fix(plugin-chart-ag-grid-table): keep basic conditional formatting aligned after sort (#105973)

The basic (increase/decrease) color formatters were built in the original
query order and read positionally by the displayed AG Grid rowIndex. Once the
table was sorted client-side, the displayed index no longer matched the data
order, so the green/red background and arrow indicators were applied to the
wrong rows.

Attach each row's formatter to its row data object (non-enumerable, so it never
leaks into exports/cross-filters) so it travels with the row through sorting,
and resolve it via getRowBasicColorFormatter in both getCellStyle and
NumericCellRenderer, falling back to the positional lookup. Add unit tests.

.asf.yaml

@@ -77,23 +77,17 @@ github:
         # combination here.
         contexts:
           - lint-check
-          - cypress-matrix (0, chrome)
-          - cypress-matrix (1, chrome)
-          - cypress-matrix (2, chrome)
-          - cypress-matrix (3, chrome)
-          - cypress-matrix (4, chrome)
-          - cypress-matrix (5, chrome)
+          - cypress-matrix-required
           - dependency-review
           - frontend-build
-          - playwright-tests (chromium)
+          - playwright-tests-required
           - pre-commit (current)
-          - pre-commit (previous)
           - test-mysql
-          - test-postgres (current)
+          - test-postgres-required
           - test-postgres-hive
           - test-postgres-presto
           - test-sqlite
-          - unit-tests (current)
+          - unit-tests-required
 
       required_pull_request_reviews:
         dismiss_stale_reviews: false

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -41,8 +41,8 @@ body:
       label: Superset version
       options:
         - master / latest-dev
+        - "6.1.0"
         - "6.0.0"
-        - "5.0.0"
     validations:
       required: true
   - type: dropdown

.github/actions/setup-backend/action.yml

@@ -42,7 +42,7 @@ runs:
         fi
         echo "python-version=$RESOLVED_VERSION" >> "$GITHUB_OUTPUT"
     - name: Set up Python ${{ steps.set-python-version.outputs.python-version }}
-      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
       with:
         python-version: ${{ steps.set-python-version.outputs.python-version }}
         cache: ${{ inputs.cache }}

.github/dependabot.yml

@@ -3,10 +3,6 @@ enable-beta-ecosystems: true
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
-    ignore:
-      # Ignore temporarily as release schedule is too mentally taxing for dep-handling maintainers
-      # Additionally, very few PRs are reviewed by this action.
-      - dependency-name: anthropics/claude-code-action
     schedule:
       interval: "daily"
     cooldown:
@@ -14,12 +10,6 @@ updates:
 
   - package-ecosystem: "npm"
     ignore:
-      # TODO: remove below entries until React >= 18.0.0
-      - dependency-name: "storybook"
-        update-types: ["version-update:semver-major", "version-update:semver-minor"]
-      - dependency-name: "@storybook*"
-        update-types: ["version-update:semver-major", "version-update:semver-minor"]
-      - dependency-name: "eslint-plugin-storybook"
       - dependency-name: "react-error-boundary"
       - dependency-name: "@rjsf/*"
       # remark-gfm v4+ requires react-markdown v9+, which needs React 18
@@ -42,14 +32,6 @@ updates:
       # and confirm the issue https://github.com/apache/superset/issues/39600 is fixed
       - dependency-name: "react-checkbox-tree"
         update-types: ["version-update:semver-major"]
-    groups:
-      storybook:
-        applies-to: version-updates
-        patterns:
-          - "@storybook*"
-          - "storybook"
-        update-types:
-          - "patch"
     directory: "/superset-frontend/"
     schedule:
       interval: "daily"
@@ -90,21 +72,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/docs/"
     ignore:
-      # TODO: remove below entries until React >= 18.0.0 in superset-frontend
-      - dependency-name: "storybook"
-        update-types: ["version-update:semver-major", "version-update:semver-minor"]
-      - dependency-name: "@storybook*"
-        update-types: ["version-update:semver-major", "version-update:semver-minor"]
-      - dependency-name: "eslint-plugin-storybook"
       - dependency-name: "react-error-boundary"
-    groups:
-      storybook:
-        applies-to: version-updates
-        patterns:
-          - "@storybook*"
-          - "storybook"
-        update-types:
-          - "patch"
     schedule:
       interval: "daily"
     open-pull-requests-limit: 10

.github/workflows/bashlib.sh

@@ -20,10 +20,6 @@ set -e
 GITHUB_WORKSPACE=${GITHUB_WORKSPACE:-.}
 ASSETS_MANIFEST="$GITHUB_WORKSPACE/superset/static/assets/manifest.json"
 
-# Rounded job start time, used to create a unique Cypress build id for
-# parallelization so we can manually rerun a job after 20 minutes
-NONCE=$(echo "$(date "+%Y%m%d%H%M") - ($(date +%M)%20)" | bc)
-
 # Echo only when not in parallel mode
 say() {
   if [[ $(echo "$INPUT_PARALLEL" | tr '[:lower:]' '[:upper:]') != 'TRUE' ]]; then
@@ -118,7 +114,7 @@ testdata() {
   say "::group::Load test data"
   # must specify PYTHONPATH to make `tests.superset_test_config` importable
   export PYTHONPATH="$GITHUB_WORKSPACE"
-  pip install -e .
+  uv pip install --system -e .
   superset db upgrade
   superset load_test_users
   superset load_examples --load-test-data
@@ -131,7 +127,7 @@ playwright_testdata() {
   say "::group::Load all examples for Playwright tests"
   # must specify PYTHONPATH to make `tests.superset_test_config` importable
   export PYTHONPATH="$GITHUB_WORKSPACE"
-  pip install -e .
+  uv pip install --system -e .
   superset db upgrade
   superset load_test_users
   superset load_examples

.github/workflows/bump-python-package.yml

@@ -30,9 +30,8 @@ jobs:
       pull-requests: write
       checks: write
     steps:
-
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: true
           ref: master

.github/workflows/check-python-deps.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
@@ -38,6 +38,19 @@ jobs:
         if: steps.check.outputs.python
         uses: ./.github/actions/setup-backend/
 
+      # Authenticate the Docker daemon so the python:slim pull in
+      # uv-pip-compile.sh uses our (much higher) authenticated rate limit
+      # instead of the shared-runner anonymous one. Best-effort: on fork PRs the
+      # secrets are unavailable, so this no-ops and the pull falls back to
+      # anonymous (covered by the retry loop in the script).
+      - name: Login to Docker Hub
+        if: steps.check.outputs.python
+        continue-on-error: true
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USER }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
       - name: Run uv
         if: steps.check.outputs.python
         run: ./scripts/uv-pip-compile.sh

.github/workflows/check_db_migration_confict.yml

@@ -25,7 +25,7 @@ jobs:
       pull-requests: write
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Check and notify

.github/workflows/claude.yml

@@ -1,88 +0,0 @@
-name: Claude PR Assistant
-
-on:
-  issue_comment:
-    types: [created]
-  pull_request_review_comment:
-    types: [created]
-
-permissions:
-  contents: read
-
-jobs:
-  check-permissions:
-    if: |
-      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude'))
-    runs-on: ubuntu-latest
-    outputs:
-      allowed: ${{ steps.check.outputs.allowed }}
-    steps:
-      - name: Check if user is allowed
-        id: check
-        env:
-          COMMENTER: ${{ github.event.comment.user.login }}
-        run: |
-          # List of allowed users
-          ALLOWED_USERS="mistercrunch,rusackas"
-
-          echo "Checking permissions for user: $COMMENTER"
-
-          # Check if user is in allowed list
-          if [[ ",$ALLOWED_USERS," == *",$COMMENTER,"* ]]; then
-            echo "allowed=true" >> $GITHUB_OUTPUT
-            echo "✅ User $COMMENTER is allowed to use Claude"
-          else
-            echo "allowed=false" >> $GITHUB_OUTPUT
-            echo "❌ User $COMMENTER is not allowed to use Claude"
-          fi
-
-  deny-access:
-    needs: check-permissions
-    if: needs.check-permissions.outputs.allowed == 'false'
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-      pull-requests: write
-    steps:
-      - name: Comment access denied
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          COMMENTER_LOGIN: ${{ github.event.comment.user.login || github.event.review.user.login || github.event.issue.user.login }}
-        with:
-          script: |
-            const commenter = process.env.COMMENTER_LOGIN;
-            const message = `👋 Hi @${commenter}!
-
-            Thanks for trying to use Claude Code, but currently only certain team members have access to this feature.
-
-            If you believe you should have access, please contact a project maintainer.`;
-
-            await github.rest.issues.createComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-              body: message
-            });
-
-  claude-code-action:
-    needs: check-permissions
-    if: needs.check-permissions.outputs.allowed == 'true'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-      issues: write
-      id-token: write
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      with:
-        persist-credentials: false
-        fetch-depth: 1
-
-    - name: Run Claude PR Action
-      uses: anthropics/claude-code-action@5fb899572b81d2bb648d4d187173a2f423a9677c # beta
-      with:
-        anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-        timeout_minutes: "60"

.github/workflows/codeql-analysis.yml

@@ -15,12 +15,39 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  changes:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      python: ${{ steps.check.outputs.python }}
+      frontend: ${{ steps.check.outputs.frontend }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Check for file changes
+        id: check
+        uses: ./.github/actions/change-detector/
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
   analyze:
     name: Analyze
+    needs: changes
+    # Skip on PRs that touch neither code group (e.g. docs-only) so the
+    # analysis runners don't spin up. push/schedule runs always proceed:
+    # the change-detector returns "all changed" for non-PR events.
+    if: needs.changes.outputs.python == 'true' || needs.changes.outputs.frontend == 'true'
     runs-on: ubuntu-24.04
+    timeout-minutes: 30
     permissions:
       actions: read
       contents: read
+      pull-requests: read
       security-events: write
 
     strategy:
@@ -31,19 +58,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
-      - name: Check for file changes
-        id: check
-        uses: ./.github/actions/change-detector/
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -54,7 +75,6 @@ jobs:
           # queries: security-extended,security-and-quality
 
       - name: Perform CodeQL Analysis
-        if: steps.check.outputs.python || steps.check.outputs.frontend
-        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/dependency-review.yml

@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: "Dependency Review"
@@ -43,7 +43,7 @@ jobs:
           #   the latest version. It's MIT: https://github.com/nbubna/store/blob/master/LICENSE-MIT
           # pkg:npm/node-forge@1.3.1
           #   selecting BSD-3-Clause licensing terms for node-forge to ensure compatibility with Apache
-          allow-dependencies-licenses: pkg:npm/store2@2.14.2, pkg:npm/node-forge@1.3.1, pkg:npm/rgbcolor, pkg:npm/jszip@3.10.1
+          allow-dependencies-licenses: pkg:npm/rgbcolor, pkg:npm/jszip@3.10.1
 
   python-dependency-liccheck:
     # NOTE: Configuration for liccheck lives in our pyproject.yml.
@@ -51,7 +51,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 

.github/workflows/docker.yml

@@ -18,9 +18,30 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  changes:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      python: ${{ steps.check.outputs.python }}
+      frontend: ${{ steps.check.outputs.frontend }}
+      docker: ${{ steps.check.outputs.docker }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Check for file changes
+        id: check
+        uses: ./.github/actions/change-detector/
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
 
   setup_matrix:
     runs-on: ubuntu-24.04
+    timeout-minutes: 5
     outputs:
       matrix_config: ${{ steps.set_matrix.outputs.matrix_config }}
     steps:
@@ -32,8 +53,13 @@ jobs:
 
   docker-build:
     name: docker-build
-    needs: setup_matrix
+    needs: [setup_matrix, changes]
+    if: >-
+      needs.changes.outputs.python == 'true' ||
+      needs.changes.outputs.frontend == 'true' ||
+      needs.changes.outputs.docker == 'true'
     runs-on: ubuntu-24.04
+    timeout-minutes: 60
     strategy:
       matrix:
         build_preset: ${{fromJson(needs.setup_matrix.outputs.matrix_config)}}
@@ -44,20 +70,30 @@ jobs:
       IMAGE_TAG: apache/superset:GHA-${{ matrix.build_preset }}-${{ github.run_id }}
 
     steps:
-
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
-      - name: Check for file changes
-        id: check
-        uses: ./.github/actions/change-detector/
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Free up disk space
+        shell: bash
+        run: |
+          # Reclaim large preinstalled toolchains we don't use. The image
+          # build, and especially the docker-compose sanity check (which
+          # rebuilds from scratch whenever the registry cache image
+          # apache/superset-cache is unavailable), can otherwise exhaust the
+          # runner's root disk and fail with "no space left on device".
+          echo "Disk before cleanup:"; df -h /
+          sudo rm -rf \
+            /usr/share/dotnet \
+            /usr/local/lib/android \
+            /opt/ghc \
+            /usr/local/.ghcup \
+            /opt/hostedtoolcache/CodeQL \
+            /usr/local/share/boost || true
+          echo "Disk after cleanup:"; df -h /
 
       - name: Setup Docker Environment
-        if: steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker
         uses: ./.github/actions/setup-docker
         with:
           dockerhub-user: ${{ secrets.DOCKERHUB_USER }}
@@ -65,11 +101,9 @@ jobs:
           build: "true"
 
       - name: Setup supersetbot
-        if: steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker
         uses: ./.github/actions/setup-supersetbot/
 
       - name: Build Docker Image
-        if: steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker
         shell: bash
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -85,17 +119,31 @@ jobs:
             PUSH_OR_LOAD="--load"
           fi
 
-          supersetbot docker \
-            $PUSH_OR_LOAD \
-            --preset "$BUILD_PRESET" \
-            --context "$EVENT" \
-            --context-ref "$RELEASE" $FORCE_LATEST \
-            --extra-flags "--build-arg INCLUDE_CHROMIUM=false --tag $IMAGE_TAG" \
-            $PLATFORM_ARG
+          # Retry to absorb transient Docker Hub registry errors (base-image
+          # pull timeouts, 504/401 on push, ECONNRESET) that otherwise fail
+          # the whole job. buildx reuses the buildkit layer cache from the
+          # failed attempt, so a retry mostly re-does just the failed push.
+          for attempt in 1 2 3; do
+            if supersetbot docker \
+              $PUSH_OR_LOAD \
+              --preset "$BUILD_PRESET" \
+              --context "$EVENT" \
+              --context-ref "$RELEASE" $FORCE_LATEST \
+              --extra-flags "--build-arg INCLUDE_CHROMIUM=false --tag $IMAGE_TAG" \
+              $PLATFORM_ARG; then
+              break
+            fi
+            if [ "$attempt" -eq 3 ]; then
+              echo "::error::supersetbot docker build failed after 3 attempts"
+              exit 1
+            fi
+            echo "::warning::Build attempt ${attempt} failed; retrying in 30s..."
+            sleep 30
+          done
 
       # in the context of push (using multi-platform build), we need to pull the image locally
       - name: Docker pull
-        if: github.event_name == 'push' && (steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker)
+        if: github.event_name == 'push'
         run: |
           for i in 1 2 3; do
             docker pull $IMAGE_TAG && break
@@ -103,7 +151,6 @@ jobs:
           done
 
       - name: Print docker stats
-        if: steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker
         run: |
           echo "SHA: ${{ github.sha }}"
           echo "IMAGE: $IMAGE_TAG"
@@ -111,7 +158,7 @@ jobs:
           docker history $IMAGE_TAG
 
       - name: docker-compose sanity check
-        if: (steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker) && matrix.build_preset == 'dev'
+        if: matrix.build_preset == 'dev'
         shell: bash
         env:
           BUILD_PRESET: ${{ matrix.build_preset }}
@@ -124,20 +171,31 @@ jobs:
   docker-compose-image-tag:
     # Run this job only on pushes to master (not for PRs)
     # goal is to check that building the latest image works, not required for all PR pushes
-    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+    needs: changes
+    if: github.event_name == 'push' && github.ref == 'refs/heads/master' && needs.changes.outputs.docker == 'true'
     runs-on: ubuntu-24.04
+    timeout-minutes: 30
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - name: Check for file changes
-        id: check
-        uses: ./.github/actions/change-detector/
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Free up disk space
+        shell: bash
+        run: |
+          # The sanity check rebuilds the image from scratch whenever the
+          # registry cache image apache/superset-cache is unavailable, which
+          # can exhaust the runner's root disk ("no space left on device").
+          echo "Disk before cleanup:"; df -h /
+          sudo rm -rf \
+            /usr/share/dotnet \
+            /usr/local/lib/android \
+            /opt/ghc \
+            /usr/local/.ghcup \
+            /opt/hostedtoolcache/CodeQL \
+            /usr/local/share/boost || true
+          echo "Disk after cleanup:"; df -h /
       - name: Setup Docker Environment
-        if: steps.check.outputs.docker
         uses: ./.github/actions/setup-docker
         with:
           dockerhub-user: ${{ secrets.DOCKERHUB_USER }}
@@ -145,7 +203,6 @@ jobs:
           build: "false"
           install-docker-compose: "true"
       - name: docker-compose sanity check
-        if: steps.check.outputs.docker
         shell: bash
         run: |
           docker compose -f docker-compose-image-tag.yml up superset-init --exit-code-from superset-init

.github/workflows/embedded-sdk-release.yml

@@ -10,37 +10,29 @@ permissions:
   contents: read
 
 jobs:
-  config:
-    runs-on: ubuntu-24.04
-    outputs:
-      has-secrets: ${{ steps.check.outputs.has-secrets }}
-    steps:
-      - name: "Check for secrets"
-        id: check
-        shell: bash
-        run: |
-          if [ -n "${NPM_TOKEN}" ]; then
-            echo "has-secrets=1" >> "$GITHUB_OUTPUT"
-          fi
-
-        env:
-          NPM_TOKEN: ${{ (secrets.NPM_TOKEN != '') || '' }}
   build:
-    needs: config
-    if: needs.config.outputs.has-secrets
+    # Publishing uses npm trusted publishing (OIDC), so there is no NPM_TOKEN to
+    # gate on. Restrict to the canonical repo: forks cannot mint a valid OIDC
+    # token for this package and must not publish.
+    if: github.repository == 'apache/superset'
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write # required for npm trusted publishing (OIDC)
     defaults:
       run:
         working-directory: superset-embedded-sdk
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
+      # Note: registry-url is intentionally omitted. When set, actions/setup-node
+      # writes an .npmrc with `_authToken=${NODE_AUTH_TOKEN}` and a placeholder
+      # token, which makes npm attempt token auth and skip the OIDC
+      # trusted-publishing exchange. With no .npmrc auth line, npm authenticates
+      # via OIDC against the default registry (registry.npmjs.org).
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version-file: './superset-embedded-sdk/.nvmrc'
-          registry-url: 'https://registry.npmjs.org'
+          node-version-file: "./superset-embedded-sdk/.nvmrc"
       - run: npm ci
       - run: npm run ci:release
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/embedded-sdk-test.yml

@@ -21,13 +21,13 @@ jobs:
       run:
         working-directory: superset-embedded-sdk
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version-file: './superset-embedded-sdk/.nvmrc'
-          registry-url: 'https://registry.npmjs.org'
+          node-version-file: "./superset-embedded-sdk/.nvmrc"
+          registry-url: "https://registry.npmjs.org"
       - run: npm ci
       - run: npm test
       - run: npm run build

.github/workflows/generate-FOSSA-report.yml

@@ -32,12 +32,12 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
       - name: Setup Java
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
         with:
           distribution: "temurin"
           java-version: "11"

.github/workflows/github-action-validator.yml

@@ -12,8 +12,12 @@ on:
 permissions:
   contents: read
 
-jobs:
+# cancel previous workflow jobs for PRs
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
 
+jobs:
   validate-all-ghas:
     runs-on: ubuntu-24.04
     permissions:
@@ -23,14 +27,14 @@ jobs:
       security-events: write
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: '20'
+          node-version: "20"
 
       - name: Install Dependencies
         run: npm install -g @action-validator/core @action-validator/cli --save-dev

.github/workflows/issue_creation.yml

@@ -15,9 +15,8 @@ jobs:
       pull-requests: write
       issues: write
     steps:
-
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 

.github/workflows/labeler.yml

@@ -2,6 +2,11 @@ name: "Pull Request Labeler"
 on:
 - pull_request_target
 
+# cancel previous workflow jobs for PRs
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   labeler:
     permissions:

.github/workflows/latest-release-tag.yml

@@ -11,29 +11,29 @@ jobs:
       contents: write
 
     steps:
-    - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      with:
-        persist-credentials: false
-        submodules: recursive
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          submodules: recursive
 
-    - name: Check for latest tag
-      id: latest-tag
-      env:
-        RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
-      run: |
-        source ./scripts/tag_latest_release.sh "$RELEASE_TAG_NAME" --dry-run
+      - name: Check for latest tag
+        id: latest-tag
+        env:
+          RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
+        run: |
+          source ./scripts/tag_latest_release.sh "$RELEASE_TAG_NAME" --dry-run
 
-    - name: Configure Git
-      run: |
-        git config user.name "$GITHUB_ACTOR"
-        git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+      - name: Configure Git
+        run: |
+          git config user.name "$GITHUB_ACTOR"
+          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
 
-    - name: Run latest-tag
-      uses: ./.github/actions/latest-tag
-      if: steps.latest-tag.outputs.SKIP_TAG != 'true'
-      with:
-        description: Superset latest release
-        tag-name: latest
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
+      - name: Run latest-tag
+        uses: ./.github/actions/latest-tag
+        if: steps.latest-tag.outputs.SKIP_TAG != 'true'
+        with:
+          description: Superset latest release
+          tag-name: latest
+        env:
+          GITHUB_TOKEN: ${{ github.token }}

.github/workflows/license-check.yml

@@ -18,14 +18,14 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
       - name: Setup Java
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
         with:
-          distribution: 'temurin'
-          java-version: '11'
+          distribution: "temurin"
+          java-version: "11"
       - name: Run license check
         run: ./scripts/check_license.sh

.github/workflows/pr-lint.yml

@@ -8,6 +8,11 @@ on:
     # Possible values: https://help.github.com/en/actions/reference/events-that-trigger-workflows#pull-request-event-pull_request
     types: [opened, edited, reopened, synchronize]
 
+# cancel previous workflow jobs for PRs
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   lint-check:
     runs-on: ubuntu-24.04
@@ -16,7 +21,7 @@ jobs:
       pull-requests: write
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
@@ -26,6 +31,5 @@ jobs:
           on-failed-regex-fail-action: true
           on-failed-regex-request-changes: false
           on-failed-regex-create-review: false
-          on-failed-regex-comment:
-            "Please format your PR title to match: `%regex%`!"
+          on-failed-regex-comment: "Please format your PR title to match: `%regex%`!"
           repo-token: "${{ github.token }}"

.github/workflows/pre-commit.yml

@@ -19,12 +19,16 @@ concurrency:
 jobs:
   pre-commit:
     runs-on: ubuntu-24.04
+    timeout-minutes: 20
     strategy:
       matrix:
-        python-version: ["current", "previous", "next"]
+        # Run the full version spread on push (master/release) and nightly,
+        # but only the current version on PRs — lint/format/type results
+        # rarely differ across patch versions, so 3x per PR is wasteful.
+        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["current"]') || fromJSON('["current", "previous", "next"]') }}
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
@@ -44,7 +48,9 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version: '20'
+          node-version-file: "superset-frontend/.nvmrc"
+          cache: "npm"
+          cache-dependency-path: "superset-frontend/package-lock.json"
 
       - name: Install Frontend Dependencies
         run: |
@@ -68,7 +74,7 @@ jobs:
         id: changed_files
         uses: ./.github/actions/file-changes-action
         with:
-          output: ' '
+          output: " "
 
       - name: pre-commit
         env:

.github/workflows/release.yml

@@ -33,7 +33,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           # pulls all commits (needed for lerna / semantic release to correctly version)
@@ -52,7 +52,7 @@ jobs:
         if: env.HAS_TAGS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version-file: './superset-frontend/.nvmrc'
+          node-version-file: "./superset-frontend/.nvmrc"
 
       - name: Cache npm
         if: env.HAS_TAGS

.github/workflows/showtime-trigger.yml

@@ -10,11 +10,11 @@ on:
   workflow_dispatch:
     inputs:
       pr_number:
-        description: 'PR number to sync'
+        description: "PR number to sync"
         required: true
         type: number
       sha:
-        description: 'Specific SHA to deploy (optional, defaults to latest)'
+        description: "Specific SHA to deploy (optional, defaults to latest)"
         required: false
         type: string
 
@@ -152,7 +152,7 @@ jobs:
 
       - name: Checkout PR code (only if build needed)
         if: steps.auth.outputs.authorized == 'true' && steps.check.outputs.build_needed == 'true'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ steps.check.outputs.target_sha }}
           persist-credentials: false

.github/workflows/superset-app-cli.yml

@@ -41,7 +41,7 @@ jobs:
           - 16379:6379
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
@@ -61,7 +61,7 @@ jobs:
       - name: superset init
         if: steps.check.outputs.python
         run: |
-          pip install -e .
+          uv pip install --system -e .
           superset db upgrade
           superset load_test_users
       - name: superset load_examples

.github/workflows/superset-docs-deploy.yml

@@ -60,7 +60,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: "Checkout ${{ github.event.workflow_run.head_sha || github.sha }}"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.workflow_run.head_sha || github.sha }}
           persist-credentials: false
@@ -68,13 +68,13 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version-file: './docs/.nvmrc'
+          node-version-file: "./docs/.nvmrc"
       - name: Setup Python
         uses: ./.github/actions/setup-backend/
-      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
         with:
-          distribution: 'zulu'
-          java-version: '21'
+          distribution: "zulu"
+          java-version: "21"
       - name: Install Graphviz
         run: sudo apt-get install -y graphviz
       - name: Compute Entity Relationship diagram (ERD)

.github/workflows/superset-docs-verify.yml

@@ -28,12 +28,12 @@ jobs:
     name: Link Checking
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       # Do not bump this linkinator-action version without opening
       # an ASF Infra ticket to allow the new version first!
-      - uses: JustinBeckwith/linkinator-action@af984b9f30f63e796ae2ea5be5e07cb587f1bbd9  # v2.3
+      - uses: JustinBeckwith/linkinator-action@af984b9f30f63e796ae2ea5be5e07cb587f1bbd9 # v2.3
         continue-on-error: true # This will make the job advisory (non-blocking, no red X)
         with:
           paths: "**/*.md, **/*.mdx"
@@ -73,14 +73,14 @@ jobs:
         working-directory: docs
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version-file: './docs/.nvmrc'
+          node-version-file: "./docs/.nvmrc"
       - name: yarn install
         run: |
           yarn install --check-cache
@@ -112,7 +112,7 @@ jobs:
         working-directory: docs
     steps:
       - name: "Checkout PR head: ${{ github.event.workflow_run.head_sha }}"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.workflow_run.head_sha }}
           persist-credentials: false
@@ -120,7 +120,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version-file: './docs/.nvmrc'
+          node-version-file: "./docs/.nvmrc"
       - name: yarn install
         run: |
           yarn install --check-cache
@@ -131,7 +131,7 @@ jobs:
           run_id: ${{ github.event.workflow_run.id }}
           name: database-diagnostics
           path: docs/src/data/
-          if_no_artifact_found: 'warning'
+          if_no_artifact_found: "warning"
       - name: Use fresh diagnostics
         run: |
           if [ -f "src/data/databases-diagnostics.json" ]; then

