The antd Table onChange callback in TableCollection fires for pagination,
filter, and sort changes alike. With an active sorter, every page click
re-dispatched setSortBy with a new array instance; react-table's
usePagination (autoResetPage) resets pageIndex whenever the sortBy state
identity changes, which cancelled the navigation. Sorting a column in any
client-paginated TableView (e.g. the dashboard 'View as table' pane) made
the pagination controls unresponsive, and ListView/server pagination
triggered a spurious page-1 refetch.
Gate the sort dispatch on antd's extra.action so only genuine sorter
changes reach setSortBy.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Homebrew rolled out an untrusted-tap security change on the GitHub runner
image that makes `brew install norwoodj/tap/helm-docs` fail with "Skipping
norwoodj/tap because it is not trusted", so the pre-commit workflow's
"Enable brew and helm-docs" step now exits non-zero before the hooks ever
run. This turned the "pre-commit checks" job red on every push regardless of
the diff.
Replace the brew tap install with `go install
github.com/norwoodj/helm-docs/cmd/helm-docs@v1.14.2`, matching apache/superset
upstream and keeping the binary version aligned with the helm-docs pre-commit
hook rev in .pre-commit-config.yaml.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Three link sites render plain anchors (Typography.Link href=...) rather than
router <Link to=...>, so they bypass the <Router basename> that prefixes the
rest of the app and produce broken links under a SUPERSET_APP_ROOT
subdirectory deployment:
- the delete-dataset modal's "Affected Dashboards" / "Affected Charts" lists
- the tag list page's dashboard, chart and query rows
- an empty dashboard tab's "create a new chart" link
Add a prefixAppRoot helper to pathUtils and apply it at those sites. It cannot
reuse ensureAppRoot: that helper skips paths that already start with the
application root, and the dashboard route is itself /superset/dashboard/<id>/,
so with an application root of /superset it no-ops and the link stays broken.
prefixAppRoot always prefixes, which is what these router-relative paths need,
and it reproduces exactly what <Link to={url}> already renders via the router
basename on the dashboard and chart list pages. Absolute and protocol-relative
URLs still pass through untouched.
Cover each site with subdirectory regression tests, including the colliding
/superset root, plus unit tests for the helper.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
(cherry picked from commit bd9ba24266)
[6.0 adaptation] Production schema aliases (chart/dashboard/dataset schemas.py)
applied to the 6.0 baseline. Two files needed adaptation because 6.0 predates
later MCP refactors:
- chart/schemas.py: kept the 6.0 base classes and added only
`model_config = ConfigDict(populate_by_name=True)` to GenerateExploreLinkRequest
and UpdateChartPreviewRequest. Dropped upstream's ChartRequestNormalizerMixin
base (absent on 6.0 — would be F821); the model_config achieves the same
populate-by-name behavior the aliases require.
- test_dashboard_schemas.py: kept TestRequestSchemaAliasChoices (exercises
GetDashboardInfoRequest / ListDashboardsRequest / AddChartToDashboardRequest —
all present on 6.0). Dropped upstream's TestDuplicateDashboardResponse (the
Duplicate Dashboard feature is absent on 6.0).
dashboard/dataset schemas.py, chart/dataset tests, and the new dataset test
file applied clean. pytest: 184 passed (42 alias/canonical-resolution cases)
across all three schema test files.
Co-authored-by: Enzo Martellucci <52219496+EnxDev@users.noreply.github.com>
(cherry picked from commit 76bb5f8e69)
[6.0 adaptation] Production sources (reducers/nativeFilters.ts, util/getRelatedCharts.ts,
actions/nativeFilters.ts, actions/chartCustomizationActions.ts) applied clean. Only the two
test files were ported to the 6.0 baseline:
- reducers/nativeFilters.test.ts: dropped 6.0's stale SET_NATIVE_FILTERS_CONFIG_COMPLETE
tests that asserted the pre-fix "backend response is the source of truth / drop-on-omit"
behavior; those directly contradict the landed merge-based reducer (which now preserves
untouched filters and only removes ids in action.deletedIds). Kept #42032's canonical
new-behavior set: removes deleted / removes all when all ids deleted / preserves untouched
on omit / mixed Filter+ChartCustomization / adds+removes / merges+deletes.
- util/getRelatedCharts.test.ts: kept the undefined-filter guard test; excluded two
master-baseline DatasourceType.SemanticView cases (SemanticView is absent on 6.0).
jest: 23/23 green across both files (nativeFilters.test.ts + getRelatedCharts.test.ts).
Manual port of apache/superset#39917 (commit 85935b0b) onto 6.0-release.
A clean cherry-pick does not apply because mcp_service/auth.py has diverged
structurally on this branch, but the vulnerable code path is present verbatim:
sync_wrapper calls db.session.remove() before user resolution on reused
thread-pool threads. If the thread-local DBAPI connection died between
requests (RDS SSL idle-timeout / max-connection-age), the implicit rollback
raises a DBAPIError and crashes the tool call.
Wrap the pre-call remove in _remove_session_safe(), which catches DBAPIError,
invalidates the dead connection so the pool discards it, and retries remove()
so the tool proceeds on a fresh connection. Ports the accompanying regression
test byte-for-byte behaviorally.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(cherry picked from commit ef7379c47e)
Adapted for 6.0-release: on this branch only the css_template and theme MCP
tool groups exist, so this pick removes those two groups (their list/get tools,
schemas, and unit tests) along with their docstring and get_schema references.
The plugin, action_log, and task-management tool groups the upstream change
also touched do not exist on 6.0 and were left untouched.
Adapted for 6.0-release: the dedupeAdhocMetricOptionName helper and its
wiring were ported onto this branch's pre-TS-migration files
(AdhocMetric.js, MetricsControl.jsx) with type annotations stripped, and
onto DndMetricSelect.tsx whose coerceMetrics lacked the master type
casts. Behavior matches upstream: duplicate optionNames are regenerated
on load so editing one metric no longer overwrites another.
Co-authored-by: Evan Rusackas <evan@rusackas.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
(cherry picked from commit 0c12114ea9)
Adapted for 6.0-release: ported onto dashboardState.js/.test.js (still
pre-TS-migration on this branch) and onto the guard-less catch block,
preserving 6.0's existing "toast on any non-404 error" behavior while
swallowing the 404 case. The upstream currentId guard is a separate
change not present on this branch and is intentionally not included.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
(cherry picked from commit 797e497f4b)
Adapted for 6.0-release: only the fetchOptions.ts concurrency throttle (429
fix) applies. The RoleListEditModal.tsx/test.tsx changes (414 fix) depend on
the AsyncSelect architecture introduced in #38387, which is not present on
6.0; in 6.0 the modal receives permissions/groups as props from the parent
list page rather than fetching them itself with id-IN filters, so the 414
URL-length code path does not exist here.
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
(cherry picked from commit f037449b75)
Completes the earlier partial backport of #39636 (commit 9039d1460c)
which only applied the database/schemas.py + test_database_tools.py
chunks and dropped the get_chart_sql.py + test_get_chart_sql.py chunks
entirely. The dropped chunks introduce the `_resolve_engine` and
`_resolve_datasource_name` helpers used by #40099.
(cherry picked from commit 7774ec7e3c)
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Joe Li <joe@preset.io>
Adapted for 6.0-release:
- Dropped the `allColumns` block and ENTIRE_ROW formatting option;
ObjectFormattingEnum.ENTIRE_ROW was introduced in master-only PR
#35897 (feat: add formatting column and formatting object to
conditional formatting table) which is not on 6.0-release.
- The customer-visible fix (fallback to datasource columns when query
results are empty) is preserved for 6.0's existing numericColumns
control surface.
- Test file: dropped the two `allColumns`/ENTIRE_ROW assertions and
the dedicated ENTIRE_ROW test for the same reason.
