
 # any versioned model class is defined.  Continuum patches the SQLAlchemy

superset/initialization/__init__.py

@@ -26,16 +26,7 @@ from typing import Any, Callable, TYPE_CHECKING
 import wtforms_json
 from colorama import Fore, Style
 from deprecation import deprecated
-from flask import (
-    abort,
-    current_app,
-    Flask,
-    has_app_context,
-    redirect,
-    request,
-    session,
-    url_for,
-)
+from flask import abort, current_app, Flask, redirect, request, session, url_for
 from flask_appbuilder import expose, IndexView
 from flask_appbuilder.api import safe
 from flask_appbuilder.utils.base import get_safe_redirect
@@ -156,16 +147,8 @@ class SupersetAppInitializer:  # pylint: disable=too-many-public-methods
             # pylint: disable=too-few-public-methods
             abstract = True
 
-            # Grab each call into the task and set up an app context, unless
-            # one is already active on this thread (e.g. Celery eager mode
-            # invoked from within an existing request/test context) - Flask-
-            # SQLAlchemy 3.x scopes db.session by the active app context's
-            # object identity rather than by thread, so pushing a redundant
-            # nested context here would silently hand the task a second,
-            # blind session unable to see the caller's uncommitted work.
+            # Grab each call into the task and set up an app context
             def __call__(self, *args: Any, **kwargs: Any) -> Any:
-                if has_app_context():
-                    return task_base.__call__(self, *args, **kwargs)
                 with superset_app.app_context():
                     return task_base.__call__(self, *args, **kwargs)
 

superset/mcp_service/auth.py

@@ -46,6 +46,7 @@ Configuration:
 
 import logging
 from contextlib import AbstractContextManager, contextmanager
+from contextvars import ContextVar
 from typing import Any, Callable, cast, Generator, TYPE_CHECKING, TypeAlias, TypeVar
 
 from flask import current_app, g, has_app_context, has_request_context
@@ -60,6 +61,7 @@ from superset.mcp_service.guest_token_verifier import GUEST_TOKEN_CLAIM
 from superset.mcp_service.mcp_config import (
     default_user_resolver,
     get_mcp_api_key_enabled,
+    MCP_GUEST_ALLOWED_TOOLS,
     validate_multi_issuer_user_resolver,
 )
 from superset.mcp_service.session_scope import _mcp_session_token
@@ -78,6 +80,15 @@ F = TypeVar("F", bound=Callable[..., Any])
 
 logger = logging.getLogger(__name__)
 
+# The resolved user's id for the current tool call, set by
+# _setup_user_context(). g.user is only valid for the lifetime of the
+# per-call app context pushed by _get_app_context_manager() (see its
+# docstring) and is gone by the time LoggingMiddleware's on_call_tool/
+# on_message finally-blocks run after call_next() returns. This ContextVar
+# survives that context pop (mirrors _mcp_call_id_var in middleware.py) so
+# audit logging can attribute the call to the right user.
+_mcp_user_id_var: ContextVar[int | None] = ContextVar("mcp_user_id", default=None)
+
 # An MCP request resolves to a real DB ``User`` or, for embedded guests, a
 # ``GuestUser`` (an AnonymousUserMixin, not a ``User`` subclass). Both are valid
 # authenticated principals for tool execution.
@@ -244,21 +255,9 @@ def _log_scope_denial(
 
 # Default-deny allow-list for embedded guests: a guest may call only these tools,
 # regardless of MCP_RBAC_ENABLED or how the guest role (PUBLIC_ROLE_LIKE) is
-# configured. Everything else is denied, including newly added tools until listed
-# here. Sync with mcp_config.py.
-_DEFAULT_GUEST_ALLOWED_TOOLS: frozenset[str] = frozenset(
-    {
-        # Dashboard structure, scoped to the token's embedded dashboards.
-        "get_dashboard_info",
-        "get_dashboard_layout",
-        "list_dashboards",
-        # Chart read + data, scoped by ChartFilter; data-model fields redacted.
-        "list_charts",
-        "get_chart_info",
-        "get_chart_data",
-        "get_chart_preview",
-    }
-)
+# configured. Everything else is denied, including newly added tools until listed.
+# Single source of truth: MCP_GUEST_ALLOWED_TOOLS in mcp_config.py.
+_DEFAULT_GUEST_ALLOWED_TOOLS: frozenset[str] = frozenset(MCP_GUEST_ALLOWED_TOOLS)
 
 
 def _guest_allowed_tools() -> frozenset[str]:
@@ -890,9 +889,9 @@ def _assert_user_active(user: MCPUser | None) -> None:
         )
 
 
-def _setup_user_context() -> MCPUser | None:
+def _resolve_user_with_retry() -> MCPUser | None:
     """
-    Set up user context for MCP tool execution.
+    Resolve the current user, retrying once on a stale DB connection.
 