.github/workflows/superset-e2e.yml

@@ -10,26 +10,49 @@ on:
   workflow_dispatch:
     inputs:
       use_dashboard:
-        description: 'Use Cypress Dashboard (true/false) [paid service - trigger manually when needed]. You MUST provide a branch and/or PR number below for this to work.'
+        description: "Use Cypress Dashboard (true/false) [paid service - trigger manually when needed]. You MUST provide a branch and/or PR number below for this to work."
         required: false
-        default: 'false'
+        default: "false"
       ref:
-        description: 'The branch or tag to checkout'
+        description: "The branch or tag to checkout"
         required: false
-        default: ''
+        default: ""
       pr_id:
-        description: 'The pull request ID to checkout'
+        description: "The pull request ID to checkout"
         required: false
-        default: ''
+        default: ""
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
 jobs:
+  changes:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      python: ${{ steps.check.outputs.python }}
+      frontend: ${{ steps.check.outputs.frontend }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Check for file changes
+        id: check
+        uses: ./.github/actions/change-detector/
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
   cypress-matrix:
+    needs: changes
+    if: (needs.changes.outputs.python == 'true' || needs.changes.outputs.frontend == 'true') && github.event.pull_request.draft == false
     # Somehow one test flakes on 24.04 for unknown reasons, this is the only GHA left on 22.04
     runs-on: ubuntu-22.04
+    timeout-minutes: 30
     permissions:
       contents: read
       pull-requests: read
@@ -40,9 +63,14 @@ jobs:
       # https://github.com/cypress-io/github-action/issues/48
       fail-fast: false
       matrix:
-        parallel_id: [0, 1, 2, 3, 4, 5]
+        parallel_id: [0, 1]
         browser: ["chrome"]
         app_root: ${{ github.event_name == 'push' && fromJSON('["", "/app/prefix"]') || fromJSON('[""]') }}
+        # The /app/prefix variant (push events only) is smoke-tested on a single
+        # shard rather than the full matrix, so exclude it from the other shards.
+        exclude:
+          - parallel_id: 1
+            app_root: "/app/prefix"
     env:
       SUPERSET_ENV: development
       SUPERSET_CONFIG: tests.integration_tests.superset_test_config
@@ -69,71 +97,60 @@ jobs:
       # Conditional checkout based on context
       - name: Checkout for push or pull_request event
         if: github.event_name == 'push' || github.event_name == 'pull_request'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
       - name: Checkout using ref (workflow_dispatch)
         if: github.event_name == 'workflow_dispatch' && github.event.inputs.ref != ''
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           ref: ${{ github.event.inputs.ref }}
           submodules: recursive
       - name: Checkout using PR ID (workflow_dispatch)
         if: github.event_name == 'workflow_dispatch' && github.event.inputs.pr_id != ''
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           ref: refs/pull/${{ github.event.inputs.pr_id }}/merge
           submodules: recursive
       # -------------------------------------------------------
-      - name: Check for file changes
-        id: check
-        uses: ./.github/actions/change-detector/
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Setup Python
         uses: ./.github/actions/setup-backend/
-        if: steps.check.outputs.python || steps.check.outputs.frontend
       - name: Setup postgres
-        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         with:
           run: setup-postgres
       - name: Import test data
-        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         with:
           run: testdata
       - name: Setup Node.js
-        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version-file: './superset-frontend/.nvmrc'
+          node-version-file: "./superset-frontend/.nvmrc"
+          cache: "npm"
+          cache-dependency-path: "superset-frontend/package-lock.json"
       - name: Install npm dependencies
-        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         with:
           run: npm-install
       - name: Build javascript packages
-        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         with:
           run: build-instrumented-assets
       - name: Install cypress
-        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         with:
           run: cypress-install
       - name: Run Cypress
-        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         env:
           CYPRESS_BROWSER: ${{ matrix.browser }}
           PARALLEL_ID: ${{ matrix.parallel_id }}
-          PARALLELISM: 6
+          PARALLELISM: 2
           CYPRESS_RECORD_KEY: ${{ secrets.CYPRESS_RECORD_KEY }}
           NODE_OPTIONS: "--max-old-space-size=4096"
         with:
@@ -154,7 +171,10 @@ jobs:
           name: cypress-artifact-${{ github.run_id }}-${{ github.job }}-${{ matrix.browser }}-${{ matrix.parallel_id }}--${{ steps.set-safe-app-root.outputs.safe_app_root }}
 
   playwright-tests:
+    needs: changes
+    if: needs.changes.outputs.python == 'true' || needs.changes.outputs.frontend == 'true'
     runs-on: ubuntu-22.04
+    timeout-minutes: 30
     permissions:
       contents: read
       pull-requests: read
@@ -187,71 +207,59 @@ jobs:
       # Conditional checkout based on context (same as Cypress workflow)
       - name: Checkout for push or pull_request event
         if: github.event_name == 'push' || github.event_name == 'pull_request'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
       - name: Checkout using ref (workflow_dispatch)
         if: github.event_name == 'workflow_dispatch' && github.event.inputs.ref != ''
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           ref: ${{ github.event.inputs.ref }}
           submodules: recursive
       - name: Checkout using PR ID (workflow_dispatch)
         if: github.event_name == 'workflow_dispatch' && github.event.inputs.pr_id != ''
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           ref: refs/pull/${{ github.event.inputs.pr_id }}/merge
           submodules: recursive
       # -------------------------------------------------------
-      - name: Check for file changes
-        id: check
-        uses: ./.github/actions/change-detector/
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Setup Python
         uses: ./.github/actions/setup-backend/
-        if: steps.check.outputs.python || steps.check.outputs.frontend
       - name: Setup postgres
-        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         with:
           run: setup-postgres
       - name: Import test data
-        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         with:
           run: playwright_testdata
       - name: Setup Node.js
-        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version-file: './superset-frontend/.nvmrc'
+          node-version-file: "./superset-frontend/.nvmrc"
+          cache: "npm"
+          cache-dependency-path: "superset-frontend/package-lock.json"
       - name: Install npm dependencies
-        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         with:
           run: npm-install
       - name: Build javascript packages
-        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         with:
           run: build-instrumented-assets
       - name: Build embedded SDK
-        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         with:
           run: build-embedded-sdk
       - name: Install Playwright
-        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         with:
           run: playwright-install
       - name: Run Playwright (Required Tests)
-        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         env:
           NODE_OPTIONS: "--max-old-space-size=4096"
@@ -273,3 +281,63 @@ jobs:
             ${{ github.workspace }}/superset-frontend/playwright-results/
             ${{ github.workspace }}/superset-frontend/test-results/
           name: playwright-artifact-${{ github.run_id }}-${{ github.job }}-${{ matrix.browser }}--${{ steps.set-safe-app-root.outputs.safe_app_root }}
+
+  # Stable required-status-check anchors. cypress-matrix and playwright-tests
+  # are matrix jobs gated on change detection (python || frontend). On a PR
+  # that touches neither — e.g. a docs-only PR — they are skipped at the job
+  # level, which happens before matrix expansion, so the per-combination
+  # contexts (`cypress-matrix (0, chrome)`, `playwright-tests (chromium)`) are
+  # never produced and branch protection waits on them forever. These
+  # always-running jobs report a single stable context that passes when the
+  # underlying matrix job succeeded or was skipped, and fails only on a real
+  # failure. Require these in .asf.yaml instead of the matrix-expanded names.
+  #
+  # A matrix job reads as "skipped" in two distinct cases, and only the first
+  # is a legitimate pass: (a) change detection succeeded and gated the job off
+  # (docs-only PR); (b) the `changes` job itself failed or was cancelled, in
+  # which case GHA skips its dependents too. Accepting (b) would let a broken
+  # change-detector report a false green, so each anchor first requires
+  # `changes` to have succeeded before honouring a skip.
+  cypress-matrix-required:
+    needs: [changes, cypress-matrix]
+    if: always()
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions: {}
+    steps:
+      - name: Check cypress-matrix result
+        env:
+          CHANGES: ${{ needs.changes.result }}
+          RESULT: ${{ needs.cypress-matrix.result }}
+        run: |
+          if [ "$CHANGES" != "success" ]; then
+            echo "change detection did not succeed (result: $CHANGES); refusing to pass on a skipped matrix"
+            exit 1
+          fi
+          if [ "$RESULT" != "success" ] && [ "$RESULT" != "skipped" ]; then
+            echo "cypress-matrix did not pass (result: $RESULT)"
+            exit 1
+          fi
+          echo "cypress-matrix result: $RESULT (changes: $CHANGES)"
+
+  playwright-tests-required:
+    needs: [changes, playwright-tests]
+    if: always()
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions: {}
+    steps:
+      - name: Check playwright-tests result
+        env:
+          CHANGES: ${{ needs.changes.result }}
+          RESULT: ${{ needs.playwright-tests.result }}
+        run: |
+          if [ "$CHANGES" != "success" ]; then
+            echo "change detection did not succeed (result: $CHANGES); refusing to pass on a skipped matrix"
+            exit 1
+          fi
+          if [ "$RESULT" != "success" ] && [ "$RESULT" != "skipped" ]; then
+            echo "playwright-tests did not pass (result: $RESULT)"
+            exit 1
+          fi
+          echo "playwright-tests result: $RESULT (changes: $CHANGES)"

.github/workflows/superset-extensions-cli.yml

@@ -20,15 +20,18 @@ concurrency:
 jobs:
   test-superset-extensions-cli-package:
     runs-on: ubuntu-24.04
+    timeout-minutes: 30
     strategy:
       matrix:
-        python-version: ["previous", "current", "next"]
+        # Full version spread on push (master/release) + nightly; current only
+        # on PRs to cut runner cost (cross-version breaks are caught at merge).
+        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["current"]') || fromJSON('["previous", "current", "next"]') }}
     defaults:
       run:
         working-directory: superset-extensions-cli
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
@@ -53,7 +56,7 @@ jobs:
 
       - name: Upload coverage reports to Codecov
         if: steps.check.outputs.superset-extensions-cli
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           file: ./coverage.xml
           flags: superset-extensions-cli

.github/workflows/superset-frontend.yml

@@ -22,11 +22,12 @@ permissions:
 jobs:
   frontend-build:
     runs-on: ubuntu-24.04
+    timeout-minutes: 30
     outputs:
       should-run: ${{ steps.check.outputs.frontend }}
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -74,6 +75,7 @@ jobs:
         shard: [1, 2, 3, 4, 5, 6, 7, 8]
       fail-fast: false
     runs-on: ubuntu-24.04
+    timeout-minutes: 20
     steps:
       - name: Download Docker Image Artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
@@ -103,11 +105,12 @@ jobs:
     needs: [sharded-jest-tests]
     if: needs.frontend-build.outputs.should-run == 'true'
     runs-on: ubuntu-24.04
+    timeout-minutes: 15
     permissions:
       id-token: write
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -131,7 +134,7 @@ jobs:
         run: npx nyc merge coverage/ merged-output/coverage-summary.json
 
       - name: Upload Code Coverage
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           flags: javascript
           use_oidc: true
@@ -144,6 +147,7 @@ jobs:
     needs: frontend-build
     if: needs.frontend-build.outputs.should-run == 'true'
     runs-on: ubuntu-24.04
+    timeout-minutes: 20
     steps:
       - name: Download Docker Image Artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
@@ -168,6 +172,7 @@ jobs:
     needs: frontend-build
     if: needs.frontend-build.outputs.should-run == 'true'
     runs-on: ubuntu-24.04
+    timeout-minutes: 20
     steps:
       - name: Download Docker Image Artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
@@ -187,6 +192,7 @@ jobs:
     needs: frontend-build
     if: needs.frontend-build.outputs.should-run == 'true'
     runs-on: ubuntu-24.04
+    timeout-minutes: 25
     steps:
       - name: Download Docker Image Artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8

.github/workflows/superset-helm-lint.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
@@ -33,7 +33,7 @@ jobs:
       - name: Setup Python
         uses: ./.github/actions/setup-backend/
         with:
-          install-superset: 'false'
+          install-superset: "false"
 
       - name: Set up chart-testing
         uses: ./.github/actions/chart-testing-action

.github/workflows/superset-helm-release.yml

@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ inputs.ref || github.ref_name }}
           persist-credentials: true

.github/workflows/superset-playwright.yml

@@ -10,23 +10,46 @@ on:
   workflow_dispatch:
     inputs:
       ref:
-        description: 'The branch or tag to checkout'
+        description: "The branch or tag to checkout"
         required: false
-        default: ''
+        default: ""
       pr_id:
-        description: 'The pull request ID to checkout'
+        description: "The pull request ID to checkout"
         required: false
-        default: ''
+        default: ""
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
 jobs:
+  changes:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      python: ${{ steps.check.outputs.python }}
+      frontend: ${{ steps.check.outputs.frontend }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Check for file changes
+        id: check
+        uses: ./.github/actions/change-detector/
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
   # NOTE: Required Playwright tests are in superset-e2e.yml (E2E / playwright-tests)
   # This workflow contains only experimental tests that run in shadow mode
   playwright-tests-experimental:
+    needs: changes
+    if: needs.changes.outputs.python == 'true' || needs.changes.outputs.frontend == 'true'
     runs-on: ubuntu-22.04
+    timeout-minutes: 30
     continue-on-error: true
     permissions:
       contents: read
@@ -60,78 +83,65 @@ jobs:
       # Conditional checkout based on context (same as Cypress workflow)
       - name: Checkout for push or pull_request event
         if: github.event_name == 'push' || github.event_name == 'pull_request'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
       - name: Checkout using ref (workflow_dispatch)
         if: github.event_name == 'workflow_dispatch' && github.event.inputs.ref != ''
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           ref: ${{ github.event.inputs.ref }}
           submodules: recursive
       - name: Checkout using PR ID (workflow_dispatch)
         if: github.event_name == 'workflow_dispatch' && github.event.inputs.pr_id != ''
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           ref: refs/pull/${{ github.event.inputs.pr_id }}/merge
           submodules: recursive
       # -------------------------------------------------------
-      - name: Check for file changes
-        id: check
-        uses: ./.github/actions/change-detector/
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Setup Python
         uses: ./.github/actions/setup-backend/
-        if: steps.check.outputs.python || steps.check.outputs.frontend
       - name: Setup postgres
-        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         with:
           run: setup-postgres
       - name: Import test data
-        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         with:
           run: playwright_testdata
       - name: Setup Node.js
-        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version-file: './superset-frontend/.nvmrc'
+          node-version-file: "./superset-frontend/.nvmrc"
+          cache: "npm"
+          cache-dependency-path: "superset-frontend/package-lock.json"
       - name: Install npm dependencies
-        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         with:
           run: npm-install
       - name: Build javascript packages
-        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         with:
           run: build-instrumented-assets
       - name: Build embedded SDK
-        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         with:
           run: build-embedded-sdk
       - name: Install Playwright
-        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         with:
           run: playwright-install
       - name: Run Playwright (Experimental Tests)
-        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         env:
           NODE_OPTIONS: "--max-old-space-size=4096"
         with:
           run: playwright-run "${{ matrix.app_root }}" experimental/
       - name: Run Playwright (Embedded Tests)
-        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         env:
           NODE_OPTIONS: "--max-old-space-size=4096"

.github/workflows/superset-python-integrationtest.yml

@@ -1,6 +1,11 @@
 # Python integration tests
 name: Python-Integration
 
+# Least-privilege default for GITHUB_TOKEN. Jobs that need more (e.g. OIDC for
+# codecov uploads) opt in via their own job-level `permissions:` block.
+permissions:
+  contents: read
+
 on:
   push:
     branches:
@@ -14,8 +19,30 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  test-mysql:
+  changes:
     runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      python: ${{ steps.check.outputs.python }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Check for file changes
+        id: check
+        uses: ./.github/actions/change-detector/
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+  test-mysql:
+    needs: changes
+    if: needs.changes.outputs.python == 'true'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
     permissions:
       id-token: write
     env:
@@ -27,6 +54,8 @@ jobs:
     services:
       mysql:
         image: mysql:8.0
+        # Authenticated pulls use our higher Docker Hub rate limit. Empty on
+        # fork PRs (secrets unavailable) -> runner falls back to anonymous.
         env:
           MYSQL_ROOT_PASSWORD: root
         ports:
@@ -43,41 +72,31 @@ jobs:
           - 16379:6379
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
-      - name: Check for file changes
-        id: check
-        uses: ./.github/actions/change-detector/
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Setup Python
         uses: ./.github/actions/setup-backend/
-        if: steps.check.outputs.python
       - name: Setup MySQL
-        if: steps.check.outputs.python
         uses: ./.github/actions/cached-dependencies
         with:
           run: setup-mysql
       - name: Start Celery worker
-        if: steps.check.outputs.python
         uses: ./.github/actions/cached-dependencies
         with:
           run: celery-worker
       - name: Python integration tests (MySQL)
-        if: steps.check.outputs.python
         run: |
           ./scripts/python_tests.sh
       - name: Upload code coverage
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           flags: python,mysql
           verbose: true
           use_oidc: true
           slug: apache/superset
       - name: Generate database diagnostics for docs
-        if: steps.check.outputs.python
         env:
           SUPERSET_CONFIG: tests.integration_tests.superset_test_config
           SUPERSET__SQLALCHEMY_DATABASE_URI: |
@@ -100,19 +119,23 @@ jobs:
               print(f'Generated diagnostics for {len(docs)} databases')
           "
       - name: Upload database diagnostics artifact
-        if: steps.check.outputs.python
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: database-diagnostics
           path: databases-diagnostics.json
           retention-days: 7
   test-postgres:
+    needs: changes
+    if: needs.changes.outputs.python == 'true'
     runs-on: ubuntu-24.04
+    timeout-minutes: 45
     permissions:
       id-token: write
     strategy:
       matrix:
-        python-version: ["current", "previous", "next"]
+        # Full version spread on push (master/release) + nightly; current only
+        # on PRs to cut runner cost (cross-version breaks are caught at merge).
+        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["current"]') || fromJSON('["current", "previous", "next"]') }}
     env:
       PYTHONPATH: ${{ github.workspace }}
       SUPERSET_CONFIG: tests.integration_tests.superset_test_config
@@ -134,37 +157,28 @@ jobs:
           - 16379:6379
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
-      - name: Check for file changes
-        id: check
-        uses: ./.github/actions/change-detector/
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Setup Python
         uses: ./.github/actions/setup-backend/
-        if: steps.check.outputs.python
         with:
           python-version: ${{ matrix.python-version }}
       - name: Setup Postgres
-        if: steps.check.outputs.python
         uses: ./.github/actions/cached-dependencies
         with:
           run: |
             setup-postgres
       - name: Start Celery worker
-        if: steps.check.outputs.python
         uses: ./.github/actions/cached-dependencies
         with:
           run: celery-worker
       - name: Python integration tests (PostgreSQL)
-        if: steps.check.outputs.python
         run: |
           ./scripts/python_tests.sh
       - name: Upload code coverage
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           flags: python,postgres
           verbose: true
@@ -172,7 +186,10 @@ jobs:
           slug: apache/superset
 
   test-sqlite:
+    needs: changes
+    if: needs.changes.outputs.python == 'true'
     runs-on: ubuntu-24.04
+    timeout-minutes: 45
     permissions:
       id-token: write
     env:
@@ -190,38 +207,51 @@ jobs:
           - 16379:6379
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
-      - name: Check for file changes
-        id: check
-        uses: ./.github/actions/change-detector/
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Setup Python
         uses: ./.github/actions/setup-backend/
-        if: steps.check.outputs.python
       - name: Install dependencies
-        if: steps.check.outputs.python
         uses: ./.github/actions/cached-dependencies
         with:
           run: |
             # sqlite needs this working directory
             mkdir ${{ github.workspace }}/.temp
       - name: Start Celery worker
-        if: steps.check.outputs.python
         uses: ./.github/actions/cached-dependencies
         with:
           run: celery-worker
       - name: Python integration tests (SQLite)
-        if: steps.check.outputs.python
         run: |
           ./scripts/python_tests.sh
       - name: Upload code coverage
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           flags: python,sqlite
           verbose: true
           use_oidc: true
           slug: apache/superset
+
+  # Stable required-status-check anchor for the matrix-based test-postgres job.
+  # It is gated on change detection, so on non-Python PRs it is skipped and
+  # never produces its `test-postgres (current)` context (a job-level skip
+  # happens before matrix expansion). This always-running job reports a single
+  # context branch protection can require: it passes when test-postgres
+  # succeeded or was skipped, and fails only on a real failure.
+  test-postgres-required:
+    needs: [changes, test-postgres]
+    if: always()
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Check test-postgres result
+        env:
+          RESULT: ${{ needs.test-postgres.result }}
+        run: |
+          if [ "$RESULT" != "success" ] && [ "$RESULT" != "skipped" ]; then
+            echo "test-postgres did not pass (result: $RESULT)"
+            exit 1
+          fi
+          echo "test-postgres result: $RESULT"

.github/workflows/superset-python-presto-hive.yml

@@ -15,8 +15,30 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  test-postgres-presto:
+  changes:
     runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      python: ${{ steps.check.outputs.python }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Check for file changes
+        id: check
+        uses: ./.github/actions/change-detector/
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+  test-postgres-presto:
+    needs: changes
+    if: needs.changes.outputs.python == 'true'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
     permissions:
       id-token: write
     env:
@@ -50,36 +72,25 @@ jobs:
           - 16379:6379
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
-      - name: Check for file changes
-        id: check
-        uses: ./.github/actions/change-detector/
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Setup Python
         uses: ./.github/actions/setup-backend/
-        if: steps.check.outputs.python == 'true'
       - name: Setup Postgres
-        if: steps.check.outputs.python
         uses: ./.github/actions/cached-dependencies
         with:
-          run: |
-            echo "${{ steps.check.outputs.python }}"
-            setup-postgres
+          run: setup-postgres
       - name: Start Celery worker
-        if: steps.check.outputs.python
         uses: ./.github/actions/cached-dependencies
         with:
           run: celery-worker
       - name: Python unit tests (PostgreSQL)
-        if: steps.check.outputs.python
         run: |
           ./scripts/python_tests.sh -m 'chart_data_flow or sql_json_flow'
       - name: Upload code coverage
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           flags: python,presto
           verbose: true
@@ -87,7 +98,10 @@ jobs:
           slug: apache/superset
 
   test-postgres-hive:
+    needs: changes
+    if: needs.changes.outputs.python == 'true'
     runs-on: ubuntu-24.04
+    timeout-minutes: 45
     permissions:
       id-token: write
     env:
@@ -113,44 +127,32 @@ jobs:
           - 16379:6379
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
-      - name: Check for file changes
-        id: check
-        uses: ./.github/actions/change-detector/
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Create csv upload directory
-        if: steps.check.outputs.python
         run: sudo mkdir -p /tmp/.superset/uploads
       - name: Give write access to the csv upload directory
-        if: steps.check.outputs.python
         run: sudo chown -R $USER:$USER /tmp/.superset
       - name: Start hadoop and hive
-        if: steps.check.outputs.python
         run: docker compose -f scripts/databases/hive/docker-compose.yml up -d
       - name: Setup Python
         uses: ./.github/actions/setup-backend/
-        if: steps.check.outputs.python
       - name: Setup Postgres
-        if: steps.check.outputs.python
         uses: ./.github/actions/cached-dependencies
         with:
           run: setup-postgres
       - name: Start Celery worker
-        if: steps.check.outputs.python
         uses: ./.github/actions/cached-dependencies
         with:
           run: celery-worker
       - name: Python unit tests (PostgreSQL)
-        if: steps.check.outputs.python
         run: |
-          pip install -e .[hive]
+          uv pip install --system -e .[hive]
           ./scripts/python_tests.sh -m 'chart_data_flow or sql_json_flow'
       - name: Upload code coverage
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           flags: python,hive
           verbose: true

.github/workflows/superset-python-unittest.yml

@@ -1,6 +1,11 @@
 # Python unit tests
 name: Python-Unit
 
+# Least-privilege default for GITHUB_TOKEN. Jobs that need more (e.g. OIDC for
+# codecov uploads) opt in via their own job-level `permissions:` block.
+permissions:
+  contents: read
+
 on:
   push:
     branches:
@@ -15,40 +20,56 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  unit-tests:
+  changes:
     runs-on: ubuntu-24.04
+    timeout-minutes: 10
     permissions:
-      id-token: write
-    strategy:
-      matrix:
-        python-version: ["previous", "current", "next"]
-    env:
-      PYTHONPATH: ${{ github.workspace }}
+      contents: read
+      pull-requests: read
+    outputs:
+      python: ${{ steps.check.outputs.python }}
     steps:
-      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-          submodules: recursive
       - name: Check for file changes
         id: check
         uses: ./.github/actions/change-detector/
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
+
+  unit-tests:
+    needs: changes
+    if: needs.changes.outputs.python == 'true'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    permissions:
+      id-token: write
+    strategy:
+      matrix:
+        # Full version spread on push (master/release) + nightly; current only
+        # on PRs to cut runner cost (cross-version breaks are caught at merge).
+        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["current"]') || fromJSON('["previous", "current", "next"]') }}
+    env:
+      PYTHONPATH: ${{ github.workspace }}
+    steps:
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          submodules: recursive
       - name: Setup Python
         uses: ./.github/actions/setup-backend/
-        if: steps.check.outputs.python
         with:
           python-version: ${{ matrix.python-version }}
       - name: Python unit tests
-        if: steps.check.outputs.python
         env:
           SUPERSET_TESTENV: true
           SUPERSET_SECRET_KEY: not-a-secret
         run: |
           pytest --durations-min=0.5 --cov-report= --cov=superset ./tests/common ./tests/unit_tests --cache-clear --maxfail=50
       - name: Python 100% coverage unit tests
-        if: steps.check.outputs.python
         env:
           SUPERSET_TESTENV: true
           SUPERSET_SECRET_KEY: not-a-secret
@@ -56,9 +77,31 @@ jobs:
           pytest --durations-min=0.5 --cov=superset/sql/ ./tests/unit_tests/sql/ --cache-clear --cov-fail-under=100
           pytest --durations-min=0.5 --cov=superset/semantic_layers/ ./tests/unit_tests/semantic_layers/ --cache-clear --cov-fail-under=100
       - name: Upload code coverage
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           flags: python,unit
           verbose: true
           use_oidc: true
           slug: apache/superset
+
+  # Stable required-status-check anchor. `unit-tests` is a matrix job gated on
+  # change detection, so on non-Python PRs it is skipped and never produces its
+  # `unit-tests (current)` context (a job-level skip happens before matrix
+  # expansion). This always-running job reports a single context that branch
+  # protection can require: it passes when unit-tests succeeded or was skipped,
+  # and fails only on a real failure.
+  unit-tests-required:
+    needs: [changes, unit-tests]
+    if: always()
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Check unit-tests result
+        env:
+          RESULT: ${{ needs.unit-tests.result }}
+        run: |
+          if [ "$RESULT" != "success" ] && [ "$RESULT" != "skipped" ]; then
+            echo "unit-tests did not pass (result: $RESULT)"
+            exit 1
+          fi
+          echo "unit-tests result: $RESULT"

.github/workflows/superset-translations.yml

@@ -25,7 +25,7 @@ jobs:
       pull-requests: read
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
@@ -40,7 +40,9 @@ jobs:
         if: steps.check.outputs.frontend
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version-file:  './superset-frontend/.nvmrc'
+          node-version-file: "./superset-frontend/.nvmrc"
+          cache: "npm"
+          cache-dependency-path: "superset-frontend/package-lock.json"
       - name: Install dependencies
         if: steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
@@ -59,7 +61,7 @@ jobs:
       pull-requests: read
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive

.github/workflows/superset-websocket.yml

@@ -22,9 +22,10 @@ concurrency:
 jobs:
   app-checks:
     runs-on: ubuntu-24.04
+    timeout-minutes: 20
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Install dependencies

.github/workflows/supersetbot.yml

@@ -9,7 +9,7 @@ on:
   workflow_dispatch:
     inputs:
       comment_body:
-        description: 'Comment Body'
+        description: "Comment Body"
         required: true
         type: string
 
@@ -38,7 +38,7 @@ jobs:
             });
 
       - name: "Checkout ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 

.github/workflows/sync-requirements-for-python-dep-upgrade-pr.yml

@@ -0,0 +1,60 @@
+name: Sync requirements for Python dependency PRs
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+
+permissions:
+  contents: write
+  pull-requests: read
+
+jobs:
+  sync-python-dep-requirements:
+    # This action is limited for (1) PRs authored by Dependabot and (2) upstream repo due to write back to remote
+    if: github.repository == 'apache/superset' && github.event.pull_request.user.login == 'dependabot[bot]' && github.event.pull_request.head.repo.fork == false
+    runs-on: ubuntu-26.04
+    steps:
+      - name: Fetch Dependabot metadata
+        id: dependabot-metadata
+        shell: bash
+        env:
+          BRANCH_NAME: ${{ github.head_ref }}
+        run: |
+          # Get current branch name, extract the package ecosystem and return as GHA step output
+          packageEcosystem=$(echo "$BRANCH_NAME" | cut -d'/' -f2)
+          echo "package-ecosystem=$packageEcosystem" >> $GITHUB_OUTPUT
+
+      # zizmor: ignore[artipacked] - required persisted credentials to push synced requirement changes back to remote
+      - name: Checkout source code
+        if: ${{ steps.dependabot-metadata.outputs.package-ecosystem == 'pip' }}
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: true
+
+      # Authenticate the Docker daemon so the python:slim pull in
+      # uv-pip-compile.sh uses our (much higher) authenticated rate limit
+      # instead of the shared-runner anonymous one.
+      - name: Login to Docker Hub
+        if: ${{ steps.dependabot-metadata.outputs.package-ecosystem == 'pip' }}
+        continue-on-error: true
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USER }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Sync requirements in containerized environment
+        if: ${{ steps.dependabot-metadata.outputs.package-ecosystem == 'pip' }}
+        run: ./scripts/uv-pip-compile.sh
+
+      - name: Push changes to remote PRs
+        if: ${{ steps.dependabot-metadata.outputs.package-ecosystem == 'pip' }}
+        run: |
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git add requirements
+          git diff --cached --quiet && exit 0
+          git commit --signoff --message "build(deps): sync pinned requirements for Dependabot pip PRs"
+          git push origin "HEAD:refs/heads/${GITHUB_EVENT_PULL_REQUEST_HEAD_REF}"
+        env:
+          GITHUB_EVENT_PULL_REQUEST_HEAD_REF: ${{ github.event.pull_request.head.ref }}

.github/workflows/tag-release.yml

@@ -16,11 +16,11 @@ on:
       force-latest:
         required: true
         type: choice
-        default: 'false'
+        default: "false"
         description: Whether to force a latest tag on the release
         options:
-          - 'true'
-          - 'false'
+          - "true"
+          - "false"
 permissions:
   contents: read
 
@@ -49,12 +49,12 @@ jobs:
       contents: write
     strategy:
       matrix:
-        build_preset: ["dev", "lean", "py310", "websocket", "dockerize", "py311", "py312"]
+        build_preset:
+          ["dev", "lean", "py310", "websocket", "dockerize", "py311", "py312"]
       fail-fast: false
     steps:
-
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -119,9 +119,8 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           fetch-depth: 0

.github/workflows/tech-debt.yml

@@ -32,14 +32,14 @@ jobs:
     name: Generate Reports
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version-file: './superset-frontend/.nvmrc'
+          node-version-file: "./superset-frontend/.nvmrc"
 
