WIP

.asf.yaml

@@ -53,9 +53,6 @@ github:
     merge: false
     rebase: false
 
-  ghp_branch:  gh-pages
-  ghp_path: /
-
   protected_branches:
     master:
       required_status_checks:
@@ -72,7 +69,6 @@ github:
           - cypress-matrix (3, chrome)
           - cypress-matrix (4, chrome)
           - cypress-matrix (5, chrome)
-          - dependency-review
           - frontend-build
           - pre-commit (current)
           - pre-commit (next)
@@ -92,10 +88,3 @@ github:
         required_approving_review_count: 1
 
       required_signatures: false
-    gh-pages:
-      required_pull_request_reviews:
-        dismiss_stale_reviews: false
-        require_code_owner_reviews: true
-        required_approving_review_count: 1
-
-      required_signatures: false

.dockerignore

@@ -42,8 +42,6 @@ docs/
 install/
 superset-frontend/cypress-base/
 superset-frontend/coverage/
-superset-frontend/.temp_cache/
 superset/static/assets/
 superset-websocket/dist/
 venv
-.venv

.gitattributes

@@ -1,3 +1,2 @@
 docker/**/*.sh text eol=lf
 *.svg binary
-*.ipynb binary

.github/CODEOWNERS

@@ -16,17 +16,17 @@
 
 # Notify E2E test maintainers of changes
 
-/superset-frontend/cypress-base/ @sadpandajoe @geido @eschutho @rusackas @betodealmeida
+/superset-frontend/cypress-base/ @jinghua-qa @geido @eschutho @rusackas @betodealmeida
 
 # Notify PMC members of changes to GitHub Actions
 
-/.github/ @villebro @geido @eschutho @rusackas @betodealmeida @nytai @mistercrunch @craig-rueda @kgabryje @dpgaspar
+/.github/ @villebro @geido @eschutho @rusackas @betodealmeida @nytai @mistercrunch @craig-rueda @john-bodley @kgabryje @dpgaspar
 
 # Notify PMC members of changes to required GitHub Actions
 
-/.asf.yaml @villebro @geido @eschutho @rusackas @betodealmeida @nytai @mistercrunch @craig-rueda @kgabryje @dpgaspar
+/.asf.yaml @villebro @geido @eschutho @rusackas @betodealmeida @nytai @mistercrunch @craig-rueda @john-bodley @kgabryje @dpgaspar
 
-# Maps are a finicky contribution process we care about
+# Maps are a finnicky contribution process we care about
 
 **/*.geojson @villebro @rusackas
 /superset-frontend/plugins/legacy-plugin-chart-country-map/ @villebro @rusackas

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -41,8 +41,8 @@ body:
       label: Superset version
       options:
         - master / latest-dev
-        - "4.1.1"
-        - "4.0.2"
+        - "4.1.0"
+        - "3.1.3"
     validations:
       required: true
   - type: dropdown

.github/actions/setup-backend/action.yml

@@ -43,14 +43,11 @@ runs:
       run: |
         if [ "${{ inputs.install-superset }}" = "true" ]; then
           sudo apt-get update && sudo apt-get -y install libldap2-dev libsasl2-dev
-          pip install --upgrade pip setuptools wheel uv
-
+          pip install --upgrade pip setuptools wheel
           if [ "${{ inputs.requirements-type }}" = "dev" ]; then
-            uv pip install --system -r requirements/development.txt
+            pip install -r requirements/development.txt
           elif [ "${{ inputs.requirements-type }}" = "base" ]; then
-            uv pip install --system -r requirements/base.txt
+            pip install -r requirements/base.txt
           fi
-
-          uv pip install --system -e .
         fi
       shell: bash

.github/actions/setup-docker/action.yml

@@ -1,69 +0,0 @@
-name: "Setup Docker Environment"
-description: "Reusable steps for setting up QEMU, Docker Buildx, DockerHub login, Supersetbot, and optionally Docker Compose"
-inputs:
-  build:
-    description: "Used for building?"
-    required: false
-    default: "false"
-  dockerhub-user:
-    description: "DockerHub username"
-    required: false
-  dockerhub-token:
-    description: "DockerHub token"
-    required: false
-  install-docker-compose:
-    description: "Flag to install Docker Compose"
-    required: false
-    default: "true"
-  login-to-dockerhub:
-    description: "Whether you want to log into dockerhub"
-    required: false
-    default: "true"
-outputs: {}
-runs:
-  using: "composite"
-  steps:
-
-    - name: Set up QEMU
-      if: ${{ inputs.build == 'true' }}
-      uses: docker/setup-qemu-action@v3
-
-    - name: Set up Docker Buildx
-      if: ${{ inputs.build == 'true' }}
-      uses: docker/setup-buildx-action@v3
-
-    - name: Try to login to DockerHub
-      if: ${{ inputs.login-to-dockerhub == 'true' }}
-      continue-on-error: true
-      uses: docker/login-action@v3
-      with:
-        username: ${{ inputs.dockerhub-user }}
-        password: ${{ inputs.dockerhub-token }}
-
-    - name: Install Docker Compose
-      if: ${{ inputs.install-docker-compose == 'true' }}
-      shell: bash
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y ca-certificates curl
-        sudo install -m 0755 -d /etc/apt/keyrings
-
-        # Download and save the Docker GPG key in the correct format
-        curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
-
-        # Ensure the key file is readable
-        sudo chmod a+r /etc/apt/keyrings/docker.gpg
-
-        # Add the Docker repository using the correct key
-        echo \
-          "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
-          $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
-          sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
-
-        # Update package lists and install Docker Compose plugin
-        sudo apt update
-        sudo apt install -y docker-compose-plugin
-
-    - name: Docker Version Info
-      shell: bash
-      run: docker info

.github/dependabot.yml

@@ -22,7 +22,8 @@ updates:
 
 
   # - package-ecosystem: "pip"
-  # NOTE: as dependabot isn't compatible with our usage of `uv pip compile` we're using
+  # NOTE: as dependabot isn't compatible with our python
+  # dependency setup (pip-compile-multi), we'll be using
   # `supersetbot` instead
 
   - package-ecosystem: "npm"

.github/workflows/bump-python-package.yml

@@ -14,16 +14,10 @@ on:
         required: true
         description: Max number of PRs to open (0 for no limit)
         default: 5
-      extra-flags:
-        required: false
-        default: --only-base
-        description: Additional flags to pass to the bump-python command
-  #schedule:
-  #  - cron: '0 0 * * *'  # Runs daily at midnight UTC
 
 jobs:
   bump-python-package:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     permissions:
       actions: write
       contents: write
@@ -45,8 +39,8 @@ jobs:
         with:
           python-version: "3.10"
 
-      - name: Install uv
-        run: pip install uv
+      - name: Install pip-compile-multi
+        run: pip install pip-compile-multi
 
       - name: supersetbot bump-python -p "${{ github.event.inputs.package }}"
         env:
@@ -65,13 +59,10 @@ jobs:
             GROUP_OPT="-g ${{ github.event.inputs.group }}"
           fi
 
-          EXTRA_FLAGS="${{ github.event.inputs.extra-flags }}"
-
           supersetbot bump-python \
             --verbose \
             --use-current-repo \
             --include-subpackages \
             --limit ${{ github.event.inputs.limit }} \
             $PACKAGE_OPT \
-            $GROUP_OPT \
-            $EXTRA_FLAGS
+            $GROUP_OPT

.github/workflows/cancel_duplicates.yml

@@ -9,7 +9,7 @@ on:
 jobs:
   cancel-duplicate-runs:
     name: Cancel duplicate workflow runs
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     permissions:
       actions: write
       contents: read

.github/workflows/check-python-deps.yml

@@ -1,44 +0,0 @@
-name: Check python dependencies
-
-on:
-  push:
-    branches:
-      - "master"
-      - "[0-9].[0-9]*"
-  pull_request:
-    types: [synchronize, opened, reopened, ready_for_review]
-
-# cancel previous workflow jobs for PRs
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  check-python-deps:
-    runs-on: ubuntu-22.04
-    steps:
-
-      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-          submodules: recursive
-          depth: 1
-
-      - name: Setup Python
-        if: steps.check.outputs.python
-        uses: ./.github/actions/setup-backend/
-
-      - name: Run uv
-        if: steps.check.outputs.python
-        run: ./scripts/uv-pip-compile.sh
-
-      - name: Check for uncommitted changes
-        run: |
-          if [[ -n "$(git diff)" ]]; then
-            echo "ERROR: The pinned dependencies are not up-to-date."
-            echo "Please run './scripts/uv-pip-compile.sh' and commit the changes."
-            exit 1
-          else
-            echo "Pinned dependencies are up-to-date."
-          fi

.github/workflows/check_db_migration_confict.yml

@@ -19,7 +19,7 @@ concurrency:
 jobs:
   check_db_migration_conflict:
     name: Check DB migration conflict
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
       pull-requests: write

.github/workflows/codeql-analysis.yml

@@ -17,7 +17,7 @@ concurrency:
 jobs:
   analyze:
     name: Analyze
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     permissions:
       actions: read
       contents: read