     Includes retry logic for stale database connections (e.g., SSL dropped
     by proxy/load balancer after idle periods). On OperationalError, the
@@ -901,14 +900,6 @@ def _setup_user_context() -> MCPUser | None:
     Returns:
         User object with roles and groups loaded, or None if no Flask context
     """
-    # Clear stale g.user to prevent user impersonation across
-    # tool calls when no per-request middleware refreshes it.
-    # Only clear in app-context-only mode; preserve g.user when
-    # a request context is active (external middleware set it).
-
-    if not has_request_context():
-        g.pop("user", None)
-
     from sqlalchemy.exc import OperationalError
 
     user = None  # Ensure defined before loop in case of unexpected exit
@@ -925,7 +916,7 @@ def _setup_user_context() -> MCPUser | None:
             if hasattr(user, "groups"):
                 user_groups = user.groups  # noqa: F841
 
-            break
+            return user
         except RuntimeError as e:
             # No Flask application context (e.g., prompts before middleware runs)
             if "application context" in str(e):
@@ -959,8 +950,38 @@ def _setup_user_context() -> MCPUser | None:
                 g.pop("user", None)
             raise
 
+    return user
+
+
+def _setup_user_context() -> MCPUser | None:
+    """
+    Set up user context for MCP tool execution.
+
+    Returns:
+        User object with roles and groups loaded, or None if no Flask context
+    """
+    # Clear stale g.user to prevent user impersonation across
+    # tool calls when no per-request middleware refreshes it.
+    # Only clear in app-context-only mode; preserve g.user when
+    # a request context is active (external middleware set it).
+
+    if not has_request_context():
+        g.pop("user", None)
+    # Clear any user_id left over from a previous call in this context
+    # (e.g. sequential calls sharing one asyncio task) so a failed/
+    # unauthenticated lookup below doesn't inherit a stale value.
+    _mcp_user_id_var.set(None)
+
+    user = _resolve_user_with_retry()
+    if user is None:
+        return None
+
     _assert_user_active(user)
     g.user = user
+    # GuestUser (embedded auth) has no numeric id; leave the ContextVar
+    # cleared (already reset above) rather than raise.
+    if (user_id := getattr(user, "id", None)) is not None:
+        _mcp_user_id_var.set(user_id)
     return user
 
 

superset/mcp_service/chart/chart_utils.py

@@ -38,6 +38,7 @@ from superset.mcp_service.chart.schemas import (
     BigNumberChartConfig,
     BoxPlotChartConfig,
     ChartCapabilities,
+    ChartConfig,
     ChartSemantics,
     ColumnRef,
     CurrencyFormat,
@@ -52,12 +53,17 @@ from superset.mcp_service.chart.schemas import (
     WaterfallChartConfig,
     XYChartConfig,
 )
+from superset.mcp_service.chart.validation.dataset_validator import (
+    is_dataset_column_temporal,
+)
 from superset.mcp_service.utils.url_utils import get_superset_base_url
 from superset.utils import json
 from superset.utils.core import FilterOperator
 
 logger = logging.getLogger(__name__)
 
+MCP_DASHBOARD_TIME_FILTER_SUBJECT = "_mcp_dashboard_time_filter_subject"
+
 
 @dataclass
 class DatasetValidationResult:
@@ -91,8 +97,6 @@ def validate_chart_dataset(
     Returns:
         DatasetValidationResult with validation status and any warnings
     """
-    from sqlalchemy.exc import SQLAlchemyError
-
     from superset.daos.dataset import DatasetDAO
     from superset.mcp_service.auth import has_dataset_access
 
@@ -108,9 +112,12 @@ def validate_chart_dataset(
             error="Chart has no dataset reference (datasource_id is None)",
         )
 
-    # Try to look up the dataset
+    # Skip the DatasourceFilter base filter when not checking access, so the
+    # lookup is a true existence check (it otherwise denies a guest outright).
     try:
-        dataset = DatasetDAO.find_by_id(datasource_id)
+        dataset = DatasetDAO.find_by_id(
+            datasource_id, skip_base_filter=not check_access
+        )
 
         if dataset is None:
             return DatasetValidationResult(
@@ -186,8 +193,6 @@ def generate_explore_link(
     this skips the permalink path and returns an ``/explore/?form_data_key=...``
     URL directly.
     """
-    from sqlalchemy.exc import SQLAlchemyError
-
     from superset.commands.exceptions import CommandException
     from superset.commands.explore.form_data.parameters import CommandParameters
     from superset.commands.explore.permalink.create import CreateExplorePermalinkCommand
@@ -295,51 +300,6 @@ def _find_dataset_by_id_or_uuid(dataset_id: int | str | None) -> "SqlaTable | No
     return DatasetDAO.find_by_id_or_uuid(str(dataset_id))
 
 
-def _is_dataset_column_temporal(
-    col: Any, column_name: str, db_engine_spec: Any
-) -> bool:
-    """Decide temporality for a single dataset column, mirroring
-    TableColumn.is_temporal: native temporal SQL types are always
-    temporal, and is_dttm=True is otherwise trusted over the raw SQL
-    type -- this is the standard, supported way to mark a non-temporal
-    column (e.g. a VARCHAR "ds" partition column on Hive/Presto/Trino)
-    as a date.
-
-    The one case guarded against is a plain NUMERIC column (e.g. an
-    integer "year"/"month" column) that Superset's column-name
-    heuristics may have mis-flagged as is_dttm=True with no
-    python_date_format to parse it -- applying DATE_TRUNC/time_grain to
-    that would fail at query time.
-    """
-    from superset.utils.core import GenericDataType
-
-    is_dttm = bool(getattr(col, "is_dttm", False))
-    col_type = col.type
-    if not col_type:
-        return is_dttm  # No type info, trust is_dttm flag
-
-    column_spec = db_engine_spec.get_column_spec(col_type)
-    generic_type = column_spec.generic_type if column_spec else None
-
-    if generic_type == GenericDataType.TEMPORAL:
-        return True
-    if not is_dttm:
-        return False
-    if generic_type != GenericDataType.NUMERIC or getattr(
-        col, "python_date_format", None
-    ):
-        return True
-
-    logger.debug(
-        "Column '%s' is marked is_dttm=True but has numeric type '%s' with "
-        "no python_date_format; treating as non-temporal to avoid an "
-        "invalid DATE_TRUNC on a numeric column",
-        column_name,
-        col_type,
-    )
-    return False
-
-
 def is_column_truly_temporal(
     column_name: str,
     dataset_id: int | str | None,
@@ -347,7 +307,7 @@ def is_column_truly_temporal(
 ) -> bool:
     """
     Check if a column is truly temporal, mirroring TableColumn.is_temporal
-    (see ``_is_dataset_column_temporal`` for the precedence rules).
+    using the shared dataset temporal predicate.
 