(cherry picked from commit a60860c969)
Adds CSV and XLSX download buttons plus an explicit reload control to the
drill-to-detail and drill-by modals. Adds a shared DownloadDropdown
component used by both modals.
Backport of #37109 from master to 6.0-release. Adapted for 6.0-release:
- All @apache-superset/core/* imports collapsed back to @superset-ui/core
(the namespace refactor is master-only).
- canCopyClipboard from usePermissions is master-only; gated the new
copy-disabled tooltip on canDownload instead until canCopyClipboard
is ported.
- TabularDataRow type is master-only (utils/common is still .js); inlined
as Record<string, unknown>[].
- The Explore pane Results/Samples tabs receive onDownloadCSV/
onDownloadXLSX/onReload as optional props but the row-limit selector
changes from master are intentionally omitted (master moved that area
toward a different pattern that is not present on 6.0-release).
- Backend FRONTEND_CONF_KEYS gains ROW_LIMIT so the new drill download
payload can read it from common.conf.
(cherry picked from commits fa31ec8, 967fa7b, 9ba8fda, b39419c, b74cc05,
15be40b, d8c8849, 6e1f03b, ca0e9cf, 76cdc1f)
Co-Authored-By: alex-poor <alex@karo.co.nz>
(cherry picked from commit adfbbf1433)
Adapted: also lifts a small infrastructure slice from #37311 (commit
87bbd54d0a) — namely the source_engine
parameter and source_dialect logic on transpile_to_dialect, plus its
three accompanying unit tests. #37311 itself is a feature PR
(import-time virtual-dataset transpilation) that is not desired on
6.0-release; only the plumbing this fix relies on is included.
The source_engine plumbing is required because #39521's call site
passes source_engine=engine to make validate() idempotent on its
second pass: the second invocation re-parses already-transpiled output
that may contain dialect-specific quoting (e.g. MySQL/BigQuery
backticks) which the generic Dialect cannot handle. Without it, the
fix would introduce a new regression on those engines.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
(cherry picked from commit 7bee2afa8e)
Adapted: source path superset-frontend/packages/superset-core/src/theme/GlobalStyles.tsx
remapped to superset-frontend/packages/superset-ui-core/... — the superset-core
package rename (#38448) is not present on 6.0-release.
The networking-settings page linked to /docs/security/securing_superset
which doesn't exist. The correct path is /docs/security/security.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Fixes ReDoS vulnerability (CVE) in ajv 8.17.1. Also bumps nested ajv 6.x
entries to 6.14.0 to match upstream.
Upstream: 577b965a60
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Bumps copy-webpack-plugin 13.0.0→14.0.0 and css-minimizer-webpack-plugin
7.0.2→8.0.0 to resolve serialize-javascript 6.0.2→7.0.5 (CVE-2026-34043,
BDSA-2020-4569 CVSS 8.1, tagged Zero-click RCE).
Note: webpack's bundled terser-webpack-plugin still pulls serialize-javascript
6.0.2 as a transitive dep — requires webpack upgrade to fully resolve.
Cherry-picked from upstream apache/superset commits 361afff798, a2c23a2a58.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Bumps root js-yaml 3.14.1→3.14.2 and nested js-yaml 4.1.0→4.1.1
to address prototype pollution vulnerability (CVE-2025-64718, CVSS 9.8).
Lerna's exact-pinned 4.1.0 entries are left as-is since they require
that exact version.
Cherry-picked from upstream apache/superset commit 362b5e3b89.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Bumps lodash-es to ^4.18.1 in generator-superset to address prototype
pollution and arbitrary code injection vulnerabilities.
Cherry-picked from upstream apache/superset commit a9ced5c881.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Bumps dompurify to ^3.4.0 in superset-ui-core and legacy-preset-chart-nvd3
to address 3 known vulnerabilities (CVEs). Removes stale nested lock entries
so both workspace packages resolve to the hoisted 3.4.0.
Cherry-picked from upstream apache/superset commit 03725d1aaa.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The hideTab guard was unintentionally brought into 6.0-release during
the cherry-pick of #38809 (conflict resolution picked up the master
version which included #38846). Since hideTab was never intended for
6.0-release, remove the guard to restore the pre-regression behavior
where tabs always render and activeTabs populates correctly.
Fixes: SC-104110
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(deckgl): complete cherry-pick of scatterplot categorical color fix (#35537)
The original cherry-pick of apache/superset#35537 was incomplete — it
included CategoricalDeckGLContainer.tsx and controlPanel.ts but missed
buildQuery.ts and transformProps.ts. Those files still referenced
`category_name` while the UI control (deckGLCategoricalColor) saves to
`dimension`, causing the categorical column to never be included in the
query and cat_color to never be populated on data points.
Renames category_name → dimension in buildQuery.ts and transformProps.ts
to match the control panel field name, completing the fix.
[sc-99443]
* fix: update tests and fix sliceId typo in CategoricalDeckGLContainer
Addresses code review feedback:
1. buildQuery.test.ts: rename category_name → dimension in test data
to match the interface change, preventing test failure
2. transformProps.test.ts: rename category_name → dimension in test
data and update test name to reflect the current field name
3. CategoricalDeckGLContainer.tsx line 71: fix fd.sliceId → fd.slice_id
(snake_case). This code path in getCategories() was previously
unreachable because fd.dimension was always falsy. Now that the
fix makes it live, the colorFn seed must use the correct field
to match the rendering path at line 182.
* test: add negative-case regression guards for dimension field
Adds two tests that would have caught the original category_name vs
dimension mismatch:
1. buildQuery: when dimension is absent, no extra column is added
to the query (only spatial columns remain)
2. transformProps: when dimension is absent, cat_color is not set
on scatter points (stays undefined)
These guard against future regressions where the form field name
diverges from what buildQuery/transformProps read.
The cherry-pick of apache/superset#39166 onto 6.0-release (commit
3cda699864) dropped the changes to
superset/mcp_service/sql_lab/tool/execute_sql.py. As a result,
OAuth2RedirectError raised during SQL execution falls through to
ExecuteSqlCore._handle_execution_error, which only calls str(e) and
drops the authorization URL stored in ex.error.extra["url"].
Clients see error_type=OAUTH2_REDIRECT but no URL in the error body
("You don't have permission to access the data."), so the end user
has no way to start the OAuth flow.
Fix: handle OAuth2RedirectError and OAuth2Error explicitly in
_handle_execution_error and use build_oauth2_redirect_message to
extract the URL from extra, mirroring the behavior already present on
master in execute_sql.py.
[sc-102144]
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: codeant-ai-for-open-source[bot] <244253245+codeant-ai-for-open-source[bot]@users.noreply.github.com>
(cherry picked from commit 38f0dc74f7)
Manual adaptation of apache/superset#38953 for 6.0-release where
TableRenderers is .jsx (not .tsx). Adds convertToNumberIfNumeric()
helper and wraps dateFormatters calls to handle numeric timestamp
strings correctly.
(cherry picked from commit f1cd1ae710)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Diego Pucci <diegopucci.me@gmail.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: codeant-ai-for-open-source[bot] <244253245+codeant-ai-for-open-source[bot]@users.noreply.github.com>
(cherry picked from commit 9516d1a306)
Adapted from master commit ba7271b to WorldMap.js (JS) on 6.0-release.
- Accepted: null-safe extents, fallback colorFn, ?? theme.colorBorder
- Accepted: 3 new tests adapted for 6.0-release test structure
- Rejected: TypeScript conversion (file is .js on this branch)
(cherry picked from commit ba7271b4d8)
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
(cherry picked from commit 1a77e17179)
Adapted:
- hydrate.ts → hydrate.js: removed TypeScript type assertions, kept JS-compatible imports
Accepted:
- Legacy chart customization format migration (migrateChartCustomization utility)
- LEGACY_GROUPBY_PREFIX support in filter state management
- Dashboard.ts type additions for legacy format
- 490-line test suite
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Cherry-pick frontend changes only from b565128fe7.