.github/workflows/dependency-review.yml

@@ -5,26 +5,14 @@
 # Source repository: https://github.com/actions/dependency-review-action
 # Public documentation: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement
 name: "Dependency Review"
-on:
-  push:
-    branches:
-      - "master"
-      - "[0-9].[0-9]*"
-  pull_request:
-    types: [synchronize, opened, reopened, ready_for_review]
-
-# cancel previous workflow jobs for PRs
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
+on: [pull_request]
 
 permissions:
   contents: read
 
 jobs:
   dependency-review:
-    if: github.event_name == 'pull_request'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     steps:
       - name: "Checkout Repository"
         uses: actions/checkout@v4
@@ -44,25 +32,4 @@ jobs:
           #   license: https://applitools.com/legal/open-source-terms-of-use/
           # pkg:npm/node-forge@1.3.1
           #   selecting BSD-3-Clause licensing terms for node-forge to ensure compatibility with Apache
-          allow-dependencies-licenses: pkg:npm/store2@2.14.2, pkg:npm/applitools/core, pkg:npm/applitools/core-base, pkg:npm/applitools/css-tree, pkg:npm/applitools/ec-client, pkg:npm/applitools/eg-socks5-proxy-server, pkg:npm/applitools/eyes, pkg:npm/applitools/eyes-cypress, pkg:npm/applitools/nml-client, pkg:npm/applitools/tunnel-client, pkg:npm/applitools/utils, pkg:npm/node-forge@1.3.1, pkg:npm/rgbcolor, pkg:npm/jszip@3.10.1
-
-  python-dependency-liccheck:
-    runs-on: ubuntu-22.04
-    steps:
-      - name: "Checkout Repository"
-        uses: actions/checkout@v4
-
-      - name: Setup Python
-        uses: ./.github/actions/setup-backend/
-        with:
-          requirements-type: base
-
-      - name: "Set up liccheck"
-        run: |
-          uv pip install --system liccheck
-      - name: "Run liccheck"
-        run: |
-          # run the checks
-          liccheck -R output.txt
-          # Print the report
-          cat output.txt
+          allow-dependencies-licenses: pkg:npm/store2@2.14.2, pkg:npm/applitools/core, pkg:npm/applitools/core-base, pkg:npm/applitools/css-tree, pkg:npm/applitools/ec-client, pkg:npm/applitools/eg-socks5-proxy-server, pkg:npm/applitools/eyes, pkg:npm/applitools/eyes-cypress, pkg:npm/applitools/nml-client, pkg:npm/applitools/tunnel-client, pkg:npm/applitools/utils, pkg:npm/node-forge@1.3.1, pkg:npm/rgbcolor

.github/workflows/docker.yml

@@ -15,20 +15,20 @@ concurrency:
 
 jobs:
   setup_matrix:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     outputs:
       matrix_config: ${{ steps.set_matrix.outputs.matrix_config }}
     steps:
       - id: set_matrix
         run: |
-          MATRIX_CONFIG=$(if [ "${{ github.event_name }}" == "pull_request" ]; then echo '["dev", "lean"]'; else echo '["dev", "lean", "py310", "websocket", "dockerize", "py311"]'; fi)
+          MATRIX_CONFIG=$(if [ "${{ github.event_name }}" == "pull_request" ]; then echo '["dev"]'; else echo '["dev", "lean", "py310", "websocket", "dockerize", "py311"]'; fi)
           echo "matrix_config=${MATRIX_CONFIG}" >> $GITHUB_OUTPUT
           echo $GITHUB_OUTPUT
 
   docker-build:
     name: docker-build
     needs: setup_matrix
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     strategy:
       matrix:
         build_preset: ${{fromJson(needs.setup_matrix.outputs.matrix_config)}}
@@ -50,13 +50,21 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Setup Docker Environment
+      - name: Set up QEMU
         if: steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker
-        uses: ./.github/actions/setup-docker
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        if: steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker
+        uses: docker/setup-buildx-action@v3
+
+      - name: Try to login to DockerHub
+        if: steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker
+        continue-on-error: true
+        uses: docker/login-action@v3
         with:
-          dockerhub-user: ${{ secrets.DOCKERHUB_USER }}
-          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
-          build: "true"
+          username: ${{ secrets.DOCKERHUB_USER }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Setup supersetbot
         if: steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker
@@ -76,30 +84,7 @@ jobs:
           fi
 
           supersetbot docker \
-            --push \
             --preset ${{ matrix.build_preset }} \
             --context "$EVENT" \
             --context-ref "$RELEASE" $FORCE_LATEST \
-            --extra-flags "--build-arg INCLUDE_CHROMIUM=false" \
             $PLATFORM_ARG
-
-      - name: Docker pull
-        if: steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker
-        run:  docker pull apache/superset:GHA-${GITHUB_RUN_ID}
-
-      - name: Print docker stats
-        if: steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker
-        run: |
-          IMAGE_ID=$(docker images --filter "label=sha=${{ github.sha }}" --format "{{.ID}}" | head -n 1)
-          echo "SHA: ${{ github.sha }}"
-          echo "IMAGE: $IMAGE_ID"
-          docker images $IMAGE_ID
-          docker history $IMAGE_ID
-
-      - name: docker-compose sanity check
-        if: (steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker) && (matrix.build_preset == 'dev' || matrix.build_preset == 'lean')
-        shell: bash
-        run: |
-          export SUPERSET_BUILD_TARGET=${{ matrix.build_preset }}
-          docker compose build superset-init --build-arg DEV_MODE=false --build-arg INCLUDE_CHROMIUM=false
-          docker compose up superset-init --exit-code-from superset-init

.github/workflows/embedded-sdk-release.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   config:
-    runs-on: ubuntu-24.04
+    runs-on: "ubuntu-22.04"
     outputs:
       has-secrets: ${{ steps.check.outputs.has-secrets }}
     steps:
@@ -23,7 +23,7 @@ jobs:
   build:
     needs: config
     if: needs.config.outputs.has-secrets
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     defaults:
       run:
         working-directory: superset-embedded-sdk

.github/workflows/embedded-sdk-test.yml

@@ -13,7 +13,7 @@ concurrency:
 
 jobs:
   embedded-sdk-test:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     defaults:
       run:
         working-directory: superset-embedded-sdk

.github/workflows/ephemeral-env-pr-close.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   config:
-    runs-on: ubuntu-24.04
+    runs-on: "ubuntu-22.04"
     outputs:
       has-secrets: ${{ steps.check.outputs.has-secrets }}
     steps:
@@ -22,7 +22,7 @@ jobs:
     needs: config
     if: needs.config.outputs.has-secrets
     name: Cleanup ephemeral envs
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     permissions:
       pull-requests: write
     steps:

.github/workflows/ephemeral-env.yml

@@ -1,35 +1,37 @@
 name: Ephemeral env workflow
 
-# Example manual trigger:  gh workflow run ephemeral-env.yml --ref fix_ephemerals  --field comment_body="/testenv up" --field issue_number=666
-
 on:
   issue_comment:
     types: [created]
-  workflow_dispatch:
-    inputs:
-      comment_body:
-        description: 'Comment body to simulate /testenv command'
-        required: true
-        default: '/testenv up'
-      issue_number:
-        description: 'Issue or PR number'
-        required: true
 
 jobs:
+  config:
+    runs-on: "ubuntu-22.04"
+    if: github.event.issue.pull_request
+    outputs:
+      has-secrets: ${{ steps.check.outputs.has-secrets }}
+    steps:
+      - name: "Check for secrets"
+        id: check
+        shell: bash
+        run: |
+          if [ -n "${{ (secrets.AWS_ACCESS_KEY_ID != '' && secrets.AWS_SECRET_ACCESS_KEY != '') || '' }}" ]; then
+            echo "has-secrets=1" >> "$GITHUB_OUTPUT"
+          fi
+
   ephemeral-env-comment:
     concurrency:
-      group: ${{ github.workflow }}-${{ github.event.inputs.issue_number || github.event.issue.number || github.run_id }}-comment
+      group: ${{ github.workflow }}-${{ github.event.issue.number || github.run_id }}-comment
       cancel-in-progress: true
+    needs: config
+    if: needs.config.outputs.has-secrets
     name: Evaluate ephemeral env comment trigger (/testenv)
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     permissions:
       pull-requests: write
     outputs:
       slash-command: ${{ steps.eval-body.outputs.result }}
       feature-flags: ${{ steps.eval-feature-flags.outputs.result }}
-    env:
-      DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }}
-      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
 
     steps:
     - name: Debug
@@ -38,26 +40,22 @@ jobs:
 
     - name: Eval comment body for /testenv slash command
       uses: actions/github-script@v7
-      env:
-        COMMENT_BODY: ${{ github.event.inputs.comment_body || github.event.comment.body }}
       id: eval-body
       with:
         result-encoding: string
         script: |
-          const pattern = /^\/testenv (up|down)/;
-          const result = pattern.exec(process.env.COMMENT_BODY || '');
-          return result === null ? 'noop' : result[1];
+          const pattern = /^\/testenv (up|down)/
+          const result = pattern.exec(context.payload.comment.body)
+          return result === null ? 'noop' : result[1]
 
-    - name: Looking for feature flags
+    - name: Eval comment body for feature flags
       uses: actions/github-script@v7
-      env:
-        COMMENT_BODY: ${{ github.event.inputs.comment_body || github.event.comment.body }}
       id: eval-feature-flags
       with:
         script: |
           const pattern = /FEATURE_(\w+)=(\w+)/g;
           let results = [];
-          [...process.env.COMMENT_BODY.matchAll(pattern)].forEach(match => {
+          [...context.payload.comment.body.matchAll(pattern)].forEach(match => {
             const config = {
               name: `SUPERSET_FEATURE_${match[1]}`,
               value: match[2],
@@ -69,53 +67,28 @@ jobs:
     - name: Limit to committers
       if: >
         steps.eval-body.outputs.result != 'noop' &&
-        github.event_name == 'issue_comment' &&
         github.event.comment.author_association != 'MEMBER' &&
         github.event.comment.author_association != 'OWNER'
       uses: actions/github-script@v7
       with:
-        github-token: ${{ github.token }}
+        github-token: ${{github.token}}
         script: |
-          const errMsg = '@${{ github.event.comment.user.login }} Ephemeral environment creation is currently limited to committers.';
+          const errMsg = '@${{ github.event.comment.user.login }} Ephemeral environment creation is currently limited to committers.'
           github.rest.issues.createComment({
             issue_number: ${{ github.event.issue.number }},
             owner: context.repo.owner,
             repo: context.repo.repo,
             body: errMsg
-          });
-          core.setFailed(errMsg);
-
-    - name: Reply with confirmation comment
-      uses: actions/github-script@v7
-      with:
-        github-token: ${{ secrets.GITHUB_TOKEN }}
-        script: |
-          const issueNumber = ${{ github.event.inputs.issue_number || github.event.issue.number }};
-          const user = '${{ github.event.comment.user.login || github.actor }}';
-          const action = '${{ steps.eval-body.outputs.result }}';
-          const runId = context.runId;
-          const workflowUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${runId}`;
-          const body = `@${user} Processing your ephemeral environment request [here](${workflowUrl}).`;
-          if (action !== 'noop') {
-            await github.rest.issues.createComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: issueNumber,
-              body,
-            });
-          }
-          else {
-            core.setFailed('No ephemeral environment action detected.');
-          }
+          })
+          core.setFailed(errMsg)
 
   ephemeral-docker-build:
     concurrency:
-      group: ${{ github.workflow }}-${{ github.event.inputs.issue_number || github.event.issue.number || github.run_id }}-build
+      group: ${{ github.workflow }}-${{ github.event.issue.number || github.run_id }}-build
       cancel-in-progress: true
     needs: ephemeral-env-comment
-    if: needs.ephemeral-env-comment.outputs.slash-command == 'up'
     name: ephemeral-docker-build
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     steps:
       - name: Get Info from comment
         uses: actions/github-script@v7
@@ -125,9 +98,9 @@ jobs:
             const request = {
                 owner: context.repo.owner,
                 repo: context.repo.repo,
-                pull_number: ${{ github.event.inputs.issue_number || github.event.issue.number }},
-            };
-            core.info(`Getting PR #${request.pull_number} from ${request.owner}/${request.repo}`);
+                pull_number: ${{ github.event.issue.number }},
+            }
+            core.info(`Getting PR #${request.pull_number} from ${request.owner}/${request.repo}`)
             const pr = await github.rest.pulls.get(request);
             return pr.data;
 