     Args:
         column_name: Name of the column to check
@@ -373,7 +333,7 @@ def is_column_truly_temporal(
         for col in dataset.columns:
             if col.column_name.lower() == column_lower:
                 db_engine_spec = dataset.database.db_engine_spec
-                return _is_dataset_column_temporal(col, column_name, db_engine_spec)
+                return is_dataset_column_temporal(col, column_name, db_engine_spec)
 
         return True  # Default if column not found
 
@@ -388,13 +348,7 @@ def is_column_truly_temporal(
 
 
 def map_config_to_form_data(
-    config: TableChartConfig
-    | XYChartConfig
-    | PieChartConfig
-    | PivotTableChartConfig
-    | MixedTimeseriesChartConfig
-    | HandlebarsChartConfig
-    | BigNumberChartConfig,
+    config: ChartConfig,
     dataset_id: int | str | None = None,
 ) -> Dict[str, Any]:
     """Map chart config to Superset form_data via the plugin registry.
@@ -434,6 +388,7 @@ def map_config_to_form_data(
             parts.append("Suggestions: " + "; ".join(error.suggestions))
         raise ValueError(" ".join(parts))
 
+    _bind_dashboard_time_range_filter(form_data, config, dataset_id)
     return form_data
 
 
@@ -802,6 +757,98 @@ def _ensure_temporal_adhoc_filter(form_data: Dict[str, Any], column: str) -> Non
     form_data["adhoc_filters"] = existing
 
 
+def _has_generated_temporal_filter(form_data: Dict[str, Any], column: str) -> bool:
+    """Return whether form data contains the neutral generated time binding."""
+    return any(
+        isinstance(filter_, dict)
+        and filter_.get("operator") == FilterOperator.TEMPORAL_RANGE.value
+        and filter_.get("subject") == column
+        and filter_.get("comparator") == NO_TIME_RANGE
+        for filter_ in form_data.get("adhoc_filters", [])
+    )
+
+
+def _ensure_generated_temporal_binding(form_data: Dict[str, Any], column: str) -> None:
+    """Add a neutral time filter and record its generated provenance."""
+    _ensure_temporal_adhoc_filter(form_data, column)
+    if _has_generated_temporal_filter(form_data, column):
+        form_data[MCP_DASHBOARD_TIME_FILTER_SUBJECT] = column
+
+
+def _bind_dashboard_time_range_filter(
+    form_data: Dict[str, Any],
+    config: ChartConfig,
+    dataset_id: int | str | None,
+) -> None:
+    """Bind charts without time configuration to a temporal filter subject."""
+    if temporal_column := getattr(config, "temporal_column", None):
+        if _is_temporal_for_dashboard_binding(temporal_column, dataset_id):
+            granularity = form_data.get("granularity_sqla")
+            if isinstance(granularity, str) and granularity != temporal_column:
+                # QueryContextFactory gives granularity precedence over a temporal
+                # filter, so a different granularity would bind both columns.
+                form_data["granularity_sqla"] = None
+            _ensure_temporal_adhoc_filter(form_data, temporal_column)
+            form_data[MCP_DASHBOARD_TIME_FILTER_SUBJECT] = temporal_column
+        return
+
+    dataset = None
+    if dataset_id:
+        try:
+            dataset = _find_dataset_by_id_or_uuid(dataset_id)
+        except (AttributeError, RuntimeError, ValueError, SQLAlchemyError) as ex:
+            logger.debug(
+                "Could not resolve dataset %s for dashboard time binding: %s",
+                dataset_id,
+                ex,
+            )
+            return
+
+    granularity = form_data.get("granularity_sqla")
+    if isinstance(granularity, str) and _is_temporal_for_dashboard_binding(
+        granularity, dataset_id, dataset
+    ):
+        # Temporal XY mappers create the neutral filter before this binding pass.
+        # Record its provenance so preview updates can replace it if the subject
+        # changes, without treating user-authored temporal ranges as generated.
+        if _has_generated_temporal_filter(form_data, granularity):
+            form_data[MCP_DASHBOARD_TIME_FILTER_SUBJECT] = granularity
+        return
+
+    x_axis = form_data.get("x_axis")
+    if isinstance(x_axis, str) and _is_temporal_for_dashboard_binding(
+        x_axis, dataset_id, dataset
+    ):
+        _ensure_temporal_adhoc_filter(form_data, x_axis)
+        form_data[MCP_DASHBOARD_TIME_FILTER_SUBJECT] = x_axis
+        return
+
+    main_dttm_col = getattr(dataset, "main_dttm_col", None)
+    if isinstance(main_dttm_col, str) and _is_temporal_for_dashboard_binding(
+        main_dttm_col, dataset_id, dataset
+    ):
+        _ensure_temporal_adhoc_filter(form_data, main_dttm_col)
+        form_data[MCP_DASHBOARD_TIME_FILTER_SUBJECT] = main_dttm_col
+
+
+def _is_temporal_for_dashboard_binding(
+    column: str,
+    dataset_id: int | str | None,
+    dataset: "SqlaTable | None" = None,
+) -> bool:
+    """Check temporal metadata without making chart mapping fail on lookup errors."""
+    try:
+        return is_column_truly_temporal(column, dataset_id, dataset=dataset)
+    except (AttributeError, RuntimeError, ValueError, SQLAlchemyError) as ex:
+        logger.debug(
+            "Could not validate temporal column %s for dataset %s: %s",
+            column,
+            dataset_id,
+            ex,
+        )
+        return False
+
+
 def _resolve_default_x_axis(
     config: XYChartConfig, dataset_id: int | str | None
 ) -> tuple[XYChartConfig, "SqlaTable | None"]:
@@ -908,7 +955,10 @@ def map_xy_config(  # noqa: C901
 