       - name: Install Dependencies
         run: npm ci

CHANGELOG.md

@@ -50,3 +50,4 @@ under the License.
 - [4.1.4](./CHANGELOG/4.1.4.md)
 - [5.0.0](./CHANGELOG/5.0.0.md)
 - [6.0.0](./CHANGELOG/6.0.0.md)
+- [6.1.0](./CHANGELOG/6.1.0.md)

CHATBOT_SIP.md

@@ -1,895 +0,0 @@
-Chatbot extensions
-Author: Enzo Martellucci
-Team: Preset
-Status: Draft | Under Review | Completed
-Day: May, 2026
-
-1. Introduction
-   This SIP proposes a new extension point that enables third-party chatbot integrations to be embedded directly into the Superset user interface through the existing extension framework.
-   The goal is to provide a stable, supported mechanism for chatbot providers to integrate with Superset without requiring direct access to internal application state, Redux stores, or implementation-specific frontend modules. Chatbot extensions should interact with Superset through the same extension-oriented principles already established for other extension surfaces, such as SQL Lab.
-   The proposal focuses on three core concerns:
-   • Defining how chatbot extensions are registered and rendered.
-   • Defining how chatbot extensions receive contextual information about the currently active application surface.
-   • Defining how administrators manage chatbot availability and select the active chatbot when multiple chatbot extensions are installed.
-   This SIP intentionally does not prescribe any specific chatbot implementation, user experience, LLM provider, or backend architecture.
-   1.1 Motivation
-   AI-powered assistants are becoming a common way for users to interact with analytical applications. Superset should provide a standardized extension mechanism that allows community-built chatbot integrations to participate in the platform without depending on internal frontend implementation details.
-   Today, chatbot integrations must either be embedded through custom application modifications or rely on unsupported access to internal application state. Both approaches create maintenance challenges and make integrations fragile when frontend architecture evolves.
-
-This SIP introduces a stable extension contract that:
-• Enables chatbot integrations to be distributed as standard Superset extensions.
-• Preserves separation between host and extension responsibilities.
-• Allows chatbot implementations to access contextual information about the current page and entity being viewed.
-• Keeps authorization and permission enforcement aligned with existing Superset APIs.
-• Remains compatible with future frontend architecture changes.
-1.2 Goals
-The goals of this SIP are:
-Introduce a dedicated chatbot extension point within the Superset application shell.
-Provide chatbot extensions with host-managed, permission-aligned page context.
-Establish stable extension-facing APIs for dashboard, explore, dataset, and navigation context.
-Support deployment-wide administration of chatbot availability and selection.
-Maintain isolation between chatbot implementations and Superset internals.
-Preserve compatibility with future extension capabilities and AI-related initiatives.
-1.3 Out of Scope
-The following capabilities are explicitly out of scope for this SIP.
-Client Actions and Agentic UI Manipulation
-This SIP defines how chatbot extensions are mounted and how they receive context from the host application.
-It does not define how a chatbot performs actions within the user interface, such as:
-• Modifying chart configuration.
-• Updating dashboard layouts.
-• Editing SQL queries.
-• Triggering frontend workflows.
-These capabilities are deferred to the proposed Client Actions SIP.
-Chatbot User Experience
-The chatbot user interface remains entirely owned by the extension.
-This SIP does not prescribe:
-• Visual design.
-• Conversation experience.
-• Streaming behavior.
-• Message persistence.
-• Prompting strategy.
-• Accessibility implementation details.
-• Branding or styling.
-LLM and Backend Infrastructure
-The following concerns remain extension-specific:
-• Model providers.
-• MCP implementations.
-• Agent frameworks.
-• Tool execution systems.
-• Prompt orchestration.
-• Backend services.
-Superset acts only as the host application and context provider.
-
-2. Requirements
-
-  2.1 Functional Requirements
-  Registration and Rendering
-  The platform must allow extensions to register chatbot providers through the standard extension system.
-  The host must:
-    • Support registration of chatbot extensions.
-    • Render a chatbot UI contributed by an extension.
-    • Maintain a single active chatbot instance at any given time.
-    • Make the chatbot available across supported application surfaces.
-    • Support fully custom chatbot user interfaces.
-
-Context Sharing
-The platform must provide chatbot extensions with contextual information about the user's current application state.
-At minimum, the host must expose:
-• Current page type (`home`, `dashboard`, `explore`, `sqllab`, `dataset`, `other`).
-• Dashboard context.
-• Explore/chart context.
-• Dataset identity context.
-• SQL Lab context.
-• Navigation events.
-The chatbot must be notified of relevant context changes without polling.
-Examples include:
-• Route changes.
-• Dashboard changes.
-• Chart changes.
-• Dataset changes.
-• Title changes.
-• Filter changes.
-Host-Owned Context
-Context exposed to extensions must be computed by the host application.
-Extensions must not be required to:
-• Read Redux state.
-• Access internal application modules.
-• Depend on component-level implementation details.
-• Reconstruct semantic context from frontend internals.
-Instead, extensions consume stable namespace APIs provided by the host.
-Conversation State
-The conversation state remains entirely owned by the chatbot extension.
-This includes:
-• Message history.
-• Tool execution state.
-• Streaming buffers.
-• Conversation persistence.
-• Session management.
-The host is responsible only for exposing contextual information.
-2.2 Non-Functional Requirements
-Security and Authorization
-Context shared with chatbot extensions must remain aligned with Superset's existing authorization model.
-The host must not expose:
-• Entities the current user cannot access.
-• Metadata outside the user's permission scope.
-• Datasource-derived information unavailable through existing APIs.
-Authorization remains enforced by backend APIs. The extension-facing APIs defined by this SIP operate on data that has already been scoped to the current user.
-Stable Extension Contracts
-Extension-facing APIs must remain independent of frontend implementation details.
-Extensions should rely on documented namespace contracts rather than:
-• Redux slices.
-• Internal selectors.
-• Component state.
-• Routing implementation details.
-This allows frontend architecture to evolve without breaking extensions.
-Performance
-The architecture must minimize impact on existing application performance.
-In particular:
-• Context APIs must avoid unnecessary application re-renders.
-• Context change notifications must not rely on polling.
-• Chatbot integrations should not introduce additional work for unrelated surfaces.
-Fault Isolation
-Failures within chatbot extensions must not affect the stability of the host application.
-Errors originating from third-party chatbot implementations should be isolated to the chatbot mount boundary.
-Extensibility
-The architecture should support future:
-• Application surfaces.
-• AI-related capabilities.
-• Extension APIs.
-• Context providers.
-without requiring redesign of the chatbot extension model.
-Vendor Neutrality
-The architecture must remain independent of any specific:
-• LLM provider.
-• AI platform.
-• Agent framework.
-• Backend implementation.
-
-3. Administration
-   3.1 Overview
-   Administrators can manage chatbot availability and select the active chatbot when multiple chatbot extensions are installed.
-   Administration is exposed through the existing Extensions management interface.
-   For chatbot extensions, administrators can:
-   • Enable or disable individual chatbot extensions.
-   • Select the default chatbot when multiple chatbot providers are available.
-   Only one chatbot may be active at a time.
-   3.2 Default Chatbot Selection
-   Extensions that contribute a chatbot view participate in a deployment-wide chatbot selection process.
-   The host discovers available chatbot candidates from the chatbot contribution location and allows administrators to designate a single active chatbot.
-
-When multiple chatbot extensions are installed:
-Administrators select the preferred chatbot.
-The host resolves the active chatbot using the configured selection.
-Only the selected chatbot is rendered.
-Changes are applied dynamically without requiring a page reload.
-3.3 Scope of Administration
-The administration model introduced by this SIP is deployment-wide.
-Administrative settings answer the question:
-"Which chatbot integrations are available within this Superset deployment?"
-They do not answer:
-"Which chatbot integrations does a specific user prefer to use?"
-This distinction is intentional.
-Deployment administrators determine which integrations are available across the environment, while user-specific preferences remain a separate concern.
-3.4 Future User Preferences
-Per-user chatbot preferences are considered an important future capability but are intentionally out of scope for this SIP.
-This proposal does not introduce user-scoped extension availability.
-Instead, future user preferences should be layered on top of deployment availability using the following model:
-Effective Availability = Deployment Availability AND User Preference
-The recommended persistence layer for future user preferences is the Extension Storage API, which provides user-scoped extension storage and aligns with the architecture established by SIP-127 (User Preferences).
-This separation preserves a clear distinction between:
-• Deployment configuration.
-• User customization.
-and avoids introducing multiple ownership models for extension availability.
-Consequently, this SIP focuses exclusively on deployment-wide administration and active chatbot selection. 4. Proposed Extension Point
-4.1 Overview
-This SIP introduces a single extension point that allows chatbot providers to integrate directly into the Superset application shell.
-Extension Point
-Contribution Location
-Registration API
-Cardinality
-Chatbot Bubble
-superset.chatbot
-views.registerView()
-Singleton
-
-The chatbot contribution point is application-wide and persists across supported Superset surfaces, including dashboards, Explore, SQL Lab, and dataset-related pages.
-Unlike most contribution locations, which allow multiple contributions to be rendered simultaneously, the chatbot location is intentionally exclusive and renders a single active provider.
-
-4.2 Chatbot Contribution Location
-Contribution Area
-The contribution location introduced by this SIP is:
-superset.chatbot
-The host provides a fixed mount point within the application shell and renders the active chatbot provider at that location.
-The mount point persists across route changes, allowing chatbot conversations and UI state to remain available while users navigate between application surfaces.
-The chatbot extension contributes a single React component representing the entire chatbot experience.
-Manifest Support
-The current contribution manifest schema is focused on SQL Lab contribution locations and does not provide an application-shell-level contribution scope.
-To support chatbot integrations, the manifest schema must be extended with an application-level contribution scope capable of declaring:
-{
-"views": {
-"app": [
-{
-"location": "superset.chatbot"
-}
-]
-}
-}
-This is a schema-level change and requires updates to both:
-• Manifest validation.
-• Runtime registration infrastructure.
-The runtime registration API alone is not sufficient because chatbot contributions must also be discoverable through extension manifests.
-4.3 Singleton Rendering Model
-The chatbot location is intentionally exclusive.
-Only one chatbot may be active at a time.
-This differs from other contribution locations that allow multiple views to be rendered simultaneously.
-Motivation
-Chatbot interactions are inherently conversational and user-focused.
-Rendering multiple chatbot providers simultaneously would:
-• Create competing user experiences.
-• Introduce ambiguity regarding which chatbot should respond.
-• Increase UI complexity.
-• Reduce discoverability.
-For these reasons, chatbot rendering is treated as a deployment-level selection rather than a multi-provider composition model.
-Resolution Rules
-The host applies the following behavior:
-Installed Chatbots
-Behavior
-None
-No chatbot is rendered
-One
-The chatbot is rendered automatically
-Multiple
-The administrator-selected chatbot is rendered
-
-The singleton policy is implemented entirely by the host.
-Extensions continue to register normally through the existing view registry.
-4.4 Provider Isolation
-A key architectural principle of this SIP is that extensions may discover registrations but may not invoke another extension's rendering logic.
-Public View Discovery
-The existing registry exposes:
-getViews(location);
-This API returns metadata describing registered views:
-interface View {
-id: string;
-name: string;
-description?: string;
-icon?: string;
-}
-The returned descriptors are intentionally passive metadata.
-They allow extensions and host components to:
-• Discover available contributions.
-• Display contribution information.
-• Populate administration interfaces.
-They do not allow rendering.
-Why Providers Are Not Exposed
-The view provider is executable rendering logic.
-If providers were exposed through the public registry:
-• Extensions could render another extension's UI.
-• Extensions could bypass host lifecycle management.
-• Extensions could circumvent fault-isolation boundaries.
-• Rendering ownership would become ambiguous.
-This would violate the separation between extension discovery and extension execution.
-For this reason:
-"Extensions may discover registered views, but only the host may render registered views."
-Host-Managed Resolution
-The host uses internal APIs to resolve the active chatbot provider.
-These APIs are not exposed through the public extension surface.
-Conceptually:
-const provider = getViewProvider("superset.chatbot", selectedId);
-The active chatbot is determined through a host-managed resolution policy:
-const chatbot = getActiveChatbot(adminSelectedId, enabledMap);
-This policy considers:
-• Enabled state.
-• Administrative selection.
-• Runtime settings.
-• Registration state.
-
-before rendering any provider.
-As a result, chatbot selection is implemented as a host-side rendering policy rather than a new registration primitive.
-4.5 Chatbot Lifecycle
-Host Responsibilities
-The host is responsible for:
-• Providing the chatbot mount point.
-• Resolving the active chatbot provider.
-• Loading chatbot extensions.
-• Managing chatbot lifecycle integration.
-• Handling activation and deactivation.
-• Maintaining fault isolation boundaries.
-• Preserving chatbot availability across route changes.
-• Providing context APIs defined by this SIP.
-The host also provides fixed positioning and layering behavior to ensure chatbot visibility remains consistent throughout the application.
-Fault Isolation
-Chatbot providers execute within a host-managed boundary.
-Failures originating from a chatbot extension must not affect the rest of the application.
-Examples include:
-• Module Federation loading failures.
-• Runtime exceptions.
-• Provider initialization errors.
-If a chatbot fails to load, the host logs the failure, surfaces an appropriate notification, and continues operating normally.
-The application shell remains functional even when the chatbot provider is unavailable.
-
-4.6 Extension Responsibilities
-The registered chatbot component owns the complete chatbot experience.
-The extension is responsible for:
-User Interface
-• Collapsed bubble UI.
-• Expanded panel UI.
-• Branding.
-• Icons and badges.
-• Layout.
-• Responsiveness.
-Interaction Model
-• Open and close behavior.
-• Keyboard shortcuts.
-• Focus management.
-• Accessibility behavior.
-• Conversation navigation.
-Conversation Runtime
-• Message history.
-• Streaming state.
-• Tool execution.
-• Persistence.
-• Session management.
-Backend Integration
-• LLM communication.
-• MCP integration.
-• Agent orchestration.
-• Tool invocation.
-The host does not manage any chatbot-specific runtime state.
-
-4.7 Registration Example
-Chatbot extensions register a single provider through the existing view registration API.
-import { views, type ExtensionContext } from '@apache-superset/core';
-import { ChatbotApp } from './ChatbotApp';
-
-export function activate(context: ExtensionContext) {
-const disposable = views.registerView(
-{
-id: 'acme.chatbot',
-name: 'Acme Chatbot',
-icon: 'Bubble',
-},
-'superset.chatbot',
-() => <ChatbotApp />,
-);
-context.subscriptions.push(disposable);
-}
-The registration process remains consistent with existing extension contribution patterns.
-The only difference is that the host applies singleton resolution before selecting the provider to render.
-
-4.8 Chatbot Descriptor Metadata
-Chatbot registrations may include an optional icon descriptor.
-{
-id: 'acme.chatbot',
-name: 'Acme Chatbot',
-icon: 'Bubble',
-}
-This metadata is used by:
-• Extension administration interfaces.
-• Chatbot selection interfaces.
-• Extension discovery surfaces.
-Design Decision
-The icon descriptor is treated as static registration metadata.
-Runtime UI state such as:
-• Notification indicators.
-• Unread counts.
-• Loading states.
-• Thinking indicators.
-belongs to the chatbot component itself rather than the registration descriptor.
-This keeps the registry simple while allowing chatbot implementations complete control over their user experience.
-If future requirements emerge for host-visible dynamic icon updates, that capability can be introduced independently without expanding the registration model defined by this SIP. 5. Context and Namespace Model
-5.1 Overview
-Chatbot extensions require access to contextual information about the user's current activity within Superset. This SIP introduces a namespace-based context model that allows extensions to consume stable, host-managed APIs rather than depending on internal frontend implementation details.
-The host exposes context through a set of surface-specific namespaces. Each namespace owns the context for a particular application surface and provides:
-• Synchronous state getters.
-• Event-based change notifications.
-• Stable extension-facing contracts.
-• Context aligned with the current user's authorized application view.
-Extensions consume these namespaces and compose them into higher-level context models tailored to their own use cases.
-5.2 Design Principles
-The namespace model is guided by the following principles.
-Stable Extension Contracts
-Extensions must depend on documented APIs rather than frontend implementation details.
-In particular, extensions must not depend on:
-• Redux slices.
-• Store shape.
-• Selectors.
-• Component-local state.
-• Routing implementation details.
-This allows Superset to evolve its frontend architecture without breaking extension integrations.
-Host-Owned Context Normalization
-The host is responsible for transforming application state into semantic extension-facing contracts.
-Extensions consume normalized context rather than deriving it from raw frontend state.
-Backend-Authorized Context
-Authorization remains a backend responsibility.
-Namespaces expose context that has already been scoped by backend APIs according to the current user's permissions.
-Namespaces do not implement authorization logic themselves and should not be considered security boundaries.
-Event-Driven Updates
-Context changes are propagated through events rather than polling.
-Extensions can subscribe to context updates and react immediately when relevant application state changes.
-5.3 Available Namespaces
-The following namespaces are available to chatbot extensions.
-Namespace
-Status
-Purpose
-sqlLab
-Existing
-SQL Lab context and events
-authentication
-Existing
-Current user and session context
-commands
-Existing
-Host actions and commands
-dashboard
-New
-Dashboard context
-explore
-New
-Explore/chart context
-dataset
-New
-Dataset identity context
-navigation
-New
-Routing and page context
-
-The new namespaces introduced by this SIP follow the same high-level contract pattern established by the existing sqlLab namespace.
-5.4 Namespace API Shape
-Each namespace follows a common structure:
-const current = namespace.getCurrent();
-const disposable = namespace.onDidChange((next) => {
-// react to updates
-});
-The exact contracts differ by surface, but every namespace provides:
-• One or more synchronous getters.
-• Event-based change notifications.
-• Stable semantic contracts.
-This pattern allows extensions to remain synchronized with application state without polling.
-
-5.5 Dashboard Namespace
-The dashboard namespace provides contextual information about the currently active dashboard.
-API
-dashboard.getCurrentDashboard();
-Contract
-interface DashboardContext {
-dashboardId: number;
-title: string;
-filters: FilterValue[];
-charts: ChartSummary[];
-}
-
-interface ChartSummary {
-chartId: number;
-chartName: string;
-vizType: string;
-datasourceId: number | null;
-datasourceName: string | null;
-isVisible: boolean;}
-The context includes:
-• Dashboard identity.
-• Active filter state.
-• Dashboard charts.
-• Per-chart visibility information.
-Returning all charts while exposing visibility allows chatbot implementations to answer both:
-• "Which charts are currently visible?"
-• "Find the chart named Revenue by Region."
-without requiring additional lookups.
-Normalization Requirements
-The namespace must expose semantic dashboard context rather than raw application state.
-For example:
-dashboard.getCurrentDashboard();
-returns a normalized contract rather than Redux slices or internal entities.
-This abstraction layer preserves compatibility as frontend implementation details evolve.
-Page-Type Guarding
-The getter returns undefined when the current page is not a dashboard.
-Conceptually:
-if (navigation.getPageType() !== "dashboard") {
-return undefined;
-}
-This prevents stale dashboard state from leaking across application surfaces.
-5.6 Explore Namespace
-The explore namespace provides context for the currently active Explore session.
-API
-explore.getCurrentChart();
-Contract
-interface ChartContext {
-chartId: number | null;
-chartName: string | null;
-datasourceId: number | null;
-datasourceName: string | null;
-vizType: string;
-}
-
-The namespace exposes:
-• Chart identity. `chartId` and `chartName` are null for a new, unsaved chart that has not yet been persisted.
-• Saved chart metadata (name, datasource, viz type)
-• Current Explore context: `vizType` reflects the type currently selected in the editor, so the value tracks the live session rather than only the last saved state.
-The contract is intentionally focused on chart-specific information relevant to chatbot integrations.
-Reflecting the live editing session — rather than reconstructing chart state from
-the route alone — is the primary reason this SIP exposes frontend context
-directly (see §6.2, Option C).
-
-Page-Type Guarding
-The getter returns undefined when the current page is not an Explore surface.
-Conceptually:
-if (navigation.getPageType() !== "explore") {
-return undefined;
-}
-This ensures the namespace reflects only active Explore context.
-5.7 Dataset Namespace
-The dataset namespace exposes the dataset currently being viewed or edited.
-API
-dataset.getCurrentDataset();
-Contract
-interface DatasetContext {
-datasetId: number;
-datasetName: string;
-schema: string | null;
-catalog: string | null;
-databaseName: string | null;
-isVirtual: boolean;}
-This contract is intentionally identity-focused.
-It answers:
-• Which dataset is currently in focus?
-• Is the dataset virtual or physical?
-• Which database and schema does it belong to?
-It does not expose:
-• Column definitions.
-• Lineage information.
-• Dataset dependencies.
-Those concerns are expected to be resolved by backend services using the dataset identifier.
-Producer-Backed Context
-Unlike dashboard and explore namespaces, dataset pages do not currently expose a shared source of truth suitable for namespace consumption.
-For this reason, dataset context is published by dataset pages through a host-managed producer mechanism.
-Dataset pages publish the active dataset as it loads, and:
-dataset.getCurrentDataset();
-returns the most recently published value.
-Until dataset information has been published, the getter returns:
-undefined;
-This design keeps the public contract stable without requiring the introduction of a dedicated Redux slice.
-
-Example Use Cases
-The dataset namespace enables chatbot workflows such as:
-• Explain this dataset.
-• Summarize this dataset's purpose.
-• Show lineage for this dataset.
-• Which charts depend on this dataset?
-The namespace provides the identity required to perform those lookups while avoiding duplication of backend metadata.
-5.8 Navigation Namespace
-The navigation namespace provides routing-related context.
-API
-navigation.getPageType();
-Events
-navigation.onDidChangePage(...)
-
-Contract
-type PageType =
-| "home"
-| "dashboard"
-| "explore"
-| "sqllab"
-| "dataset"
-| "other";
-The namespace answers a single question:
-"Which application surface is currently active?"
-It intentionally does not expose entity-specific information.
-Entity context remains owned by the corresponding surface namespace.
-Examples:
-dashboard.getCurrentDashboard();
-explore.getCurrentChart();
-dataset.getCurrentDataset();
-This separation preserves clear ownership boundaries and prevents duplication across namespaces.
-
-5.9 Context Composition
-This SIP intentionally does not introduce a host-owned aggregate context object.
-Instead, extensions compose the context they require from individual namespaces.
-For example:
-const pageContext = {
-pageType: navigation.getPageType(),
-dashboard: dashboard.getCurrentDashboard(),
-chart: explore.getCurrentChart(),
-dataset: dataset.getCurrentDataset(),
-sqlLab: sqlLab.getCurrentTab(),
-};
-The extension assembles a higher-level context tailored to its own requirements.
-The host remains responsible for:
-• Context ownership.
-• Context normalization.
-• Authorization alignment.
-The extension remains responsible for:
-• Context composition.
-• Prompt construction.
-• Application-specific interpretation.
-This separation avoids introducing a centralized context abstraction while allowing new surfaces to be added incrementally over time.
-
-5.10 Compatibility and Evolution
-Namespace contracts are part of the public Superset extension API surface.
-Breaking changes require standard compatibility and deprecation processes.
-Extensions should depend only on documented namespace contracts and must not rely on implementation details behind those contracts.
-As new application surfaces become extension-aware, additional namespaces may be introduced without affecting existing integrations.
-This additive model allows the extension ecosystem to evolve while preserving backward compatibility.
-
-6. Design Decisions
-   This section consolidates the key architectural decisions made by this SIP and summarizes the alternatives that were evaluated.
-   The goal is to capture the rationale behind the extension model so that future contributors can understand not only what was selected, but why alternative approaches were rejected.
-   6.1 Decision Summary
-   Decision
-   Topic
-   Selected Approach
-   D1
-   Page Context Model
-   Extension-composed context from host-provided namespaces
-   D2
-   Chatbot Resolution
-   Host-managed singleton resolution
-   D3
-   Descriptor Metadata
-   Static icon metadata
-   D4
-   Administration Scope
-   Deployment-wide administration
-   D5
-   Per-Page Visibility
-   Deferred - open question, see §8
-   D6
-   Generalized Floating Slots
-   Deferred - open question, see §8
-
-6.2 D1 — Page Context Model
-A central design question is how chatbot extensions obtain contextual information about the currently active application surface.
-Three approaches were considered.
-Option A — Host-Owned Aggregate Context
-The host exposes a single API:
-context.getPageContext();
-which returns a fully assembled context object containing dashboard, chart, dataset, navigation, and SQL Lab information.
-Rejected Because
-• The host becomes responsible for understanding every application surface.
-• The aggregate contract grows whenever a new surface is introduced.
-• Changes in any surface can trigger unnecessary recomputation.
-• The host becomes coupled to a single canonical context model.
-• Ownership boundaries become unclear over time.
-Option B — Surface Namespaces Composed by Extensions (Selected)
-The host exposes independent namespaces:
-• dashboard
-• explore
-• dataset
-• navigation
-• sqlLab
-Extensions compose these primitives into their own application-specific context.
-Advantages
-• Clear ownership boundaries.
-• Independent evolution of namespaces.
-• Additive extensibility.
-• Reduced coupling between surfaces.
-• Extensions subscribe only to the context they require.
-Option C — Route-Only Context
-The host exposes only routing information.
-Chatbot providers independently reconstruct context through APIs or backend services.
-Rejected Because
-This approach cannot reliably represent transient frontend state.
-Examples include:
-• Unsaved chart edits.
-• Temporary dashboard filters.
-• Active dashboard tabs.
-• SQL editor state.
-• Draft configuration changes.
-As a result, chatbot context would frequently drift from what the user is actually viewing.
-Decision
-Option B is selected.
-The host owns context normalization while extensions own context composition.
-This preserves separation of concerns, minimizes coupling, and provides a stable foundation for future extension capabilities.
-6.3 D2 — Singleton Chatbot Resolution
-When multiple chatbot extensions are installed, the host must determine which chatbot is rendered.
-This decision shapes both the rendering model and the extension isolation model.
-Option A — Expose Providers Through getViews()
-Allow:
-getViews(location);
-to return both metadata and rendering providers.
-Rejected Because
-Rendering providers are executable logic.
-Exposing providers would allow one extension to:
-• Render another extension.
-• Bypass host lifecycle management.
-• Circumvent fault isolation.
-• Assume ownership of another extension's UI.
-This violates a deliberate separation between extension discovery and extension execution.
-Option B — Host-Managed Provider Resolution (Selected)
-The host exposes only metadata publicly while retaining provider resolution internally.
-Conceptually:
-const provider = getViewProvider("superset.chatbot", selectedId);
-Chatbot selection is handled through a host-managed policy:
-const chatbot = getActiveChatbot(adminSelectedId, enabledMap);
-Advantages
-• Preserves extension isolation.
-• Preserves host ownership of rendering.
-• Supports administrative selection.
-• Supports enablement checks.
-• Supports future policy evolution.
-Option C — Reuse resolveView()
-Use the existing rendering helper:
-resolveView(id);
-to render chatbot providers.
-Rejected Because
-resolveView() assumes the caller already knows which view should be rendered.
-It does not account for:
-• Administrative selection.
-• Enablement state.
-• Settings synchronization.
-• Chatbot-specific resolution policy.
-Decision
-Option B is selected.
-The host owns chatbot selection and rendering.
-The registry remains a discovery mechanism rather than a rendering mechanism.
-Architectural Principle
-A core principle established by this SIP is:
-"Extensions may discover registered views, but only the host may render registered views."
-This preserves extension isolation and prevents cross-extension rendering dependencies.
-6.4 D3 — Descriptor Metadata Ownership
-Chatbot registrations may include metadata used by administrative and discovery interfaces.
-A key question is whether descriptor metadata should be static or runtime-updatable.
-
-Option A — Static Descriptor Metadata (Selected)
-Metadata is defined at registration time and remains unchanged for the lifetime of the registration.
-Example:
-{
-id: 'acme.chatbot',
-name: 'Acme Chatbot',
-icon: 'Bubble',
-}
-Advantages
-• Simpler registry implementation.
-• Clear ownership model.
-• Consistent administration UI.
-• No registry update lifecycle.
-Option B — Runtime-Updatable Metadata
-Extensions can update descriptor metadata after registration.
-Examples:
-• Notification badges.
-• Thinking indicators.
-• Dynamic branding.
-Rejected Because
-These states belong to the chatbot user interface rather than the registration descriptor.
-Supporting dynamic metadata would:
-• Increase registry complexity.
-• Introduce update synchronization concerns.
-• Provide limited benefit for current consumers.
-Decision
-Option A is selected.
-Descriptor metadata remains static.
-Dynamic UI state remains the responsibility of the chatbot component.
-Future requirements for dynamic metadata can be addressed independently if needed.
-6.5 D4 — Administration Scope
-This SIP introduces deployment-wide chatbot administration.
-A key question is whether availability should be deployment-scoped or user-scoped.
-Option A — Deployment-Wide Administration (Selected)
-Administrators manage:
-• Extension availability.
-• Default chatbot selection.
-These settings apply to the entire deployment.
-Advantages
-• Clear administrative ownership.
-• Simple operational model.
-• Consistent with existing extension administration patterns.
-• Avoids introducing multiple configuration layers.
-Option B — User-Scoped Availability
-Availability and chatbot selection become user-specific settings.
-Rejected Because
-Administrative availability and user preference represent different concerns.
-Administrators answer:
-"Which integrations are available in this deployment?"
-Users answer:
-"Which available integrations do I prefer?"
-Combining these concerns into a single model creates unclear ownership and duplicated configuration responsibilities.
-
-Decision
-Option A is selected.
-This SIP introduces only deployment-wide administration.
-Future user preferences should be layered on top using the following model:
-Effective Availability = Deployment Availability AND User Preference
-The recommended persistence mechanism for user-specific preferences is the Extension Storage API.
-This approach aligns with SIP-127 and preserves a clear separation between administrative configuration and user customization.
-
-7. Risks and Future Considerations
-The selected architecture introduces several tradeoffs.
-Namespace Maintenance
-As additional application surfaces become extension-aware, new namespaces may be required.
-This increases the maintenance burden of the extension API surface.
-Contract Evolution
-Namespace contracts are intended to be stable.
-Over time, extensions may require additional context that is not initially exposed.
-Future additions must preserve compatibility and avoid leaking implementation details.
-Context Growth
-Dashboard and chart context may become increasingly rich over time.
-Care must be taken to ensure context APIs remain focused and do not evolve into large aggregate objects.
-Extension Expectations
-Chatbot vendors may request direct access to internal application state for convenience.
-This SIP intentionally rejects that approach in favor of stable semantic contracts.
-Maintaining that boundary may require additional namespace evolution over time. 8. Open Questions
-D5 — Per-Page Visibility
-Should chatbot extensions be able to declare page visibility constraints?
-Two approaches remain possible.
-Extension-Controlled Visibility
-Extensions observe:
-navigation.onDidChangePage(...)
-and decide whether to render themselves.
-Host-Enforced Visibility
-Extensions declare supported page types through manifest metadata and the host enforces visibility.
-Recommendation
-Defer this decision.
-The current architecture already supports extension-controlled visibility without requiring additional platform capabilities.
-
-D6 — Generalized Floating Contribution Areas
-The current proposal introduces a chatbot-specific contribution location:
-superset.chatbot
-A future question is whether this should evolve into a more generic floating-widget framework.
-Examples might include:
-• Chatbots.
-• Guided tours.
-• Notification centers.
-• Productivity assistants.
-Recommendation
-Keep the contribution area chatbot-specific.
-If broader floating-widget requirements emerge, introduce a dedicated abstraction rather than expanding the scope of this SIP.
-
-9. Related Documents
-   Contribution types
-   Client actions
-
-The following proposals are related to this SIP.
-Extension Storage API
-Add storage API for extensions (#39171)
-Introduces namespace-isolated storage for extensions with support for:
-• Local storage.
-• Session storage.
-• Ephemeral server storage.
-• Persistent database-backed storage.
-This proposal is complementary to the administration model defined by this SIP and is the recommended foundation for future user-specific extension preferences.
-
-SIP-127 — User Preferences
-[SIP-127] User Preferences (#28047)
-Establishes the per-user preference model used by Superset core.
-The Extension Storage API serves as the extension-scoped equivalent of this pattern and provides the recommended approach for future user-specific chatbot preferences. 10. Migration Plan
-Base branch enxdev/chat-prototype
-Branch for testing test/chatbot-local
-The following capabilities are required to fully realize this SIP.
-Core Platform Changes
-Implemented
-• superset.chatbot contribution location.
-• Host-side chatbot resolution.
-• Administration UI for chatbot selection.
-• Dashboard namespace.
-• Explore namespace.
-• Navigation namespace.
-• Runtime settings synchronization.
-Pending
-• Dataset namespace implementation.
-• Dashboard chart visibility context.
-• Permission-scoped dashboard context endpoint.
-• Manifest support for application-level contribution scopes.
-• Optional descriptor icon support.
-
-11. Implementation Phases
-    Phase 1 — Chatbot Mount Point
-    • Chatbot contribution location.
-    • Host-side rendering.
-    • Lifecycle management.
-    • Fault isolation.
-    Status: Complete
-    Phase 2 — Administration
-    • Enable/disable support.
-    • Default chatbot selection.
-    • Runtime synchronization.
-    Status: Complete
-    Phase 3 — Context APIs
-    • Dashboard namespace.
-    • Explore namespace.
-    • Navigation namespace.
-    • Dataset namespace.
-    Status: Partially Complete
-    Remaining work:
-    • Dataset namespace.
-    • Dashboard chart visibility context.
-    • Dashboard context endpoint.
-    Phase 4 — Client Actions
-    Client actions and agentic UI interactions remain outside the scope of this SIP and are expected to be addressed through a separate proposal.