@@ -142,28 +115,18 @@ jobs:
           ref: ${{ steps.get-sha.outputs.sha }}
           persist-credentials: false
 
-      - name: Setup Docker Environment
-        uses: ./.github/actions/setup-docker
-        with:
-          dockerhub-user: ${{ secrets.DOCKERHUB_USER }}
-          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
-          build: "true"
-          install-docker-compose: "false"
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
 
-      - name: Setup supersetbot
-        uses: ./.github/actions/setup-supersetbot/
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
 
       - name: Build ephemeral env image
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          supersetbot docker \
-            --push \
-            --load \
-            --preset ci \
-            --platform  linux/amd64 \
-            --context-ref "$RELEASE" \
-            --extra-flags "--build-arg INCLUDE_CHROMIUM=false"
+          ./scripts/build_docker.py \
+            "ci" \
+            "pull_request" \
+            --build_context_ref ${{ github.event.issue.number }}
 
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v4
@@ -183,14 +146,14 @@ jobs:
           ECR_REPOSITORY: superset-ci
           IMAGE_TAG: apache/superset:${{ steps.get-sha.outputs.sha }}-ci
         run: |
-          docker tag $IMAGE_TAG $ECR_REGISTRY/$ECR_REPOSITORY:pr-${{ github.event.inputs.issue_number || github.event.issue.number }}-ci
+          docker tag $IMAGE_TAG $ECR_REGISTRY/$ECR_REPOSITORY:pr-${{ github.event.issue.number }}-ci
           docker push -a $ECR_REGISTRY/$ECR_REPOSITORY
 
   ephemeral-env-up:
     needs: [ephemeral-env-comment, ephemeral-docker-build]
     if: needs.ephemeral-env-comment.outputs.slash-command == 'up'
     name: Spin up an ephemeral environment
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
       pull-requests: write
@@ -218,22 +181,22 @@ jobs:
         aws ecr describe-images \
         --registry-id $(echo "${{ steps.login-ecr.outputs.registry }}" | grep -Eo "^[0-9]+") \
         --repository-name superset-ci \
-        --image-ids imageTag=pr-${{ github.event.inputs.issue_number || github.event.issue.number }}-ci
+        --image-ids imageTag=pr-${{ github.event.issue.number }}-ci
 
     - name: Fail on missing container image
       if: steps.check-image.outcome == 'failure'
       uses: actions/github-script@v7
       with:
-        github-token: ${{ github.token }}
+        github-token: ${{github.token}}
         script: |
-          const errMsg = '@${{ github.event.comment.user.login }} Container image not yet published for this PR. Please try again when build is complete.';
+          const errMsg = '@${{ github.event.comment.user.login }} Container image not yet published for this PR. Please try again when build is complete.'
           github.rest.issues.createComment({
-            issue_number: ${{ github.event.inputs.issue_number || github.event.issue.number }},
+            issue_number: ${{ github.event.issue.number }},
             owner: context.repo.owner,
             repo: context.repo.repo,
             body: errMsg
-          });
-          core.setFailed(errMsg);
+          })
+          core.setFailed(errMsg)
 
     - name: Fill in the new image ID in the Amazon ECS task definition
       id: task-def
@@ -241,7 +204,7 @@ jobs:
       with:
         task-definition: .github/workflows/ecs-task-definition.json
         container-name: superset-ci
-        image: ${{ steps.login-ecr.outputs.registry }}/superset-ci:pr-${{ github.event.inputs.issue_number || github.event.issue.number }}-ci
+        image: ${{ steps.login-ecr.outputs.registry }}/superset-ci:pr-${{ github.event.issue.number }}-ci
 
     - name: Update env vars in the Amazon ECS task definition
       run: |
@@ -250,29 +213,30 @@ jobs:
     - name: Describe ECS service
       id: describe-services
       run: |
-        echo "active=$(aws ecs describe-services --cluster superset-ci --services pr-${{ github.event.inputs.issue_number || github.event.issue.number }}-service | jq '.services[] | select(.status == "ACTIVE") | any')" >> $GITHUB_OUTPUT
+        echo "active=$(aws ecs describe-services --cluster superset-ci --services pr-${{ github.event.issue.number }}-service | jq '.services[] | select(.status == "ACTIVE") | any')" >> $GITHUB_OUTPUT
     - name: Create ECS service
-      id: create-service
       if: steps.describe-services.outputs.active != 'true'
+      id: create-service
       env:
         ECR_SUBNETS: subnet-0e15a5034b4121710,subnet-0e8efef4a72224974
         ECR_SECURITY_GROUP: sg-092ff3a6ae0574d91
       run: |
         aws ecs create-service \
         --cluster superset-ci \
-        --service-name pr-${{ github.event.inputs.issue_number || github.event.issue.number }}-service \
+        --service-name pr-${{ github.event.issue.number }}-service \
         --task-definition superset-ci \
         --launch-type FARGATE \
         --desired-count 1 \
         --platform-version LATEST \
         --network-configuration "awsvpcConfiguration={subnets=[$ECR_SUBNETS],securityGroups=[$ECR_SECURITY_GROUP],assignPublicIp=ENABLED}" \
-        --tags key=pr,value=${{ github.event.inputs.issue_number || github.event.issue.number }} key=github_user,value=${{ github.actor }}
+        --tags key=pr,value=${{ github.event.issue.number }} key=github_user,value=${{ github.actor }}
+
     - name: Deploy Amazon ECS task definition
       id: deploy-task
       uses: aws-actions/amazon-ecs-deploy-task-definition@v2
       with:
         task-definition: ${{ steps.task-def.outputs.task-definition }}
-        service: pr-${{ github.event.inputs.issue_number || github.event.issue.number }}-service
+        service: pr-${{ github.event.issue.number }}-service
         cluster: superset-ci
         wait-for-service-stability: true
         wait-for-minutes: 10
@@ -280,15 +244,18 @@ jobs:
     - name: List tasks
       id: list-tasks
       run: |
-        echo "task=$(aws ecs list-tasks --cluster superset-ci --service-name pr-${{ github.event.inputs.issue_number || github.event.issue.number }}-service | jq '.taskArns | first')" >> $GITHUB_OUTPUT
+        echo "task=$(aws ecs list-tasks --cluster superset-ci --service-name pr-${{ github.event.issue.number }}-service | jq '.taskArns | first')" >> $GITHUB_OUTPUT
+
     - name: Get network interface
       id: get-eni
       run: |
-        echo "eni=$(aws ecs describe-tasks --cluster superset-ci --tasks ${{ steps.list-tasks.outputs.task }} | jq '.tasks | .[0] | .attachments | .[0] | .details | map(select(.name==\"networkInterfaceId\")) | .[0] | .value')" >> $GITHUB_OUTPUT
+        echo "eni=$(aws ecs describe-tasks --cluster superset-ci --tasks ${{ steps.list-tasks.outputs.task }} | jq '.tasks | .[0] | .attachments | .[0] | .details | map(select(.name=="networkInterfaceId")) | .[0] | .value')" >> $GITHUB_OUTPUT
+
     - name: Get public IP
       id: get-ip
       run: |
         echo "ip=$(aws ec2 describe-network-interfaces --network-interface-ids ${{ steps.get-eni.outputs.eni }} | jq -r '.NetworkInterfaces | first | .Association.PublicIp')" >> $GITHUB_OUTPUT
+
     - name: Comment (success)
       if: ${{ success() }}
       uses: actions/github-script@v7
@@ -296,11 +263,12 @@ jobs:
         github-token: ${{github.token}}
         script: |
           github.rest.issues.createComment({
-            issue_number: ${{ github.event.inputs.issue_number || github.event.issue.number }},
+            issue_number: ${{ github.event.issue.number }},
             owner: context.repo.owner,
             repo: context.repo.repo,
-            body: '@${{ github.event.inputs.user_login || github.event.comment.user.login }} Ephemeral environment spinning up at http://${{ steps.get-ip.outputs.ip }}:8080. Credentials are `admin`/`admin`. Please allow several minutes for bootstrapping and startup.'
+            body: '@${{ github.event.comment.user.login }} Ephemeral environment spinning up at http://${{ steps.get-ip.outputs.ip }}:8080. Credentials are `admin`/`admin`. Please allow several minutes for bootstrapping and startup.'
           })
+
     - name: Comment (failure)
       if: ${{ failure() }}
       uses: actions/github-script@v7
@@ -308,8 +276,8 @@ jobs:
         github-token: ${{github.token}}
         script: |
           github.rest.issues.createComment({
-            issue_number: ${{ github.event.inputs.issue_number || github.event.issue.number }},
+            issue_number: ${{ github.event.issue.number }},
             owner: context.repo.owner,
             repo: context.repo.repo,
-            body: '@${{ github.event.inputs.user_login || github.event.comment.user.login }} Ephemeral environment creation failed. Please check the Actions logs for details.'
+            body: '@${{ github.event.comment.user.login }} Ephemeral environment creation failed. Please check the Actions logs for details.'
           })