     _add_adhoc_filters(form_data, config.filters)
 
-    if x_is_temporal:
+    # A shared explicit temporal_column is the dashboard binding source of truth.
+    # Defer to _bind_dashboard_time_range_filter instead of also binding the
+    # temporal x-axis, which would apply the dashboard range to both columns.
+    if x_is_temporal and not config.temporal_column:
         _ensure_temporal_adhoc_filter(form_data, config.x.name)
 
     _add_xy_limits(form_data, config)
@@ -1104,7 +1154,7 @@ def map_big_number_config(
     # panel, which exposes an `adhoc_filters` control even though there's no
     # dedicated time-column control for the total variant.
     if temporal_column := _resolve_big_number_temporal_column(config, dataset_id):
-        _ensure_temporal_adhoc_filter(form_data, temporal_column)
+        _ensure_generated_temporal_binding(form_data, temporal_column)
 
     return form_data
 

superset/mcp_service/chart/preview_utils.py

@@ -69,7 +69,7 @@ def generate_preview_from_form_data(
         from superset.connectors.sqla.models import SqlaTable
         from superset.extensions import db
 
-        dataset = db.session.get(SqlaTable, dataset_id)
+        dataset = db.session.query(SqlaTable).get(dataset_id)
         if not dataset:
             return ChartError(
                 error=f"Dataset {dataset_id} not found", error_type="DatasetNotFound"

superset/mcp_service/chart/resources/chart_configs.py

@@ -248,6 +248,8 @@ def get_chart_configs_resource() -> str:
         ],
         "general": [
             "Always verify column names with get_dataset_info before charting",
+            "Set temporal_column when dashboard time filters should use a column "
+            "other than the dataset's main temporal column",
             "Use generate_explore_link for preview, generate_chart for saving",
             "Each column label must be unique across the entire configuration",
             "Column names must match: ^[a-zA-Z0-9_][a-zA-Z0-9_ \\-\\.]*$",

superset/mcp_service/chart/schemas.py

@@ -772,6 +772,33 @@ class UnknownFieldCheckMixin(BaseModel):
         return _check_unknown_fields(data, cls)
 
 
+class BaseChartConfig(UnknownFieldCheckMixin):
+    """Fields shared by every MCP chart configuration."""
+
+    temporal_column: str | None = Field(
+        None,
+        description=(
+            "Temporal column used to bind dashboard time-range filters. "
+            "When omitted, charts without a temporal axis use the dataset's "
+            "main temporal column."
+        ),
+        min_length=1,
+        max_length=255,
+    )
+
+    @field_validator("temporal_column")
+    @classmethod
+    def sanitize_temporal_column(cls, v: str | None) -> str | None:
+        """Sanitize temporal column names to prevent SQL injection."""
+        return sanitize_user_input(
+            v,
+            "Temporal column",
+            max_length=255,
+            check_sql_keywords=True,
+            allow_empty=True,
+        )
+
+
 class ColumnRef(UnknownFieldCheckMixin):
     model_config = ConfigDict(extra="ignore", populate_by_name=True)
 
@@ -1024,7 +1051,7 @@ class SortByConfig(UnknownFieldCheckMixin):
 
 
 # Actual chart types
-class PieChartConfig(UnknownFieldCheckMixin):
+class PieChartConfig(BaseChartConfig):
     model_config = ConfigDict(extra="ignore", populate_by_name=True)
 
     chart_type: Literal["pie"] = "pie"
@@ -1098,7 +1125,7 @@ class PieChartConfig(UnknownFieldCheckMixin):
         return self
 
 
-class PivotTableChartConfig(UnknownFieldCheckMixin):
+class PivotTableChartConfig(BaseChartConfig):
     model_config = ConfigDict(extra="ignore", populate_by_name=True)
 
     chart_type: Literal["pivot_table"] = "pivot_table"
@@ -1162,7 +1189,7 @@ class PivotTableChartConfig(UnknownFieldCheckMixin):
         return self
 
 
-class MixedTimeseriesChartConfig(UnknownFieldCheckMixin):
+class MixedTimeseriesChartConfig(BaseChartConfig):
     model_config = ConfigDict(extra="ignore", populate_by_name=True)
 
     chart_type: Literal["mixed_timeseries"] = "mixed_timeseries"
@@ -1255,7 +1282,7 @@ class MixedTimeseriesChartConfig(UnknownFieldCheckMixin):
         return self
 
 
-class HandlebarsChartConfig(UnknownFieldCheckMixin):
+class HandlebarsChartConfig(BaseChartConfig):
     model_config = ConfigDict(extra="ignore")
 
     chart_type: Literal["handlebars"] = Field(
@@ -1371,7 +1398,7 @@ class HandlebarsChartConfig(UnknownFieldCheckMixin):
         return self
 