- Accepted: Chart.tsx fix to show backend API errors instead of infinite
loading spinner when datasource is placeholder; ErrorContainer wrapper
for scrollable error display; Chart.test.tsx with test coverage
- Adapted: Removed chartRenderingSucceeded from test mock (not in
6.0-release Actions type)
- Rejected: gsheets.py needs_oauth2() changes (method doesn't exist on
6.0-release); test_gsheets.py test for missing method
(cherry picked from commit b565128fe7)
Cherry-picked from master (f2b6c39) with adaptations:
- Changed import path from @apache-superset/core to @superset-ui/core
- Removed ReactRefreshWebpackPlugin (not in 6.0-release)
- Fixed button type attribute in test file
Co-authored-by: Beto Dealmeida <roberto@dealmeida.net>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Cherry-picked from master commit 459b4cb23d
Accepted:
- Bounded \s+ to \s{1,5} and \s* to \s{0,5} in time_range_lookup regexes
- Added tests for bounded whitespace validation
Adapted:
- Preserved 6.0-release "first/1st of" patterns between modified sections
- Kept existing tests for "first of" expressions
Original author: Jean Massucatto <massucattoj@gmail.com>
Cherry-picked from 54919c9 with adaptation for 6.0 branch:
Accepted:
- FilterControls.tsx: Fix for overflowedByIndex calculation that now considers
filterBarOrientation - out-of-scope filters in vertical mode are in a Collapse
panel and should not be marked as overflowed
- DateFilterLabel.test.tsx: New tests for isOverflowingFilterBar prop behavior
Rejected:
- FilterControls.test.tsx: Incompatible with 6.0 - uses ChartCustomizationType,
ChartCustomizationDivider, and props that don't exist in this branch version
Original commit: 54919c942a
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
**Complete technical reference for converting JavaScript/JSX files to TypeScript/TSX in Apache Superset frontend.**
**Agent Role:** Atomic migration unit - migrate the core file + ALL related tests/mocks as one cohesive unit. Use `git mv` to preserve history, NO `git commit`. NO global import changes. Report results upon completion.
---
## 🎯 Migration Principles
1.**Atomic migration units** - Core file + all related tests/mocks migrate together
2.**Zero `any` types** - Use proper TypeScript throughout
3.**Leverage existing types** - Reuse established definitions
4.**Type inheritance** - Derivatives extend base component types
5.**Strategic placement** - File types for maximum discoverability
6.**Surgical improvements** - Enhance existing types during migration
// Only include properties the function actually uses
}
```
---
## 🎯 PropTypes Auto-Generation (Elegant Approach)
**IMPORTANT**: Superset has `babel-plugin-typescript-to-proptypes` configured to automatically generate PropTypes from TypeScript interfaces. Use this instead of manual PropTypes duplication!
### ❌ Manual PropTypes Duplication (Avoid This)
```typescript
export interface MyComponentProps {
title: string;
count?: number;
}
// 8+ lines of manual PropTypes duplication 😱
const propTypes = PropTypes.shape({
title: PropTypes.string.isRequired,
count: PropTypes.number,
});
export default propTypes;
```
### ✅ Auto-Generated PropTypes (Use This)
```typescript
import { InferProps } from 'prop-types';
export interface MyComponentProps {
title: string;
count?: number;
}
// Single validator function - babel plugin auto-generates PropTypes! ✨
export default function MyComponentValidator(props: MyComponentProps) {
return null; // PropTypes auto-assigned by babel-plugin-typescript-to-proptypes
}
// Optional: For consumers needing PropTypes type inference
export type MyComponentPropsInferred = InferProps<typeof MyComponentValidator>;
```
### Migration Pattern for Type-Only Files
**When migrating type-only files with manual PropTypes:**
1. **Keep the TypeScript interfaces** (single source of truth)
2. **Replace manual PropTypes** with validator function
3. **Remove PropTypes imports** and manual shape definitions
4. **Add InferProps import** if type inference needed
**Example Migration:**
```typescript
// Before: 25+ lines with manual PropTypes duplication
body: '⚠️ **DEPRECATED WORKFLOW** - Ephemeral environment shutdown and build artifacts deleted. Please migrate to the new Superset Showtime system for future PRs.'
body: 'Ephemeral environment shutdown and build artifacts deleted.'
**Important**: Always reference the actual template file at `.github/PULL_REQUEST_TEMPLATE.md` instead of using cached content, as the template may be updated over time.
@@ -469,10 +469,6 @@ an account first if you don't have one, and reference your username
while requesting access to push packages.
```bash
# Run this first to make sure you are uploading the right version.
# Pypi does not allow you to delete or retract once uplaoded.
twine check dist/*
twine upload dist/*
```
@@ -522,8 +518,6 @@ takes the version (ie `3.1.1`), the git reference (any SHA, tag or branch
reference), and whether to force the `latest` Docker tag on the
generated images.
**NOTE:** If the docker image isn't built, you'll need to run this [GH action](https://github.com/apache/superset/actions/workflows/tag-release.yml) where you provide it the tag sha.
### Npm Release
You might want to publish the latest @superset-ui release to npm
This file documents any backwards-incompatible changes in Superset and
assists people when migrating to a new version.
## 6.0.0
## Next
### `thumbnail_url` removed from dashboard list API response
The `thumbnail_url` field has been removed from `GET /api/v1/dashboard/` list responses. External consumers relying on this field must now construct the thumbnail URL client-side using `id` and `changed_on_utc`:
The thumbnail endpoint redirects to the current digest URL regardless of whether the supplied digest is exact. If the image is not yet cached, that digest URL may return `202` and trigger async generation. Using `changed_on_utc` as the digest is sufficient for cache-busting purposes.
### Dataset import validates catalog against the target connection
Importing a dataset now validates the `catalog` field against the target database connection. When the connection has multi-catalog disabled (`allow_multi_catalog` off) and the dataset's catalog is not the connection's default catalog, the import fails instead of silently persisting the non-default catalog. This matches the validation already enforced on the dataset update path and prevents imported datasets from querying an unintended database.
If you relied on importing datasets with a non-default catalog, enable "Allow changing catalogs" on the target connection, or set the dataset's catalog to the connection's default before importing.
### Dynamic Group By respects the sort toggle for display values
The Dynamic Group By chart customization now orders its display values according to the "Sort display control values" toggle: ascending (A–Z), descending (Z–A), or the dataset's source order when the toggle is unset. Previously the dropdown always sorted alphabetically. Existing dashboards where the toggle was never set will show options in source order instead of A–Z; open the customization and enable the toggle to restore alphabetical ordering.
### MCP Tool Observability
MCP (Model Context Protocol) tools now include enhanced observability instrumentation for monitoring and debugging:
**Two-layer instrumentation:**
1.**Middleware layer** (`LoggingMiddleware`): Automatically logs all MCP tool calls with `duration_ms` and `success` status in the audit log (Action Log UI, logs table)
2.**Sub-operation tracking**: All 19 MCP tools include granular `event_logger.log_context()` blocks for tracking individual operations like validation, database writes, and query execution
**Security note:** Sensitive parameters (passwords, API keys, tokens) are automatically redacted in logs as `[REDACTED]`.
### Signal Cache Backend
A new `SIGNAL_CACHE_CONFIG` configuration provides a unified Redis-based backend for real-time coordination features in Superset. This backend enables:
- **Pub/sub messaging** for real-time event notifications between workers
- **Atomic distributed locking** using Redis SET NX EX (more performant than database-backed locks)
- **Event-based coordination** for background task management
The signal cache is used by the Global Task Framework (GTF) for abort notifications and task completion signaling, and will eventually replace `GLOBAL_ASYNC_QUERIES_CACHE_BACKEND` as the standard signaling backend. Configuring this is recommended for Redis enabled production deployments.