Dockerfile

@@ -29,7 +29,7 @@ ARG BUILD_TRANSLATIONS="false"
 ######################################################################
 # superset-node-ci used as a base for building frontend assets and CI
 ######################################################################
-FROM --platform=${BUILDPLATFORM} node:22-trixie-slim AS superset-node-ci
+FROM --platform=${BUILDPLATFORM} node:24-trixie-slim AS superset-node-ci
 ARG BUILD_TRANSLATIONS
 ENV BUILD_TRANSLATIONS=${BUILD_TRANSLATIONS}
 ARG DEV_MODE="false"           # Skip frontend build in dev mode
@@ -55,6 +55,13 @@ WORKDIR /app/superset-frontend
 RUN mkdir -p /app/superset/static/assets \
              /app/superset/translations
 
+# Harden `npm ci` against transient npm-registry network blips (e.g. ECONNRESET),
+# which otherwise fail the entire multi-platform image build with no retry.
+ENV npm_config_fetch_retries=5 \
+    npm_config_fetch_retry_mintimeout=20000 \
+    npm_config_fetch_retry_maxtimeout=120000 \
+    npm_config_fetch_timeout=600000
+
 # Mount package files and install dependencies if not in dev mode
 # NOTE: we mount packages and plugins as they are referenced in package.json as workspaces
 # ideally we'd COPY only their package.json. Here npm ci will be cached as long

Makefile

@@ -23,11 +23,14 @@ PYTHON=`command -v python3.11 || command -v python3.10`
 install: superset pre-commit
 
 superset:
+	# Bootstrap uv (the project's installer) into the active environment
+	pip install uv
+
 	# Install external dependencies
-	pip install -r requirements/development.txt
+	uv pip install -r requirements/development.txt
 
 	# Install Superset in editable (development) mode
-	pip install -e .
+	uv pip install -e .
 
 	# Create an admin user in your metadata database
 	superset fab create-admin \
@@ -52,11 +55,14 @@ superset:
 update: update-py update-js
 
 update-py:
+	# Bootstrap uv (the project's installer) into the active environment
+	pip install uv
+
 	# Install external dependencies
-	pip install -r requirements/development.txt
+	uv pip install -r requirements/development.txt
 
 	# Install Superset in editable (development) mode
-	pip install -e .
+	uv pip install -e .
 
 	# Initialize the database
 	superset db upgrade
@@ -79,7 +85,8 @@ activate:
 
 pre-commit:
 	# setup pre commit dependencies
-	pip3 install -r requirements/development.txt
+	pip install uv
+	uv pip install -r requirements/development.txt
 	pre-commit install
 
 format: py-format js-format

README.md

@@ -189,6 +189,11 @@ Try out Superset's [quickstart](https://superset.apache.org/docs/quickstart/) gu
 - [Join our community's Slack](http://bit.ly/join-superset-slack)
   and please read our [Slack Community Guidelines](https://github.com/apache/superset/blob/master/CODE_OF_CONDUCT.md#slack-community-guidelines)
 - [Join our dev@superset.apache.org Mailing list](https://lists.apache.org/list.html?dev@superset.apache.org). To join, simply send an email to [dev-subscribe@superset.apache.org](mailto:dev-subscribe@superset.apache.org)
+- Follow us on social media:
+  [X](https://x.com/apachesuperset) |
+  [LinkedIn](https://www.linkedin.com/company/apache-superset) |
+  [Bluesky](https://bsky.app/profile/apachesuperset.bsky.social) |
+  [Reddit](https://reddit.com/r/apache-superset)
 - If you want to help troubleshoot GitHub Issues involving the numerous database drivers that Superset supports, please consider adding your name and the databases you have access to on the [Superset Database Familiarity Rolodex](https://docs.google.com/spreadsheets/d/1U1qxiLvOX0kBTUGME1AHHi6Ywel6ECF8xk_Qy-V9R8c/edit#gid=0)
 - Join Superset's Town Hall and [Operational Model](https://preset.io/blog/the-superset-operational-model-wants-you/) recurring meetings. Meeting info is available on the [Superset Community Calendar](https://superset.apache.org/community)
 

RESOURCES/INTHEWILD.yaml

@@ -83,6 +83,9 @@ categories:
     - name: Clark.de
       url: https://clark.de/
 
+    - name: Cover Genius
+      url: https://covergenius.com/
+
     - name: EnquiryLabs
       url: https://www.enquirylabs.co.uk
 
@@ -92,6 +95,10 @@ categories:
     - name: KarrotPay
       url: https://www.daangnpay.com/
 
+    - name: NICE Actimize
+      url: https://www.niceactimize.com/
+      contributors: ["@stevensuting"]
+
     - name: Remita
       url: https://remita.net
       contributors: ["@mujibishola"]
@@ -112,9 +119,6 @@ categories:
       url: https://xendit.co/
       contributors: ["@LieAlbertTriAdrian"]
 
-    - name: Cover Genius
-      url: https://covergenius.com/
-
   Gaming:
     - name: Popoko VM Games Studio
       url: https://popoko.live
@@ -296,7 +300,6 @@ categories:
       logo: hifadih.png
       contributors: ["@saintLaurent00"]
 
-    # Logo approved by @anmol-hpe on behalf of HPE
     - name: HPE
       url: https://www.hpe.com/in/en/home.html
       logo: hpe.png
@@ -396,6 +399,10 @@ categories:
       url: https://www.techaudit.info
       contributors: ["@ETselikov"]
 
+    - name: Tech Solution
+      url: https://www.tech-solution.com.ar/
+      contributors: ["@danteGiuliano", "@LeandroVallejos", "@McJaben", "@xJeree", "@zeo-return-null"]
+
     - name: Tenable
       url: https://www.tenable.com
       contributors: ["@dflionis"]
@@ -425,6 +432,10 @@ categories:
       logo: userguiding.svg
       contributors: ["@tzercin"]
 
+    - name: Value Ad
+      url: https://bestpair.info/
+      contributors: ["@stevensuting"]
+
     - name: Virtuoso QA
       url: https://www.virtuosoqa.com
 
@@ -509,10 +520,6 @@ categories:
       url: https://www.sunbird.org/
       contributors: ["@eksteporg"]
 
-    - name: The GRAPH Network
-      url: https://thegraphnetwork.org/
-      contributors: ["@fccoelho"]
-
     - name: Udemy
       url: https://www.udemy.com/
       contributors: ["@sungjuly"]
@@ -521,7 +528,24 @@ categories:
       url: https://www.vipkid.com.cn/
       contributors: ["@illpanda"]
 
-    - name: WikiMedia Foundation
+  Social Organization:
+    - name: Living Goods
+      url: https://www.livinggoods.org
+      contributors: ["@chelule"]
+
+    - name: One Acre Fund
+      url: https://oneacrefund.org/
+      contributors: ["@stevensuting"]
+
+    - name: Quest Alliance
+      url: https://www.questalliance.net/
+      contributors: ["@stevensuting"]
+
+    - name: The GRAPH Network
+      url: https://thegraphnetwork.org/
+      contributors: ["@fccoelho"]
+
+    - name: Wikimedia Foundation
       url: https://wikimediafoundation.org
       contributors: ["@vg"]
 
@@ -534,6 +558,10 @@ categories:
       url: https://www.douroeci.com/
       contributors: ["@nunohelibeires"]
 
+    - name: Rogow
+      url: https://rogow.com.br/
+      contributors: ["@nilmonto"]
+
     - name: Safaricom
       url: https://www.safaricom.co.ke/
       contributors: ["@mmutiso"]
@@ -546,11 +574,10 @@ categories:
       url: https://wattbewerb.de/
       contributors: ["@wattbewerb"]
 
-    - name: Rogow
-      url: https://rogow.com.br/
-      contributors: ["@nilmonto"]
-
   Healthcare:
+    - name: 2070Health
+      url: https://2070health.com/
+
     - name: Amino
       url: https://amino.com
       contributors: ["@shkr"]
@@ -563,10 +590,6 @@ categories:
       url: https://www.getcare.io/
       contributors: ["@alandao2021"]
 
-    - name: Living Goods
-      url: https://www.livinggoods.org
-      contributors: ["@chelule"]
-
     - name: Maieutical Labs
       url: https://maieuticallabs.it
       contributors: ["@xrmx"]
@@ -585,10 +608,10 @@ categories:
     - name: WeSure
       url: https://www.wesure.cn/
 
-    - name: 2070Health
-      url: https://2070health.com/
-
   HR / Staffing:
+    - name: bluquist
+      url: https://bluquist.com/
+
     - name: Swile
       url: https://www.swile.co/
       contributors: ["@PaoloTerzi"]
@@ -596,21 +619,18 @@ categories:
     - name: Symmetrics
       url: https://www.symmetrics.fyi
 
-    - name: bluquist
-      url: https://bluquist.com/
-
   Government:
     - name: City of Ann Arbor, MI
       url: https://www.a2gov.org/
       contributors: ["@sfirke"]
 
+    - name: NRLM - Sarathi, India
+      url: https://pib.gov.in/PressReleasePage.aspx?PRID=1999586
+
     - name: RIS3 Strategy of CZ, MIT CR
       url: https://www.ris3.cz/
       contributors: ["@RIS3CZ"]
 
-    - name: NRLM - Sarathi, India
-      url: https://pib.gov.in/PressReleasePage.aspx?PRID=1999586
-
   Mobile Software:
     - name: VLMedia
       url: https://www.vlmedia.com.tr

SECURITY.md

@@ -109,7 +109,7 @@ If yes, it is in scope. If no, it is out of scope. The lists below apply that te
 - Any action an Admin role can perform through documented configuration, API, or UI. The Admin role is a trusted operational principal by policy. Per MITRE CNA Operational Rules 4.1, a qualifying vulnerability must violate a security policy; behavior within a documented trust boundary does not.
 - Deployment or operator decisions: the values of secrets and tokens, whether internal networks are reachable from the server, which database connectors or cache backends are enabled, which feature flags are set, where notifications are delivered, and which third-party plugins are loaded.
 - Compromise, modification, or malicious control of trusted backend infrastructure. Apache Superset assumes the integrity of its metastore, cache backends (for example Redis or Memcached), message brokers, secret stores, and other operator-managed infrastructure. Findings that require an attacker to read from, write to, or otherwise tamper with these systems, including injecting malicious state, serialized objects, cache entries, task metadata, configuration, or database records, are post-compromise scenarios and do not constitute vulnerabilities in Apache Superset itself. A finding remains in scope only if an unprivileged user can cause such modification through a vulnerability in Apache Superset.
-- Code paths whose intended purpose is example data, demos, fixtures, local development, or documentation, rather than the production runtime.
+- The continued presence of expired key-value or metastore-cache entries that have not yet been deleted from the metadata database. Such entries are excluded from reads once expired, are purged opportunistically on write, and are removed in bulk by the scheduled `prune_key_value` maintenance task; their lingering until purged is an eventual-cleanup property, not a security boundary, and does not constitute a vulnerability.
 - How a downstream application (spreadsheet program, email client, browser handling user-downloaded files) interprets output Apache Superset produced for it.
 - Findings without a reproducible proof of concept against a supported release. The burden of demonstrating exploitability rests with the reporter; findings closed for lack of a proof of concept may be refiled if one is later produced.
 - Brute force, rate limiting, denial of service, or resource exhaustion that does not bypass a documented control.

TICKETS.md

@@ -1,322 +0,0 @@
-# Chatbot Extensions — Tickets
-
-Lightweight, pre-implementation tickets. Each says what to build and where the
-boundaries are; it does not prescribe the final code. Stack order (bottom → top):
-contribution point → frontend API mount → eager loading → admin UI → backend
-settings/permissions → context sharing → import/delete.
-
----
-
-## 1. Define the contribution point
-
-**Goal:** Introduce the `superset.chatbot` contribution area and the host plumbing
-needed to mount a single chatbot at the application-shell level, persistent across
-routes. This is the keystone everything else builds on.
-
-**Build:**
-
-- Register `superset.chatbot` as a recognized contribution location in the view
-  registry.
-- Add an app-shell / app-root contribution scope to the extension manifest schema
-  so the location can be declared in `extension.json` (the current schema is
-  SQL-Lab-only). Teach both manifest validation and runtime registration about it.
-- Provide an exclusive-location resolver that selects exactly one renderable
-  chatbot for the slot, with a deterministic first-to-register fallback and a seam
-  for an externally supplied "active chatbot id" (so admin/runtime policy can plug
-  in later without touching the resolver).
-- Host-managed mount layout: fixed bottom-right, 24px margin, z-index above content
-  and toasts, below modals.
-
-**Out of scope:** fault isolation, admin selection UI, the lifecycle/teardown
-contract, eager loading, streaming, context namespaces, authoring docs.
-
-**Depends on:** nothing — this unblocks the rest.
-
-**Done when:** an extension can register at `superset.chatbot` and render at the
-app shell across routes; the resolver returns one provider (admin-id seam +
-first-to-register fallback); unregistering removes the mount cleanly with no
-duplicate bubbles.
-
-Base branch: `enxdev/chat-prototype`
-
-**External Links:** https://github.com/apache/superset/pull/40439
-
----
-
-## 2. Host resolution & mount (frontend API entry point)
-
-**Goal:** Turn a registered `superset.chatbot` view into a rendered, fault-isolated
-bubble — the host-internal provider accessor, the selection policy, and the
-fixed-position mount.
-
-**Build:**
-
-- Host-internal accessors on the views registry: `getViewProvider(location, id)`
-  and `getRegisteredViewIds(location)`. Keep the public `getViews` descriptor-only —
-  do not expose providers on the public surface.
-- A registry change subscription so a mount can re-resolve without polling (fired
-  on register/unregister).
-- The `getActiveChatbot(adminSelectedId?, enabledMap?)` resolver implementing the
-  selection policy: empty → none; drop disabled ids; admin-selected-and-enabled
-  wins; else first enabled in registration order.
-- A `ChatbotMount` component at the app shell that renders the active provider
-  inside the host `ErrorBoundary`, re-resolves on registry change, and renders
-  nothing when no chatbot is active.
-
-**Out of scope:** the contribution location itself (#40439); eager-loading the
-bundle (#40441); the settings endpoint (#40443, consumed here with silent
-fallback); admin UI; the lifecycle/teardown contract.
-
-**Depends on:** #40439 (imports `CHATBOT_LOCATION`). The settings endpoint is a soft
-forward-dependency — the mount falls back to first-registered-enabled if it 404s.
-
-**Done when:** the provider accessor and resolver behave per the policy; the mount
-renders/clears correctly and survives a throwing provider via `ErrorBoundary`;
-`getViews` stays descriptor-only.
-
-Base branch: `enxdev/feat/chatbot-contribution-point` (on #40439)
-
-**External Links:** https://github.com/apache/superset/pull/40440
-
----
-
-## 3. Eager loading & extension lifecycle/teardown
-
-> Merged: this ticket also covers the **lifecycle & teardown contract** — both are
-> implemented in the same PR (#40441), so they are tracked together.
-
-**Goal:** Boot extension bundles at app-shell startup so contributions register
-before the first route, and define the host contract for tearing those
-contributions down on uninstall.
-
-**Build — eager loading:**
-
-- An `ExtensionsStartup` component that, once the session is confirmed and behind
-  `FeatureFlag.EnableExtensions`, kicks off `initializeExtensions()` in the
-  background. The host renders immediately; the mount re-resolves reactively when
-  registrations land.
-- Wire `window.superset` so Module-Federation remotes can consume host namespaces.
-- Mount `<ChatbotMount />` as a sibling of the route switch, inside
-  `ExtensionsStartup`.
-- On bundle-load failure: a danger toast, host stays interactive, corner stays
-  empty. Add a global `unhandledrejection` logger (log only; do not suppress the
-  browser default).
-
-**Build — lifecycle/teardown contract (Model A1, per-contribution dispose):**
-
-- During the `./index` factory call, intercept the public registrars and collect
-  the returned `Disposable`s keyed by extension id.
-- `deactivateExtension(id)` is the single teardown entrypoint: it fires every
-  collected `Disposable` and removes the extension from the index. A throwing
-  `Disposable` must not block the others (catch per-disposable). Idempotent;
-  unknown id is a no-op.
-- Trigger semantics to document: **uninstall** → `deactivateExtension(id)`;
-  **disable** → mount filters by `enabledMap`, does NOT fire disposables, re-enable
-  needs no reload; **replace** (singleton) → resolver re-selects, the losing
-  extension is not deactivated. Disposal order is best-effort (registration order),
-  not a contract — consumers must be order-independent.
-
-**Out of scope:** selective per-type eager loading (not feasible without running the
-factory); the mount-boundary `ErrorBoundary` (#40440); the settings endpoint and
-its subscription primitive (#40443); context namespaces (#40444); an async-aware
-`deactivate(): Promise<void>` — file separately only if a graceful-flush
-requirement appears.
-
-**Depends on:** #40440 (`ChatbotMount`, resolver, registry-subscription hook). Soft
-build-time deps on #40443 (settings subscription) and #40444 (namespaces) — land
-those first or stub the imports.
-
-**Done when:** enabled extensions init once at startup behind the flag without
-gating initial render; the bubble appears reactively on registration;
-`deactivateExtension(id)` disposes all of an extension's contributions (per-disposable
-catch, idempotent); load failure toasts without throwing; teardown is verified
-end-to-end on the reference chatbot (including an abort-registry controller that must
-still abort on deactivate).
-
-Base branch: `enxdev/feat/chatbot-frontend-api` (on #40440)
-
-**External Links:** https://github.com/apache/superset/pull/40441
-
----
-
-## 4. Admin configuration UI
-
-**Goal:** Let an admin enable/disable the chatbot and, when more than one chatbot is
-installed, choose which is active.
-
-**Resolve before building:**
-
-- Is "disable the chatbot" the existing generic extension-disable, or a
-  chatbot-specific toggle? (Determines the ticket's size — prefer reusing the
-  existing flag.)
-- Where does the UI live? Default: the existing extensions management surface, not a
-  new page.
-- How does the "default chatbot" selection persist? Reuse existing extension-state
-  storage or a config value — do not invent a table.
-- Which permission gates it? Default: the existing Extensions-API write permission.
-
-**Build:**
-
-- Enable/disable control that empties the `superset.chatbot` slot when off (no broken
-  placeholder).
-- (Gated on the singleton-policy decision) A selection control listing candidates via
-  `getViews('superset.chatbot')`, activating the choice through the resolver, falling
-  back to first-to-register when unset.
-- Switching the active chatbot or disabling it at runtime must dispose the previously
-  active chatbot via its `Disposable` and release its in-flight stream readers (via
-  `AbortController`) — no two bubbles, no leaked readers.
-
-**Out of scope:** the singleton-policy decision itself; per-page visibility; the
-resolver implementation (consumed here).
-
-**Depends on:** #40440 (resolver) for selection; enable/disable does not wait on the
-policy decision.
-
-**Done when:** admin can enable/disable (gated by the chosen permission) and the slot
-empties when off; selection picks the active chatbot with first-to-register fallback;
-the persistence-mechanism and permission decisions are recorded in the ticket.
-
-Base branch: `enxdev/chat-prototype`
-
-**External Links:** https://github.com/apache/superset/pull/40442
-
----
-
-## 5. Permissions
-
-**Goal:** Guarantee the new page-context surface cannot expose anything the current
-user can't already access through Superset's standard security model. Chatbot
-extensions fetch data as any other frontend surface and inherit only the current
-user's privileges; this ticket covers only the new host → extension context-sharing
-path.
-
-**Build:**
-
-- The page-context namespaces (#40444) must derive entity metadata from the same
-  permission checks that gate the underlying page — not a raw Redux pass-through.
-- Canonical threat (SIP §2.1): a dashboard the user can view that contains a chart
-  whose dataset they cannot query — that chart's metadata (id, name, datasource,
-  viz type, form_data) must be dropped from the context payload.
-- Context carries only lightweight semantic data + identifiers that resolve through
-  already-protected APIs; never inline dataset rows or query results.
-- Filtering applies equally to the initial read and every change-notification
-  payload. A chatbot an admin has disabled receives no context at all.
-
-**Out of scope:** REST API authorization, RBAC, RLS (already enforced by Superset);
-LLM/backend auth; the singleton selection policy. The chatbot authenticates via the
-user's existing session (cookie + CSRF) — no separate credential is issued.
-
-**Depends on:** the Spike sizing the new namespaces (the per-getter filtering lands
-with those getters); the Context-sharing ticket consumes the filtered getters this
-one specifies.
-
-**Done when:** context never exposes entities/ids/metadata the user can't access
-(even via a manually-entered URL); the dashboard payload omits charts whose dataset
-the user can't query; no inline privileged payloads; filtering covers change events
-as well as the initial read; a disabled chatbot gets nothing.
-
-Base branch: `enxdev/chat-prototype`
-
-**External Links:** https://github.com/apache/superset/pull/40443
-
----
-
-## 6. Context sharing
-
-**Goal:** Let the chatbot read semantic page context and subscribe to changes through
-public per-surface core namespaces only — never the host Redux store.
-
-**Approach:** Deliver context through per-surface namespaces — the existing `sqlLab`
-namespace plus new `dashboard` / `explore` / `navigation` namespaces that mirror its
-shape (a state getter + an `Event<T>` change subscription). No new aggregate context
-API. The new namespaces copy `sqlLab`'s shape but must filter the Redux state they
-read (the permission filtering itself is specified by #40443).
-
-**Build:**
-
-- Route all chatbot page-context reads through one narrow adapter module with a fixed
-  interface — the adapter is the deliverable, not scattered call sites — so swapping
-  to core namespaces is a one-line change.
-- Back the adapter with `sqlLab` immediately; back the dashboard/explore/navigation
-  portions and wire change notifications through `navigation`'s page-change event once
-  those namespaces ship.
-
-**Out of scope:** the permission-filtering logic (#40443 + upstream namespace work);
-designing the namespace API surface (upstream OSS work, sized by the Spike).
-
-**Depends on:** a Spike to size the new namespaces (state getters + events + the
-per-getter permission filtering). The namespace _shape_ is settled by the `sqlLab`
-precedent; the filtering is real design work.
-
-**Done when:** all context reads go through the single adapter (zero direct Redux
-imports, greppable); SQL Lab context works today; dashboard/explore context is either
-delivered or explicitly tracked as OSS-blocked (not faked); change notifications need
-no polling; no extra host re-renders.
-
-Base branch: `enxdev/chat-prototype`
-
-**External Links:** https://github.com/apache/superset/pull/40444
-
----
-
-## 7. Import / delete UI
-
-**Goal:** Add an actions column to the extensions list with buttons to delete an
-extension, set-as-default (chatbot extensions only), and import a new extension.
-
-**Build:**
-
-- Import an extension bundle, refreshing the list on success.
-- Delete an installed extension.
-- A "set as default chatbot" control, shown only for chatbot extensions.
-
-**Out of scope:** the settings endpoint itself (#40443); the resolver (#40440).
-
-**Depends on:** #40442/#40443 for the settings + chatbot-selection plumbing.
-
-**Done when:** an admin can import, delete, and set a default chatbot from the
-actions column, with the list reflecting changes.
-
-Base branch: `enxdev/chat-prototype`
-
-**External Links:** https://github.com/apache/superset/pull/40450
-
----
-
-## ~~8. Fault isolation & error boundaries~~ — CLOSED (no ticket needed)
-
-The protective fault-isolation mechanisms are **already implemented** across the
-mount and eager-loading PRs, so no standalone ticket is required:
-
-- Render/lifecycle throw → host `ErrorBoundary` around the `superset.chatbot` slot
-  (#40440, reinforced by the `ChatbotRenderer` wrapper in #40441).
-- Bundle-load failure → `.catch()` + danger toast in `ExtensionsLoader` (#40441).
-- `activate()` throw → host try/catch in `ExtensionsLoader` (#40441).
-- Escaped async rejection → `unhandledrejection` hook in `ExtensionsStartup` (#40441).
-- Failed-activation cleanup → driven by `deactivateExtension` (ticket 3 / #40441).
-
-The host stays safe under every failure class today. The only unbuilt pieces were the
-**optional** "chatbot failed — Reload page" notification and structured
-failure-class/telemetry logging — both judged not worth a ticket (the original spec
-itself marked the reload notification "optional"). File a fresh ticket only if that
-UX is later wanted.
-
-(Original link, for reference only: PR #40433 `feat(extensions): adds chatbot P1-P2` —
-closed/superseded; never a dedicated fault-isolation PR.)
-
----
-
-## Notes on consolidation
-
-- **Lifecycle/teardown** was a separate ticket pointing at the same PR as **Eager
-  loading** (#40441) — merged into ticket 3 above. (This is the only true duplicate.)
-- The **Permissions** ticket (#40443) is kept as-is. Note its PR also contains
-  backend settings-persistence code, but the original ticket only ever scoped the
-  permission-safe context surface — so the ticket stays "Permissions" and no
-  persistence ticket is invented.
-- The **Permissions** ticket previously had a truncated base branch
-  (`enxdev/chat-protot`) — corrected to `enxdev/chat-prototype`.
-- **Fault isolation** was **closed without a ticket** (see the struck-through section
-  above): its protective mechanisms already shipped in #40440/#40441, and the only
-  unbuilt pieces (the optional "Reload page" notification + structured telemetry
-  logging) were judged not worth a ticket.