 
-class BigNumberChartConfig(UnknownFieldCheckMixin):
+class BigNumberChartConfig(BaseChartConfig):
     model_config = ConfigDict(extra="ignore")
 
     chart_type: Literal["big_number"] = Field(
@@ -1391,17 +1418,6 @@ class BigNumberChartConfig(UnknownFieldCheckMixin):
             "Must include an aggregate function (e.g., SUM, COUNT)."
         ),
     )
-    temporal_column: str | None = Field(
-        None,
-        description=(
-            "Temporal column for the trendline x-axis. Required when "
-            "show_trendline is True. Also used (whether or not a trendline is "
-            "shown) to bind the chart's dashboard time-range filter; when "
-            "omitted, the dataset's default temporal column is used instead."
-        ),
-        min_length=1,
-        max_length=255,
-    )
     time_grain: TimeGrain | None = Field(
         None,
         description=(
@@ -1495,18 +1511,6 @@ class BigNumberChartConfig(UnknownFieldCheckMixin):
         description="Filters to apply",
     )
 
-    @field_validator("temporal_column")
-    @classmethod
-    def sanitize_temporal_column(cls, v: str | None) -> str | None:
-        """Sanitize temporal column name to prevent SQL injection."""
-        return sanitize_user_input(
-            v,
-            "Temporal column",
-            max_length=255,
-            check_sql_keywords=True,
-            allow_empty=True,
-        )
-
     @model_validator(mode="after")
     def validate_trendline_fields(self) -> Self:
         """Validate trendline requires temporal column."""
@@ -1576,7 +1580,7 @@ class TableColumnConfig(UnknownFieldCheckMixin):
     )
 
 
-class TableChartConfig(UnknownFieldCheckMixin):
+class TableChartConfig(BaseChartConfig):
     model_config = ConfigDict(extra="ignore", populate_by_name=True)
 
     chart_type: Literal["table"] = "table"
@@ -1707,7 +1711,7 @@ def _metric_display_label(col: ColumnRef) -> str:
     return col.label or col.name or ""
 
 
-class XYChartConfig(UnknownFieldCheckMixin):
+class XYChartConfig(BaseChartConfig):
     model_config = ConfigDict(extra="ignore", populate_by_name=True)
 
     chart_type: Literal["xy"] = "xy"
@@ -1878,7 +1882,7 @@ class XYChartConfig(UnknownFieldCheckMixin):
         return self
 
 
-class HistogramChartConfig(UnknownFieldCheckMixin):
+class HistogramChartConfig(BaseChartConfig):
     """Config for histogram charts (viz_type ``histogram_v2``)."""
 
     model_config = ConfigDict(extra="ignore", populate_by_name=True)
@@ -1921,7 +1925,7 @@ class HistogramChartConfig(UnknownFieldCheckMixin):
         return self
 
 
-class BoxPlotChartConfig(UnknownFieldCheckMixin):
+class BoxPlotChartConfig(BaseChartConfig):
     """Config for box plot charts (viz_type ``box_plot``)."""
 
     model_config = ConfigDict(extra="ignore", populate_by_name=True)
@@ -2036,7 +2040,7 @@ class BoxPlotChartConfig(UnknownFieldCheckMixin):
         return self
 
 
-class WaterfallChartConfig(UnknownFieldCheckMixin):
+class WaterfallChartConfig(BaseChartConfig):
     """Config for waterfall charts (viz_type ``waterfall``)."""
 
     model_config = ConfigDict(extra="ignore", populate_by_name=True)
@@ -2574,6 +2578,16 @@ class DataColumn(BaseModel):
     )
 
 
+class ChartQueryResult(BaseModel):
+    """Data returned by one query in a chart's query context."""
+
+    query_index: int = Field(description="Zero-based query position")
+    columns: list[str] = Field(description="Column names returned by the query")
+    data: list[dict[str, Any]] = Field(description="Actual data rows")
+    row_count: int = Field(description="Rows returned")
+    total_rows: int | None = Field(None, description="Total available rows")
+
+
 class ChartData(BaseModel):
     """Rich chart data response with statistical insights."""
 
@@ -2585,6 +2599,13 @@ class ChartData(BaseModel):
     # Enhanced data description
     columns: List[DataColumn] = Field(description="Rich column metadata")
     data: List[Dict[str, Any]] = Field(description="Actual data rows")
+    query_results: list[ChartQueryResult] | None = Field(
+        None,
+        description=(
+            "All query results for multi-query charts. The top-level columns and data "
+            "fields remain aliases for the first query for backward compatibility."
+        ),
+    )
 
     # Data insights
     row_count: int = Field(description="Rows returned")

superset/mcp_service/chart/tool/generate_chart.py

@@ -326,7 +326,7 @@ async def generate_chart(  # noqa: C901
 
         # Persist the chart only when explicitly requested (save_chart=False by default)
         if request.save_chart:
-            await ctx.report_progress(2, 5, "Creating chart in database")
+            await ctx.report_progress(2, 5, "Validating chart query")
             from superset.commands.chart.create import CreateChartCommand
 
             # Find the dataset to get its numeric ID
@@ -414,6 +414,64 @@ async def generate_chart(  # noqa: C901
             )
             await ctx.debug("Chart name: chart_name=%s" % (chart_name,))
 