Example configuration in `superset_config.py`:
```python
SIGNAL_CACHE_CONFIG={
"CACHE_TYPE":"RedisCache",
"CACHE_KEY_PREFIX":"signal_",
"CACHE_REDIS_URL":"redis://localhost:6379/1",
"CACHE_DEFAULT_TIMEOUT":300,
}
```
See `superset/config.py` for complete configuration options.
### WebSocket config for GAQ with Docker
[35896](https://github.com/apache/superset/pull/35896) and [37624](https://github.com/apache/superset/pull/37624) updated documentation on how to run and configure Superset with Docker. Specifically for the WebSocket configuration, a new `docker/superset-websocket/config.example.json` was added to the repo, so that users could copy it to create a `docker/superset-websocket/config.json` file. The existing `docker/superset-websocket/config.json` was removed and git-ignored, so if you're using GAQ / WebSocket make sure to:
- Stash/backup your existing `config.json` file, to re-apply it after (will get git-ignored going forward)
- Update the `volumes` configuration for the `superset-websocket` service in your `docker-compose.override.yml` file, to include the `docker/superset-websocket/config.json` file. For example:
- Auto-discovery: create `superset/examples/my_dataset/data.parquet` to add a new example
- Parquet is an Apache project format: compressed (~27% smaller), self-describing schema
- YAML configs define datasets, charts, and dashboards declaratively
- Removed Python-based data generation from individual example files
#### Test Data Reorganization
- Moved `big_data.py` to `superset/cli/test_loaders.py` - better reflects its purpose as a test utility
- Fixed inverted logic for `--load-test-data` flag (now correctly includes .test.yaml files when flag is set)
- Clarified CLI flags:
- `--force` / `-f`: Force reload even if tables exist
- `--only-metadata` / `-m`: Create table metadata without loading data
- `--load-test-data` / `-t`: Include test dashboards and .test.yaml configs
- `--load-big-data` / `-b`: Generate synthetic stress-test data
#### Bug Fixes
- Fixed numpy array serialization for PostgreSQL (converts complex types to JSON strings)
- Fixed KeyError for `allow_csv_upload` field in database configs (now optional with default)
- Fixed test data loading logic that was incorrectly filtering files
### MCP Service
The MCP (Model Context Protocol) service enables AI assistants and automation tools to interact programmatically with Superset.
@@ -124,6 +253,7 @@ See `superset/mcp_service/PRODUCTION.md` for deployment guides.
---
- [35621](https://github.com/apache/superset/pull/35621): The default hash algorithm has changed from MD5 to SHA-256 for improved security and FedRAMP compliance. This affects cache keys for thumbnails, dashboard digests, chart digests, and filter option names. Existing cached data will be invalidated upon upgrade. To opt out of this change and maintain backward compatibility, set `HASH_ALGORITHM = "md5"` in your `superset_config.py`.
- [33055](https://github.com/apache/superset/pull/33055): Upgrades Flask-AppBuilder to 5.0.0. The AUTH_OID authentication type has been deprecated and is no longer available as an option in Flask-AppBuilder. OpenID (OID) is considered a deprecated authentication protocol - if you are using AUTH_OID, you will need to migrate to an alternative authentication method such as OAuth, LDAP, or database authentication before upgrading.
- [35062](https://github.com/apache/superset/pull/35062): Changed the function signature of `setupExtensions` to `setupCodeOverrides` with options as arguments.
- [34871](https://github.com/apache/superset/pull/34871): Fixed Jest test hanging issue from Ant Design v5 upgrade. MessageChannel is now mocked in test environment to prevent rc-overflow from causing Jest to hang. Test environment only - no production impact.
@@ -142,10 +272,63 @@ Note: Pillow is now a required dependency (previously optional) to support image
- [33116](https://github.com/apache/superset/pull/33116) In Echarts Series charts (e.g. Line, Area, Bar, etc.) charts, the `x_axis_sort_series` and `x_axis_sort_series_ascending` form data items have been renamed with `x_axis_sort` and `x_axis_sort_asc`.
There's a migration added that can potentially affect a significant number of existing charts.
- [32317](https://github.com/apache/superset/pull/32317) The horizontal filter bar feature is now out of testing/beta development and its feature flag `HORIZONTAL_FILTER_BAR` has been removed.
- [31590](https://github.com/apache/superset/pull/31590) Marks the beginning of intricate work around supporting dynamic Theming, and breaks support for [THEME_OVERRIDES](https://github.com/apache/superset/blob/732de4ac7fae88e29b7f123b6cbb2d7cd411b0e4/superset/config.py#L671) in favor of a new theming system based on AntD V5. Likely this will be in disrepair until settling over the 5.x lifecycle.
- [31590](https://github.com/apache/superset/pull/31590) Marks the begining of intricate work around supporting dynamic Theming, and breaks support for [THEME_OVERRIDES](https://github.com/apache/superset/blob/732de4ac7fae88e29b7f123b6cbb2d7cd411b0e4/superset/config.py#L671) in favor of a new theming system based on AntD V5. Likely this will be in disrepair until settling over the 5.x lifecycle.
- [32432](https://github.com/apache/superset/pull/31260) Moves the List Roles FAB view to the frontend and requires `FAB_ADD_SECURITY_API` to be enabled in the configuration and `superset init` to be executed.
- [34319](https://github.com/apache/superset/pull/34319) Drill to Detail and Drill By is now supported in Embedded mode, and also with the `DASHBOARD_RBAC` FF. If you don't want to expose these features in Embedded / `DASHBOARD_RBAC`, make sure the roles used for Embedded / `DASHBOARD_RBAC`don't have the required permissions to perform D2D actions.
### Breaking Changes
#### APP_NAME no longer controls frontend branding
The `APP_NAME` configuration variable no longer controls the browser window/tab title or other frontend branding. Application names should now be configured using the theme system with the `brandAppName` token. The `APP_NAME` config is still used for backend contexts (MCP service, logs, etc.) and serves as a fallback if `brandAppName` is not set.
# Keep APP_NAME for now (will be used as fallback for brandAppName)
APP_NAME = "My Custom App"
# But you should migrate to THEME_DEFAULT.token.brandAppName
```
**Note:** For dark mode, set the same tokens in `THEME_DARK` configuration.
#### CUSTOM_FONT_URLS removed
The `CUSTOM_FONT_URLS` configuration option has been removed. Use the new per-theme `fontUrls` token in `THEME_DEFAULT` or database-managed themes instead.
**Before (5.x):**
```python
CUSTOM_FONT_URLS = [
"https://fonts.example.com/myfont.css",
]
```
**After (6.0):**
```python
THEME_DEFAULT = {
"token": {
"fontUrls": [
"https://fonts.example.com/myfont.css",
],
# ... other tokens
}
}
```
## 5.0.0
- [31976](https://github.com/apache/superset/pull/31976) Removed the `DISABLE_LEGACY_DATASOURCE_EDITOR` feature flag. The previous value of the feature flag was `True` and now the feature is permanently removed.
WEBDRIVER_BASEURL=f"http://superset_app{os.environ.get('SUPERSET_APP_ROOT','/')}/"# When using docker compose baseurl should be http://superset_nginx{ENV{BASEPATH}}/ # noqa: E501
# The base URL for the email report hyperlinks.
@@ -146,7 +132,7 @@ try:
fromsuperset_config_dockerimport*# noqa: F403
logger.info(
"Loaded your Docker configuration at [%s]",superset_config_docker.__file__
f"Loaded your Docker configuration at [{superset_config_docker.__file__}]"
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
-->
# LLM Context Guide for Apache Superset Documentation
This guide helps LLMs work with the Apache Superset documentation site built with Docusaurus 3.