UPDATING.md

@@ -24,12 +24,180 @@ assists people when migrating to a new version.
 
 ## Next
 
+### Pivot table First/Last aggregations follow data order
+
+The pivot table chart's `First` and `Last` aggregations now return the first and last value in data (query result) order, instead of effectively returning the minimum and maximum. Existing pivot tables that use these aggregations for totals/subtotals may show different values after upgrading. For deterministic results, ensure the underlying query has a stable sort order.
+
+### `thumbnail_url` removed from dashboard list API response
+
+The `thumbnail_url` field has been removed from `GET /api/v1/dashboard/` list responses. External consumers relying on this field must now construct the thumbnail URL client-side using `id` and `changed_on_utc`:
+
+```
+/api/v1/dashboard/{id}/thumbnail/{changed_on_utc}/
+```
+
+The thumbnail endpoint redirects to the current digest URL regardless of whether the supplied digest is exact. If the image is not yet cached, that digest URL may return `202` and trigger async generation. Using `changed_on_utc` as the digest is sufficient for cache-busting purposes.
+
+### Webhook alerts/reports block private/internal hosts by default
+
+Webhook alert/report dispatch (`WebhookNotification.send`) now validates the target URL's host against the same private/internal-IP block applied to dataset import URLs. If the resolved host is in a loopback, link-local, private (RFC-1918), shared-CGNAT, or multicast range, the webhook is rejected with `NotificationParamException`.
+
+Deployments that intentionally point webhooks at internal targets (chatops bridges, internal automation servers, on-premises Mattermost/Rocket.Chat, etc.) can opt out by setting `ALERT_REPORTS_WEBHOOK_ALLOW_INTERNAL_HOSTS = True` in `superset_config.py`. This mirrors the existing `DATASET_IMPORT_ALLOW_INTERNAL_DATA_URLS` opt-out for dataset imports.
+
+### Impala cancel_query blocks private/internal hosts by default
+
+The Impala engine spec's `cancel_query` issues an HTTP request from the Superset backend to the host configured on the Impala database connection. That host is now validated before the request: if it resolves to a private/internal IP range, the cancel call is refused and a warning is logged. Operators whose Impala cluster runs on an internal network can opt out by setting `IMPALA_CANCEL_QUERY_ALLOW_INTERNAL_HOSTS = True` in `superset_config.py`. This mirrors the dataset-import and webhook opt-out flags.
+### Map chart renderer and OpenStreetMap migration behavior
+
+The MapLibre migration for deck.gl charts preserves saved non-Mapbox styles on
+the MapLibre-compatible path. Saved styles such as OpenStreetMap, `tile://`
+tile templates, generic HTTPS style URLs, and charts without a saved style are
+not reclassified as Mapbox during migration and do not require
+`MAPBOX_API_KEY` only because of the migration.
+
+Saved true Mapbox styles whose value starts with `mapbox://` remain
+Mapbox-backed. If a Superset deployment does not configure `MAPBOX_API_KEY`,
+those saved Mapbox charts keep the existing missing-key message instead of
+silently falling back to MapLibre or another provider. In Explore, deck.gl and
+point-cluster renderer controls preserve saved Mapbox state, but the Mapbox
+choice is not available as a new working renderer without a configured key.
+
+The MapLibre style choices include `Streets (OSM)`, backed by
+`https://tile.openstreetmap.org/{z}/{x}/{y}.png`. This OpenStreetMap tile
+service requires visible `© OpenStreetMap contributors` attribution and should
+be used through normal browser map tile requests and caching; it is not intended
+for bulk prefetch or offline tile downloads.
+
+### Password complexity policy enabled by default
+
+Superset now ships a default password-complexity policy, enforced (via Flask-AppBuilder) across self-registration, the user create/edit/reset forms, and the User REST API. The policy requires a minimum password length of 8 characters and rejects a built-in blocklist of common/guessable passwords.
+
+This is enabled by default (`FAB_PASSWORD_COMPLEXITY_ENABLED = True`), so new or reset passwords that are too short or appear in the blocklist will be rejected where they were previously accepted. Existing stored passwords are unaffected until they are next changed.
+
+Operators can tune or disable the policy via config:
+
+- `AUTH_PASSWORD_MIN_LENGTH` — minimum length (default `8`).
+- `AUTH_PASSWORD_COMMON_BLOCKLIST` — extra passwords to reject, in addition to the built-in list.
+- `FAB_PASSWORD_COMPLEXITY_VALIDATOR` — replace with your own callable for custom rules.
+- `FAB_PASSWORD_COMPLEXITY_ENABLED = False` — disable enforcement entirely.
+
+### Data uploads bounded by UPLOAD_MAX_FILE_SIZE_BYTES
+
+Single data-file uploads (CSV, Excel, columnar) are now bounded by the `UPLOAD_MAX_FILE_SIZE_BYTES` config option, which defaults to `100 * 1024 * 1024` (100 MB). Files larger than this are rejected with a `413` before their contents are buffered into memory. Set `UPLOAD_MAX_FILE_SIZE_BYTES = None` to disable the check and restore unbounded uploads.
+
+### Duration formatter precision
+
+The `DURATION` number formatter now uses `Intl.DurationFormat` for locale-aware output. By default, sub-second fields are omitted, so values that previously displayed fractional seconds with `pretty-ms`, such as `10500` milliseconds rendering as `10.5s`, now render as `10s`.
+
+To preserve sub-second precision in custom duration formatters, enable `formatSubMilliseconds`.
+
+### Cache warmup authenticates via SUPERSET_CACHE_WARMUP_USER
+
+The `cache-warmup` Celery task now drives a real WebDriver session for reliable authentication and reads the user to authenticate as from the new `SUPERSET_CACHE_WARMUP_USER` config option. It no longer consults `CACHE_WARMUP_EXECUTORS` for the warmup path. `SUPERSET_CACHE_WARMUP_USER` defaults to `None`, so the task fails fast with a clear message until you set it. Operators who previously relied on `CACHE_WARMUP_EXECUTORS` for cache warmup must set `SUPERSET_CACHE_WARMUP_USER` to a dedicated least-privilege user with access to the dashboards they want warmed up before the next warmup run.
+
+### YDB now uses a native sqlglot dialect
+
+YDB SQL parsing now relies on the dedicated [`ydb-sqlglot-plugin`](https://pypi.org/project/ydb-sqlglot-plugin/) dialect, which registers itself with sqlglot automatically. YDB users must install this plugin (e.g., via `pip install "apache-superset[ydb]"`) to avoid a `ValueError` when Superset parses YDB queries.
+
+### Embedded dashboards enforce configured Allowed Domains for postMessage
+
+The embedded dashboard page now validates the origin of incoming `postMessage` events against the dashboard's configured **Allowed Domains**. The server-rendered embedded page exposes the configured domains in its bootstrap payload, and the frontend rejects message events whose origin is not in that list.
+
+Enforcement only applies when the Allowed Domains list is non-empty. If the list is empty (the default), any origin is accepted, so there is no behavior change for embeds that did not configure Allowed Domains.
+
+### Default guest/async JWT secrets are rejected at startup
+
+Superset already refuses to start in production (non-debug, non-testing) when `SECRET_KEY` is left at its built-in default, and when `GUEST_TOKEN_JWT_SECRET` is left at its default while `EMBEDDED_SUPERSET` is enabled. This behavior is extended to `GLOBAL_ASYNC_QUERIES_JWT_SECRET`: if the `GLOBAL_ASYNC_QUERIES` feature flag is enabled and the secret is still the publicly known default (`test-secret-change-me`), Superset logs a clear error and refuses to start.
+
+As with the existing `SECRET_KEY` check, this only fails in production. In debug mode, testing mode, or under the test runner, a warning is logged instead of exiting, so local development is unaffected.
+
+To resolve the error, set a strong random value in `superset_config.py`:
+
+```python
+GLOBAL_ASYNC_QUERIES_JWT_SECRET = "<output of: openssl rand -base64 42>"
+```
+
+The check is only active when the relevant feature is enabled, so deployments that do not use global async queries (or embedding) are not affected.
+
+### Guest token revocation (opt-in)
+
+Embedded guest tokens can be coarsely revoked at runtime via a new opt-in mechanism. A new config flag `GUEST_TOKEN_REVOCATION_ENABLED` (default `False`) gates the feature. When enabled, every minted guest token carries a revocation version, and tokens whose version is below the current expected version (stored in the metadata database) are rejected at validation time.
+
+Bump the expected version with the new CLI command to invalidate all outstanding guest tokens:
+
+```bash
+superset revoke-guest-tokens
+```
+
+This change is backward compatible. The feature is off by default, and even when enabled nothing is revoked until an admin explicitly bumps the version: the expected version starts at `0`, and tokens minted before this change (which carry no version claim) are treated as version `0`. No database migration is required.
+
+### Sessions are terminated when an account is disabled
+
+Disabling a user account (setting `active` to `False`, via the admin UI, REST API, or CLI) now terminates that user's outstanding sessions on their next request, instead of relying on a passive check. This works for both client-side cookie sessions and server-side session stores via a per-user invalidation epoch (`user_attribute.sessions_invalidated_at`, added by a migration). The mechanism is inert for users that were never disabled (NULL epoch), so there is no behavior change for active users. Re-enabling an account and logging in again starts a fresh, valid session. The migration backfills the epoch for accounts that are already disabled at upgrade time, so re-enabling such an account does not revive a session that predates this feature.
+
+### Opt-in SSH tunnel server host key verification
+
+SSH tunnels can now optionally pin the expected SSH server host key as a defense-in-depth measure against man-in-the-middle attacks. paramiko's transport performs no known-hosts checking by default, so previously the SSH server's identity was not verified. This feature is opt-in and off by default; existing tunnels are unaffected.
+
+- A new nullable `server_host_key` column on the `ssh_tunnels` table stores the expected host key in authorized-key form (e.g. `ssh-ed25519 AAAA...`). It is a public key and is stored in plaintext. It can be set via the SSH tunnel POST/PUT payloads (`ssh_tunnel.server_host_key`).
+- When a tunnel has `server_host_key` set, Superset connects to the SSH server, reads the host key it presents, and rejects the tunnel if it does not match.
+- A new config flag `SSH_TUNNEL_STRICT_HOST_KEY_CHECKING` (default `False`) controls fail-closed behavior. When `True`, every tunnel must declare a `server_host_key`; a tunnel without one is rejected.
+
+Runbook to adopt:
+
+1. Capture the SSH server's host key, e.g. `ssh-keyscan -t ed25519 ssh.example.com` (verify it out-of-band).
+2. Set that value on the tunnel's `server_host_key` (via the database/SSH tunnel API or UI payload).
+3. Optionally set `SSH_TUNNEL_STRICT_HOST_KEY_CHECKING = True` in `superset_config.py` to require host-key verification on all tunnels.
+
 ### Dataset import validates catalog against the target connection
 
 Importing a dataset now validates the `catalog` field against the target database connection. When the connection has multi-catalog disabled (`allow_multi_catalog` off) and the dataset's catalog is not the connection's default catalog, the import fails instead of silently persisting the non-default catalog. This matches the validation already enforced on the dataset update path and prevents imported datasets from querying an unintended database.
 
 If you relied on importing datasets with a non-default catalog, enable "Allow changing catalogs" on the target connection, or set the dataset's catalog to the connection's default before importing.
 
+### Extension supply-chain controls (denylist + version policy)
+
+Two opt-in static gates control which extensions are allowed to load:
+
+- `EXTENSION_DENYLIST` refuses extensions matching an id (every version) or `id@version` (a single version), e.g. `["compromised-extension", "other-ext@1.2.3"]`.
+- `EXTENSION_VERSION_POLICY` enforces a minimum version per extension id, e.g. `{"acme.widget": "1.2.0"}` (PEP 440 comparison); a release below the minimum is refused.
+
+Both default to empty (no behavior change). They apply to both the `LOCAL_EXTENSIONS` and `EXTENSIONS_PATH` load paths.
+
+### Dynamic Group By respects the sort toggle for display values
+
+The Dynamic Group By chart customization now orders its display values according to the "Sort display control values" toggle: ascending (A–Z), descending (Z–A), or the dataset's source order when the toggle is unset. Previously the dropdown always sorted alphabetically. Existing dashboards where the toggle was never set will show options in source order instead of A–Z; open the customization and enable the toggle to restore alphabetical ordering.
+
+### Selectable encryption engine for app-encrypted fields (AES-GCM)
+
+App-encrypted fields (database passwords, SSH tunnel credentials, OAuth tokens, etc.) can now use authenticated **AES-GCM** encryption instead of the historical unauthenticated **AES-CBC**. A new config selects the engine for the default adapter:
+
+```python
+# "aes" (AES-CBC, historical default) | "aes-gcm" (authenticated, recommended for new installs)
+SQLALCHEMY_ENCRYPTED_FIELD_ENGINE = "aes"
+```
+
+**No action required / no behavior change:** the default remains `"aes"`, so existing installs are unaffected.
+
+**Opting in on an existing install:** flipping the engine on a populated database without re-encrypting first will make stored secrets undecryptable, because the two ciphertext formats are not compatible. A migrator is provided. Recommended runbook:
+
+1. Take a metadata-DB backup.
+2. Re-encrypt existing secrets into the new engine (the `SECRET_KEY` is unchanged):
+   ```bash
+   superset re-encrypt-secrets --engine aes-gcm
+   ```
+3. Set `SQLALCHEMY_ENCRYPTED_FIELD_ENGINE = "aes-gcm"` in your config.
+4. Restart Superset.
+5. Re-run the migrator once more after the restart:
+   ```bash
+   superset re-encrypt-secrets --engine aes-gcm
+   ```
+   A live instance keeps writing *new* secrets as AES-CBC during the window between step 2 and the restart in step 4; this second pass sweeps those up (it is idempotent, so already-migrated values are skipped).
+
+Schedule the cutover in a quiet window. Runtime reads use only the single configured engine, so in a multi-worker deployment there is an unavoidable brief decrypt-outage between the migration commit and the last worker restarting with the new config — each migrator run is transactional, but the fleet-wide cutover is not zero-downtime.
+
+The migration is transactional (all-or-nothing) and idempotent — it can be safely re-run or resumed. Note that AES-GCM, unlike AES-CBC, does not support querying directly over encrypted columns; audit any code that filters on an encrypted column before switching. See the SIP at `docs/sip/authenticated-encryption-at-rest.md` for details.
+
 ### Granular Export Controls
 
 A new feature flag `GRANULAR_EXPORT_CONTROLS` introduces three fine-grained permissions that replace the legacy `can_csv` permission:
@@ -59,6 +227,9 @@ Added a new combined datasource list endpoint at `GET /api/v1/datasource/` to se
 - The endpoint is available to users with at least one of `can_read` on `Dataset` or `SemanticView`.
 - Semantic views are included only when the `SEMANTIC_LAYERS` feature flag is enabled.
 - The endpoint enforces strict `order_column` validation and returns `400` for invalid sort columns.
+
+## 6.1.0
+
 ### ClickHouse minimum driver version bump
 
 The minimum required version of `clickhouse-connect` has been raised to `>=0.13.0`. If you are using the ClickHouse connector, please upgrade your `clickhouse-connect` package. The `_mutate_label` workaround that appended hash suffixes to column aliases has also been removed, as it is no longer needed with modern versions of the driver.

docker-compose.yml

@@ -61,6 +61,34 @@ services:
     volumes:
       - ./docker/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
       - ./docker/nginx/templates:/etc/nginx/templates:ro
+    # Wait for the webpack dev server's manifest.json to be served before
+    # starting nginx. This prevents 404s on static assets at startup. The
+    # probe targets host.docker.internal so it works regardless of whether
+    # the dev server runs in the superset-node container
+    # (BUILD_SUPERSET_FRONTEND_IN_DOCKER=true, the default) or directly on
+    # the host (BUILD_SUPERSET_FRONTEND_IN_DOCKER=false).
+    command:
+      - /bin/bash
+      - -c
+      - |
+        url="http://host.docker.internal:9000/static/assets/manifest.json"
+        max_attempts=300  # ~10 minutes at 2s intervals; first build can be slow
+        echo "Waiting for webpack dev server at $$url..."
+        attempt=0
+        until curl -sf --max-time 5 -H "Host: localhost" -o /dev/null "$$url"; do
+          attempt=$$((attempt + 1))
+          if [ "$$attempt" -ge "$$max_attempts" ]; then
+            echo "ERROR: webpack dev server did not serve $$url after $$max_attempts attempts." >&2
+            echo "Is the dev server running? With BUILD_SUPERSET_FRONTEND_IN_DOCKER=false you must start it on the host (e.g. 'npm run dev' in superset-frontend)." >&2
+            exit 1
+          fi
+          if [ $$((attempt % 15)) -eq 0 ]; then
+            echo "Still waiting for webpack dev server... ($$attempt/$$max_attempts)"
+          fi
+          sleep 2
+        done
+        echo "Webpack dev server is ready; starting nginx."
+        exec /docker-entrypoint.sh nginx -g 'daemon off;'
 
   redis:
     image: redis:7

docker/docker-bootstrap.sh

@@ -71,16 +71,34 @@ case "${1}" in
   worker)
     echo "Starting Celery worker..."
     # setting up only 2 workers by default to contain memory usage in dev environments
-    celery --app=superset.tasks.celery_app:app worker -O fair -l INFO --concurrency=${CELERYD_CONCURRENCY:-2}
+    celery --app=superset.tasks.celery_app:app worker -O fair -l INFO --concurrency=${CELERYD_CONCURRENCY:-2} ${WORKER_LOG_FILE:+--logfile=$WORKER_LOG_FILE}
     ;;
   beat)
     echo "Starting Celery beat..."
     rm -f /tmp/celerybeat.pid
-    celery --app=superset.tasks.celery_app:app beat --pidfile /tmp/celerybeat.pid -l INFO -s "${SUPERSET_HOME}"/celerybeat-schedule
+    celery --app=superset.tasks.celery_app:app beat --pidfile /tmp/celerybeat.pid -l INFO -s "${SUPERSET_HOME}"/celerybeat-schedule ${BEAT_LOG_FILE:+--logfile=$BEAT_LOG_FILE}
     ;;
   app)
     echo "Starting web app (using development server)..."
-    flask run -p $PORT --reload --debugger --host=0.0.0.0 --exclude-patterns "*/node_modules/*:*/.venv/*:*/build/*:*/__pycache__/*:*/superset-frontend/*"
+
+    # Default to Flask debug mode in this dev compose entrypoint so the Talisman
+    # dev CSP (which permits 'unsafe-eval' required by React Refresh / HMR) is
+    # served. Operators can still set FLASK_DEBUG=false in docker/.env-local
+    # to exercise the production-like CSP and error handling.
+    : "${FLASK_DEBUG:=1}"
+    export FLASK_DEBUG
+
+    # Werkzeug's interactive debugger (/console) is a separate, security-sensitive
+    # feature and must be opted into explicitly via SUPERSET_DEBUG_ENABLED=true.
+    if [[ "${SUPERSET_DEBUG_ENABLED:-}" == "true" ]]; then
+        DEBUGGER_FLAG="--debugger"
+        echo "  ⚠️  Werkzeug debugger enabled (requires PIN for /console access)"
+    else
+        DEBUGGER_FLAG="--no-debugger"
+        echo "  🔒 Werkzeug debugger disabled (set SUPERSET_DEBUG_ENABLED=true to enable)"
+    fi
+
+    flask run -p $PORT --reload $DEBUGGER_FLAG --host=0.0.0.0 --exclude-patterns "*/node_modules/*:*/.venv/*:*/build/*:*/__pycache__/*:*/superset-frontend/*"
     ;;
   app-gunicorn)
     echo "Starting web app..."

docker/entrypoints/run-server.sh

@@ -19,7 +19,7 @@
 #
 HYPHEN_SYMBOL='-'
 
-gunicorn \
+exec gunicorn \
     --bind "${SUPERSET_BIND_ADDRESS:-0.0.0.0}:${SUPERSET_PORT:-8088}" \
     --access-logfile "${ACCESS_LOG_FILE:-$HYPHEN_SYMBOL}" \
     --error-logfile "${ERROR_LOG_FILE:-$HYPHEN_SYMBOL}" \

docs/.nvmrc

@@ -1 +1 @@
-v22.22.0
+v24.16.0

docs/admin_docs/configuration/cache.mdx

@@ -86,6 +86,39 @@ instead requires a cachelib object.
 
 See [Async Queries via Celery](/admin-docs/configuration/async-queries-celery) for details.
 
+## Celery beat
+
+Superset has a Celery task that will periodically warm up the cache based on different strategies.
+To use it, add the following to your `superset_config.py`:
+
+```python
+from celery.schedules import crontab
+from superset.config import CeleryConfig
+
+# User that will be used to authenticate and render dashboards for cache warmup
+SUPERSET_CACHE_WARMUP_USER = "user_with_permission_to_dashboards"
+
+# Extend the default CeleryConfig to add cache warmup schedule
+class CustomCeleryConfig(CeleryConfig):
+    beat_schedule = {
+        **CeleryConfig.beat_schedule,
+        'cache-warmup-hourly': {
+            'task': 'cache-warmup',
+            'schedule': crontab(minute=0, hour='*'),  # hourly
+            'kwargs': {
+                'strategy_name': 'top_n_dashboards',
+                'top_n': 5,
+                'since': '7 days ago',
+            },
+        },
+    }
+
+CELERY_CONFIG = CustomCeleryConfig
+```
+
+This will cache the top 5 most popular dashboards every hour. For other
+strategies, check the `superset/tasks/cache.py` file.
+
 ## Caching Thumbnails
 
 This is an optional feature that can be turned on by activating its [feature flag](/admin-docs/configuration/configuring-superset#feature-flags) on config:

docs/admin_docs/configuration/configuring-superset.mdx

@@ -455,6 +455,51 @@ def FLASK_APP_MUTATOR(app: Flask) -> None:
     app.before_request_funcs.setdefault(None, []).append(make_session_permanent)
 ```
 
+## Customizing the landing page (index view)
+
+The page served at `/` is rendered by an index view. By default Superset registers
+`SupersetIndexView`, which redirects to `/superset/welcome/` and also adds the
+`/lang/<locale>` locale handler. You can replace it with your own view, for example
+to send users straight to a specific dashboard or to a chart list.
+
+Set `FAB_INDEX_VIEW` to the **importable dotted path** of your view class. Flask-AppBuilder
+resolves this during app initialization and uses it in place of the default:
+
+```python
+# my_overrides.py — must be importable on the PYTHONPATH
+from flask import redirect
+from superset.initialization import SupersetIndexView
+from superset.superset_typing import FlaskResponse
+from flask_appbuilder import expose
+
+
+class MyIndexView(SupersetIndexView):
+    @expose("/")
+    def index(self) -> FlaskResponse:
+        return redirect("/chart/list/")
+```
+
+```python
+# superset_config.py
+FAB_INDEX_VIEW = "my_overrides.MyIndexView"
+```
+
+A few things that commonly trip people up:
+
+- **Subclass `SupersetIndexView`, not Flask-AppBuilder's bare `IndexView`.** Subclassing
+  keeps Superset's `/lang/<locale>` locale handling; replacing it with a bare `IndexView`
+  silently drops that behavior.
+- **The class must be importable as a real module.** `FAB_INDEX_VIEW` is resolved by
+  importing the dotted path, which is independent of how `superset_config.py` itself is
+  loaded. Superset only copies **uppercase** names out of `superset_config.py` into its
+  runtime config, so a `FAB_INDEX_VIEW = "superset_config.MyIndexView"` reference only works
+  if `superset_config` is itself importable by that name on the `PYTHONPATH`. If you load
+  config via `SUPERSET_CONFIG_PATH` (an arbitrary file path), put the view in a separate
+  importable module instead and reference that module.
+- **Don't set `appbuilder.indexview` from `FLASK_APP_MUTATOR`.** The mutator runs after
+  routes are already registered, so the assignment has no effect on the `/` route. Use
+  `FAB_INDEX_VIEW` instead.
+
 ## Feature Flags
 
 To support a diverse set of users, Superset has some features that are not enabled by default. For

docs/admin_docs/installation/pypi.mdx

@@ -22,31 +22,24 @@ level dependencies.
 
 **Debian and Ubuntu**
 
-Ubuntu **24.04** uses python 3.12 per default, which currently is not supported by Superset. You need to add a second python installation of 3.11 and install the required additional dependencies.
-```bash
-sudo add-apt-repository ppa:deadsnakes/ppa
-sudo apt update
-sudo apt install python3.11 python3.11-dev python3.11-venv build-essential libssl-dev libffi-dev libsasl2-dev libldap2-dev default-libmysqlclient-dev
-```
-
-In Ubuntu **20.04 and 22.04** the following command will ensure that the required dependencies are installed:
+The following command will ensure that the required dependencies are installed (tested on Ubuntu 20.04, 22.04, and 24.04):
 
 ```bash
-sudo apt-get install build-essential libssl-dev libffi-dev python3-dev python3-pip libsasl2-dev libldap2-dev default-libmysqlclient-dev
+sudo apt-get install build-essential libssl-dev libffi-dev python3-dev python3-pip python3-venv libsasl2-dev libldap2-dev libpq-dev default-libmysqlclient-dev pkg-config
 ```
 
-In Ubuntu **before 20.04** the following command will ensure that the required dependencies are installed:
-
-```bash
-sudo apt-get install build-essential libssl-dev libffi-dev python-dev python-pip libsasl2-dev libldap2-dev default-libmysqlclient-dev
-```
+Refer to the
+[pyproject.toml](https://github.com/apache/superset/blob/master/pyproject.toml) file for the list of
+Python versions officially supported by Superset, and install a matching `python3` interpreter for
+your distribution. The `libpq-dev` package is only needed if you intend to connect to (or use) a
+PostgreSQL database; you can omit it otherwise.
 
 **Fedora and RHEL-derivative Linux distributions**
 
 Install the following packages using the `yum` package manager:
 
 ```bash
-sudo yum install gcc gcc-c++ libffi-devel python-devel python-pip python-wheel openssl-devel cyrus-sasl-devel openldap-devel
+sudo yum install gcc gcc-c++ libffi-devel python3-devel python3-pip python3-wheel openssl-devel cyrus-sasl-devel openldap-devel
 ```
 
 In more recent versions of CentOS and Fedora, you may need to install a slightly different set of packages using `dnf`:
@@ -157,8 +150,15 @@ superset load_examples
 superset init
 
 # To start a development web server on port 8088, use -p to bind to another port
-superset run -p 8088 --with-threads --reload --debugger
+superset run -p 8088 --with-threads --reload
+
+# For debugging with interactive console (⚠️ localhost only)
+# superset run -p 8088 --with-threads --reload --debugger
 ```
 
+:::warning Security Note
+The `--debugger` flag enables Werkzeug's interactive console at `/console`. Only use this for local development and never bind to `0.0.0.0` or expose the server to networks when debugging is enabled.
+:::
+
 If everything worked, you should be able to navigate to `hostname:port` in your browser (e.g.
 locally by default at `localhost:8088`) and login using the username and password you created.