+            # Compile before persisting. A failed query must not leave a broken
+            # chart row behind and then rely on a later transaction to delete it.
+            with event_logger.log_context(action="mcp.generate_chart.compile_check"):
+                compile_result = _compile_chart(form_data, dataset.id)
+            if not compile_result.success:
+                logger.warning(
+                    "Compile check failed before chart creation: %s",
+                    compile_result.error,
+                )
+                await ctx.warning(
+                    "Chart compile check failed: error=%s" % (compile_result.error,)
+                )
+                from superset.mcp_service.common.error_schemas import (
+                    ChartGenerationError,
+                )
+
+                execution_time = int((time.time() - start_time) * 1000)
+                error = compile_result.error_obj or ChartGenerationError(
+                    error_type="compile_error",
+                    message="Chart query failed to execute. The chart was not saved.",
+                    details=str(compile_result.error) or "",
+                    suggestions=[
+                        "Check that all columns exist in the dataset",
+                        "Verify aggregate functions are compatible with column types",
+                        "Ensure filters reference valid columns",
+                        "Try simplifying the chart configuration",
+                    ],
+                    error_code="CHART_COMPILE_FAILED",
+                )
+                return GenerateChartResponse.model_validate(
+                    {
+                        "chart": None,
+                        "error": error.model_dump(),
+                        "form_data": (
+                            _sanitize_generate_chart_form_data_for_llm_context(
+                                form_data
+                            )
+                        ),
+                        "performance": {
+                            "query_duration_ms": execution_time,
+                            "cache_status": "error",
+                            "optimization_suggestions": [],
+                        },
+                        "warnings": (
+                            sanitization_warnings
+                            + runtime_warnings
+                            + response_warnings
+                            + compile_result.warnings
+                        ),
+                        "success": False,
+                        "schema_version": "2.0",
+                        "api_version": "v1",
+                    }
+                )
+            response_warnings.extend(compile_result.warnings)
+
+            await ctx.report_progress(3, 5, "Creating chart in database")
+
             try:
                 with event_logger.log_context(action="mcp.generate_chart.db_write"):
                     command = CreateChartCommand(
@@ -489,66 +547,6 @@ async def generate_chart(  # noqa: C901
                 # Add any validation warnings (e.g., virtual dataset warnings)
                 response_warnings.extend(dataset_check.warnings)
 
-                # Compile check: execute the chart query to catch runtime errors
-                await ctx.report_progress(3, 5, "Running compile check (test query)")
-                with event_logger.log_context(
-                    action="mcp.generate_chart.compile_check"
-                ):
-                    compile_result = _compile_chart(form_data, dataset.id)
-                if not compile_result.success:
-                    # Query failed — delete the broken chart and return an error
-                    logger.warning(
-                        "Compile check failed for chart %s: %s",
-                        chart_id,
-                        compile_result.error,
-                    )
-                    await ctx.warning(
-                        "Chart compile check failed: error=%s" % (compile_result.error,)
-                    )
-                    from superset.daos.chart import ChartDAO
-
-                    ChartDAO.delete([chart])
-                    from superset.mcp_service.common.error_schemas import (
-                        ChartGenerationError,
-                    )
-
-                    execution_time = int((time.time() - start_time) * 1000)
-                    error = compile_result.error_obj or ChartGenerationError(
-                        error_type="compile_error",
-                        message=(
-                            "Chart query failed to execute. The chart was not saved."
-                        ),
-                        details=str(compile_result.error) or "",
-                        suggestions=[
-                            "Check that all columns exist in the dataset",
-                            "Verify aggregate functions are compatible "
-                            "with column types",
-                            "Ensure filters reference valid columns",
-                            "Try simplifying the chart configuration",
-                        ],
-                        error_code="CHART_COMPILE_FAILED",
-                    )
-                    return GenerateChartResponse.model_validate(
-                        {
-                            "chart": None,
-                            "error": error.model_dump(),
-                            "form_data": (
-                                _sanitize_generate_chart_form_data_for_llm_context(
-                                    form_data
-                                )
-                            ),
-                            "performance": {
-                                "query_duration_ms": execution_time,
-                                "cache_status": "error",
-                                "optimization_suggestions": [],
-                            },
-                            "success": False,
-                            "schema_version": "2.0",
-                            "api_version": "v1",
-                        }
-                    )
-                response_warnings.extend(compile_result.warnings)
-
             except CommandException as e:
                 logger.error("Chart creation failed: %s", e)
                 await ctx.error("Chart creation failed: error=%s" % (str(e),))

superset/mcp_service/chart/tool/get_chart_data.py

@@ -32,6 +32,7 @@ from superset_core.mcp.decorators import tool, ToolAnnotations
 if TYPE_CHECKING:
     from superset.models.slice import Slice
 
+from superset.charts.data.form_data import set_query_context_form_data
 from superset.commands.exceptions import CommandException
 from superset.exceptions import OAuth2Error, OAuth2RedirectError, SupersetException
 from superset.extensions import event_logger
@@ -47,6 +48,7 @@ from superset.mcp_service.chart.chart_utils import validate_chart_dataset
 from superset.mcp_service.chart.schemas import (
     ChartData,
     ChartError,
+    ChartQueryResult,
     DataColumn,
     GetChartDataRequest,
     PerformanceMetadata,
@@ -112,12 +114,14 @@ _MAX_RECOMMENDATIONS = 4
 
 def _coerce_row_limit(value: Any, default: int) -> int:
     """Coerce a row_limit (which may arrive as a str from chart.params) to int,
-    falling back to ``default`` when it is missing or non-numeric — downstream
-    apply_max_row_limit compares it against an int."""
+    falling back to ``default`` when it is missing, non-numeric, or non-positive.
+    A non-positive limit would otherwise flow through apply_max_row_limit as-is
+    and emit ``LIMIT -1`` (unbounded on some engines, an error on others)."""
     try:
-        return int(value)
+        coerced = int(value)
     except (TypeError, ValueError):
         return default
+    return coerced if coerced > 0 else default
 