.github/workflows/generate-FOSSA-report.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   config:
-    runs-on: ubuntu-24.04
+    runs-on: "ubuntu-22.04"
     outputs:
       has-secrets: ${{ steps.check.outputs.has-secrets }}
     steps:
@@ -24,7 +24,7 @@ jobs:
     needs: config
     if: needs.config.outputs.has-secrets
     name: Generate Report
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v4

.github/workflows/github-action-validator.yml

@@ -11,7 +11,7 @@ on:
 jobs:
 
   validate-all-ghas:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4

.github/workflows/issue_creation.yml

@@ -9,7 +9,7 @@ on:
 
 jobs:
   superbot-orglabel:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
       pull-requests: write

.github/workflows/labeler.yml

@@ -7,7 +7,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     steps:
     - uses: actions/labeler@v5
       with:

.github/workflows/latest-release-tag.yml

@@ -6,7 +6,7 @@ on:
 jobs:
   latest-release:
     name: Add/update tag to new release
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     permissions:
       contents: write
 

.github/workflows/license-check.yml

@@ -12,7 +12,7 @@ concurrency:
 jobs:
   license_check:
     name: License Check
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v4

.github/workflows/no-hold-label.yml

@@ -11,7 +11,7 @@ concurrency:
 
 jobs:
   check-hold-label:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     steps:
     - name: Check for 'hold' label
       uses: actions/github-script@v7

.github/workflows/pr-lint.yml

@@ -10,7 +10,7 @@ on:
 
 jobs:
   lint-check:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
       pull-requests: write

.github/workflows/pre-commit.yml

@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   pre-commit:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     strategy:
       matrix:
         python-version: ["current", "next", "previous"]

.github/workflows/prefer-typescript.yml

@@ -21,7 +21,7 @@ jobs:
   prefer_typescript:
     if: github.ref == 'ref/heads/master' && github.event_name == 'pull_request'
     name: Prefer TypeScript
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
       pull-requests: write

.github/workflows/release.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   config:
-    runs-on: ubuntu-24.04
+    runs-on: "ubuntu-22.04"
     outputs:
       has-secrets: ${{ steps.check.outputs.has-secrets }}
     steps:
@@ -25,7 +25,7 @@ jobs:
     if: needs.config.outputs.has-secrets
     name: Bump version and publish package(s)
 
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
 
     strategy:
       matrix:

.github/workflows/superset-applitool-cypress.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   config:
-    runs-on: ubuntu-24.04
+    runs-on: "ubuntu-22.04"
     outputs:
       has-secrets: ${{ steps.check.outputs.has-secrets }}
     steps:
@@ -21,7 +21,7 @@ jobs:
   cypress-applitools:
     needs: config
     if: needs.config.outputs.has-secrets
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     strategy:
       fail-fast: false
       matrix:

.github/workflows/superset-applitools-storybook.yml

@@ -12,7 +12,7 @@ env:
 
 jobs:
   config:
-    runs-on: ubuntu-24.04
+    runs-on: "ubuntu-22.04"
     outputs:
       has-secrets: ${{ steps.check.outputs.has-secrets }}
     steps:
@@ -27,7 +27,7 @@ jobs:
   cron:
     needs: config
     if: needs.config.outputs.has-secrets
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     strategy:
       matrix:
         node: [20]

.github/workflows/superset-cli.yml

@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   test-load-examples:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     env:
       PYTHONPATH: ${{ github.workspace }}
       SUPERSET_CONFIG: tests.integration_tests.superset_test_config

.github/workflows/superset-docs-deploy.yml

@@ -12,7 +12,7 @@ on:
 
 jobs:
   config:
-    runs-on: ubuntu-24.04
+    runs-on: "ubuntu-22.04"
     outputs:
       has-secrets: ${{ steps.check.outputs.has-secrets }}
     steps:
@@ -28,7 +28,7 @@ jobs:
     needs: config
     if: needs.config.outputs.has-secrets
     name: Build & Deploy
-    runs-on: ubuntu-24.04
+    runs-on: "ubuntu-22.04"
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v4

.github/workflows/superset-docs-verify.yml

@@ -51,7 +51,7 @@ jobs:
             https://www.plaidcloud.com/
   build-deploy:
     name: Build & Deploy
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     defaults:
       run:
         working-directory: docs

.github/workflows/superset-e2e.yml

@@ -28,7 +28,6 @@ concurrency:
 
 jobs:
   cypress-matrix:
-    # Somehow one test flakes on 24.04 for unknown reasons, this is the only GHA left on 22.04
     runs-on: ubuntu-22.04
     permissions:
       contents: read

.github/workflows/superset-frontend.yml

@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   frontend-build:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v4
@@ -73,7 +73,7 @@ jobs:
         working-directory: ./superset-frontend/packages/generator-superset
         run: npm run test
       - name: Upload code coverage
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v4
         with:
           flags: javascript
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/superset-helm-lint.yml

@@ -1,4 +1,4 @@
-name: "Helm: lint and test charts"
+name: Lint and Test Charts
 
 on:
   pull_request:
@@ -13,7 +13,7 @@ concurrency:
 
 jobs:
   lint-test:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v4

.github/workflows/superset-helm-release.yml

@@ -1,8 +1,4 @@
-# This workflow automates the release process for Helm charts.
-# The workflow creates a new branch for the release and opens a pull request against the 'gh-pages' branch,
-# allowing the changes to be reviewed and merged manually.
-
-name: "Helm: release charts"
+name: Release Charts
 
 on:
   push:
@@ -11,28 +7,18 @@ on:
       - "[0-9].[0-9]*"
     paths:
       - "helm/**"
-  workflow_dispatch:
-    inputs:
-      ref:
-        description: "The branch, tag, or commit SHA to check out"
-        required: false
-        default: "master"
 
 jobs:
   release:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     permissions:
       contents: write
-      pull-requests: write
-    env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
     steps:
-      - name: Checkout code
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v4
         with:
-          ref: ${{ inputs.ref || github.ref_name }}
-          persist-credentials: true
+          persist-credentials: false
           submodules: recursive
           fetch-depth: 0
 
@@ -49,77 +35,11 @@ jobs:
       - name: Add bitnami repo dependency
         run: helm repo add bitnami https://charts.bitnami.com/bitnami
 
-      - name: Fetch/list all tags
-        run: |
-          # Debugging tags
-          git fetch --tags --force
-          git tag -d superset-helm-chart-0.13.4 || true
-          echo "DEBUG TAGS"
-          git show-ref --tags
-
-      - name: Create unique pages branch name
-        id: vars
-        run: echo "branch_name=helm-publish-${GITHUB_SHA:0:7}" >> $GITHUB_ENV
-
-      - name: Force recreate branch from gh-pages
-        run: |
-          # Ensure a clean working directory
-          git reset --hard
-          git clean -fdx
-          git checkout -b local_gha_temp
-          git submodule update
-
-          # Fetch the latest gh-pages branch
-          git fetch origin gh-pages
-
-          # Check out and reset the target branch based on gh-pages
-          git checkout -B ${{ env.branch_name }} origin/gh-pages
-
-          # Remove submodules from the branch
-          git submodule deinit -f --all
-
-          # Force push to the remote branch
-          git push origin ${{ env.branch_name }} --force
-
-          # Return to the original branch
-          git checkout local_gha_temp
-
-      - name: Fetch/list all tags
-        run: |
-          git submodule update
-          cat .github/actions/chart-releaser-action/action.yml
-
       - name: Run chart-releaser
         uses: ./.github/actions/chart-releaser-action
         with:
-          version: v1.6.0
           charts_dir: helm
           mark_as_latest: false
-          pages_branch: ${{ env.branch_name }}
         env:
           CR_TOKEN: "${{ github.token }}"
           CR_RELEASE_NAME_TEMPLATE: "superset-helm-chart-{{ .Version }}"
-
-      - name: Open Pull Request
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const branchName = '${{ env.branch_name }}';
-            const [owner, repo] = process.env.GITHUB_REPOSITORY.split('/');
-
-            if (!branchName) {
-              throw new Error("Branch name is not defined.");
-            }
-
-            const pr = await github.rest.pulls.create({
-              owner,
-              repo,
-              title: `Helm chart release for ${branchName}`,
-              head: branchName,
-              base: "gh-pages", // Adjust if the target branch is different
-              body: `This PR releases Helm charts to the gh-pages branch.`,
-            });
-
-            core.info(`Pull request created: ${pr.data.html_url}`);
-        env:
-          BRANCH_NAME: ${{ env.branch_name }}

.github/workflows/superset-python-integrationtest.yml

@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   test-mysql:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     env:
       PYTHONPATH: ${{ github.workspace }}
       SUPERSET_CONFIG: tests.integration_tests.superset_test_config
@@ -68,13 +68,13 @@ jobs:
         run: |
           ./scripts/python_tests.sh
       - name: Upload code coverage
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v4
         with:
           flags: python,mysql
           token: ${{ secrets.CODECOV_TOKEN }}
           verbose: true
   test-postgres:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     strategy:
       matrix:
         python-version: ["current", "next", "previous"]
@@ -129,14 +129,14 @@ jobs:
         run: |
           ./scripts/python_tests.sh
       - name: Upload code coverage
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v4
         with:
           flags: python,postgres
           token: ${{ secrets.CODECOV_TOKEN }}
           verbose: true
 
   test-sqlite:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     env:
       PYTHONPATH: ${{ github.workspace }}
       SUPERSET_CONFIG: tests.integration_tests.superset_test_config
@@ -181,7 +181,7 @@ jobs:
         run: |
           ./scripts/python_tests.sh
       - name: Upload code coverage
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v4
         with:
           flags: python,sqlite
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/superset-python-presto-hive.yml