docs/admin_docs_versioned_docs/version-6.1.0/installation/pypi.mdx

@@ -157,8 +157,15 @@ superset load_examples
 superset init
 
 # To start a development web server on port 8088, use -p to bind to another port
-superset run -p 8088 --with-threads --reload --debugger
+superset run -p 8088 --with-threads --reload
+
+# For debugging with interactive console (⚠️ localhost only)
+# superset run -p 8088 --with-threads --reload --debugger
 ```
 
+:::warning Security Note
+The `--debugger` flag enables Werkzeug's interactive console at `/console`. Only use this for local development and never bind to `0.0.0.0` or expose the server to networks when debugging is enabled.
+:::
+
 If everything worked, you should be able to navigate to `hostname:port` in your browser (e.g.
 locally by default at `localhost:8088`) and login using the username and password you created.

docs/developer_docs/contributing/development-setup.md

@@ -102,6 +102,8 @@ Affecting the Docker build process:
   save some precious time on startup by `SUPERSET_LOAD_EXAMPLES=no docker compose up`
 - **SUPERSET_LOG_LEVEL (default=info)**: Can be set to debug, info, warning, error, critical
   for more verbose logging
+- **SUPERSET_DEBUG_ENABLED (default=false)**: Enable Werkzeug debugger with interactive console.
+  Set to `true` for debugging: `SUPERSET_DEBUG_ENABLED=true docker compose up`
 
 For more env vars that affect your configuration, see this
 [superset_config.py](https://github.com/apache/superset/blob/master/docker/pythonpath_dev/superset_config.py)

docs/docusaurus.config.ts

@@ -917,6 +917,23 @@ const config: Config = {
     footer: {
       links: [],
       copyright: `
+          <div class="footer__social-links">
+            <a href="https://bit.ly/join-superset-slack" target="_blank" rel="noopener noreferrer" title="Join us on Slack" aria-label="Slack">
+              <img src="/img/community/slack-symbol.svg" alt="Slack" />
+            </a>
+            <a href="https://x.com/apachesuperset" target="_blank" rel="noopener noreferrer" title="Follow us on X" aria-label="X">
+              <img src="/img/community/x-symbol.svg" alt="X" />
+            </a>
+            <a href="https://www.linkedin.com/company/apache-superset" target="_blank" rel="noopener noreferrer" title="Follow us on LinkedIn" aria-label="LinkedIn">
+              <img src="/img/community/linkedin-symbol.svg" alt="LinkedIn" />
+            </a>
+            <a href="https://bsky.app/profile/apachesuperset.bsky.social" target="_blank" rel="noopener noreferrer" title="Follow us on Bluesky" aria-label="Bluesky">
+              <img src="/img/community/bluesky-symbol.svg" alt="Bluesky" />
+            </a>
+            <a href="https://reddit.com/r/apache-superset" target="_blank" rel="noopener noreferrer" title="Follow us on Reddit" aria-label="Reddit">
+              <img src="/img/community/reddit-symbol.svg" alt="Reddit" />
+            </a>
+          </div>
           <div class="footer__ci-services">
             <span>CI powered by</span>
             <a href="https://www.netlify.com/" target="_blank" rel="nofollow noopener noreferrer"><img src="/img/netlify.png" alt="Netlify" title="Netlify - Deploy Previews" /></a>

docs/i18n/en/docusaurus-theme-classic/footer.json

@@ -1,6 +1,6 @@
 {
   "copyright": {
-    "message": "\n          <div class=\"footer__ci-services\">\n            <span>CI powered by</span>\n            <a href=\"https://www.netlify.com/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\"><img src=\"/img/netlify.png\" alt=\"Netlify\" title=\"Netlify - Deploy Previews\" /></a>\n          </div>\n          <p>Copyright © 2026,\n          The <a href=\"https://www.apache.org/\" target=\"_blank\" rel=\"noreferrer\">Apache Software Foundation</a>,\n          Licensed under the Apache <a href=\"https://apache.org/licenses/LICENSE-2.0\" target=\"_blank\" rel=\"noreferrer\">License</a>.</p>\n          <p><small>Apache Superset, Apache, Superset, the Superset logo, and the Apache feather logo are either registered trademarks or trademarks of The Apache Software Foundation. All other products or name brands are trademarks of their respective holders, including The Apache Software Foundation.\n          <a href=\"https://www.apache.org/\" target=\"_blank\">Apache Software Foundation</a> resources</small></p>\n          <img class=\"footer__divider\" src=\"/img/community/line.png\" alt=\"Divider\" />\n          <p>\n            <small>\n              <a href=\"/docs/security/\" target=\"_blank\" rel=\"noreferrer\">Security</a>&nbsp;|&nbsp;\n              <a href=\"https://www.apache.org/foundation/sponsorship.html\" target=\"_blank\" rel=\"noreferrer\">Donate</a>&nbsp;|&nbsp;\n              <a href=\"https://www.apache.org/foundation/thanks.html\" target=\"_blank\" rel=\"noreferrer\">Thanks</a>&nbsp;|&nbsp;\n              <a href=\"https://apache.org/events/current-event\" target=\"_blank\" rel=\"noreferrer\">Events</a>&nbsp;|&nbsp;\n              <a href=\"https://apache.org/licenses/\" target=\"_blank\" rel=\"noreferrer\">License</a>&nbsp;|&nbsp;\n              <a href=\"https://privacy.apache.org/policies/privacy-policy-public.html\" target=\"_blank\" rel=\"noreferrer\">Privacy</a>\n            </small>\n          </p>\n          <!-- telemetry/analytics pixel: -->\n          <img referrerPolicy=\"no-referrer-when-downgrade\" src=\"https://static.scarf.sh/a.png?x-pxid=39ae6855-95fc-4566-86e5-360d542b0a68\" />\n          ",
+    "message": "\n          <div class=\"footer__social-links\">\n            <a href=\"https://bit.ly/join-superset-slack\" target=\"_blank\" rel=\"noopener noreferrer\" title=\"Join us on Slack\" aria-label=\"Slack\">\n              <img src=\"/img/community/slack-symbol.svg\" alt=\"Slack\" />\n            </a>\n            <a href=\"https://x.com/apachesuperset\" target=\"_blank\" rel=\"noopener noreferrer\" title=\"Follow us on X\" aria-label=\"X\">\n              <img src=\"/img/community/x-symbol.svg\" alt=\"X\" />\n            </a>\n            <a href=\"https://www.linkedin.com/company/apache-superset\" target=\"_blank\" rel=\"noopener noreferrer\" title=\"Follow us on LinkedIn\" aria-label=\"LinkedIn\">\n              <img src=\"/img/community/linkedin-symbol.svg\" alt=\"LinkedIn\" />\n            </a>\n            <a href=\"https://bsky.app/profile/apachesuperset.bsky.social\" target=\"_blank\" rel=\"noopener noreferrer\" title=\"Follow us on Bluesky\" aria-label=\"Bluesky\">\n              <img src=\"/img/community/bluesky-symbol.svg\" alt=\"Bluesky\" />\n            </a>\n            <a href=\"https://reddit.com/r/apache-superset\" target=\"_blank\" rel=\"noopener noreferrer\" title=\"Follow us on Reddit\" aria-label=\"Reddit\">\n              <img src=\"/img/community/reddit-symbol.svg\" alt=\"Reddit\" />\n            </a>\n          </div>\n          <div class=\"footer__ci-services\">\n            <span>CI powered by</span>\n            <a href=\"https://www.netlify.com/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\"><img src=\"/img/netlify.png\" alt=\"Netlify\" title=\"Netlify - Deploy Previews\" /></a>\n          </div>\n          <p>Copyright © 2026,\n          The <a href=\"https://www.apache.org/\" target=\"_blank\" rel=\"noreferrer\">Apache Software Foundation</a>,\n          Licensed under the Apache <a href=\"https://apache.org/licenses/LICENSE-2.0\" target=\"_blank\" rel=\"noreferrer\">License</a>.</p>\n          <p><small>Apache Superset, Apache, Superset, the Superset logo, and the Apache feather logo are either registered trademarks or trademarks of The Apache Software Foundation. All other products or name brands are trademarks of their respective holders, including The Apache Software Foundation.\n          <a href=\"https://www.apache.org/\" target=\"_blank\">Apache Software Foundation</a> resources</small></p>\n          <img class=\"footer__divider\" src=\"/img/community/line.png\" alt=\"Divider\" />\n          <p>\n            <small>\n              <a href=\"/admin-docs/security/\" target=\"_blank\" rel=\"noreferrer\">Security</a>&nbsp;|&nbsp;\n              <a href=\"https://www.apache.org/foundation/sponsorship.html\" target=\"_blank\" rel=\"noreferrer\">Donate</a>&nbsp;|&nbsp;\n              <a href=\"https://www.apache.org/foundation/thanks.html\" target=\"_blank\" rel=\"noreferrer\">Thanks</a>&nbsp;|&nbsp;\n              <a href=\"https://apache.org/events/current-event\" target=\"_blank\" rel=\"noreferrer\">Events</a>&nbsp;|&nbsp;\n              <a href=\"https://apache.org/licenses/\" target=\"_blank\" rel=\"noreferrer\">License</a>&nbsp;|&nbsp;\n              <a href=\"https://privacy.apache.org/policies/privacy-policy-public.html\" target=\"_blank\" rel=\"noreferrer\">Privacy</a>\n            </small>\n          </p>\n          <!-- telemetry/analytics pixel: -->\n          <img referrerPolicy=\"no-referrer-when-downgrade\" src=\"https://static.scarf.sh/a.png?x-pxid=39ae6855-95fc-4566-86e5-360d542b0a68\" />\n          ",
     "description": "The footer copyright"
   }
 }

docs/netlify.toml

@@ -28,14 +28,19 @@
   # Skip builds when no docs changes (exit 0 = skip, non-zero = build).
   # Checks for changes in docs/ and README.md (which gets pulled into docs).
   #
-  # $CACHED_COMMIT_REF is the last *deployed* commit. On a PR's first build it
-  # is empty, so the original `git diff` errored and Netlify fell back to
-  # building -- which is why every PR built a docs preview once even with no
-  # docs changes. When it is empty we instead diff the whole branch against its
-  # merge-base with master, so non-docs PRs are skipped from the very first
-  # build. Subsequent builds (and the master production build) keep the cheaper
-  # incremental $CACHED_COMMIT_REF diff. Any failure exits non-zero -> build.
-  ignore = 'if [ -n "$CACHED_COMMIT_REF" ]; then git diff --quiet "$CACHED_COMMIT_REF" "$COMMIT_REF" -- . ../README.md; else git fetch origin master --depth=100 >/dev/null 2>&1; git diff --quiet "$(git merge-base origin/master "$COMMIT_REF" 2>/dev/null || echo origin/master)" "$COMMIT_REF" -- . ../README.md; fi'
+  # $CACHED_COMMIT_REF is the last *deployed* commit; it is set on incremental
+  # builds (notably the master production deploy) and empty on a context's
+  # first build (every deploy preview). The production path diffs against it
+  # and skips correctly.
+  #
+  # Deploy previews need different handling: Netlify checks out a *merge*
+  # commit, so $COMMIT_REF (the PR head SHA) is frequently not resolvable in
+  # the clone, and on a shallow clone `git merge-base` can fail too -- so the
+  # previous logic fell through to a build on every PR, even non-docs ones.
+  # Instead, always diff the checked-out HEAD against its merge-base with
+  # master, deepening the shallow clone until that merge-base resolves. If it
+  # genuinely can't be determined, exit non-zero to build (fail safe).
+  ignore = 'if [ -n "$CACHED_COMMIT_REF" ]; then git diff --quiet "$CACHED_COMMIT_REF" HEAD -- . ../README.md; else git fetch --no-tags origin master >/dev/null 2>&1 || true; i=0; while [ "$i" -lt 10 ] && ! git merge-base origin/master HEAD >/dev/null 2>&1; do git fetch --deepen=200 origin master >/dev/null 2>&1 || break; i=$((i+1)); done; BASE="$(git merge-base origin/master HEAD 2>/dev/null || true)"; if [ -z "$BASE" ]; then exit 1; fi; git diff --quiet "$BASE" HEAD -- . ../README.md; fi'
 
 [build.environment]
   # Node version matching docs/.nvmrc

docs/package.json

@@ -43,7 +43,7 @@
     "version:remove:components": "node scripts/manage-versions.mjs remove components"
   },
   "dependencies": {
-    "@ant-design/icons": "^6.2.3",
+    "@ant-design/icons": "^6.2.5",
     "@docusaurus/core": "^3.10.1",
     "@docusaurus/faster": "^3.10.1",
     "@docusaurus/plugin-client-redirects": "^3.10.1",
@@ -70,13 +70,13 @@
     "@storybook/preview-api": "^8.6.18",
     "@storybook/theming": "^8.6.15",
     "@superset-ui/core": "^0.20.4",
-    "@swc/core": "^1.15.40",
-    "antd": "^6.4.3",
-    "baseline-browser-mapping": "^2.10.32",
-    "caniuse-lite": "^1.0.30001793",
+    "@swc/core": "^1.15.41",
+    "antd": "^6.4.4",
+    "baseline-browser-mapping": "^2.10.37",
+    "caniuse-lite": "^1.0.30001799",
     "docusaurus-plugin-openapi-docs": "^5.0.2",
     "docusaurus-theme-openapi-docs": "^5.0.2",
-    "js-yaml": "^4.1.1",
+    "js-yaml": "^4.2.0",
     "js-yaml-loader": "^1.2.2",
     "json-bigint": "^1.0.0",
     "prism-react-renderer": "^2.4.1",
@@ -101,15 +101,15 @@
     "@types/js-yaml": "^4.0.9",
     "@types/react": "^19.1.8",
     "@typescript-eslint/eslint-plugin": "^8.59.3",
-    "@typescript-eslint/parser": "^8.60.0",
+    "@typescript-eslint/parser": "^8.61.0",
     "eslint": "^9.39.2",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-prettier": "^5.5.5",
+    "eslint-plugin-prettier": "^5.5.6",
     "eslint-plugin-react": "^7.37.5",
     "globals": "^17.6.0",
-    "prettier": "^3.8.3",
+    "prettier": "^3.8.4",
     "typescript": "~6.0.3",
-    "typescript-eslint": "^8.60.0",
+    "typescript-eslint": "^8.61.1",
     "webpack": "^5.107.2"
   },
   "browserslist": {

docs/sip/authenticated-encryption-at-rest.md

@@ -0,0 +1,136 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# SIP: Authenticated encryption (AES-GCM) for app-encrypted fields
+
+## [DRAFT — proposal for discussion]
+
+This document is a draft proposal accompanying the code in this PR. It is
+intended to seed the formal SIP discussion. The code here ships the
+backward-compatible engine selection **and** the re-encryption migrator
+(Phases 1–2 below); both are opt-in and change nothing for existing installs by
+default. Flipping the default for fresh installs (Phase 3) remains future work.
+
+## Motivation
+
+Superset app-encrypts a number of sensitive fields before persisting them to
+the metadata database, including:
+
+- database connection passwords and `encrypted_extra` (`superset/models/core.py`),
+- SSH tunnel credentials — password, private key, private-key password
+  (`superset/databases/ssh_tunnel/models.py`),
+- OAuth2 tokens and other secrets stored via `EncryptedType`.
+
+These fields are encrypted with `sqlalchemy_utils.EncryptedType`, which
+**defaults to `AesEngine` (AES-CBC)**. AES-CBC provides confidentiality but is
+**unauthenticated**: it has no integrity tag. An attacker with write access to
+the ciphertext (e.g. direct metadata-DB access, a backup, or a compromised
+replica) can perform **bit-flipping / chosen-ciphertext manipulation** to
+silently alter the decrypted plaintext of a secret without detection.
+
+`AesGcmEngine` (AES-GCM) is authenticated encryption: tampering causes
+decryption to fail loudly rather than yielding attacker-influenced plaintext.
+Using authenticated encryption for secrets at rest is an ASVS L1 expectation
+(11.3.2 / cryptography best practice).
+
+`config.py` already documents that operators *can* switch to GCM by writing a
+custom `AbstractEncryptedFieldAdapter`, but:
+
+1. it is opt-in, undocumented as a security recommendation, and easy to miss;
+2. there is **no migration path** — flipping the engine on a populated database
+   makes every existing secret undecryptable, because GCM ciphertext is not
+   format-compatible with CBC.
+
+## Proposed change
+
+A three-part change, delivered incrementally so existing deployments are never
+broken:
+
+### Phase 1 — engine selection (this PR)
+
+- Add a `SQLALCHEMY_ENCRYPTED_FIELD_ENGINE` config (`"aes"` | `"aes-gcm"`),
+  **defaulting to `"aes"`** (no behavior change for existing installs).
+- Teach the default `SQLAlchemyUtilsAdapter` to honor it (an explicit `engine`
+  kwarg still wins, so the migrator can pin an engine).
+- This lets **new** deployments choose AES-GCM from day one with a one-line
+  config, instead of writing a custom adapter.
+
+### Phase 2 — CBC→GCM re-encryption migrator (this PR)
+
+The existing `SecretsMigrator` (previously only used for `SECRET_KEY` rotation)
+gains an **engine migration** mode that:
+
+1. discovers every `EncryptedType` column (via `discover_encrypted_fields()`),
+2. decrypts each value with the **source** engine (AES-CBC) under the current
+   `SECRET_KEY`,
+3. re-encrypts with the **target** engine (AES-GCM),
+4. runs transactionally per the existing all-or-nothing semantics, and is
+   idempotent per column (already-migrated values are skipped), so a run can be
+   safely repeated or resumed.
+
+Exposed via a new `--engine` option on the existing CLI command:
+`superset re-encrypt-secrets --engine aes-gcm`, runnable by operators with a DB
+backup in hand. The `SECRET_KEY` is unchanged; an engine change and a key
+rotation can also be combined (pass `--previous_secret_key` as well).
+
+### Phase 3 — flip the default for new installs
+
+Once the migrator and docs are in place, change the default to `"aes-gcm"` for
+**fresh** installs only (e.g. keyed off an empty metadata DB / documented in
+`UPDATING.md`), keeping existing installs on `"aes"` until they run Phase 2.
+
+## New or changed public interfaces
+
+- New config: `SQLALCHEMY_ENCRYPTED_FIELD_ENGINE: Literal["aes", "aes-gcm"]`.
+- New (Phase 2) CLI: `superset re-encrypt-secrets --engine <name>`.
+- No schema changes; ciphertext format changes per migrated column.
+
+## Migration plan and compatibility
+
+- **Backward compatible by default.** Phase 1 changes nothing unless the
+  operator opts in.
+- Switching an existing deployment to `"aes-gcm"` **without** running the Phase
+  2 migrator will make existing secrets undecryptable — this is called out in
+  the config comment and must be in `UPDATING.md`.
+- Recommended operator runbook: take a metadata-DB backup → run
+  `re-encrypt-secrets --engine aes-gcm` → set
+  `SQLALCHEMY_ENCRYPTED_FIELD_ENGINE = "aes-gcm"` → restart → re-run
+  `re-encrypt-secrets --engine aes-gcm` once more to sweep up any secrets a live
+  instance wrote as AES-CBC during the cutover window. The canonical, more
+  detailed version of this runbook lives in `UPDATING.md`; this is a summary.
+- `AesEngine` allows queryability over encrypted fields; AES-GCM does not.
+  Any code that filters/queries on an encrypted column directly must be audited
+  before Phase 3 (none is expected, but it must be verified).
+
+## Rejected alternatives
+
+- **Flip the default immediately.** Rejected: bricks every existing
+  deployment's secrets with no migration path.
+- **Document-only (custom adapter).** Status quo; high friction and no
+  migration tooling — most operators will never do it.
+
+## Open questions
+
+- GCM→CBC rollback (for operators who need queryability) already works via the
+  same command (`re-encrypt-secrets --engine aes`), since the migrator is
+  engine-symmetric. Should rollback be documented as a supported path or
+  discouraged?
+- The migrator already supports a concurrent `SECRET_KEY` rotation + engine
+  change in a single pass (pass `--previous_secret_key` alongside `--engine`).
+  Is that combination worth calling out in the operator docs, or kept advanced?

docs/src/data/databases.json

@@ -7235,10 +7235,10 @@
         "pypi_packages": [
           "oracledb"
         ],
-        "connection_string": "oracle://{username}:{password}@{hostname}:{port}",
+        "connection_string": "oracle+oracledb://{username}:{password}@{hostname}:{port}",
         "default_port": 1521,
         "notes": "Previously used cx_Oracle, now uses oracledb.",
-        "docs_url": "https://cx-oracle.readthedocs.io/en/latest/user_guide/installation.html",
+        "docs_url": "https://python-oracledb.readthedocs.io/en/latest/user_guide/installation.html",
         "category": "Other Databases"
       },
       "engine": "oracle",

docs/src/styles/main.css

@@ -260,10 +260,45 @@ a > span > svg {
 
 .footer {
   position: relative;
-  padding-top: 90px;
+  padding-top: 130px;
   font-size: 15px;
 }
 
+.footer__social-links {
+  background-color: #173036;
+  position: absolute;
+  top: 52px;
+  left: 0;
+  width: 100%;
+  padding: 10px 0;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 24px;
+}
+
+.footer__social-links a {
+  display: inline-flex;
+  align-items: center;
+  transition: opacity 0.2s, transform 0.2s;
+}
+
+.footer__social-links a:hover {
+  opacity: 0.8;
+  transform: scale(1.1);
+}
+
+.footer__social-links img {
+  height: 24px;
+  width: 24px;
+  /* The brand SVGs ship in their native colors (e.g. Slack's dark aubergine,
+     X's near-black), which disappear on the dark footer. Render them all as
+     uniform white silhouettes. The icons are single-path glyphs whose
+     counters (the LinkedIn "in", Slack gaps, Reddit face) are transparent
+     cut-outs, so they stay legible against the footer background. */
+  filter: brightness(0) invert(1);
+}
+
 .footer__ci-services {
   background-color: #0d3e49;
   color: #e1e1e1;
@@ -309,6 +344,21 @@ a > span > svg {
 }
 
 @media only screen and (max-width: 996px) {
+  .footer {
+    padding-top: 120px;
+  }
+
+  .footer__social-links {
+    top: 44px;
+    gap: 20px;
+    padding: 8px 16px;
+  }
+
+  .footer__social-links img {
+    height: 20px;
+    width: 20px;
+  }
+
   .footer__ci-services {
     gap: 12px;
     padding: 10px 16px;

docs/static/img/community/reddit-symbol.svg

@@ -0,0 +1,21 @@
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one
+  or more contributor license agreements.  See the NOTICE file
+  distributed with this work for additional information
+  regarding copyright ownership.  The ASF licenses this file
+  to you under the Apache License, Version 2.0 (the
+  "License"); you may not use this file except in compliance
+  with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing,
+  software distributed under the License is distributed on an
+  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+  KIND, either express or implied.  See the License for the
+  specific language governing permissions and limitations
+  under the License.
+-->
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="40" height="40" fill="#FF4500">
+  <path d="M12 0A12 12 0 0 0 0 12a12 12 0 0 0 12 12 12 12 0 0 0 12-12A12 12 0 0 0 12 0zm5.01 4.744c.688 0 1.25.561 1.25 1.249a1.25 1.25 0 0 1-2.498.056l-2.597-.547-.8 3.747c1.824.07 3.48.632 4.674 1.488.308-.309.73-.491 1.207-.491.968 0 1.754.786 1.754 1.754 0 .716-.435 1.333-1.01 1.614a3.111 3.111 0 0 1 .042.52c0 2.694-3.13 4.87-7.004 4.87-3.874 0-7.004-2.176-7.004-4.87 0-.183.015-.366.043-.534A1.748 1.748 0 0 1 4.028 12c0-.968.786-1.754 1.754-1.754.463 0 .898.196 1.207.49 1.207-.883 2.878-1.43 4.744-1.487l.885-4.182a.342.342 0 0 1 .14-.197.35.35 0 0 1 .238-.042l2.906.617a1.214 1.214 0 0 1 1.108-.701zM9.25 12c-.688 0-1.25.561-1.25 1.25 0 .687.562 1.248 1.25 1.248.687 0 1.248-.561 1.248-1.249 0-.688-.561-1.249-1.249-1.249zm5.5 0c-.687 0-1.248.561-1.248 1.25 0 .687.561 1.248 1.249 1.248.688 0 1.249-.561 1.249-1.249 0-.687-.562-1.249-1.25-1.249zm-5.466 3.99a.327.327 0 0 0-.231.094.33.33 0 0 0 0 .463c.842.842 2.484.913 2.961.913.477 0 2.105-.056 2.961-.913a.361.361 0 0 0 .029-.463.33.33 0 0 0-.464 0c-.547.533-1.684.73-2.512.73-.828 0-1.979-.196-2.512-.73a.326.326 0 0 0-.232-.095z"/>
+</svg>

docs/static/img/community/slack-symbol.svg

@@ -0,0 +1,21 @@
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one
+  or more contributor license agreements.  See the NOTICE file
+  distributed with this work for additional information
+  regarding copyright ownership.  The ASF licenses this file
+  to you under the Apache License, Version 2.0 (the
+  "License"); you may not use this file except in compliance
+  with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing,
+  software distributed under the License is distributed on an
+  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+  KIND, either express or implied.  See the License for the
+  specific language governing permissions and limitations
+  under the License.
+-->
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="40" height="40" fill="#4A154B">
+  <path d="M5.042 15.165a2.528 2.528 0 0 1-2.52 2.523A2.528 2.528 0 0 1 0 15.165a2.527 2.527 0 0 1 2.522-2.52h2.52v2.52zm1.271 0a2.527 2.527 0 0 1 2.521-2.52 2.527 2.527 0 0 1 2.521 2.52v6.313A2.528 2.528 0 0 1 8.834 24a2.528 2.528 0 0 1-2.521-2.522v-6.313zM8.834 5.042a2.528 2.528 0 0 1-2.521-2.52A2.528 2.528 0 0 1 8.834 0a2.528 2.528 0 0 1 2.521 2.522v2.52H8.834zm0 1.271a2.528 2.528 0 0 1 2.521 2.521 2.528 2.528 0 0 1-2.521 2.521H2.522A2.528 2.528 0 0 1 0 8.834a2.528 2.528 0 0 1 2.522-2.521h6.312zm10.124 2.521a2.528 2.528 0 0 1 2.522-2.521A2.528 2.528 0 0 1 24 8.834a2.528 2.528 0 0 1-2.52 2.521h-2.522V8.834zm-1.271 0a2.528 2.528 0 0 1-2.521 2.521 2.528 2.528 0 0 1-2.521-2.521V2.522A2.528 2.528 0 0 1 15.166 0a2.528 2.528 0 0 1 2.521 2.522v6.312zm-2.521 10.124a2.528 2.528 0 0 1 2.521 2.522A2.528 2.528 0 0 1 15.166 24a2.528 2.528 0 0 1-2.521-2.52v-2.522h2.521zm0-1.271a2.528 2.528 0 0 1-2.521-2.521 2.528 2.528 0 0 1 2.521-2.521h6.312A2.528 2.528 0 0 1 24 15.165a2.528 2.528 0 0 1-2.52 2.521h-6.313z"/>
+</svg>

docs/user_docs_versioned_docs/version-6.0.0/configuration/databases.mdx

@@ -1808,6 +1808,10 @@ If you enable DML in the meta database users will be able to run DML queries on
 
 Second, you might want to change the value of `SUPERSET_META_DB_LIMIT`. The default value is 1000, and defines how many are read from each database before any aggregations and joins are executed. You can also set this value `None` if you only have small tables.
 
+:::warning
+`SUPERSET_META_DB_LIMIT` is applied to **each** underlying table *before* the in-memory join runs, not to the final result. If any table involved in a join has more rows than the limit, the meta database will read only the first `SUPERSET_META_DB_LIMIT` rows of that table, which means matching rows can be silently dropped and the join can return **incomplete or even empty** results with no error. If you join tables larger than the limit, raise `SUPERSET_META_DB_LIMIT` to comfortably exceed your largest joined table, or set it to `None` when working only with small tables, to get correct results.
+:::
+
 Additionally, you might want to restrict the databases to with the meta database has access to. This can be done in the database configuration, under "Advanced" -> "Other" -> "ENGINE PARAMETERS" and adding:
 
 ```json

extensions/chat/README.md

@@ -1,138 +0,0 @@
-<!--
-Licensed to the Apache Software Foundation (ASF) under one
-or more contributor license agreements.  See the NOTICE file
-distributed with this work for additional information
-regarding copyright ownership.  The ASF licenses this file
-to you under the Apache License, Version 2.0 (the
-"License"); you may not use this file except in compliance
-with the License.  You may obtain a copy of the License at
-
-  http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing,
-software distributed under the License is distributed on an
-"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-KIND, either express or implied.  See the License for the
-specific language governing permissions and limitations
-under the License.
--->
-
-# Reference Chatbot Extension
-
-Canonical environment-validation extension for the `superset.chatbot`
-contribution area. **Not** a product chatbot — there is no LLM, no backend,
-no persistence. Its purpose is to exercise the extension platform end-to-end:
-
-- `views.registerView` at `superset.chatbot` (singleton resolution)
-- Lifecycle activation + a master disposable that tears down everything
-- `commands.registerCommand` for `core.chatbot__open|close|toggle`
-- Mock streaming with `AbortController` cancellation on dispose
-- Defense-in-depth React error boundary inside the panel
-- A single P3 page-context seam that lights up automatically as the
-  `dashboard` / `explore` / `dataset` / `navigation` namespaces become
-  available at runtime on the host
-
-It is intended as the reference implementation third-party chatbot extension
-authors copy. Anything that ships as host-internal (the mount point, the
-admin picker, the `getActiveChatbot` resolver) is **not** here — see the
-host side at `superset-frontend/src/components/ChatbotMount/` and
-`superset-frontend/src/core/chatbot/`.
-
-## Layout
-
-```
-extensions/chat/
-├── extension.json              Manifest (app.chatbot view + commands)
-├── package.json
-├── tsconfig.json
-├── webpack.config.js           ModuleFederation → window.superset
-├── jest.config.js              Self-contained unit tests
-└── src/
-    ├── index.tsx               MF entry — calls activate() once
-    ├── activate.ts             Returns master disposable
-    ├── commands.ts             core.chatbot__open|close|toggle
-    ├── state.ts                Module-scoped open/closed + emitter
-    ├── ReferenceChatbot.tsx    Root component (bubble ↔ panel)
-    ├── components/
-    │   ├── Bubble.tsx
-    │   ├── Panel.tsx
-    │   └── ErrorBoundary.tsx
-    ├── streaming/
-    │   ├── mockStream.ts       AsyncIterable<string> + AbortSignal
-    │   └── registry.ts         Cross-component abort tracking
-    ├── context/
-    │   └── pageContext.ts      P3 namespace seam (defensive)
-    └── __tests__/
-        ├── sdkMock.ts          In-memory @apache-superset/core mock
-        └── activate.test.tsx
-```
-
-## Run the unit tests
-
-```bash
-cd extensions/chat
-npm install            # first time only
-npx jest
-```
-
-The tests mock `@apache-superset/core` via `src/__tests__/sdkMock.ts` so they
-do not depend on host runtime wiring.
-
-## Build / bundle for deployment
-
-```bash
-# from the extension folder
-npm install
-npm run build
-
-# packaging into a .supx is handled by the Superset extensions CLI
-pip install apache-superset-extensions-cli
-superset-extensions bundle    # produces apache-superset.reference-chatbot-0.1.0.supx
-```
-
-Drop the `.supx` into the `EXTENSIONS_PATH` of a Superset instance that has
-`FEATURE_FLAGS = { "ENABLE_EXTENSIONS": True }`.
-
-## Selecting it as the active chatbot
-
-The host's singleton picker reads `active_chatbot_id` from the admin
-settings endpoint (`/api/v1/extensions/settings`). Set it to:
-
-```
-apache-superset.reference-chatbot
-```
-
-If no admin selection exists, the host falls back to the first-to-register
-chatbot — installing this extension alone is enough for the bubble to appear.
-
-## P3 integration seams
-
-All page-context derivation lives in [`src/context/pageContext.ts`](src/context/pageContext.ts).
-Each namespace branch (`dashboard`, `explore`, `dataset`, `navigation`) is
-called defensively — when the host implementation lands, the returned value
-becomes non-undefined automatically with no other change in the extension.
-
-The panel re-reads context on `popstate`. Once `navigation.onDidChangePage`
-is live on the host, the panel's `useEffect` should subscribe to it instead;
-that is the only file in the extension that needs to change for full P3
-context sync.
-
-## Known intentional non-features
-
-- No conversation persistence — by design (extension scope per SIP §2).
-- No real network. The mock stream is a `setTimeout` token emitter so the
-  cancellation contract is exercised without external dependencies.
-- No keyboard shortcut binding (Cmd+K). Extensions own that, but it adds
-  surface area not needed for platform validation.
-- No notification badge / icon mutation. SIP §3.2 recommends static icons;
-  the bubble re-renders freely already.
-
-## TODOs
-
-- **P1**: if/when the host gains `deactivate(): Promise<void>`, wrap the
-  master disposer in `activate.ts` to flush async work before returning.
-- **P3**: replace the `popstate` listener in `Panel.tsx` with
-  `navigation.onDidChangePage` once that event is wired up host-side.
-- **P4**: if the host pre-registers `core.chatbot__*` as host-owned intents,
-  swap `commands.registerCommand` for the implementation hook in
-  `commands.ts`. Command IDs do not change.