 
 def _recommend_visualizations(
@@ -264,6 +268,12 @@ def _sanitize_chart_data_for_llm_context(chart_data: ChartData) -> ChartData:
         field_path=("data",),
         excluded_field_names=frozenset(),
     )
+    for query_index, query_result in enumerate(payload.get("query_results") or []):
+        query_result["data"] = sanitize_for_llm_context(
+            query_result.get("data", []),
+            field_path=("query_results", str(query_index), "data"),
+            excluded_field_names=frozenset(),
+        )
     payload["columns"] = [
         {
             **column,
@@ -279,6 +289,29 @@ def _sanitize_chart_data_for_llm_context(chart_data: ChartData) -> ChartData:
     return ChartData.model_validate(payload)
 
 
+def _build_query_results(
+    query_results: list[dict[str, Any]], limit: int | None
+) -> list[ChartQueryResult] | None:
+    """Preserve every result when a chart executes more than one query."""
+    if len(query_results) <= 1:
+        return None
+
+    results = []
+    for index, query_result in enumerate(query_results):
+        data = query_result.get("data", [])
+        returned_data = data[:limit] if limit else data
+        results.append(
+            ChartQueryResult(
+                query_index=index,
+                columns=query_result.get("colnames", []),
+                data=returned_data,
+                row_count=len(returned_data),
+                total_rows=query_result.get("rowcount"),
+            )
+        )
+    return results
+
+
 @tool(
     tags=["data"],
     class_permission_name="Chart",
@@ -335,6 +368,13 @@ async def get_chart_data(  # noqa: C901
 
         # Handle unsaved chart (form_data_key only, no identifier)
         if not request.identifier and request.form_data_key:
+            # The unsaved-chart cache is not dashboard-scoped, so guests can't
+            # use it.
+            if guest_scope.is_guest_read():
+                return ChartError(
+                    error="No accessible chart found for this request.",
+                    error_type="NotFound",
+                )
             with event_logger.log_context(
                 action="mcp.get_chart_data.unsaved_chart_from_cache"
             ):
@@ -433,30 +473,30 @@ async def get_chart_data(  # noqa: C901
         )
         logger.info("Getting data for chart %s: %s", chart.id, chart.slice_name)
 
-        # Skip the dataset RBAC pre-check for guests (see guest_scope.is_guest_read).
-        if not guest_scope.is_guest_read():
-            validation_result = validate_chart_dataset(
-                chart.datasource_id, check_access=True
+        # Guests skip the RBAC check (authorize_query covers it) but keep the
+        # existence check, so a deleted dataset still returns
+        # DatasetNotAccessible.
+        validation_result = validate_chart_dataset(
+            chart.datasource_id, check_access=not guest_scope.is_guest_read()
+        )
+        if not validation_result.is_valid:
+            await ctx.warning(
+                "Chart found but dataset is not accessible: %s"
+                % (validation_result.error,)
             )
-            if not validation_result.is_valid:
-                await ctx.warning(
-                    "Chart found but dataset is not accessible: %s"
-                    % (validation_result.error,)
-                )
-                logger.warning(
-                    "get_chart_data: dataset not accessible for chart_id=%s: %s",
-                    chart.id,
-                    validation_result.error,
-                )
-                return ChartError(
-                    error=validation_result.error
-                    or "Chart's dataset is not accessible. "
-                    "Dataset may have been deleted.",
-                    error_type="DatasetNotAccessible",
-                )
-            # Log any warnings (e.g., virtual dataset warnings)
-            for warning in validation_result.warnings:
-                await ctx.warning("Dataset warning: %s" % (warning,))
+            logger.warning(
+                "get_chart_data: dataset not accessible for chart_id=%s: %s",
+                chart.id,
+                validation_result.error,
+            )
+            return ChartError(
+                error=validation_result.error
+                or "Chart's dataset is not accessible. Dataset may have been deleted.",
+                error_type="DatasetNotAccessible",
+            )
+        # Log any warnings (e.g., virtual dataset warnings)
+        for warning in validation_result.warnings:
+            await ctx.warning("Dataset warning: %s" % (warning,))
 
         start_time = time.time()
 
@@ -469,8 +509,10 @@ async def get_chart_data(  # noqa: C901
             from superset.charts.schemas import ChartDataQueryContextSchema
             from superset.commands.chart.data.get_data_command import ChartDataCommand
 
-            # Check if form_data_key is provided - use cached form_data instead
-            if request.form_data_key:
+            # Guests always read the saved chart config: the cache isn't
+            # dashboard-scoped and its payload could point the query at another
+            # datasource.
+            if request.form_data_key and not guest_scope.is_guest_read():
                 with event_logger.log_context(
                     action="mcp.get_chart_data.unsaved_state_override"
                 ):
@@ -513,11 +555,13 @@ async def get_chart_data(  # noqa: C901
 
             # If using cached form_data, we need to build query_context from it
             if using_unsaved_state and cached_form_data_dict is not None:
-                # Build query context from cached form_data (unsaved state)
-                row_limit = (
+                # row_limit may arrive as a str. The trailing fallback keeps a
+                # falsy 0 resolving to ROW_LIMIT.
+                row_limit = _coerce_row_limit(
                     request.limit
                     or cached_form_data_dict.get("row_limit")
-                    or current_app.config["ROW_LIMIT"]
+                    or current_app.config["ROW_LIMIT"],
+                    current_app.config["ROW_LIMIT"],
                 )
 
                 query_context = build_query_context_from_form_data(
@@ -628,8 +672,8 @@ async def get_chart_data(  # noqa: C901
                 # Apply request overrides to the saved query_context
                 query_context_json["force"] = request.force_refresh
 