@@ -16,7 +16,7 @@ concurrency:
 
 jobs:
   test-postgres-presto:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     env:
       PYTHONPATH: ${{ github.workspace }}
       SUPERSET_CONFIG: tests.integration_tests.superset_test_config
@@ -77,14 +77,14 @@ jobs:
         run: |
           ./scripts/python_tests.sh -m 'chart_data_flow or sql_json_flow'
       - name: Upload code coverage
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v4
         with:
           flags: python,presto
           token: ${{ secrets.CODECOV_TOKEN }}
           verbose: true
 
   test-postgres-hive:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     env:
       PYTHONPATH: ${{ github.workspace }}
       SUPERSET_CONFIG: tests.integration_tests.superset_test_config
@@ -142,10 +142,9 @@ jobs:
       - name: Python unit tests (PostgreSQL)
         if: steps.check.outputs.python
         run: |
-          pip install -e .[hive]
           ./scripts/python_tests.sh -m 'chart_data_flow or sql_json_flow'
       - name: Upload code coverage
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v4
         with:
           flags: python,hive
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/superset-python-unittest.yml

@@ -16,7 +16,7 @@ concurrency:
 
 jobs:
   unit-tests:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     strategy:
       matrix:
         python-version: ["current", "next"]
@@ -46,7 +46,7 @@ jobs:
         run: |
           pytest --durations-min=0.5 --cov-report= --cov=superset ./tests/common ./tests/unit_tests --cache-clear
       - name: Upload code coverage
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v4
         with:
           flags: python,unit
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/superset-translations.yml

@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   frontend-check-translations:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v4
@@ -46,7 +46,7 @@ jobs:
           npm run build-translation
 
   babel-extract:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v4

.github/workflows/superset-websocket.yml

@@ -18,7 +18,7 @@ concurrency:
 
 jobs:
   app-checks:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v4

.github/workflows/supersetbot.yml

@@ -15,7 +15,7 @@ on:
 
 jobs:
   supersetbot:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     if: >
       github.event_name == 'workflow_dispatch' ||
       (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@supersetbot'))

.github/workflows/tag-release.yml

@@ -23,7 +23,7 @@ on:
           - 'false'
 jobs:
   config:
-    runs-on: ubuntu-24.04
+    runs-on: "ubuntu-22.04"
     outputs:
       has-secrets: ${{ steps.check.outputs.has-secrets }}
     steps:
@@ -39,26 +39,23 @@ jobs:
     needs: config
     if: needs.config.outputs.has-secrets
     name: docker-release
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     strategy:
       matrix:
         build_preset: ["dev", "lean", "py310", "websocket", "dockerize", "py311"]
       fail-fast: false
     steps:
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
 
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - name: Setup Docker Environment
-        uses: ./.github/actions/setup-docker
-        with:
-          dockerhub-user: ${{ secrets.DOCKERHUB_USER }}
-          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
-          install-docker-compose: "false"
-          build: "true"
-
       - name: Use Node.js 20
         uses: actions/setup-node@v4
         with:
@@ -67,6 +64,13 @@ jobs:
       - name: Setup supersetbot
         uses: ./.github/actions/setup-supersetbot/
 
+      - name: Try to login to DockerHub
+        continue-on-error: true
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USER }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
       - name: Execute custom Node.js script
         env:
           DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }}
@@ -87,7 +91,6 @@ jobs:
           fi
 
           supersetbot docker \
-            --push \
             --preset ${{ matrix.build_preset }} \
             --context "$EVENT" \
             --context-ref "$RELEASE" $FORCE_LATEST \
@@ -100,7 +103,7 @@ jobs:
   update-prs-with-release-info:
     needs: config
     if: needs.config.outputs.has-secrets
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
       pull-requests: write

.github/workflows/tech-debt.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   config:
-    runs-on: ubuntu-24.04
+    runs-on: "ubuntu-22.04"
     outputs:
       has-secrets: ${{ steps.check.outputs.has-secrets }}
     steps:
@@ -23,7 +23,7 @@ jobs:
   process-and-upload:
     needs: config
     if: needs.config.outputs.has-secrets
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     name: Generate Reports
     steps:
       - name: Checkout Repository

.github/workflows/welcome-new-users.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   welcome:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     permissions:
       pull-requests: write
 

.pre-commit-config.yaml

@@ -16,11 +16,11 @@
 #
 repos:
   - repo: https://github.com/MarcoGorelli/auto-walrus
-    rev: 0.3.4
+    rev: v0.2.2
     hooks:
       - id: auto-walrus
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: v1.13.0
+    rev: v1.3.0
     hooks:
       - id: mypy
         args: [--check-untyped-defs]
@@ -38,22 +38,25 @@ repos:
             types-paramiko,
             types-Markdown,
           ]
+  - repo: https://github.com/peterdemin/pip-compile-multi
+    rev: v2.6.2
+    hooks:
+      - id: pip-compile-multi-verify
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v4.4.0
     hooks:
       - id: check-docstring-first
       - id: check-added-large-files
-        exclude: ^.*\.(geojson)$|^docs/static/img/screenshots/.*|^superset-frontend/CHANGELOG\.md$
+        exclude: ^.*\.(geojson)$|^docs/static/img/screenshots/.*
       - id: check-yaml
         exclude: ^helm/superset/templates/
       - id: debug-statements
       - id: end-of-file-fixer
-        exclude: .*/lerna\.json$
       - id: trailing-whitespace
         exclude: ^.*\.(snap)
         args: ["--markdown-linebreak-ext=md"]
   - repo: https://github.com/pre-commit/mirrors-prettier
-    rev: v4.0.0-alpha.8 # Use the sha or tag you want to point at
+    rev: v3.1.0 # Use the sha or tag you want to point at
     hooks:
       - id: prettier
         additional_dependencies:
@@ -67,13 +70,27 @@ repos:
       - id: blacklist
         args: ["--blacklisted-names=make_url", "--ignore=tests/"]
   - repo: https://github.com/norwoodj/helm-docs
-    rev: v1.14.2
+    rev: v1.11.0
     hooks:
       - id: helm-docs
         files: helm
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.8.0
+    rev: v0.4.0
     hooks:
       - id: ruff
         args: [ --fix ]
       - id: ruff-format
+  - repo: local
+    hooks:
+      - id: pylint
+        name: pylint
+        entry: pylint
+        language: system
+        types: [python]
+        exclude: ^(tests/|superset/migrations/|scripts/|RELEASING/|docker/)
+        args:
+          [
+            "-rn", # Only display messages
+            "-sn", # Don't display the score
+            "--rcfile=.pylintrc",
+          ]