extensions/chat/extension.json

@@ -1,40 +0,0 @@
-{
-  "publisher": "apache-superset",
-  "name": "reference-chatbot",
-  "displayName": "Reference Chatbot",
-  "description": "Canonical environment-validation chatbot extension for the superset.chatbot contribution area. Exercises registration, lifecycle, singleton resolution, commands, fault isolation, and streaming teardown. Not a product chatbot.",
-  "version": "0.1.0",
-  "license": "Apache-2.0",
-  "permissions": [],
-  "contributes": {
-    "views": {
-      "app": {
-        "chatbot": [
-          {
-            "id": "apache-superset.reference-chatbot",
-            "name": "Reference Chatbot",
-            "description": "Validates the chatbot extension environment end-to-end.",
-            "icon": "Bubble"
-          }
-        ]
-      }
-    },
-    "commands": [
-      {
-        "id": "core.chatbot__open",
-        "title": "Open chatbot",
-        "description": "Opens the reference chatbot panel."
-      },
-      {
-        "id": "core.chatbot__close",
-        "title": "Close chatbot",
-        "description": "Closes the reference chatbot panel."
-      },
-      {
-        "id": "core.chatbot__toggle",
-        "title": "Toggle chatbot",
-        "description": "Toggles the reference chatbot panel."
-      }
-    ]
-  }
-}

extensions/chat/jest.config.js

@@ -1,53 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-const path = require('path');
-
-// When run as a standalone package (`cd extensions/chat && npm test`), modules
-// resolve from this folder's own node_modules. When run from the superset-frontend
-// workspace (CI, dev convenience), resolve ts-jest there too.
-const tsJest = (() => {
-  try {
-    require.resolve('ts-jest');
-    return 'ts-jest';
-  } catch {
-    return path.resolve(
-      __dirname,
-      '..',
-      '..',
-      'superset-frontend',
-      'node_modules',
-      'ts-jest',
-    );
-  }
-})();
-
-module.exports = {
-  testEnvironment: 'jsdom',
-  rootDir: __dirname,
-  testMatch: ['<rootDir>/src/**/*.test.{ts,tsx}'],
-  // When running from the extension folder without node_modules installed,
-  // resolve react / react-dom from the superset-frontend workspace.
-  modulePaths: [path.resolve(__dirname, '..', '..', 'superset-frontend', 'node_modules')],
-  moduleNameMapper: {
-    '^@apache-superset/core$': '<rootDir>/src/__tests__/sdkMock.ts',
-  },
-  transform: {
-    '^.+\\.tsx?$': [tsJest, { tsconfig: '<rootDir>/tsconfig.test.json' }],
-  },
-};

extensions/chat/package.json

@@ -1,26 +0,0 @@
-{
-  "name": "@apache-superset/reference-chatbot",
-  "version": "0.1.0",
-  "private": true,
-  "license": "Apache-2.0",
-  "description": "Reference chatbot extension that validates the Superset chatbot extension platform.",
-  "scripts": {
-    "start": "webpack serve --mode development",
-    "build": "webpack --stats-error-details --mode production"
-  },
-  "peerDependencies": {
-    "@apache-superset/core": "^0.1.0",
-    "react": "^18.2.0",
-    "react-dom": "^18.2.0"
-  },
-  "devDependencies": {
-    "@apache-superset/core": "^0.1.0",
-    "@types/react": "^18.2.0",
-    "@types/react-dom": "^18.2.0",
-    "ts-loader": "^9.5.0",
-    "typescript": "^5.0.0",
-    "webpack": "^5.0.0",
-    "webpack-cli": "^5.0.0",
-    "webpack-dev-server": "^5.0.0"
-  }
-}

extensions/chat/src/ReferenceChatbot.tsx

@@ -1,45 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import React, { useEffect, useState } from 'react';
-import { commands } from '@apache-superset/core';
-import { Bubble } from './components/Bubble';
-import { Panel } from './components/Panel';
-import { ExtensionErrorBoundary } from './components/ErrorBoundary';
-import { isOpen, subscribe } from './state';
-
-/**
- * Root extension component. Mirrors module-state into React via `subscribe`
- * so the bubble↔panel transition is driven by the same command handlers
- * that external callers use (`core.chatbot__open`, `__close`, `__toggle`).
- */
-export const ReferenceChatbot: React.FC = () => {
-  const [open, setOpenState] = useState<boolean>(isOpen());
-
-  useEffect(() => subscribe(setOpenState), []);
-
-  return (
-    <ExtensionErrorBoundary>
-      {open ? (
-        <Panel onClose={() => commands.executeCommand('core.chatbot__close')} />
-      ) : (
-        <Bubble onClick={() => commands.executeCommand('core.chatbot__open')} />
-      )}
-    </ExtensionErrorBoundary>
-  );
-};

extensions/chat/src/__tests__/activate.test.tsx

@@ -1,144 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import { commands } from '@apache-superset/core';
-import { registry, reset } from './sdkMock';
-import { activate, VIEW_ID, CHATBOT_LOCATION } from '../activate';
-import { isOpen } from '../state';
-import { streamReply } from '../streaming/mockStream';
-import {
-  registerActiveController,
-  unregisterActiveController,
-  abortAllActiveControllers,
-} from '../streaming/registry';
-
-beforeEach(() => {
-  reset();
-});
-
-test('registers one view at superset.chatbot and three chatbot commands', () => {
-  const disposable = activate();
-
-  try {
-    expect(registry.views.size).toBe(1);
-    const entry = registry.views.get(VIEW_ID);
-    expect(entry?.location).toBe(CHATBOT_LOCATION);
-    expect(entry?.view.icon).toBe('Bubble');
-
-    expect(Array.from(registry.commands.keys()).sort()).toEqual([
-      'core.chatbot__close',
-      'core.chatbot__open',
-      'core.chatbot__toggle',
-    ]);
-  } finally {
-    disposable.dispose();
-  }
-});
-
-test('executeCommand drives open/close/toggle through module state', async () => {
-  const disposable = activate();
-  try {
-    expect(isOpen()).toBe(false);
-
-    await commands.executeCommand('core.chatbot__open');
-    expect(isOpen()).toBe(true);
-
-    await commands.executeCommand('core.chatbot__toggle');
-    expect(isOpen()).toBe(false);
-
-    await commands.executeCommand('core.chatbot__toggle');
-    expect(isOpen()).toBe(true);
-
-    await commands.executeCommand('core.chatbot__close');
-    expect(isOpen()).toBe(false);
-  } finally {
-    disposable.dispose();
-  }
-});
-
-test('disposing the master disposable unregisters view + commands', () => {
-  const disposable = activate();
-  expect(registry.views.size).toBe(1);
-  expect(registry.commands.size).toBe(3);
-
-  disposable.dispose();
-
-  expect(registry.views.size).toBe(0);
-  expect(registry.commands.size).toBe(0);
-});
-
-test('disposal is idempotent', () => {
-  const disposable = activate();
-  disposable.dispose();
-  expect(() => disposable.dispose()).not.toThrow();
-  expect(registry.views.size).toBe(0);
-});
-
-test('re-activate after dispose works (validates replace semantics)', () => {
-  const first = activate();
-  first.dispose();
-
-  const second = activate();
-  try {
-    expect(registry.views.size).toBe(1);
-    expect(registry.commands.size).toBe(3);
-    expect(isOpen()).toBe(false); // resetState() cleared open flag
-  } finally {
-    second.dispose();
-  }
-});
-
-test('aborting an active controller stops the stream cleanly', async () => {
-  const controller = new AbortController();
-  registerActiveController(controller);
-
-  const iter = streamReply('hello world', controller.signal);
-  const received: string[] = [];
-
-  const consume = (async () => {
-    for await (const tok of iter) received.push(tok);
-  })();
-
-  // Abort after a single tick — the iterator must return without throwing.
-  await new Promise(r => setTimeout(r, 50));
-  abortAllActiveControllers();
-  await expect(consume).resolves.toBeUndefined();
-
-  unregisterActiveController(controller);
-  expect(received.length).toBeLessThan(20); // would be ~20+ tokens if uncancelled
-});
-
-test('disposing the extension aborts any in-flight controller', async () => {
-  const disposable = activate();
-  const controller = new AbortController();
-  registerActiveController(controller);
-
-  const iter = streamReply('a longer prompt to ensure many tokens', controller.signal);
-  const consume = (async () => {
-    // eslint-disable-next-line no-unused-vars, @typescript-eslint/no-unused-vars
-    for await (const _tok of iter) {
-      // drain
-    }
-  })();
-
-  await new Promise(r => setTimeout(r, 30));
-  disposable.dispose();
-
-  await expect(consume).resolves.toBeUndefined();
-  expect(controller.signal.aborted).toBe(true);
-});

extensions/chat/src/__tests__/sdkMock.ts

@@ -1,119 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/**
- * In-memory mock of `@apache-superset/core` for unit-testing the extension.
- *
- * Mirrors only the surfaces the reference chatbot consumes:
- *  - views.registerView returns a disposable that removes the view
- *  - commands.registerCommand / executeCommand round-trip handlers
- *  - sqlLab.getCurrentTab returns undefined (no SQL Lab in tests)
- *
- * The mock is intentionally observable: tests can read `registry.views` and
- * `registry.commands` to assert contract compliance.
- */
-
-import type { ReactElement } from 'react';
-
-type Provider = () => ReactElement;
-
-interface ViewDescriptor {
-  id: string;
-  name: string;
-  icon?: string;
-  description?: string;
-}
-
-interface DisposableLike {
-  dispose(): void;
-}
-
-interface RegisteredView {
-  view: ViewDescriptor;
-  location: string;
-  provider: Provider;
-}
-
-interface RegisteredCommand {
-  id: string;
-  title: string;
-  handler: (...args: any[]) => any;
-}
-
-export const registry = {
-  views: new Map<string, RegisteredView>(),
-  commands: new Map<string, RegisteredCommand>(),
-};
-
-export const reset = (): void => {
-  registry.views.clear();
-  registry.commands.clear();
-};
-
-export const views = {
-  registerView(
-    view: ViewDescriptor,
-    location: string,
-    provider: Provider,
-  ): DisposableLike {
-    registry.views.set(view.id, { view, location, provider });
-    return {
-      dispose: () => {
-        registry.views.delete(view.id);
-      },
-    };
-  },
-  getViews(location: string) {
-    return Array.from(registry.views.values())
-      .filter(v => v.location === location)
-      .map(v => v.view);
-  },
-};
-
-export const commands = {
-  registerCommand(
-    command: { id: string; title: string },
-    handler: (...args: any[]) => any,
-  ): DisposableLike {
-    registry.commands.set(command.id, {
-      id: command.id,
-      title: command.title,
-      handler,
-    });
-    return {
-      dispose: () => {
-        registry.commands.delete(command.id);
-      },
-    };
-  },
-  async executeCommand(id: string, ...rest: any[]): Promise<unknown> {
-    const cmd = registry.commands.get(id);
-    return cmd?.handler(...rest);
-  },
-  getCommands() {
-    return Array.from(registry.commands.values()).map(c => ({
-      id: c.id,
-      title: c.title,
-    }));
-  },
-};
-
-export const sqlLab = {
-  getCurrentTab: () => undefined,
-};

extensions/chat/src/activate.ts

@@ -1,88 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import React from 'react';
-import { views } from '@apache-superset/core';
-import { ReferenceChatbot } from './ReferenceChatbot';
-import { registerChatbotCommands } from './commands';
-import { abortAllActiveControllers } from './streaming/registry';
-import { resetState } from './state';
-
-export const VIEW_ID = 'apache-superset.reference-chatbot';
-export const CHATBOT_LOCATION = 'superset.chatbot';
-
-interface DisposableLike {
-  dispose(): void;
-}
-
-/**
- * Registers the reference chatbot and returns a single disposable that
- * tears down everything it created. Idempotent across activate/dispose cycles.
- *
- * Cleanup order matters: stop in-flight streams first so listeners do not
- * receive late tokens, then unregister commands (so user clicks during teardown
- * become no-ops), then unregister the view (so the host's ChatbotMount unmounts
- * the React tree), and finally reset module state.
- *
- * Returns a plain `{ dispose }` object rather than constructing a Disposable
- * from the SDK — the SDK class is host-injected and only reliably available
- * via window.superset at runtime, while plain disposable-likes work in both
- * runtime and unit-test contexts.
- *
- * TODO(P1): when the host gains an async `deactivate(): Promise<void>` hook,
- * wrap the master disposer to flush in-flight async work before returning.
- */
-export const activate = (): DisposableLike => {
-  const commandDisposables = registerChatbotCommands();
-  const viewDisposable = views.registerView(
-    {
-      id: VIEW_ID,
-      name: 'Reference Chatbot',
-      icon: 'Bubble',
-      description: 'Validates the chatbot extension environment end-to-end.',
-    },
-    CHATBOT_LOCATION,
-    () => React.createElement(ReferenceChatbot),
-  );
-
-  let disposed = false;
-  return {
-    dispose() {
-      if (disposed) return;
-      disposed = true;
-      try {
-        abortAllActiveControllers();
-      } catch {
-        // streams are best-effort during teardown
-      }
-      commandDisposables.forEach(d => {
-        try {
-          d.dispose();
-        } catch {
-          // a single command failing to unregister must not block the rest
-        }
-      });
-      try {
-        viewDisposable.dispose();
-      } catch {
-        // ignore
-      }
-      resetState();
-    },
-  };
-};

extensions/chat/src/commands.ts

@@ -1,47 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import { commands } from '@apache-superset/core';
-import { isOpen, setOpen } from './state';
-
-interface DisposableLike {
-  dispose(): void;
-}
-
-/**
- * Registers the three chatbot intent commands and returns their disposables.
- *
- * TODO(P4): if/when the host pre-registers `core.chatbot__*` as host-owned
- * intents that extensions implement instead of own, swap registerCommand for
- * the implementation hook. The command ids stay the same so call sites do not
- * change.
- */
-export const registerChatbotCommands = (): DisposableLike[] => [
-  commands.registerCommand(
-    { id: 'core.chatbot__open', title: 'Open chatbot' },
-    () => setOpen(true),
-  ),
-  commands.registerCommand(
-    { id: 'core.chatbot__close', title: 'Close chatbot' },
-    () => setOpen(false),
-  ),
-  commands.registerCommand(
-    { id: 'core.chatbot__toggle', title: 'Toggle chatbot' },
-    () => setOpen(!isOpen()),
-  ),
-];

extensions/chat/src/components/Bubble.tsx

@@ -1,46 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import React from 'react';
-
-interface Props {
-  onClick: () => void;
-}
-
-export const Bubble: React.FC<Props> = ({ onClick }) => (
-  <button
-    type="button"
-    onClick={onClick}
-    data-test="reference-chatbot-bubble"
-    aria-label="Open reference chatbot"
-    style={{
-      width: 56,
-      height: 56,
-      borderRadius: '50%',
-      border: 'none',
-      background: '#1f6feb',
-      color: '#fff',
-      fontSize: 24,
-      fontWeight: 600,
-      cursor: 'pointer',
-      boxShadow: '0 4px 14px rgba(0,0,0,0.18)',
-    }}
-  >
-    ?
-  </button>
-);

extensions/chat/src/components/ErrorBoundary.tsx

@@ -1,66 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import React from 'react';
-
-interface State {
-  error: Error | null;
-}
-
-/**
- * Defense-in-depth boundary. The host already wraps the mount in its own
- * ErrorBoundary; this one keeps a panel crash from also bringing down the
- * bubble next to it.
- */
-export class ExtensionErrorBoundary extends React.Component<
-  React.PropsWithChildren<{}>,
-  State
-> {
-  state: State = { error: null };
-
-  static getDerivedStateFromError(error: Error): State {
-    return { error };
-  }
-
-  componentDidCatch(error: Error): void {
-    // eslint-disable-next-line no-console
-    console.error('[reference-chatbot] render error', error);
-  }
-
-  render() {
-    if (this.state.error) {
-      return (
-        <div
-          data-test="reference-chatbot-error"
-          style={{
-            padding: 12,
-            border: '1px solid #f5222d',
-            borderRadius: 6,
-            background: '#fff1f0',
-            color: '#a8071a',
-            fontSize: 12,
-            maxWidth: 320,
-          }}
-        >
-          Reference chatbot crashed: {this.state.error.message}
-        </div>
-      );
-    }
-    return <>{this.props.children}</>;
-  }
-}

extensions/chat/src/components/Panel.tsx

@@ -1,307 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import React, { useCallback, useEffect, useRef, useState } from 'react';
-import { streamReply } from '../streaming/mockStream';
-import { getPageContext, PageContext, subscribeToPageChanges } from '../context/pageContext';
-import { registerActiveController, unregisterActiveController } from '../streaming/registry';
-
-interface Props {
-  onClose: () => void;
-}
-
-interface Message {
-  id: number;
-  from: 'user' | 'bot';
-  text: string;
-}
-
-let messageSeq = 0;
-
-/**
- * Builds the full set of context fields the host exposes for the current
- * surface, as ordered [label, value] rows. Whatever the host provides for where
- * the user is, the panel shows — nothing is summarized away. Returns an empty
- * array for surfaces with no active entity (list/home pages), where the
- * `page:` line alone is the context.
- */
-const contextRows = (ctx: PageContext): Array<[string, string]> => {
-  const rows: Array<[string, string]> = [];
-  const push = (label: string, value: unknown) => {
-    if (value !== undefined && value !== null && value !== '') {
-      rows.push([label, String(value)]);
-    }
-  };
-
-  const chart = ctx.chart as
-    | {
-        chartId?: number | null;
-        chartName?: string | null;
-        vizType?: string;
-        datasourceId?: number | null;
-        datasourceName?: string | null;
-      }
-    | undefined;
-  if (chart) {
-    push('chart', chart.chartName ?? (chart.chartId == null ? '(unsaved)' : ''));
-    push('chartId', chart.chartId);
-    push('viz', chart.vizType);
-    push('datasource', chart.datasourceName);
-    push('datasourceId', chart.datasourceId);
-  }
-
-  const dashboard = ctx.dashboard as
-    | { dashboardId?: number; title?: string; filters?: Array<{ label: string; value: unknown }> }
-    | undefined;
-  if (dashboard) {
-    push('dashboard', dashboard.title);
-    push('dashboardId', dashboard.dashboardId);
-    const filters = dashboard.filters ?? [];
-    if (filters.length) {
-      push(
-        'filters',
-        filters.map(f => `${f.label}=${JSON.stringify(f.value)}`).join(', '),
-      );
-    }
-  }
-
-  const dataset = ctx.dataset as
-    | {
-        datasetId?: number;
-        datasetName?: string;
-        schema?: string | null;
-        catalog?: string | null;
-        databaseName?: string | null;
-        isVirtual?: boolean;
-      }
-    | undefined;
-  if (dataset) {
-    push('dataset', dataset.datasetName);
-    push('datasetId', dataset.datasetId);
-    push('schema', dataset.schema);
-    push('catalog', dataset.catalog);
-    push('database', dataset.databaseName);
-    if (typeof dataset.isVirtual === 'boolean') {
-      push('virtual', dataset.isVirtual);
-    }
-  }
-
-  if (ctx.sqlLab) {
-    push('tab', ctx.sqlLab.title);
-  }
-
-  return rows;
-};
-
-export const Panel: React.FC<Props> = ({ onClose }) => {
-  const [input, setInput] = useState('');
-  const [messages, setMessages] = useState<Message[]>([]);
-  const [streaming, setStreaming] = useState(false);
-  const [pageContext, setPageContext] = useState<PageContext>(() => getPageContext());
-  const controllerRef = useRef<AbortController | null>(null);
-
-  useEffect(
-    () => subscribeToPageChanges(() => setPageContext(getPageContext())),
-    [],
-  );
-
-  useEffect(
-    () => () => {
-      // Component unmount cancels any in-flight stream.
-      controllerRef.current?.abort();
-    },
-    [],
-  );
-
-  const send = useCallback(async () => {
-    const prompt = input.trim();
-    if (!prompt || streaming) return;
-    setInput('');
-    const userMsg: Message = { id: ++messageSeq, from: 'user', text: prompt };
-    const botMsg: Message = { id: ++messageSeq, from: 'bot', text: '' };
-    setMessages(prev => [...prev, userMsg, botMsg]);
-    setStreaming(true);
-
-    const controller = new AbortController();
-    controllerRef.current = controller;
-    registerActiveController(controller);
-
-    try {
-      for await (const token of streamReply(prompt, controller.signal)) {
-        setMessages(prev =>
-          prev.map(m => (m.id === botMsg.id ? { ...m, text: m.text + token } : m)),
-        );
-      }
-    } finally {
-      unregisterActiveController(controller);
-      controllerRef.current = null;
-      setStreaming(false);
-    }
-  }, [input, streaming]);
-
-  const cancel = useCallback(() => {
-    controllerRef.current?.abort();
-  }, []);
-
-  return (
-    <div
-      data-test="reference-chatbot-panel"
-      style={{
-        width: 360,
-        maxHeight: 480,
-        display: 'flex',
-        flexDirection: 'column',
-        background: '#fff',
-        border: '1px solid #d9d9d9',
-        borderRadius: 8,
-        boxShadow: '0 8px 24px rgba(0,0,0,0.18)',
-        overflow: 'hidden',
-        fontSize: 13,
-      }}
-    >
-      <header
-        style={{
-          padding: '8px 12px',
-          background: '#1f6feb',
-          color: '#fff',
-          display: 'flex',
-          justifyContent: 'space-between',
-          alignItems: 'center',
-        }}
-      >
-        <span>Reference Chatbot</span>
-        <button
-          type="button"
-          onClick={onClose}
-          aria-label="Close chatbot"
-          data-test="reference-chatbot-close"
-          style={{
-            background: 'transparent',
-            border: 'none',
-            color: '#fff',
-            fontSize: 16,
-            cursor: 'pointer',
-          }}
-        >
-          ×
-        </button>
-      </header>
-
-      <div
-        data-test="reference-chatbot-context"
-        style={{
-          padding: '6px 12px',
-          background: '#f6f8fa',
-          borderBottom: '1px solid #eaecef',
-          fontFamily: 'monospace',
-          fontSize: 11,
-          color: '#57606a',
-          wordBreak: 'break-all',
-        }}
-      >
-        <div>page: {pageContext.pageType}</div>
-        {contextRows(pageContext).map(([label, value]) => (
-          <div key={label}>
-            {label}: {value}
-          </div>
-        ))}
-      </div>
-
-      <div style={{ flex: 1, overflowY: 'auto', padding: 12 }}>
-        {messages.length === 0 && (
-          <p style={{ color: '#8c8c8c' }}>
-            Ask anything — replies are canned tokens streamed by the reference extension.
-          </p>
-        )}
-        {messages.map(m => (
-          <div
-            key={m.id}
-            data-test={`reference-chatbot-msg-${m.from}`}
-            style={{
-              margin: '6px 0',
-              textAlign: m.from === 'user' ? 'right' : 'left',
-            }}
-          >
-            <span
-              style={{
-                display: 'inline-block',
-                padding: '4px 8px',
-                borderRadius: 6,
-                background: m.from === 'user' ? '#1f6feb' : '#eef0f3',
-                color: m.from === 'user' ? '#fff' : '#1f2328',
-                maxWidth: '85%',
-                whiteSpace: 'pre-wrap',
-              }}
-            >
-              {m.text || '…'}
-            </span>
-          </div>
-        ))}
-      </div>
-
-      <footer
-        style={{
-          padding: 8,
-          borderTop: '1px solid #eaecef',
-          display: 'flex',
-          gap: 6,
-        }}
-      >
-        <input
-          aria-label="Chat input"
-          data-test="reference-chatbot-input"
-          value={input}
-          onChange={e => setInput(e.target.value)}
-          onKeyDown={e => {
-            if (e.key === 'Enter' && !e.shiftKey) {
-              e.preventDefault();
-              send();
-            }
-          }}
-          placeholder="Type a message"
-          style={{
-            flex: 1,
-            padding: '4px 8px',
-            border: '1px solid #d9d9d9',
-            borderRadius: 4,
-          }}
-        />
-        {streaming ? (
-          <button
-            type="button"
-            onClick={cancel}
-            data-test="reference-chatbot-cancel"
-            style={{ padding: '4px 10px' }}
-          >
-            Stop
-          </button>
-        ) : (
-          <button
-            type="button"
-            onClick={send}
-            data-test="reference-chatbot-send"
-            disabled={!input.trim()}
-            style={{ padding: '4px 10px' }}
-          >
-            Send
-          </button>
-        )}
-      </footer>
-    </div>
-  );
-};

extensions/chat/src/context/pageContext.ts

@@ -1,159 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/**
- * Single integration seam for the P3 namespaces.
- *
- * Each surface namespace is consumed via a try/catch — the host may ship a
- * version where a namespace function is declared but not yet implemented at
- * runtime, and the reference extension must keep working in that case. As
- * each namespace lights up on the host, that branch starts returning real
- * data without any change here.
- *
- * Route inference is the fallback when navigation.getPageType() is absent.
- */
-
-import * as core from '@apache-superset/core';
-
-export type PageType =
-  | 'home'
-  | 'dashboard'
-  | 'dashboard_list'
-  | 'chart'
-  | 'chart_list'
-  | 'sqllab'
-  | 'query_history'
-  | 'saved_queries'
-  | 'dataset'
-  | 'dataset_list'
-  | 'unknown';
-
-export interface PageContext {
-  pageType: PageType;
-  dashboard?: unknown;
-  chart?: unknown;
-  dataset?: unknown;
-  sqlLab?: { tabId: string; title: string };
-  href: string;
-}
-
-const tryCall = <T>(fn: () => T | undefined): T | undefined => {
-  try {
-    return fn();
-  } catch {
-    return undefined;
-  }
-};
-
-const inferPageType = (pathname: string): PageType => {
-  if (pathname.startsWith('/sqllab/history')) return 'query_history';
-  if (pathname.startsWith('/savedqueryview/list')) return 'saved_queries';
-  if (pathname.startsWith('/sqllab')) return 'sqllab';
-  if (pathname.startsWith('/dashboard/list')) return 'dashboard_list';
-  if (
-    pathname.startsWith('/superset/dashboard') ||
-    pathname.startsWith('/dashboard')
-  )
-    return 'dashboard';
-  if (pathname.startsWith('/chart/list')) return 'chart_list';
-  if (pathname.startsWith('/explore') || pathname.startsWith('/chart'))
-    return 'chart';
-  if (pathname.startsWith('/tablemodelview/list')) return 'dataset_list';
-  if (pathname.startsWith('/tablemodelview') || pathname.startsWith('/dataset'))
-    return 'dataset';
-  if (pathname === '/' || pathname.startsWith('/superset/welcome'))
-    return 'home';
-  return 'unknown';
-};
-
-const readSqlLabTab = (): PageContext['sqlLab'] => {
-  const tab = tryCall(() => (core as any).sqlLab?.getCurrentTab?.());
-  return tab ? { tabId: tab.id, title: tab.title } : undefined;
-};
-
-const readPageType = (pathname: string): PageType => {
-  const fromNav = tryCall(() => (core as any).navigation?.getPageType?.());
-  return (fromNav as PageType | undefined) ?? inferPageType(pathname);
-};
-
-/**
- * Subscribe to page-context changes and invoke `onChange` whenever any part of
- * the context may have changed. Returns a cleanup function.
- *
- * Three classes of change are watched:
- *  - Navigation (`navigation.onDidChangePage`, or `popstate` as a fallback for
- *    hosts without the namespace) — the user moved to a different surface.
- *  - Entity hydration (`explore.onDidChangeChart`, `dashboard.onDidChangeDashboard`,
- *    `dataset.onDidChangeDataset`) — the surface's entity loaded or changed
- *    *after* navigation settled. This matters because a surface (notably Explore)
- *    can finish hydrating several seconds after the route change fires, so a
- *    navigation-only subscription would read empty entity context and never
- *    refresh once the real data arrives.
- *  - In-surface SQL Lab changes (`sqlLab.onDidChangeActiveTab`,
- *    `sqlLab.onDidChangeTabTitle`) — switching or renaming a tab does not change
- *    the route, so without these the panel would keep showing the first tab.
- */
-export const subscribeToPageChanges = (onChange: () => void): (() => void) => {
-  const disposers: Array<() => void> = [];
-
-  const nav = tryCall(() => (core as any).navigation);
-  if (nav?.onDidChangePage) {
-    const sub = nav.onDidChangePage(onChange);
-    disposers.push(() => sub.dispose());
-  } else {
-    window.addEventListener('popstate', onChange);
-    disposers.push(() => window.removeEventListener('popstate', onChange));
-  }
-
-  // Entity-context change events. Each is optional — a host may not implement a
-  // given namespace yet — so subscribe defensively and collect any disposer.
-  const subscribeEntity = (
-    getNamespace: () => any,
-    method: string,
-  ): void => {
-    const sub = tryCall(() => getNamespace()?.[method]?.(onChange));
-    if (sub?.dispose) {
-      disposers.push(() => sub.dispose());
-    }
-  };
-  subscribeEntity(() => (core as any).explore, 'onDidChangeChart');
-  subscribeEntity(() => (core as any).dashboard, 'onDidChangeDashboard');
-  subscribeEntity(() => (core as any).dataset, 'onDidChangeDataset');
-  // SQL Lab tab switches/renames happen without a route change.
-  subscribeEntity(() => (core as any).sqlLab, 'onDidChangeActiveTab');
-  subscribeEntity(() => (core as any).sqlLab, 'onDidChangeTabTitle');
-
-  return () => disposers.forEach(dispose => dispose());
-};
-
-export const getPageContext = (): PageContext => {
-  const { pathname, href } =
-    typeof window !== 'undefined'
-      ? window.location
-      : { pathname: '', href: '' };
-
-  return {
-    pageType: readPageType(pathname),
-    dashboard: tryCall(() => (core as any).dashboard?.getCurrentDashboard?.()),
-    chart: tryCall(() => (core as any).explore?.getCurrentChart?.()),
-    dataset: tryCall(() => (core as any).dataset?.getCurrentDataset?.()),
-    sqlLab: readSqlLabTab(),
-    href,
-  };
-};