## 📍 Current Directory Context
You are currently in the `/docs` subdirectory of the Apache Superset repository. When referencing files from the main codebase, use `../` to access the parent directory.
```
/Users/evan_1/GitHub/superset/ # Main repository root
Ensure you have Python 3.9+ and Node.js 16+ installed before proceeding.
:::
## Installation Steps
1. **Clone the repository**
```bash
git clone https://github.com/apache/superset.git
cd superset
```
2. **Install Python dependencies**
```bash
pip install -e .
```
3. **Initialize the database**
```bash
superset db upgrade
superset init
```
:::tip Success Check
Navigate to http://localhost:8088 and login with admin/admin
:::
```
### Documenting API Endpoints
```mdx
## Chart API
### GET /api/v1/chart/
Returns a list of charts.
**Parameters:**
- `page` (optional): Page number
- `page_size` (optional): Number of items per page
**Example Request:**
```bash
curl -X GET "http://localhost:8088/api/v1/chart/" \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN"
```
**Example Response:**
```json
{
"count": 42,
"result": [
{
"id": 1,
"slice_name": "Sales Dashboard",
"viz_type": "line"
}
]
}
```
```
---
**Note**: This documentation site serves as the primary resource for Superset users, administrators, and contributors. Always prioritize clarity, accuracy, and completeness when creating or updating documentation.
Each section maintains its own version history and can be versioned independently.
### Creating a New Version
To create a new version for any section, use the Docusaurus version command with the appropriate plugin ID or use our automated scripts:
#### Using Automated Scripts (Required)
**⚠️ Important:** Always use these custom commands instead of the native Docusaurus commands. These scripts ensure that both the Docusaurus versioning system AND the `versions-config.json` file are updated correctly.
```bash
# Main Documentation
yarn version:add:docs 1.2.0
# Developer Portal
yarn version:add:developer_portal 1.2.0
# Component Playground (when enabled)
yarn version:add:components 1.2.0
```
**Do NOT use** the native Docusaurus commands directly (`yarn docusaurus docs:version`), as they will:
- ❌ Create version files but NOT update `versions-config.json`
- ❌ Cause versions to not appear in dropdown menus
- ❌ Require manual fixes to synchronize the configuration
### Managing Versions
#### With Automated Scripts
The automated scripts handle all configuration updates automatically. No manual editing required!
#### Manual Configuration
If creating versions manually, you'll need to:
1.**Update `versions-config.json`** (or `docusaurus.config.ts` if not using dynamic config):
- Add version to `onlyIncludeVersions` array
- Add version metadata to `versions` object
- Update `lastVersion` if needed
2.**Files Created by Versioning**:
When a new version is created, Docusaurus generates:
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
-->
---
title: Component Library
sidebar_position: 1
---
# Superset Component Library
Welcome to the Apache Superset Component Library documentation. This section provides comprehensive documentation for all the UI components, chart components, and layout components used in Superset.
## What is the Component Library?
The Component Library is a collection of reusable UI components that are used to build the Superset user interface. These components are designed to be consistent, accessible, and easy to use.
## Component Categories
The Component Library is organized into the following categories:
### UI Components
Basic UI components like buttons, inputs, dropdowns, and other form elements.
### Chart Components
Visualization components used to render different types of charts and graphs.
### Layout Components
Components used for page layout, such as containers, grids, and navigation elements.
## Versioning
The Component Library documentation follows its own versioning scheme, independent from the main Superset documentation. This allows us to update the component documentation as the components evolve, without affecting the main documentation.
## Getting Started
Browse the sidebar to explore the different components available in the library. Each component documentation includes:
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
-->
# Code Review Process
Understand how code reviews work in Apache Superset and how to participate effectively.
## Overview
Code review is a critical part of maintaining code quality and sharing knowledge across the team. Every change to Superset goes through peer review before merging.
## For Authors
### Preparing for Review
#### Before Requesting Review
- [ ] Self-review your changes
- [ ] Ensure CI checks pass
- [ ] Add comprehensive tests
- [ ] Update documentation
- [ ] Fill out PR template completely
- [ ] Add screenshots for UI changes
#### Self-Review Checklist
```bash
# View your changes
git diff upstream/master
# Check for common issues:
# - Commented out code
# - Debug statements (console.log, print)
# - TODO comments that should be addressed
# - Hardcoded values that should be configurable
# - Missing error handling
# - Performance implications
```
### Requesting Review
#### Auto-Assignment
GitHub will automatically request reviews based on CODEOWNERS file.
#### Manual Assignment
For specific expertise, request additional reviewers:
- Frontend changes: Tag frontend experts
- Backend changes: Tag backend experts
- Security changes: Tag security team
- Database changes: Tag database experts
#### Review Request Message
```markdown
@reviewer This PR implements [feature]. Could you please review:
1. The approach taken in [file]
2. Performance implications of [change]
3. Security considerations for [feature]
Thanks!
```
### Responding to Feedback
#### Best Practices
- **Be receptive**: Reviews improve code quality
- **Ask questions**: Clarify if feedback is unclear
- **Explain decisions**: Share context for your choices
- **Update promptly**: Address feedback in timely manner
#### Comment Responses
```markdown
# Acknowledging
"Good catch! Fixed in [commit hash]"
# Explaining
"I chose this approach because [reason]. Would you prefer [alternative]?"
# Questioning
"Could you elaborate on [concern]? I'm not sure I understand the issue."
# Disagreeing respectfully
"I see your point, but I think [current approach] because [reason]. What do you think?"
```
## For Reviewers
### Review Responsibilities
#### What to Review
1.**Correctness**: Does the code do what it claims?
2.**Design**: Is the approach appropriate?
3.**Clarity**: Is the code readable and maintainable?
4.**Testing**: Are tests comprehensive?
5.**Performance**: Any performance concerns?
6.**Security**: Any security issues?
7.**Documentation**: Is it well documented?
### Review Checklist
#### Functionality
- [ ] Feature works as described
- [ ] Edge cases are handled
- [ ] Error handling is appropriate
- [ ] Backwards compatibility maintained
#### Code Quality
- [ ] Follows project conventions
- [ ] No code duplication
- [ ] Clear variable/function names
- [ ] Appropriate abstraction levels
- [ ] SOLID principles followed
#### Testing
- [ ] Unit tests for business logic
- [ ] Integration tests for APIs
- [ ] E2E tests for critical paths
- [ ] Tests are maintainable
- [ ] Good test coverage
#### Security
- [ ] Input validation
- [ ] SQL injection prevention
- [ ] XSS prevention
- [ ] CSRF protection
- [ ] Authentication/authorization checks
- [ ] No sensitive data in logs
#### Performance
- [ ] Database queries optimized
- [ ] No N+1 queries
- [ ] Appropriate caching
- [ ] Frontend bundle size impact
- [ ] Memory usage considerations
### Providing Feedback
#### Effective Comments
```python
# ✅ Good: Specific and actionable
"This query could cause N+1 problems. Consider using
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
-->
# Contribution Guidelines
## Pull Request Guidelines
A philosophy we would like to strongly encourage is
> Before creating a PR, create an issue.
The purpose is to separate problem from possible solutions.
**Bug fixes:** If you're only fixing a small bug, it's fine to submit a pull request right away but we highly recommend filing an issue detailing what you're fixing. This is helpful in case we don't accept that specific fix but want to keep track of the issue. Please keep in mind that the project maintainers reserve the rights to accept or reject incoming PRs, so it is better to separate the issue and the code to fix it from each other. In some cases, project maintainers may request you to create a separate issue from PR before proceeding.