.pylintrc

@@ -0,0 +1,380 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+[MASTER]
+
+# Specify a configuration file.
+#rcfile=
+
+# Python code to execute, usually for sys.path manipulation such as
+# pygtk.require().
+#init-hook=
+
+# Add files or directories to the blacklist. They should be base names, not
+# paths.
+ignore=CVS,migrations
+
+# Add files or directories matching the regex patterns to the blacklist. The
+# regex matches against base names, not paths.
+ignore-patterns=
+
+# Pickle collected data for later comparisons.
+persistent=yes
+
+# List of plugins (as comma separated values of python modules names) to load,
+# usually to register additional checkers.
+load-plugins=superset.extensions.pylint
+
+# Use multiple processes to speed up Pylint.
+jobs=2
+
+# Allow loading of arbitrary C extensions. Extensions are imported into the
+# active Python interpreter and may run arbitrary code.
+unsafe-load-any-extension=no
+
+# A comma-separated list of package or module names from where C extensions may
+# be loaded. Extensions are loading into the active Python interpreter and may
+# run arbitrary code
+extension-pkg-whitelist=pyarrow
+
+
+[MESSAGES CONTROL]
+
+# Only show warnings with the listed confidence levels. Leave empty to show
+# all. Valid levels: HIGH, INFERENCE, INFERENCE_FAILURE, UNDEFINED
+confidence=
+
+# Enable the message, report, category or checker with the given id(s). You can
+# either give multiple identifier separated by comma (,) or put this option
+# multiple time (only on the command line, not in the configuration file where
+# it should appear only once). See also the "--disable" option for examples.
+enable=
+    useless-suppression,
+
+# Disable the message, report, category or checker with the given id(s). You
+# can either give multiple identifiers separated by comma (,) or put this
+# option multiple times (only on the command line, not in the configuration
+# file where it should appear only once).You can also use "--disable=all" to
+# disable everything first and then reenable specific checks. For example, if
+# you want to run only the similarities checker, you can use "--disable=all
+# --enable=similarities". If you want to run only the classes checker, but have
+# no Warning level messages displayed, use"--disable=all --enable=classes
+# --disable=W"
+disable=
+    cyclic-import,  # re-enable once this no longer raises false positives
+    missing-docstring,
+    duplicate-code,
+    line-too-long,
+    unspecified-encoding,
+    too-many-instance-attributes  # re-enable once this no longer raises false positives
+
+[REPORTS]
+
+# Set the output format. Available formats are text, parseable, colorized, msvs
+# (visual studio) and html. You can also give a reporter class, eg
+# mypackage.mymodule.MyReporterClass.
+output-format=text
+
+# Tells whether to display a full report or only the messages
+reports=yes
+
+# Python expression which should return a note less than 10 (10 is the highest
+# note). You have access to the variables errors warning, statement which
+# respectively contain the number of errors / warnings messages and the total
+# number of statements analyzed. This is used by the global evaluation report
+# (RP0004).
+evaluation=10.0 - ((float(5 * error + warning + refactor + convention) / statement) * 10)
+
+# Template used to display messages. This is a python new-style format string
+# used to format the message information. See doc for all details
+#msg-template=
+
+
+[BASIC]
+
+# Good variable names which should always be accepted, separated by a comma
+good-names=_,df,ex,f,i,id,j,k,l,o,pk,Run,ts,v,x,y
+
+# Bad variable names which should always be refused, separated by a comma
+bad-names=bar,baz,db,fd,foo,sesh,session,tata,toto,tutu
+
+# Colon-delimited sets of names that determine each other's naming style when
+# the name regexes allow several styles.
+name-group=
+
+# Include a hint for the correct naming format with invalid-name
+include-naming-hint=no
+
+# List of decorators that produce properties, such as abc.abstractproperty. Add
+# to this list to register other decorators that produce valid properties.
+property-classes=
+    abc.abstractproperty,
+    sqlalchemy.ext.hybrid.hybrid_property
+
+# Regular expression matching correct argument names
+argument-rgx=[a-z_][a-z0-9_]{2,30}$
+
+# Regular expression matching correct method names
+method-rgx=[a-z_][a-z0-9_]{2,30}$
+
+# Regular expression matching correct variable names
+variable-rgx=[a-z_][a-z0-9_]{1,30}$
+
+# Regular expression matching correct inline iteration names
+inlinevar-rgx=[A-Za-z_][A-Za-z0-9_]*$
+
+# Regular expression matching correct constant names
+const-rgx=(([A-Za-z_][A-Za-z0-9_]*)|(__.*__))$
+
+# Regular expression matching correct class names
+class-rgx=[A-Z_][a-zA-Z0-9]+$
+
+# Regular expression matching correct class attribute names
+class-attribute-rgx=([A-Za-z_][A-Za-z0-9_]{2,30}|(__.*__))$
+
+# Regular expression matching correct module names
+module-rgx=(([a-z_][a-z0-9_]*)|([A-Z][a-zA-Z0-9]+))$
+
+# Regular expression matching correct attribute names
+attr-rgx=[a-z_][a-z0-9_]{2,30}$
+
+# Regular expression matching correct function names
+function-rgx=[a-z_][a-z0-9_]{2,30}$
+
+# Regular expression which should only match function or class names that do
+# not require a docstring.
+no-docstring-rgx=^_
+
+# Minimum line length for functions/classes that require docstrings, shorter
+# ones are exempt.
+docstring-min-length=10
+
+
+[ELIF]
+
+# Maximum number of nested blocks for function / method body
+max-nested-blocks=5
+
+
+[FORMAT]
+
+# Maximum number of characters on a single line.
+max-line-length=100
+
+# Regexp for a line that is allowed to be longer than the limit.
+ignore-long-lines=^\s*(# )?<?https?://\S+>?$
+
+# Allow the body of an if to be on the same line as the test if there is no
+# else.
+single-line-if-stmt=no
+
+# Maximum number of lines in a module
+max-module-lines=1000
+
+# String used as indentation unit. This is usually "    " (4 spaces) or "\t" (1
+# tab).
+indent-string='    '
+
+# Number of spaces of indent required inside a hanging  or continued line.
+indent-after-paren=4
+
+# Expected format of line ending, e.g. empty (any line ending), LF or CRLF.
+expected-line-ending-format=
+
+
+[LOGGING]
+
+# Logging modules to check that the string format arguments are in logging
+# function parameter format
+logging-modules=logging
+
+
+[MISCELLANEOUS]
+
+# List of note tags to take in consideration, separated by a comma.
+notes=FIXME,XXX
+
+
+[SIMILARITIES]
+
+# Minimum lines number of a similarity.
+min-similarity-lines=5
+
+# Ignore comments when computing similarities.
+ignore-comments=yes
+
+# Ignore docstrings when computing similarities.
+ignore-docstrings=yes
+
+# Ignore imports when computing similarities.
+ignore-imports=no
+
+
+[SPELLING]
+
+# Spelling dictionary name. Available dictionaries: none. To make it working
+# install python-enchant package.
+spelling-dict=
+
+# List of comma separated words that should not be checked.
+spelling-ignore-words=
+
+# A path to a file that contains private dictionary; one word per line.
+spelling-private-dict-file=
+
+# Tells whether to store unknown words to indicated private dictionary in
+# --spelling-private-dict-file option instead of raising a message.
+spelling-store-unknown-words=no
+
+
+[TYPECHECK]
+
+# Tells whether missing members accessed in mixin class should be ignored. A
+# mixin class is detected if its name ends with "mixin" (case insensitive).
+ignore-mixin-members=yes
+
+# List of module names for which member attributes should not be checked
+# (useful for modules/projects where namespaces are manipulated during runtime
+# and thus existing member attributes cannot be deduced by static analysis. It
+# supports qualified module names, as well as Unix pattern matching.
+ignored-modules=numpy,pandas,alembic.op,sqlalchemy,alembic.context,flask_appbuilder.security.sqla.PermissionView.role,flask_appbuilder.Model.metadata,flask_appbuilder.Base.metadata
+
+# List of class names for which member attributes should not be checked (useful
+# for classes with dynamically set attributes). This supports the use of
+# qualified names.
+ignored-classes=contextlib.closing,optparse.Values,thread._local,_thread._local
+
+# List of members which are set dynamically and missed by pylint inference
+# system, and so shouldn't trigger E1101 when accessed. Python regular
+# expressions are accepted.
+generated-members=
+
+# List of decorators that produce context managers, such as
+# contextlib.contextmanager. Add to this list to register other decorators that
+# produce valid context managers.
+contextmanager-decorators=contextlib.contextmanager
+
+
+[VARIABLES]
+
+# Tells whether we should check for unused import in __init__ files.
+init-import=no
+
+# A regular expression matching the name of dummy variables (i.e. expectedly
+# not used).
+dummy-variables-rgx=(_+[a-zA-Z0-9]*?$)|dummy
+
+# List of additional names supposed to be defined in builtins. Remember that
+# you should avoid to define new builtins when possible.
+additional-builtins=
+
+# List of strings which can identify a callback function by name. A callback
+# name must start or end with one of those strings.
+callbacks=cb_,_cb
+
+# List of qualified module names which can have objects that can redefine
+# builtins.
+redefining-builtins-modules=six.moves,future.builtins
+
+
+[CLASSES]
+
+# List of method names used to declare (i.e. assign) instance attributes.
+defining-attr-methods=__init__,__new__,setUp
+
+# List of valid names for the first argument in a class method.
+valid-classmethod-first-arg=cls
+
+# List of valid names for the first argument in a metaclass class method.
+valid-metaclass-classmethod-first-arg=mcs
+
+# List of member names, which should be excluded from the protected access
+# warning.
+exclude-protected=_asdict,_fields,_replace,_source,_make
+
+
+[DESIGN]
+
+# Maximum number of arguments for function / method
+max-args=5
+
+# Argument names that match this expression will be ignored. Default to name
+# with leading underscore
+ignored-argument-names=_.*
+
+# Maximum number of locals for function / method body
+max-locals=15
+
+# Maximum number of return / yield for function / method body
+max-returns=10
+
+# Maximum number of branch for function / method body
+max-branches=15
+
+# Maximum number of statements in function / method body
+max-statements=50
+
+# Maximum number of parents for a class (see R0901).
+max-parents=7
+
+# Maximum number of attributes for a class (see R0902).
+max-attributes=8
+
+# Minimum number of public methods for a class (see R0903).
+min-public-methods=2
+
+# Maximum number of public methods for a class (see R0904).
+max-public-methods=20
+
+# Maximum number of boolean expressions in a if statement
+max-bool-expr=5
+
+
+[IMPORTS]
+
+# Deprecated modules which should not be used, separated by a comma
+deprecated-modules=optparse
+
+# Create a graph of every (i.e. internal and external) dependencies in the
+# given file (report RP0402 must not be disabled)
+import-graph=
+
+# Create a graph of external dependencies in the given file (report RP0402 must
+# not be disabled)
+ext-import-graph=
+
+# Create a graph of internal dependencies in the given file (report RP0402 must
+# not be disabled)
+int-import-graph=
+
+# Force import order to recognize a module as part of the standard
+# compatibility libraries.
+known-standard-library=
+
+# Force import order to recognize a module as part of a third party library.
+known-third-party=enchant
+
+# Analyse import fallback blocks. This can be used to support both Python 2 and
+# 3 compatible code, which means that the block might have code that exists
+# only in one or another interpreter, leading to false positives when analysed.
+analyse-fallback-blocks=no
+
+
+[EXCEPTIONS]
+
+# Exceptions that will emit a warning when being caught. Defaults to
+# "Exception"
+overgeneral-exceptions=builtins.Exception

.rat-excludes

@@ -70,7 +70,6 @@ google-sheets.svg
 ibm-db2.svg
 postgresql.svg
 snowflake.svg
-ydb.svg
 
 # docs-related
 erd.puml

Dockerfile

@@ -20,43 +20,44 @@
 ######################################################################
 ARG PY_VER=3.10-slim-bookworm
 
-# If BUILDPLATFORM is null, set it to 'amd64' (or leave as is otherwise).
+# if BUILDPLATFORM is null, set it to 'amd64' (or leave as is otherwise).
 ARG BUILDPLATFORM=${BUILDPLATFORM:-amd64}
-
-######################################################################
-# superset-node used for building frontend assets
-######################################################################
 FROM --platform=${BUILDPLATFORM} node:20-bullseye-slim AS superset-node
-ARG BUILD_TRANSLATIONS="false" # Include translations in the final build
-ENV BUILD_TRANSLATIONS=${BUILD_TRANSLATIONS}
-ARG DEV_MODE="false"           # Skip frontend build in dev mode
-ENV DEV_MODE=${DEV_MODE}
 
-COPY docker/ /app/docker/
-# Arguments for build configuration
 ARG NPM_BUILD_CMD="build"
 
-# Install system dependencies required for node-gyp
-RUN /app/docker/apt-install.sh build-essential python3 zstd
+# Include translations in the final build. The default supports en only to
+# reduce complexity and weight for those only using en
+ARG BUILD_TRANSLATIONS="false"
+
+# Used by docker-compose to skip the frontend build,
+# in dev we mount the repo and build the frontend inside docker
+ARG DEV_MODE="false"
+
+# Include headless browsers? Allows for alerts, reports & thumbnails, but bloats the images
+ARG INCLUDE_CHROMIUM="true"
+ARG INCLUDE_FIREFOX="false"
+
+# Somehow we need python3 + build-essential on this side of the house to install node-gyp
+RUN apt-get update -qq \
+    && apt-get install \
+        -yqq --no-install-recommends \
+        build-essential \
+        python3 \
+        zstd
 
-# Define environment variables for frontend build
 ENV BUILD_CMD=${NPM_BUILD_CMD} \
     PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true
+# NPM ci first, as to NOT invalidate previous steps except for when package.json changes
 
-# Run the frontend memory monitoring script
-RUN /app/docker/frontend-mem-nag.sh
+RUN --mount=type=bind,target=/frontend-mem-nag.sh,src=./docker/frontend-mem-nag.sh \
+    /frontend-mem-nag.sh
 