-                # Apply row limit if specified (respects chart's configured limits)
-                if request.limit:
+                # Ignore a non-positive limit so it can't emit LIMIT -1 downstream.
+                if request.limit and request.limit > 0:
                     for query in query_context_json.get("queries", []):
                         query["row_limit"] = request.limit
 
@@ -663,6 +707,12 @@ async def get_chart_data(  # noqa: C901
             if guest_dashboard_id is not None:
                 guest_scope.authorize_query(query_context, guest_dashboard_id, chart)
 
+            set_query_context_form_data(
+                query_context,
+                chart.datasource_id,
+                chart.datasource_type,
+            )
+
             # Execute the query
             with event_logger.log_context(action="mcp.get_chart_data.query_execution"):
                 command = ChartDataCommand(query_context)
@@ -703,7 +753,7 @@ async def get_chart_data(  # noqa: C901
             )
 
             # Check if we have data to work with
-            if not data:
+            if not any(query.get("data") for query in result["queries"]):
                 await ctx.warning("No data in query results: chart_id=%s" % (chart.id,))
                 logger.warning(
                     "get_chart_data: no data in query results for chart_id=%s",
@@ -883,6 +933,9 @@ async def get_chart_data(  # noqa: C901
                     chart_type=chart.viz_type or "unknown",
                     columns=columns,
                     data=data[: request.limit] if request.limit else data,
+                    query_results=_build_query_results(
+                        result["queries"], request.limit
+                    ),
                     row_count=len(data),
                     total_rows=query_result.get("rowcount"),
                     summary=summary,
@@ -994,8 +1047,11 @@ async def _query_from_form_data(
             error_type="InvalidFormData",
         )
 
-    row_limit = (
-        request.limit or form_data.get("row_limit") or current_app.config["ROW_LIMIT"]
+    # row_limit may arrive as a str. The trailing fallback keeps a falsy 0
+    # resolving to ROW_LIMIT.
+    row_limit = _coerce_row_limit(
+        request.limit or form_data.get("row_limit") or current_app.config["ROW_LIMIT"],
+        current_app.config["ROW_LIMIT"],
     )
     viz_type = form_data.get("viz_type", "unknown")
 
@@ -1029,7 +1085,7 @@ async def _query_from_form_data(
         data = query_result.get("data", [])
         raw_columns = query_result.get("colnames", [])
 
-        if not data:
+        if not any(query.get("data") for query in result["queries"]):
             logger.warning(
                 "get_chart_data: no data for unsaved chart (form_data_key=%s)",
                 request.form_data_key,
@@ -1078,6 +1134,7 @@ async def _query_from_form_data(
                 chart_type=viz_type,
                 columns=columns,
                 data=data[: request.limit] if request.limit else data,
+                query_results=_build_query_results(result["queries"], request.limit),
                 row_count=len(data),
                 total_rows=query_result.get("rowcount"),
                 summary=summary,

superset/mcp_service/chart/tool/get_chart_preview.py

@@ -29,6 +29,7 @@ from superset_core.mcp.decorators import tool, ToolAnnotations
 from superset.commands.exceptions import CommandException
 from superset.exceptions import OAuth2Error, OAuth2RedirectError, SupersetException
 from superset.extensions import db, event_logger
+from superset.mcp_service import guest_scope
 from superset.mcp_service.chart.ascii_charts import (
     generate_ascii_chart,
     generate_ascii_table,
@@ -276,8 +277,6 @@ class PreviewFormatStrategy:
     def _authorize_guest_query(self, query_context: Any) -> None:
         """For a guest, attach the dashboard context so raise_for_access
         authorizes the preview query."""
-        from superset.mcp_service import guest_scope
-
         if (dashboard_id := guest_scope.guest_dashboard_id(self.chart)) is not None:
             guest_scope.authorize_query(query_context, dashboard_id, self.chart)
 
@@ -1293,13 +1292,11 @@ async def _get_chart_preview_internal(  # noqa: C901
         logger.info("Generating preview for chart %s", getattr(chart, "id", "NO_ID"))
         logger.info("Chart datasource_id: %s", getattr(chart, "datasource_id", "NONE"))
 
-        # Skip the dataset pre-check for transient charts (no ID) and for guests
-        # (authorized via the dashboard context, not dataset RBAC).
-        from superset.mcp_service import guest_scope
-
-        if getattr(chart, "id", None) is not None and not guest_scope.is_guest_read():
+        # Transient charts have a falsy id of 0, so skip the pre-check for them.
+        # Guests keep the existence check but skip RBAC (dashboard-authorized).
+        if getattr(chart, "id", None):
             validation_result = validate_chart_dataset(
-                chart.datasource_id, check_access=True
+                chart.datasource_id, check_access=not guest_scope.is_guest_read()
             )
             if not validation_result.is_valid:
                 await ctx.warning(

superset/mcp_service/chart/tool/list_charts.py

@@ -102,7 +102,8 @@ async def list_charts(
 
     Sortable columns for ``order_column``:
         ``id``, ``slice_name``, ``viz_type``, ``description``,
-        ``changed_on``, ``created_on``
+        ``changed_on``, ``changed_on_delta_humanized`` (alias for ``changed_on``),
+        ``created_on``
 
     To filter by a person, call find_users to resolve the name to a user ID,
     then pass it as a filter: filters=[{"col": "created_by_fk", "opr": "eq",