**Refactor:** For small refactors, it can be a standalone PR itself detailing what you are refactoring and why. If there are concerns, project maintainers may request you to create a `#SIP` for the PR before proceeding.
**Feature/Large changes:** If you intend to change the public API, or make any non-trivial changes to the implementation, we require you to file a new issue as `#SIP` (Superset Improvement Proposal). This lets us reach an agreement on your proposal before you put significant effort into it. You are welcome to submit a PR along with the SIP (sometimes necessary for demonstration), but we will not review/merge the code until the SIP is approved.
In general, small PRs are always easier to review than large PRs. The best practice is to break your work into smaller independent PRs and refer to the same issue. This will greatly reduce turnaround time.
If you wish to share your work which is not ready to merge yet, create a [Draft PR](https://github.blog/2019-02-14-introducing-draft-pull-requests/). This will enable maintainers and the CI runner to prioritize mature PR's.
Finally, never submit a PR that will put master branch in broken state. If the PR is part of multiple PRs to complete a large feature and cannot work on its own, you can create a feature branch and merge all related PRs into the feature branch before creating a PR from feature branch to master.
### Protocol
#### Authoring
- Fill in all sections of the PR template.
- Title the PR with one of the following semantic prefixes (inspired by [Karma](http://karma-runner.github.io/0.10/dev/git-commit-msg.html])):
-`feat` (new feature)
-`fix` (bug fix)
-`docs` (changes to the documentation)
-`style` (formatting, missing semi colons, etc; no application logic change)
-`refactor` (refactoring code)
-`test` (adding missing tests, refactoring tests; no application logic change)
-`chore` (updating tasks etc; no application logic change)
-`other` (changes that don't correspond to the above -- should be rare!)
- Examples:
-`feat: export charts as ZIP files`
-`perf(api): improve API info performance`
-`fix(chart-api): cached-indicator always shows value is cached`
- Add prefix `[WIP]` to title if not ready for review (WIP = work-in-progress). We recommend creating a PR with `[WIP]` first and remove it once you have passed CI test and read through your code changes at least once.
- If you believe your PR contributes a potentially breaking change, put a `!` after the semantic prefix but before the colon in the PR title, like so: `feat!: Added foo functionality to bar`
- **Screenshots/GIFs:** Changes to user interface require before/after screenshots, or GIF for interactions
- If no screenshot is provided, the committers will mark the PR with `need:screenshot` label and will not review until screenshot is provided.
- **Dependencies:** Be careful about adding new dependency and avoid unnecessary dependencies.
- For Python, include it in `pyproject.toml` denoting any specific restrictions and
in `requirements.txt` pinned to a specific version which ensures that the application
build is deterministic.
- For TypeScript/JavaScript, include new libraries in `package.json`
- **Tests:** The pull request should include tests, either as doctests, unit tests, or both. Make sure to resolve all errors and test failures. See [Testing](./howtos#testing) for how to run tests.
- **Documentation:** If the pull request adds functionality, the docs should be updated as part of the same PR.
- **CI:** Reviewers will not review the code until all CI tests are passed. Sometimes there can be flaky tests. You can close and open PR to re-run CI test. Please report if the issue persists. After the CI fix has been deployed to `master`, please rebase your PR.
- **Code coverage:** Please ensure that code coverage does not decrease.
- Remove `[WIP]` when ready for review. Please note that it may be merged soon after approved so please make sure the PR is ready to merge and do not expect more time for post-approval edits.
- If the PR was not ready for review and inactive for > 30 days, we will close it due to inactivity. The author is welcome to re-open and update.
#### Reviewing
- Use constructive tone when writing reviews.
- If there are changes required, state clearly what needs to be done before the PR can be approved.
- If you are asked to update your pull request with some changes there's no need to create a new one. Push your changes to the same branch.
- The committers reserve the right to reject any PR and in some cases may request the author to file an issue.
#### Test Environments
- Members of the Apache GitHub org can launch an ephemeral test environment directly on a pull request by creating a comment containing (only) the command `/testenv up`.
- Note that org membership must be public in order for this validation to function properly.
- Feature flags may be set for a test environment by specifying the flag name (prefixed with `FEATURE_`) and value after the command.
- Format: `/testenv up FEATURE_<feature flag name>=true|false`
- Example: `/testenv up FEATURE_DASHBOARD_NATIVE_FILTERS=true`
- Multiple feature flags may be set in single command, separated by whitespace
- A comment will be created by the workflow script with the address and login information for the ephemeral environment.
- Test environments may be created once the Docker build CI workflow for the PR has completed successfully.
- Test environments do not currently update automatically when new commits are added to a pull request.
- Test environments do not currently support async workers, though this is planned.
- Running test environments will be shutdown upon closing the pull request.
You can also access per-PR ephemeral environment directly using the following URL pattern:
`https://pr-{PR_NUMBER}.superset.apache.org`
#### Merging
- At least one approval is required for merging a PR.
- PR is usually left open for at least 24 hours before merging.
- After the PR is merged, [close the corresponding issue(s)](https://help.github.com/articles/closing-issues-using-keywords/).
#### Post-merge Responsibility
- Project maintainers may contact the PR author if new issues are introduced by the PR.
- Project maintainers may revert your changes if a critical issue is found, such as breaking master branch CI.
## Managing Issues and PRs
To handle issues and PRs that are coming in, committers read issues/PRs and flag them with labels to categorize and help contributors spot where to take actions, as contributors usually have different expertises.
Triaging goals
- **For issues:** Categorize, screen issues, flag required actions from authors.
- **For PRs:** Categorize, flag required actions from authors. If PR is ready for review, flag required actions from reviewers.
First, add **Category labels (a.k.a. hash labels)**. Every issue/PR must have one hash label (except spam entry). Labels that begin with `#` defines issue/PR type:
| `#code-quality` | Describe problem with code, architecture or productivity | Refactor, tests, tooling |
| `#feature` | New feature request | New feature implementation |
| `#refine` | Propose improvement such as adjusting padding or refining UI style, excluding new features, bug fixes, and refactoring. | Implementation of improvement such as adjusting padding or refining UI style, excluding new features, bug fixes, and refactoring. |
| `#doc` | Documentation | Documentation |
| `#question` | Troubleshooting: Installation, Running locally, Ask how to do something. Can be changed to `#bug` later. | N/A |
| `#SIP` | Superset Improvement Proposal | N/A |
| `#ASF` | Tasks related to Apache Software Foundation policy | Tasks related to Apache Software Foundation policy |
Then add other types of labels as appropriate.
- **Descriptive labels (a.k.a. dot labels):** These labels that begin with `.` describe the details of the issue/PR, such as `.ui`, `.js`, `.install`, `.backend`, etc. Each issue/PR can have zero or more dot labels.
- **Need labels:** These labels have pattern `need:xxx`, which describe the work required to progress, such as `need:rebase`, `need:update`, `need:screenshot`.
- **Risk labels:** These labels have pattern `risk:xxx`, which describe the potential risk on adopting the work, such as `risk:db-migration`. The intention was to better understand the impact and create awareness for PRs that need more rigorous testing.
- **Status labels:** These labels describe the status (`abandoned`, `wontfix`, `cant-reproduce`, etc.) Issue/PRs that are rejected or closed without completion should have one or more status labels.
- **Version labels:** These have the pattern `vx.x` such as `v0.28`. Version labels on issues describe the version the bug was reported on. Version labels on PR describe the first release that will include the PR.
Committers may also update title to reflect the issue/PR content if the author-provided title is not descriptive enough.
If the PR passes CI tests and does not have any `need:` labels, it is ready for review, add label `review` and/or `design-review`.
If an issue/PR has been inactive for at least 30 days, it will be closed. If it does not have any status label, add `inactive`.
When creating a PR, if you're aiming to have it included in a specific release, please tag it with the version label. For example, to have a PR considered for inclusion in Superset 1.1 use the label `v1.1`.