 WORKDIR /app/superset-frontend
-
-# Create necessary folders to avoid errors in subsequent steps
-RUN mkdir -p /app/superset/static/assets \
-             /app/superset/translations
-
-# Mount package files and install dependencies if not in dev mode
-RUN --mount=type=bind,source=./superset-frontend/package.json,target=./package.json \
-    --mount=type=bind,source=./superset-frontend/package-lock.json,target=./package-lock.json \
-    --mount=type=cache,target=/root/.cache \
-    --mount=type=cache,target=/root/.npm \
+# Creating empty folders to avoid errors when running COPY later on
+RUN mkdir -p /app/superset/static/assets
+RUN --mount=type=bind,target=./package.json,src=./superset-frontend/package.json \
+    --mount=type=bind,target=./package-lock.json,src=./superset-frontend/package-lock.json \
     if [ "$DEV_MODE" = "false" ]; then \
         npm ci; \
     else \
@@ -65,37 +66,36 @@ RUN --mount=type=bind,source=./superset-frontend/package.json,target=./package.j
 
 # Runs the webpack build process
 COPY superset-frontend /app/superset-frontend
-
-# Build the frontend if not in dev mode
-RUN --mount=type=cache,target=/app/superset-frontend/.temp_cache \
-    --mount=type=cache,target=/root/.npm \
-    if [ "$DEV_MODE" = "false" ]; then \
-        echo "Running 'npm run ${BUILD_CMD}'"; \
-        npm run ${BUILD_CMD}; \
+# This copies the .po files needed for translation
+RUN mkdir -p /app/superset/translations
+COPY superset/translations /app/superset/translations
+RUN if [ "$DEV_MODE" = "false" ]; then \
+        BUILD_TRANSLATIONS=$BUILD_TRANSLATIONS npm run ${BUILD_CMD}; \
     else \
         echo "Skipping 'npm run ${BUILD_CMD}' in dev mode"; \
-    fi;
+    fi
 
-# Copy translation files
-COPY superset/translations /app/superset/translations
 
-# Build the frontend if not in dev mode
+# Compiles .json files from the .po files, then deletes the .po files
 RUN if [ "$BUILD_TRANSLATIONS" = "true" ]; then \
         npm run build-translation; \
-    fi; \
-    rm -rf /app/superset/translations/*/*/*.po; \
-    rm -rf /app/superset/translations/*/*/*.mo;
+    else \
+        echo "Skipping translations as requested by build flag"; \
+    fi
+RUN rm /app/superset/translations/*/LC_MESSAGES/*.po
+RUN rm /app/superset/translations/messages.pot
 
-
-######################################################################
-# Base python layer
-######################################################################
 FROM python:${PY_VER} AS python-base
-ARG BUILD_TRANSLATIONS="false" # Include translations in the final build
-ENV BUILD_TRANSLATIONS=${BUILD_TRANSLATIONS}
-ARG DEV_MODE="false"           # Skip frontend build in dev mode
-ENV DEV_MODE=${DEV_MODE}
+######################################################################
+# Final lean image...
+######################################################################
+FROM python-base AS lean
 
+# Include translations in the final build. The default supports en only to
+# reduce complexity and weight for those only using en
+ARG BUILD_TRANSLATIONS="false"
+
+WORKDIR /app
 ENV LANG=C.UTF-8 \
     LC_ALL=C.UTF-8 \
     SUPERSET_ENV=production \
@@ -104,144 +104,123 @@ ENV LANG=C.UTF-8 \
     SUPERSET_HOME="/app/superset_home" \
     SUPERSET_PORT=8088
 
+RUN mkdir -p ${PYTHONPATH} superset/static requirements superset-frontend apache_superset.egg-info requirements \
+    && useradd --user-group -d ${SUPERSET_HOME} -m --no-log-init --shell /bin/bash superset \
+    && apt-get update -qq && apt-get install -yqq --no-install-recommends \
+        curl \
+        libsasl2-dev \
+        libsasl2-modules-gssapi-mit \
+        libpq-dev \
+        libecpg-dev \
+        libldap2-dev \
+    && touch superset/static/version_info.json \
+    && chown -R superset:superset ./* \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN useradd --user-group -d ${SUPERSET_HOME} -m --no-log-init --shell /bin/bash superset
+COPY --chown=superset:superset pyproject.toml setup.py MANIFEST.in README.md ./
+# setup.py uses the version information in package.json
+COPY --chown=superset:superset superset-frontend/package.json superset-frontend/
+COPY --chown=superset:superset requirements/base.txt requirements/
+COPY --chown=superset:superset scripts/check-env.py scripts/
+RUN --mount=type=cache,target=/root/.cache/pip \
+    apt-get update -qq && apt-get install -yqq --no-install-recommends \
+      build-essential \
+    && pip install --no-cache-dir --upgrade setuptools pip \
+    && pip install --no-cache-dir -r requirements/base.txt \
+    && apt-get autoremove -yqq --purge build-essential \
+    && rm -rf /var/lib/apt/lists/*
 
-# Some bash scripts needed throughout the layers
-COPY --chmod=755 docker/*.sh /app/docker/
+# Copy the compiled frontend assets
+COPY --chown=superset:superset --from=superset-node /app/superset/static/assets superset/static/assets
 
-RUN pip install --no-cache-dir --upgrade uv
+## Lastly, let's install superset itself
+COPY --chown=superset:superset superset superset
+RUN --mount=type=cache,target=/root/.cache/pip \
+    pip install --no-cache-dir -e .
 
-# Using uv as it's faster/simpler than pip
-RUN uv venv /app/.venv
-ENV PATH="/app/.venv/bin:${PATH}"
+# Copy the .json translations from the frontend layer
+COPY --chown=superset:superset --from=superset-node /app/superset/translations superset/translations
 
-# Install Playwright and optionally setup headless browsers
-ARG INCLUDE_CHROMIUM="true"
-ARG INCLUDE_FIREFOX="false"
-RUN --mount=type=cache,target=/root/.cache/uv\
-    if [ "$INCLUDE_CHROMIUM" = "true" ] || [ "$INCLUDE_FIREFOX" = "true" ]; then \
-        uv pip install playwright && \
-        playwright install-deps && \
-        if [ "$INCLUDE_CHROMIUM" = "true" ]; then playwright install chromium; fi && \
-        if [ "$INCLUDE_FIREFOX" = "true" ]; then playwright install firefox; fi; \
+# Compile translations for the backend - this generates .mo files, then deletes the .po files
+COPY ./scripts/translations/generate_mo_files.sh ./scripts/translations/
+RUN if [ "$BUILD_TRANSLATIONS" = "true" ]; then \
+        ./scripts/translations/generate_mo_files.sh \
+        && chown -R superset:superset superset/translations \
+        && rm superset/translations/messages.pot \
+        && rm superset/translations/*/LC_MESSAGES/*.po; \
     else \
-        echo "Skipping browser installation"; \
+        echo "Skipping translations as requested by build flag"; \
     fi
 
-######################################################################
-# Python translation compiler layer
-######################################################################
-FROM python-base AS python-translation-compiler
-
-# Install Python dependencies using docker/pip-install.sh
-COPY requirements/translations.txt requirements/
-RUN --mount=type=cache,target=/root/.cache/uv \
-    /app/docker/pip-install.sh --requires-build-essential -r requirements/translations.txt
-
-COPY superset/translations/ /app/translations_mo/
-RUN if [ "$BUILD_TRANSLATIONS" = "true" ]; then \
-        pybabel compile -d /app/translations_mo | true; \
-    fi; \
-    rm -f /app/translations_mo/*/*/*.po; \
-    rm -f /app/translations_mo/*/*/*.json;
-
-######################################################################
-# Python APP common layer
-######################################################################
-FROM python-base AS python-common
-# Copy the entrypoints, make them executable in userspace
-COPY --chmod=755 docker/entrypoints /app/docker/entrypoints
-
-WORKDIR /app
-# Set up necessary directories and user
-RUN mkdir -p \
-      ${SUPERSET_HOME} \
-      ${PYTHONPATH} \
-      superset/static \
-      requirements \
-      superset-frontend \
-      apache_superset.egg-info \
-      requirements \
-    && touch superset/static/version_info.json
-
-# Copy required files for Python build
-COPY pyproject.toml setup.py MANIFEST.in README.md ./
-COPY superset-frontend/package.json superset-frontend/
-COPY scripts/check-env.py scripts/
-
-# keeping for backward compatibility
-COPY --chmod=755 ./docker/entrypoints/run-server.sh /usr/bin/
-
-# Some debian libs
-RUN /app/docker/apt-install.sh \
-      curl \
-      libsasl2-dev \
-      libsasl2-modules-gssapi-mit \
-      libpq-dev \
-      libecpg-dev \
-      libldap2-dev
-
-# Copy compiled things from previous stages
-COPY --from=superset-node /app/superset/static/assets superset/static/assets
-
-# TODO, when the next version comes out, use --exclude superset/translations
-COPY superset superset
-# TODO in the meantime, remove the .po files
-RUN rm superset/translations/*/*/*.po
-
-# Merging translations from backend and frontend stages
-COPY --from=superset-node /app/superset/translations superset/translations
-COPY --from=python-translation-compiler /app/translations_mo superset/translations
+COPY --chmod=755 ./docker/run-server.sh /usr/bin/
+USER superset
 
 HEALTHCHECK CMD curl -f "http://localhost:${SUPERSET_PORT}/health"
-CMD ["/app/docker/entrypoints/run-server.sh"]
+
 EXPOSE ${SUPERSET_PORT}
 
-######################################################################
-# Final lean image...
-######################################################################
-FROM python-common AS lean
-
-# Install Python dependencies using docker/pip-install.sh
-COPY requirements/base.txt requirements/
-RUN --mount=type=cache,target=/root/.cache/uv \
-    /app/docker/pip-install.sh --requires-build-essential -r requirements/base.txt
-# Install the superset package
-RUN --mount=type=cache,target=/root/.cache/uv \
-    uv pip install .
-
-RUN python -m compileall /app/superset
-
-USER superset
+CMD ["/usr/bin/run-server.sh"]
 
 ######################################################################
 # Dev image...
 ######################################################################
-FROM python-common AS dev
+FROM lean AS dev
 