extensions/chat/src/state.ts

@@ -1,57 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/**
- * Module-scoped open/closed state plus a tiny emitter the UI subscribes to.
- *
- * Lives entirely inside the extension — never reaches into the host store.
- * Reset on dispose so re-activation starts cleanly.
- */
-
-export type OpenStateListener = (open: boolean) => void;
-
-let open = false;
-const listeners = new Set<OpenStateListener>();
-
-export const isOpen = (): boolean => open;
-
-export const setOpen = (next: boolean): void => {
-  if (next === open) return;
-  open = next;
-  listeners.forEach(fn => {
-    try {
-      fn(open);
-    } catch {
-      // A listener throwing must not block other listeners or flip our state back.
-    }
-  });
-};
-
-export const subscribe = (fn: OpenStateListener): (() => void) => {
-  listeners.add(fn);
-  return () => {
-    listeners.delete(fn);
-  };
-};
-
-/** Drains listeners and resets state. Called from the master Disposable. */
-export const resetState = (): void => {
-  open = false;
-  listeners.clear();
-};

extensions/chat/src/streaming/mockStream.ts

@@ -1,73 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/**
- * Mock streaming reply used to validate stream teardown semantics.
- *
- * The reference chatbot is environment-validation only — there is no LLM.
- * This iterator yields canned tokens on a timer and exits cleanly when its
- * AbortSignal is fired. Disposal of the extension aborts any in-flight
- * controller, which is the contract that proves async cancellation works.
- */
-
-const TICK_MS = 40;
-
-const buildReply = (prompt: string): string => {
-  const trimmed = prompt.trim();
-  if (!trimmed) {
-    return 'Reference chatbot online. Send a message to validate streaming.';
-  }
-  return (
-    `[reference-chatbot] received "${trimmed}". ` +
-    'Streaming token-by-token to validate cancellation and teardown.'
-  );
-};
-
-const sleep = (ms: number, signal: AbortSignal): Promise<void> =>
-  new Promise((resolve, reject) => {
-    if (signal.aborted) {
-      reject(new DOMException('aborted', 'AbortError'));
-      return;
-    }
-    const timer = setTimeout(() => {
-      signal.removeEventListener('abort', onAbort);
-      resolve();
-    }, ms);
-    const onAbort = () => {
-      clearTimeout(timer);
-      reject(new DOMException('aborted', 'AbortError'));
-    };
-    signal.addEventListener('abort', onAbort, { once: true });
-  });
-
-export async function* streamReply(
-  prompt: string,
-  signal: AbortSignal,
-): AsyncIterableIterator<string> {
-  const tokens = buildReply(prompt).split(/(\s+)/);
-  for (const token of tokens) {
-    if (signal.aborted) return;
-    try {
-      await sleep(TICK_MS, signal);
-    } catch {
-      return;
-    }
-    yield token;
-  }
-}

extensions/chat/tsconfig.json

@@ -1,16 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "es2019",
-    "module": "esnext",
-    "moduleResolution": "node",
-    "jsx": "react",
-    "strict": true,
-    "noImplicitAny": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "forceConsistentCasingInFileNames": true,
-    "lib": ["dom", "es2019"]
-  },
-  "include": ["src"],
-  "exclude": ["src/**/*.test.ts", "src/**/*.test.tsx", "src/__tests__"]
-}

extensions/chat/tsconfig.test.json

@@ -1,16 +0,0 @@
-{
-  "extends": "./tsconfig.json",
-  "compilerOptions": {
-    "baseUrl": ".",
-    "paths": {
-      "@apache-superset/core": ["src/__tests__/sdkMock.ts"]
-    },
-    "typeRoots": [
-      "./node_modules/@types",
-      "../../superset-frontend/node_modules/@types"
-    ],
-    "types": ["jest", "node"]
-  },
-  "include": ["src"],
-  "exclude": []
-}

extensions/chat/webpack.config.js

@@ -1,108 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-const path = require('path');
-const fs = require('fs');
-const { ModuleFederationPlugin } = require('webpack').container;
-const packageConfig = require('./package.json');
-const extensionConfig = require('./extension.json');
-
-const MODULE_FEDERATION_NAME = 'apacheSuperset_referenceChatbot';
-
-/**
- * Emits the `manifest.json` the host reads from the extension `dist/` root.
- *
- * The host (`superset/extensions/utils.py`) expects an extension dist laid out
- * as `dist/manifest.json` plus the federated bundle under `dist/frontend/dist/`.
- * The manifest carries `extension.json` verbatim, plus the composite `id` and a
- * `frontend` block naming the content-hashed `remoteEntry` so the host can load
- * the right file. Because the hash is only known after the build, the manifest
- * is written from the final asset names rather than checked in.
- */
-class EmitManifestPlugin {
-  apply(compiler) {
-    compiler.hooks.afterEmit.tap('EmitManifestPlugin', compilation => {
-      const assets = Object.keys(compilation.assets);
-      const remoteEntry = assets.find(name => /^remoteEntry\..*\.js$/.test(name));
-      if (!remoteEntry) {
-        throw new Error('EmitManifestPlugin: no remoteEntry asset was emitted');
-      }
-      const manifest = {
-        ...extensionConfig,
-        id: `${extensionConfig.publisher}.${extensionConfig.name}`,
-        frontend: {
-          remoteEntry,
-          moduleFederationName: MODULE_FEDERATION_NAME,
-        },
-      };
-      fs.writeFileSync(
-        path.resolve(__dirname, 'dist', 'manifest.json'),
-        `${JSON.stringify(manifest, null, 2)}\n`,
-      );
-    });
-  }
-}
-
-module.exports = (env, argv) => {
-  const isProd = argv.mode === 'production';
-
-  return {
-    entry: isProd ? {} : './src/index.tsx',
-    mode: isProd ? 'production' : 'development',
-    devtool: isProd ? false : 'eval-cheap-module-source-map',
-    devServer: {
-      port: 3030,
-      headers: { 'Access-Control-Allow-Origin': '*' },
-    },
-    output: {
-      clean: true,
-      filename: isProd ? undefined : '[name].[contenthash].js',
-      chunkFilename: '[name].[contenthash].js',
-      path: path.resolve(__dirname, 'dist', 'frontend', 'dist'),
-      publicPath: `/api/v1/extensions/${extensionConfig.publisher}/${extensionConfig.name}/`,
-    },
-    resolve: { extensions: ['.ts', '.tsx', '.js', '.jsx'] },
-    externalsType: 'window',
-    externals: { '@apache-superset/core': 'superset' },
-    module: {
-      rules: [
-        { test: /\.tsx?$/, use: 'ts-loader', exclude: /node_modules/ },
-      ],
-    },
-    plugins: [
-      new ModuleFederationPlugin({
-        name: MODULE_FEDERATION_NAME,
-        filename: 'remoteEntry.[contenthash].js',
-        exposes: { './index': './src/index.tsx' },
-        shared: {
-          react: {
-            singleton: true,
-            requiredVersion: packageConfig.peerDependencies.react,
-            import: false,
-          },
-          'react-dom': {
-            singleton: true,
-            requiredVersion: packageConfig.peerDependencies['react-dom'],
-            import: false,
-          },
-        },
-      }),
-      new EmitManifestPlugin(),
-    ],
-  };
-};

extensions/chat2/README.md

@@ -1,138 +0,0 @@
-<!--
-Licensed to the Apache Software Foundation (ASF) under one
-or more contributor license agreements.  See the NOTICE file
-distributed with this work for additional information
-regarding copyright ownership.  The ASF licenses this file
-to you under the Apache License, Version 2.0 (the
-"License"); you may not use this file except in compliance
-with the License.  You may obtain a copy of the License at
-
-  http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing,
-software distributed under the License is distributed on an
-"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-KIND, either express or implied.  See the License for the
-specific language governing permissions and limitations
-under the License.
--->
-
-# Reference Chatbot Extension
-
-Canonical environment-validation extension for the `superset.chatbot`
-contribution area. **Not** a product chatbot — there is no LLM, no backend,
-no persistence. Its purpose is to exercise the extension platform end-to-end:
-
-- `views.registerView` at `superset.chatbot` (singleton resolution)
-- Lifecycle activation + a master disposable that tears down everything
-- `commands.registerCommand` for `core.chatbot__open|close|toggle`
-- Mock streaming with `AbortController` cancellation on dispose
-- Defense-in-depth React error boundary inside the panel
-- A single P3 page-context seam that lights up automatically as the
-  `dashboard` / `explore` / `dataset` / `navigation` namespaces become
-  available at runtime on the host
-
-It is intended as the reference implementation third-party chatbot extension
-authors copy. Anything that ships as host-internal (the mount point, the
-admin picker, the `getActiveChatbot` resolver) is **not** here — see the
-host side at `superset-frontend/src/components/ChatbotMount/` and
-`superset-frontend/src/core/chatbot/`.
-
-## Layout
-
-```
-extensions/chat/
-├── extension.json              Manifest (app.chatbot view + commands)
-├── package.json
-├── tsconfig.json
-├── webpack.config.js           ModuleFederation → window.superset
-├── jest.config.js              Self-contained unit tests
-└── src/
-    ├── index.tsx               MF entry — calls activate() once
-    ├── activate.ts             Returns master disposable
-    ├── commands.ts             core.chatbot__open|close|toggle
-    ├── state.ts                Module-scoped open/closed + emitter
-    ├── ReferenceChatbot.tsx    Root component (bubble ↔ panel)
-    ├── components/
-    │   ├── Bubble.tsx
-    │   ├── Panel.tsx
-    │   └── ErrorBoundary.tsx
-    ├── streaming/
-    │   ├── mockStream.ts       AsyncIterable<string> + AbortSignal
-    │   └── registry.ts         Cross-component abort tracking
-    ├── context/
-    │   └── pageContext.ts      P3 namespace seam (defensive)
-    └── __tests__/
-        ├── sdkMock.ts          In-memory @apache-superset/core mock
-        └── activate.test.tsx
-```
-
-## Run the unit tests
-
-```bash
-cd extensions/chat
-npm install            # first time only
-npx jest
-```
-
-The tests mock `@apache-superset/core` via `src/__tests__/sdkMock.ts` so they
-do not depend on host runtime wiring.
-
-## Build / bundle for deployment
-
-```bash
-# from the extension folder
-npm install
-npm run build
-
-# packaging into a .supx is handled by the Superset extensions CLI
-pip install apache-superset-extensions-cli
-superset-extensions bundle    # produces apache-superset.reference-chatbot-0.1.0.supx
-```
-
-Drop the `.supx` into the `EXTENSIONS_PATH` of a Superset instance that has
-`FEATURE_FLAGS = { "ENABLE_EXTENSIONS": True }`.
-
-## Selecting it as the active chatbot
-
-The host's singleton picker reads `active_chatbot_id` from the admin
-settings endpoint (`/api/v1/extensions/settings`). Set it to:
-
-```
-apache-superset.reference-chatbot
-```
-
-If no admin selection exists, the host falls back to the first-to-register
-chatbot — installing this extension alone is enough for the bubble to appear.
-
-## P3 integration seams
-
-All page-context derivation lives in [`src/context/pageContext.ts`](src/context/pageContext.ts).
-Each namespace branch (`dashboard`, `explore`, `dataset`, `navigation`) is
-called defensively — when the host implementation lands, the returned value
-becomes non-undefined automatically with no other change in the extension.
-
-The panel re-reads context on `popstate`. Once `navigation.onDidChangePage`
-is live on the host, the panel's `useEffect` should subscribe to it instead;
-that is the only file in the extension that needs to change for full P3
-context sync.
-
-## Known intentional non-features
-
-- No conversation persistence — by design (extension scope per SIP §2).
-- No real network. The mock stream is a `setTimeout` token emitter so the
-  cancellation contract is exercised without external dependencies.
-- No keyboard shortcut binding (Cmd+K). Extensions own that, but it adds
-  surface area not needed for platform validation.
-- No notification badge / icon mutation. SIP §3.2 recommends static icons;
-  the bubble re-renders freely already.
-
-## TODOs
-
-- **P1**: if/when the host gains `deactivate(): Promise<void>`, wrap the
-  master disposer in `activate.ts` to flush async work before returning.
-- **P3**: replace the `popstate` listener in `Panel.tsx` with
-  `navigation.onDidChangePage` once that event is wired up host-side.
-- **P4**: if the host pre-registers `core.chatbot__*` as host-owned intents,
-  swap `commands.registerCommand` for the implementation hook in
-  `commands.ts`. Command IDs do not change.

extensions/chat2/extension.json

@@ -1,23 +0,0 @@
-{
-  "publisher": "apache-superset",
-  "name": "alt-chatbot",
-  "displayName": "Alt Chatbot",
-  "description": "Second chatbot for testing multi-chatbot selection in the superset.chatbot contribution area.",
-  "version": "0.1.0",
-  "license": "Apache-2.0",
-  "permissions": [],
-  "contributes": {
-    "views": {
-      "app": {
-        "chatbot": [
-          {
-            "id": "apache-superset.alt-chatbot",
-            "name": "Alt Chatbot",
-            "description": "Second chatbot for testing singleton resolution.",
-            "icon": "Star"
-          }
-        ]
-      }
-    }
-  }
-}

extensions/chat2/jest.config.js

@@ -1,53 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-const path = require('path');
-
-// When run as a standalone package (`cd extensions/chat && npm test`), modules
-// resolve from this folder's own node_modules. When run from the superset-frontend
-// workspace (CI, dev convenience), resolve ts-jest there too.
-const tsJest = (() => {
-  try {
-    require.resolve('ts-jest');
-    return 'ts-jest';
-  } catch {
-    return path.resolve(
-      __dirname,
-      '..',
-      '..',
-      'superset-frontend',
-      'node_modules',
-      'ts-jest',
-    );
-  }
-})();
-
-module.exports = {
-  testEnvironment: 'jsdom',
-  rootDir: __dirname,
-  testMatch: ['<rootDir>/src/**/*.test.{ts,tsx}'],
-  // When running from the extension folder without node_modules installed,
-  // resolve react / react-dom from the superset-frontend workspace.
-  modulePaths: [path.resolve(__dirname, '..', '..', 'superset-frontend', 'node_modules')],
-  moduleNameMapper: {
-    '^@apache-superset/core$': '<rootDir>/src/__tests__/sdkMock.ts',
-  },
-  transform: {
-    '^.+\\.tsx?$': [tsJest, { tsconfig: '<rootDir>/tsconfig.test.json' }],
-  },
-};

extensions/chat2/package.json

@@ -1,26 +0,0 @@
-{
-  "name": "@apache-superset/alt-chatbot",
-  "version": "0.1.0",
-  "private": true,
-  "license": "Apache-2.0",
-  "description": "Second chatbot extension for testing multi-chatbot selection in the Superset chatbot contribution area.",
-  "scripts": {
-    "start": "webpack serve --mode development",
-    "build": "webpack --stats-error-details --mode production"
-  },
-  "peerDependencies": {
-    "@apache-superset/core": "^0.1.0",
-    "react": "^18.2.0",
-    "react-dom": "^18.2.0"
-  },
-  "devDependencies": {
-    "@apache-superset/core": "^0.1.0",
-    "@types/react": "^18.2.0",
-    "@types/react-dom": "^18.2.0",
-    "ts-loader": "^9.5.0",
-    "typescript": "^5.0.0",
-    "webpack": "^5.0.0",
-    "webpack-cli": "^5.0.0",
-    "webpack-dev-server": "^5.0.0"
-  }
-}

extensions/chat2/src/ReferenceChatbot.tsx

@@ -1,46 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import React, { useEffect, useState } from 'react';
-import { Bubble } from './components/Bubble';
-import { Panel } from './components/Panel';
-import { ExtensionErrorBoundary } from './components/ErrorBoundary';
-import { isOpen, setOpen, subscribe } from './state';
-
-/**
- * Root extension component. Mirrors module-state into React via `subscribe`.
- *
- * Unlike the Reference Chatbot, Alt registers no `core.chatbot__*` commands
- * (those ids are globally owned by Reference), so the bubble↔panel transition
- * drives the local open-state directly via `setOpen`.
- */
-export const ReferenceChatbot: React.FC = () => {
-  const [open, setOpenState] = useState<boolean>(isOpen());
-
-  useEffect(() => subscribe(setOpenState), []);
-
-  return (
-    <ExtensionErrorBoundary>
-      {open ? (
-        <Panel onClose={() => setOpen(false)} />
-      ) : (
-        <Bubble onClick={() => setOpen(true)} />
-      )}
-    </ExtensionErrorBoundary>
-  );
-};

extensions/chat2/src/__tests__/activate.test.tsx

@@ -1,131 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import { registry, reset } from './sdkMock';
-import { activate, VIEW_ID, CHATBOT_LOCATION } from '../activate';
-import { isOpen, setOpen } from '../state';
-import { streamReply } from '../streaming/mockStream';
-import {
-  registerActiveController,
-  unregisterActiveController,
-  abortAllActiveControllers,
-} from '../streaming/registry';
-
-beforeEach(() => {
-  reset();
-});
-
-test('registers one view at superset.chatbot and no commands', () => {
-  const disposable = activate();
-
-  try {
-    expect(registry.views.size).toBe(1);
-    const entry = registry.views.get(VIEW_ID);
-    expect(entry?.location).toBe(CHATBOT_LOCATION);
-    expect(entry?.view.icon).toBe('Star');
-
-    // Alt Chatbot is view-only — the core.chatbot__* command ids are owned by
-    // the Reference Chatbot, so Alt registers none of its own.
-    expect(registry.commands.size).toBe(0);
-  } finally {
-    disposable.dispose();
-  }
-});
-
-test('setOpen drives open/close through module state', () => {
-  const disposable = activate();
-  try {
-    expect(isOpen()).toBe(false);
-    setOpen(true);
-    expect(isOpen()).toBe(true);
-    setOpen(false);
-    expect(isOpen()).toBe(false);
-  } finally {
-    disposable.dispose();
-  }
-});
-
-test('disposing the master disposable unregisters the view', () => {
-  const disposable = activate();
-  expect(registry.views.size).toBe(1);
-
-  disposable.dispose();
-
-  expect(registry.views.size).toBe(0);
-  expect(registry.commands.size).toBe(0);
-});
-
-test('disposal is idempotent', () => {
-  const disposable = activate();
-  disposable.dispose();
-  expect(() => disposable.dispose()).not.toThrow();
-  expect(registry.views.size).toBe(0);
-});
-
-test('re-activate after dispose works (validates replace semantics)', () => {
-  const first = activate();
-  first.dispose();
-
-  const second = activate();
-  try {
-    expect(registry.views.size).toBe(1);
-    expect(isOpen()).toBe(false); // resetState() cleared open flag
-  } finally {
-    second.dispose();
-  }
-});
-
-test('aborting an active controller stops the stream cleanly', async () => {
-  const controller = new AbortController();
-  registerActiveController(controller);
-
-  const iter = streamReply('hello world', controller.signal);
-  const received: string[] = [];
-
-  const consume = (async () => {
-    for await (const tok of iter) received.push(tok);
-  })();
-
-  // Abort after a single tick — the iterator must return without throwing.
-  await new Promise(r => setTimeout(r, 50));
-  abortAllActiveControllers();
-  await expect(consume).resolves.toBeUndefined();
-
-  unregisterActiveController(controller);
-  expect(received.length).toBeLessThan(20); // would be ~20+ tokens if uncancelled
-});
-
-test('disposing the extension aborts any in-flight controller', async () => {
-  const disposable = activate();
-  const controller = new AbortController();
-  registerActiveController(controller);
-
-  const iter = streamReply('a longer prompt to ensure many tokens', controller.signal);
-  const consume = (async () => {
-    // eslint-disable-next-line no-unused-vars, @typescript-eslint/no-unused-vars
-    for await (const _tok of iter) {
-      // drain
-    }
-  })();
-
-  await new Promise(r => setTimeout(r, 30));
-  disposable.dispose();
-
-  await expect(consume).resolves.toBeUndefined();
-  expect(controller.signal.aborted).toBe(true);
-});

extensions/chat2/src/__tests__/sdkMock.ts

@@ -1,119 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/**
- * In-memory mock of `@apache-superset/core` for unit-testing the extension.
- *
- * Mirrors only the surfaces the reference chatbot consumes:
- *  - views.registerView returns a disposable that removes the view
- *  - commands.registerCommand / executeCommand round-trip handlers
- *  - sqlLab.getCurrentTab returns undefined (no SQL Lab in tests)
- *
- * The mock is intentionally observable: tests can read `registry.views` and
- * `registry.commands` to assert contract compliance.
- */
-
-import type { ReactElement } from 'react';
-
-type Provider = () => ReactElement;
-
-interface ViewDescriptor {
-  id: string;
-  name: string;
-  icon?: string;
-  description?: string;
-}
-
-interface DisposableLike {
-  dispose(): void;
-}
-
-interface RegisteredView {
-  view: ViewDescriptor;
-  location: string;
-  provider: Provider;
-}
-
-interface RegisteredCommand {
-  id: string;
-  title: string;
-  handler: (...args: any[]) => any;
-}
-
-export const registry = {
-  views: new Map<string, RegisteredView>(),
-  commands: new Map<string, RegisteredCommand>(),
-};
-
-export const reset = (): void => {
-  registry.views.clear();
-  registry.commands.clear();
-};
-
-export const views = {
-  registerView(
-    view: ViewDescriptor,
-    location: string,
-    provider: Provider,
-  ): DisposableLike {
-    registry.views.set(view.id, { view, location, provider });
-    return {
-      dispose: () => {
-        registry.views.delete(view.id);
-      },
-    };
-  },
-  getViews(location: string) {
-    return Array.from(registry.views.values())
-      .filter(v => v.location === location)
-      .map(v => v.view);
-  },
-};
-
-export const commands = {
-  registerCommand(
-    command: { id: string; title: string },
-    handler: (...args: any[]) => any,
-  ): DisposableLike {
-    registry.commands.set(command.id, {
-      id: command.id,
-      title: command.title,
-      handler,
-    });
-    return {
-      dispose: () => {
-        registry.commands.delete(command.id);
-      },
-    };
-  },
-  async executeCommand(id: string, ...rest: any[]): Promise<unknown> {
-    const cmd = registry.commands.get(id);
-    return cmd?.handler(...rest);
-  },
-  getCommands() {
-    return Array.from(registry.commands.values()).map(c => ({
-      id: c.id,
-      title: c.title,
-    }));
-  },
-};
-
-export const sqlLab = {
-  getCurrentTab: () => undefined,
-};

extensions/chat2/src/activate.ts

@@ -1,83 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import React from 'react';
-import { views } from '@apache-superset/core';
-import { ReferenceChatbot } from './ReferenceChatbot';
-import { abortAllActiveControllers } from './streaming/registry';
-import { resetState } from './state';
-
-export const VIEW_ID = 'apache-superset.alt-chatbot';
-export const CHATBOT_LOCATION = 'superset.chatbot';
-
-interface DisposableLike {
-  dispose(): void;
-}
-
-/**
- * Registers the reference chatbot and returns a single disposable that
- * tears down everything it created. Idempotent across activate/dispose cycles.
- *
- * Cleanup order matters: stop in-flight streams first so listeners do not
- * receive late tokens, then unregister commands (so user clicks during teardown
- * become no-ops), then unregister the view (so the host's ChatbotMount unmounts
- * the React tree), and finally reset module state.
- *
- * Returns a plain `{ dispose }` object rather than constructing a Disposable
- * from the SDK — the SDK class is host-injected and only reliably available
- * via window.superset at runtime, while plain disposable-likes work in both
- * runtime and unit-test contexts.
- *
- * TODO(P1): when the host gains an async `deactivate(): Promise<void>` hook,
- * wrap the master disposer to flush in-flight async work before returning.
- */
-export const activate = (): DisposableLike => {
-  // Alt Chatbot deliberately registers no commands: the `core.chatbot__*`
-  // command ids are owned by the Reference Chatbot, and command ids are global,
-  // so a second registrant would collide. Alt is a view-only chatbot used to
-  // exercise multi-chatbot selection.
-  const viewDisposable = views.registerView(
-    {
-      id: VIEW_ID,
-      name: 'Alt Chatbot',
-      icon: 'Star',
-      description: 'Second chatbot for testing singleton resolution.',
-    },
-    CHATBOT_LOCATION,
-    () => React.createElement(ReferenceChatbot),
-  );
-
-  let disposed = false;
-  return {
-    dispose() {
-      if (disposed) return;
-      disposed = true;
-      try {
-        abortAllActiveControllers();
-      } catch {
-        // streams are best-effort during teardown
-      }
-      try {
-        viewDisposable.dispose();
-      } catch {
-        // ignore
-      }
-      resetState();
-    },
-  };
-};

extensions/chat2/src/components/Bubble.tsx

@@ -1,46 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import React from 'react';
-
-interface Props {
-  onClick: () => void;
-}
-
-export const Bubble: React.FC<Props> = ({ onClick }) => (
-  <button
-    type="button"
-    onClick={onClick}
-    data-test="reference-chatbot-bubble"
-    aria-label="Open Alt chatbot"
-    style={{
-      width: 56,
-      height: 56,
-      borderRadius: '50%',
-      border: 'none',
-      background: '#2da44e',
-      color: '#fff',
-      fontSize: 24,
-      fontWeight: 600,
-      cursor: 'pointer',
-      boxShadow: '0 4px 14px rgba(0,0,0,0.18)',
-    }}
-  >
-    ?
-  </button>
-);

extensions/chat2/src/components/ErrorBoundary.tsx

@@ -1,66 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import React from 'react';
-
-interface State {
-  error: Error | null;
-}
-
-/**
- * Defense-in-depth boundary. The host already wraps the mount in its own
- * ErrorBoundary; this one keeps a panel crash from also bringing down the
- * bubble next to it.
- */
-export class ExtensionErrorBoundary extends React.Component<
-  React.PropsWithChildren<{}>,
-  State
-> {
-  state: State = { error: null };
-
-  static getDerivedStateFromError(error: Error): State {
-    return { error };
-  }
-
-  componentDidCatch(error: Error): void {
-    // eslint-disable-next-line no-console
-    console.error('[reference-chatbot] render error', error);
-  }
-
-  render() {
-    if (this.state.error) {
-      return (
-        <div
-          data-test="reference-chatbot-error"
-          style={{
-            padding: 12,
-            border: '1px solid #f5222d',
-            borderRadius: 6,
-            background: '#fff1f0',
-            color: '#a8071a',
-            fontSize: 12,
-            maxWidth: 320,
-          }}
-        >
-          Reference chatbot crashed: {this.state.error.message}
-        </div>
-      );
-    }
-    return <>{this.props.children}</>;
-  }
-}