## Revert Guidelines
Reverting changes that are causing issues in the master branch is a normal and expected part of the development process. In an open source community, the ramifications of a change cannot always be fully understood. With that in mind, here are some considerations to keep in mind when considering a revert:
- **Availability of the PR author:** If the original PR author or the engineer who merged the code is highly available and can provide a fix in a reasonable time frame, this would counter-indicate reverting.
- **Severity of the issue:** How severe is the problem on master? Is it keeping the project from moving forward? Is there user impact? What percentage of users will experience a problem?
- **Size of the change being reverted:** Reverting a single small PR is a much lower-risk proposition than reverting a massive, multi-PR change.
- **Age of the change being reverted:** Reverting a recently-merged PR will be more acceptable than reverting an older PR. A bug discovered in an older PR is unlikely to be causing widespread serious issues.
- **Risk inherent in reverting:** Will the reversion break critical functionality? Is the medicine more dangerous than the disease?
- **Difficulty of crafting a fix:** In the case of issues with a clear solution, it may be preferable to implement and merge a fix rather than a revert.
Should you decide that reverting is desirable, it is the responsibility of the Contributor performing the revert to:
- **Contact the interested parties:** The PR's author and the engineer who merged the work should both be contacted and informed of the revert.
- **Provide concise reproduction steps:** Ensure that the issue can be clearly understood and duplicated by the original author of the PR.
- **Put the revert through code review:** The revert must be approved by another committer.
**Revert liberally to keep `master` stable**:
- Build failures
- Test failures
- Critical bugs in production
- Security vulnerabilities
**How to revert**:
1. Use GitHub's revert button when possible
2. Create a PR with clear explanation
3. Tag the original author
4. Work with them on a fix
## Design Guidelines
### Capitalization Guidelines
#### Sentence case
Use sentence-case capitalization for everything in the UI (except these **).
Sentence case is predominantly lowercase. Capitalize only the initial character of the first word, and other words that require capitalization, like:
- **Proper nouns.** Objects in the product _are not_ considered proper nouns e.g. dashboards, charts, saved queries etc. Proprietary feature names eg. SQL Lab, Preset Manager _are_ considered proper nouns
- **Acronyms** (e.g. CSS, HTML)
- When referring to **UI labels that are themselves capitalized** from sentence case (e.g. page titles - Dashboards page, Charts page, Saved queries page, etc.)
- User input that is reflected in the UI. E.g. a user-named a dashboard tab
**Sentence case vs. Title case:**
Title case: "A Dog Takes a Walk in Paris"
Sentence case: "A dog takes a walk in Paris"
**Why sentence case?**
- It's generally accepted as the quickest to read
- It's the easiest form to distinguish between common and proper nouns
**Good examples:**
- "Select a database"
- "Create new chart"
- "View all dashboards"
**Bad examples:**
- "Select a Database"
- "Create New Chart"
- "View All Dashboards"
#### How to refer to UI elements
When writing about a UI element, use the same capitalization as used in the UI.
For example, if an input field is labeled "Name" then you refer to this as the "Name input field". Similarly, if a button has the label "Save" in it, then it is correct to refer to the "Save button".
Where a product page is titled "Settings", you refer to this in writing as follows:
"Edit your personal information on the Settings page".
Often a product page will have the same title as the objects it contains. In this case, refer to the page as it appears in the UI, and the objects as common nouns:
- Upload a dashboard on the Dashboards page
- Go to Dashboards
- View dashboard
- View all dashboards
- Upload CSS templates on the CSS templates page
- Queries that you save will appear on the Saved queries page
- Create custom queries in SQL Lab then create dashboards
When writing about UI elements:
- Use **bold** for clickable elements: "Click **Save**"
- Use quotes for text fields: 'Enter "My Dashboard" in the name field'
- Be specific about element types: button, link, dropdown, etc.
#### **Exceptions to sentence case
Only use title case for:
- Product names (Apache Superset)
- Proper nouns
- Acronyms (SQL, API, CSV)
- Input labels, buttons and UI tabs are all caps
- User input values (e.g. column names, SQL Lab tab names) should be in their original case
## Programming Language Conventions
### Python
We use:
- **[Ruff](https://docs.astral.sh/ruff/)** for linting and formatting
- **[Mypy](http://mypy-lang.org/)** for type checking
Python code should:
- Follow PEP 8
- Use type hints for all new code
- Use descriptive variable names
- Include docstrings for modules, classes, and functions
- Handle exceptions appropriately
- Avoid global variables
Parameters in the `config.py` (which are accessible via the Flask app.config dictionary) are
assumed to always be defined and thus should be accessed directly via,
```python
blueprints=app.config["BLUEPRINTS"]
```
rather than,
```python
blueprints=app.config.get("BLUEPRINTS")
```
or similar as the later will cause typing issues. The former is of type `List[Callable]`
whereas the later is of type `Optional[List[Callable]]`.
#### Typing / Type Hints
All new Python code should include type hints:
To ensure clarity, consistency, all readability, _all_ new functions should use
[type hints](https://docs.python.org/3/library/typing.html) and include a
docstring.
Note per [PEP-484](https://www.python.org/dev/peps/pep-0484/#exceptions) no
syntax for listing explicitly raised exceptions is proposed and thus the
recommendation is to put this information in a docstring, i.e.,
```python
importmath
fromtypingimportList,Optional,Dict,Any,Union
defsqrt(x:Union[float,int])->Union[float,int]:
"""
Return the square root of x.
:param x: A number
:returns: The square root of the given number
:raises ValueError: If the number is negative
"""
returnmath.sqrt(x)
defprocess_data(
data:List[Dict[str,Any]],
filter_empty:bool=True
)->Optional[Dict[str,Any]]:
"""
Process a list of data dictionaries.
Args:
data: List of dictionaries containing data
filter_empty: Whether to filter empty entries
Returns:
Processed data dictionary or None if no valid data
"""
ifnotdata:
returnNone
# Process data...
returnprocessed_data
```
Use `mypy` to check types:
```bash
mypy superset
```
### TypeScript
We use:
- **ESLint** for linting
- **Prettier** for formatting
- **TypeScript** strict mode
TypeScript is fully supported and is the recommended language for writing all new frontend
components. When modifying existing functions/components, migrating to TypeScript is
appreciated, but not required. Examples of migrating functions/components to TypeScript can be
found in [#9162](https://github.com/apache/superset/pull/9162) and [#9180](https://github.com/apache/superset/pull/9180).
TypeScript code should:
- Avoid `any` types - use proper TypeScript types
- Use functional components with hooks for React
- Include JSDoc comments for complex functions
- Use consistent naming conventions
- Handle errors appropriately
Example:
```typescript
interfaceUser{
id: number;
name: string;
email?: string;
}
exportfunctionprocessUser(user: User):string{
// Avoid using 'any'
const{name,email}=user;
returnemail?`${name} <${email}>`:name;
}
```
## Additional Guidelines
### Commit Messages
- Use clear, descriptive commit messages
- Start with a verb in imperative mood
- Reference issue numbers when applicable
Good: "Fix dashboard filter bug when dataset is deleted"
Bad: "Fixed stuff"
### Code Review Etiquette
- Be respectful and constructive
- Focus on the code, not the person
- Provide specific suggestions for improvement
- Acknowledge good work
- Be open to different approaches
### Documentation
- Update docs for any user-facing changes
- Include code examples where helpful
- Keep language clear and concise
- Test documentation changes locally
### Security
- Never commit secrets or credentials
- Validate all user input
- Use parameterized queries for SQL
- Follow OWASP guidelines
- Report security issues privately to private@superset.apache.org
## Questions?
If you have questions about these guidelines, ask in:
**Frontend**: Webpack dev server provides hot module replacement automatically.
**Backend**: Use Flask debug mode:
```bash
FLASK_ENV=development superset run -p 8088 --with-threads --reload
```
### Performance Profiling
For Python profiling:
```python
# In superset_config.py
PROFILING=True
```
For React profiling:
- Use React DevTools Profiler
- Enable performance marks in Chrome DevTools
### Database Migrations
```bash
# Create a new migration
superset db migrate -m "Description of changes"
# Apply migrations
superset db upgrade
# Downgrade
superset db downgrade
```
### Useful Aliases
Add to your shell profile:
```bash
aliassdev='FLASK_ENV=development superset run -p 8088 --with-threads --reload'
aliasstest='pytest tests/unit_tests'
aliasslint='pre-commit run --all-files'
aliassfront='cd superset-frontend && npm run dev-server'
```
## Common Issues and Solutions
### Node/npm Issues
```bash
# Clear npm cache
npm cache clean --force
# Reinstall dependencies
rm -rf node_modules package-lock.json
npm install
```
### Python Environment Issues
```bash
# Recreate virtual environment
deactivate
rm -rf venv
python3 -m venv venv
source venv/bin/activate
pip install -r requirements/development.txt
pip install -e .
```
### Database Issues
```bash
# Reset local database
superset db downgrade -r base
superset db upgrade
superset init
```
### Port Already in Use
```bash
# Find process using port
lsof -i :8088
# Kill process
kill -9 [PID]
```
## Reporting Security Vulnerabilities
Please report security vulnerabilities to **private@superset.apache.org**.
In the event a community member discovers a security flaw in Superset, it is important to follow the [Apache Security Guidelines](https://www.apache.org/security/committers.html) and release a fix as quickly as possible before public disclosure. Reporting security vulnerabilities through the usual GitHub Issues channel is not ideal as it will publicize the flaw before a fix can be applied.
## SQL Lab Async Configuration
It's possible to configure a local database to operate in `async` mode, to work on `async` related features.
To do this, you'll need to:
- Add an additional database entry. We recommend you copy the connection string from the database labeled `main`, and then enable `SQL Lab` and the features you want to use. Don't forget to check the `Async` box
- Configure a results backend, here's a local `FileSystemCache` example, not recommended for production, but perfect for testing (stores cache in `/tmp`)
```python
from flask_caching.backends.filesystemcache import FileSystemCache
- for changes that affect the worker logic, you'll have to restart the `celery worker` process for the changes to be reflected.
- The message queue used is a `sqlite` database using the `SQLAlchemy` experimental broker. Ok for testing, but not recommended in production
- In some cases, you may want to create a context that is more aligned to your production environment, and use the similar broker as well as results backend configuration
## Async Chart Queries
It's possible to configure database queries for charts to operate in `async` mode. This is especially useful for dashboards with many charts that may otherwise be affected by browser connection limits. To enable async queries for dashboards and Explore, the following dependencies are required:
- Redis 5.0+ (the feature utilizes [Redis Streams](https://redis.io/topics/streams-intro))
- Cache backends enabled via the `CACHE_CONFIG` and `DATA_CACHE_CONFIG` config settings
- Celery workers configured and running to process async tasks
## Need Help?
- Check the [FAQ](https://superset.apache.org/docs/frequently-asked-questions)
- Ask in [Slack](https://apache-superset.slack.com)
_Please note that feature requests opened as GitHub Issues will be moved to Discussions._
### Submit Ideas or Feature Requests
The best way is to start an ["Ideas" Discussion thread](https://github.com/apache/superset/discussions/categories/ideas) on GitHub:
- Explain in detail how it would work.
- Keep the scope as narrow as possible, to make it easier to implement.
- Remember that this is a volunteer-driven project, and that your contributions are as welcome as anyone's :)
To propose large features or major changes to codebase, and help usher in those changes, please create a **Superset Improvement Proposal (SIP)**. See template from [SIP-0](https://github.com/apache/superset/issues/5602)
### Fix Bugs
Look through the GitHub issues. Issues tagged with `#bug` are
open to whoever wants to implement them.
### Implement Features
Look through the GitHub issues. Issues tagged with
`#feature` are open to whoever wants to implement them.
### Improve Documentation
Superset could always use better documentation,
whether as part of the official Superset docs,
in docstrings, `docs/*.rst` or even on the web as blog posts or
articles. See [Documentation](./howtos#contributing-to-documentation) for more details.
### Add Translations
If you are proficient in a non-English language, you can help translate
text strings from Superset's UI. You can jump into the existing
language dictionaries at
`superset/translations/<language_code>/LC_MESSAGES/messages.po`, or
even create a dictionary for a new language altogether.
See [Translating](./howtos#contributing-translations) for more details.
### Ask Questions
There is a dedicated [`apache-superset` tag](https://stackoverflow.com/questions/tagged/apache-superset) on [StackOverflow](https://stackoverflow.com/). Please use it when asking questions.
## Types of Contributors
Following the project governance model of the Apache Software Foundation (ASF), Apache Superset has a specific set of contributor roles:
### PMC Member
A Project Management Committee (PMC) member is a person who has been elected by the PMC to help manage the project. PMC members are responsible for the overall health of the project, including community development, release management, and project governance. PMC members are also responsible for the technical direction of the project.
For more information about Apache Project PMCs, please refer to https://www.apache.org/foundation/governance/pmcs.html
### Committer
A committer is a person who has been elected by the PMC to have write access (commit access) to the code repository. They can modify the code, documentation, and website and accept contributions from others.
The official list of committers and PMC members can be found [here](https://projects.apache.org/committee.html?superset).
### Contributor
A contributor is a person who has contributed to the project in any way, including but not limited to code, tests, documentation, issues, and discussions.
> You can also review the Superset project's guidelines for PMC member promotion here: https://github.com/apache/superset/wiki/Guidelines-for-promoting-Superset-Committers-to-the-Superset-PMC
### Security Team
The security team is a selected subset of PMC members, committers and non-committers who are responsible for handling security issues.
New members of the security team are selected by the PMC members in a vote. You can request to be added to the team by sending a message to private@superset.apache.org. However, the team should be small and focused on solving security issues, so the requests will be evaluated on a case-by-case basis and the team size will be kept relatively small, limited to only actively security-focused contributors.
This security team must follow the [ASF vulnerability handling process](https://apache.org/security/committers.html#asf-project-security-for-committers).
Each new security issue is tracked as a JIRA ticket on the [ASF's JIRA Superset security project](https://issues.apache.org/jira/secure/RapidBoard.jspa?rapidView=588&projectKey=SUPERSETSEC)
Security team members must:
- Have an [ICLA](https://www.apache.org/licenses/contributor-agreements.html) signed with Apache Software Foundation.
- Not reveal information about pending and unfixed security issues to anyone (including their employers) unless specifically authorised by the security team members, e.g., if the security team agrees that diagnosing and solving an issue requires the involvement of external experts.
A release manager, the contributor overseeing the release of a specific version of Apache Superset, is by default a member of the security team. However, they are not expected to be active in assessing, discussing, and fixing security issues.
Security team members should also follow these general expectations:
- Actively participate in assessing, discussing, fixing, and releasing security issues in Superset.
- Avoid discussing security fixes in public forums. Pull request (PR) descriptions should not contain any information about security issues. The corresponding JIRA ticket should contain a link to the PR.
- Security team members who contribute to a fix may be listed as remediation developers in the CVE report, along with their job affiliation (if they choose to include it).
## Getting Started
Ready to contribute? Here's how to get started:
1.**[Set up your environment](./development-setup)** - Get Superset running locally
2.**[Find something to work on](#types-of-contributions)** - Pick an issue or feature
3.**[Submit your contribution](./submitting-pr)** - Create a pull request
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.