-# Debian libs needed for dev
-RUN /app/docker/apt-install.sh \
-    git \
-    pkg-config \
-    default-libmysqlclient-dev
+USER root
+RUN apt-get update -qq \
+    && apt-get install -yqq --no-install-recommends \
+        libnss3 \
+        libdbus-glib-1-2 \
+        libgtk-3-0 \
+        libx11-xcb1 \
+        libasound2 \
+        libxtst6 \
+        git \
+        pkg-config \
+        && rm -rf /var/lib/apt/lists/*
 
-# Copy development requirements and install them
-COPY requirements/*.txt requirements/
-# Install Python dependencies using docker/pip-install.sh
-RUN --mount=type=cache,target=/root/.cache/uv \
-    /app/docker/pip-install.sh --requires-build-essential -r requirements/development.txt
-# Install the superset package
-RUN --mount=type=cache,target=/root/.cache/uv \
-    uv pip install .
+RUN --mount=type=cache,target=/root/.cache/pip \
+    pip install --no-cache-dir playwright
+RUN playwright install-deps
 
-RUN python -m compileall /app/superset
+RUN if [ "$INCLUDE_CHROMIUM" = "true" ]; then \
+        playwright install chromium; \
+    else \
+        echo "Skipping translations in dev mode"; \
+    fi
+
+# Install GeckoDriver WebDriver
+ARG GECKODRIVER_VERSION=v0.34.0 \
+    FIREFOX_VERSION=125.0.3
+
+RUN if [ "$INCLUDE_FIREFOX" = "true" ]; then \
+        apt-get update -qq \
+        && apt-get install -yqq --no-install-recommends wget bzip2 \
+        && wget -q https://github.com/mozilla/geckodriver/releases/download/${GECKODRIVER_VERSION}/geckodriver-${GECKODRIVER_VERSION}-linux64.tar.gz -O - | tar xfz - -C /usr/local/bin \
+        && wget -q https://download-installer.cdn.mozilla.net/pub/firefox/releases/${FIREFOX_VERSION}/linux-x86_64/en-US/firefox-${FIREFOX_VERSION}.tar.bz2 -O - | tar xfj - -C /opt \
+        && ln -s /opt/firefox/firefox /usr/local/bin/firefox \
+        && apt-get autoremove -yqq --purge wget bzip2 && rm -rf /var/[log,tmp]/* /tmp/* /var/lib/apt/lists/*; \
+    fi
+
+# Installing mysql client os-level dependencies in dev image only because GPL
+RUN apt-get install -yqq --no-install-recommends \
+        default-libmysqlclient-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --chown=superset:superset requirements/development.txt requirements/
+RUN --mount=type=cache,target=/root/.cache/pip \
+    apt-get update -qq && apt-get install -yqq --no-install-recommends \
+      build-essential \
+    && pip install --no-cache-dir -r requirements/development.txt \
+    && apt-get autoremove -yqq --purge build-essential \
+    && rm -rf /var/lib/apt/lists/*
 
 USER superset
-
 ######################################################################
 # CI image...
 ######################################################################
 FROM lean AS ci
 
-CMD ["/app/docker/entrypoints/docker-ci.sh"]
+COPY --chown=superset:superset --chmod=755 ./docker/*.sh /app/docker/
+
+CMD ["/app/docker/docker-ci.sh"]

Makefile

@@ -87,6 +87,9 @@ format: py-format js-format
 py-format: pre-commit
 	pre-commit run black --all-files
 
+py-lint: pre-commit
+	pylint -j 0 superset
+
 js-format:
 	cd superset-frontend; npm run prettier
 

README.md

@@ -136,7 +136,6 @@ Here are some of the major database solutions that are supported:
   <img src="https://superset.apache.org/img/databases/oceanbase.svg" alt="oceanbase" border="0" width="220" />
   <img src="https://superset.apache.org/img/databases/sap-hana.png" alt="oceanbase" border="0" width="220" />
   <img src="https://superset.apache.org/img/databases/denodo.png" alt="denodo" border="0" width="200" />
-  <img src="https://superset.apache.org/img/databases/ydb.svg" alt="ydb" border="0" width="200" />
 </p>
 
 **A more comprehensive list of supported databases** along with the configuration instructions can be found [here](https://superset.apache.org/docs/configuration/databases).

RELEASING/changelog.py

@@ -272,14 +272,14 @@ class GitLogs:
 
     @staticmethod
     def _git_get_current_head() -> str:
-        output = os.popen("git status | head -1").read()  # noqa: S605, S607
+        output = os.popen("git status | head -1").read()
         match = re.match("(?:HEAD detached at|On branch) (.*)", output)
         if not match:
             return ""
         return match.group(1)
 
     def _git_checkout(self, git_ref: str) -> None:
-        os.popen(f"git checkout {git_ref}").read()  # noqa: S605
+        os.popen(f"git checkout {git_ref}").read()
         current_head = self._git_get_current_head()
         if current_head != git_ref:
             print(f"Could not checkout {git_ref}")
@@ -290,7 +290,7 @@ class GitLogs:
         current_git_ref = self._git_get_current_head()
         self._git_checkout(self._git_ref)
         output = (
-            os.popen('git --no-pager log --pretty=format:"%h|%an|%ae|%ad|%s|"')  # noqa: S605, S607
+            os.popen('git --no-pager log --pretty=format:"%h|%an|%ae|%ad|%s|"')
             .read()
             .split("\n")
         )

RELEASING/generate_email.py

@@ -31,7 +31,7 @@ except ModuleNotFoundError:
 RECEIVER_EMAIL = "dev@superset.apache.org"
 PROJECT_NAME = "Superset"
 PROJECT_MODULE = "superset"
-PROJECT_DESCRIPTION = "Apache Superset is a modern, enterprise-ready business intelligence web application."  # noqa: E501
+PROJECT_DESCRIPTION = "Apache Superset is a modern, enterprise-ready business intelligence web application."
 
 
 def string_comma_to_list(message: str) -> list[str]:

RELEASING/verify_release.py

@@ -23,12 +23,12 @@ from typing import Optional
 
 import requests
 
-# Part 1: Verify SHA512 hash - this is the same as running `shasum -a 512 {release}` and comparing it against `{release}.sha512`  # noqa: E501
+# Part 1: Verify SHA512 hash - this is the same as running `shasum -a 512 {release}` and comparing it against `{release}.sha512`
 
 
 def get_sha512_hash(filename: str) -> str:
     """Run the shasum command on the file and return the SHA512 hash."""
-    result = subprocess.run(["shasum", "-a", "512", filename], stdout=subprocess.PIPE)  # noqa: S603, S607
+    result = subprocess.run(["shasum", "-a", "512", filename], stdout=subprocess.PIPE)
     sha512_hash = result.stdout.decode().split()[0]
     return sha512_hash
 
@@ -43,7 +43,7 @@ def read_sha512_file(filename: str) -> str:
 
 
 def verify_sha512(filename: str) -> str:
-    """Verify if the SHA512 hash of the file matches with the hash in the .sha512 file."""  # noqa: E501
+    """Verify if the SHA512 hash of the file matches with the hash in the .sha512 file."""
     sha512_hash = get_sha512_hash(filename)
     sha512_file_content = read_sha512_file(filename)
 
@@ -53,15 +53,14 @@ def verify_sha512(filename: str) -> str:
         return "SHA failed"
 
 
-# Part 2: Verify RSA key - this is the same as running `gpg --verify {release}.asc {release}` and comparing the RSA key and email address against the KEYS file  # noqa: E501
+# Part 2: Verify RSA key - this is the same as running `gpg --verify {release}.asc {release}` and comparing the RSA key and email address against the KEYS file
 
 
 def get_gpg_info(filename: str) -> tuple[Optional[str], Optional[str]]:
     """Run the GPG verify command and extract RSA key and email address."""
     asc_filename = filename + ".asc"
-    result = subprocess.run(  # noqa: S603
-        ["gpg", "--verify", asc_filename, filename],  # noqa: S607
-        capture_output=True,  # noqa: S607
+    result = subprocess.run(
+        ["gpg", "--verify", asc_filename, filename], capture_output=True
     )
     output = result.stderr.decode()
 
@@ -91,7 +90,7 @@ def get_gpg_info(filename: str) -> tuple[Optional[str], Optional[str]]:
 def verify_key(key: str, email: Optional[str]) -> str:
     """Fetch the KEYS file and verify if the RSA/EDDSA key and email match."""
     url = "https://downloads.apache.org/superset/KEYS"
-    response = requests.get(url)  # noqa: S113
+    response = requests.get(url)
     if response.status_code == 200:
         if key not in response.text:
             return "RSA/EDDSA key not found on KEYS page"

RESOURCES/INTHEWILD.md

@@ -79,7 +79,7 @@ Join our growing community!
 - [Astronomer](https://www.astronomer.io) [@ryw]
 - [Avesta Technologies](https://avestatechnologies.com/) [@TheRum]
 - [Caizin](https://caizin.com/) [@tejaskatariya]
-- [Careem](https://www.careem.com/) [@samraHanif0340]
+- [Careem](https://www.careem.com/) [@SamraHanifCareem]
 - [Cloudsmith](https://cloudsmith.io) [@alancarson]
 - [Cyberhaven](https://www.cyberhaven.com/) [@toliver-ch]
 - [Deepomatic](https://deepomatic.com/) [@Zanoellia]
@@ -119,7 +119,6 @@ Join our growing community!
 - [Tobii](https://www.tobii.com/) [@dwa]
 - [Tooploox](https://www.tooploox.com/) [@jakubczaplicki]
 - [Unvired](https://unvired.com) [@srinisubramanian]
-- [Virtuoso QA](https://www.virtuosoqa.com)
 - [Whale](https://whale.im)
 - [Windsor.ai](https://www.windsor.ai/) [@octaviancorlade]
 - [Zeta](https://www.zeta.tech/) [@shaikidris]

UPDATING.md

@@ -24,13 +24,9 @@ assists people when migrating to a new version.
 
 ## Next
 
-- [31198](https://github.com/apache/superset/pull/31198) Disallows by default the use of the following ClickHouse functions: "version", "currentDatabase", "hostName".
 - [29798](https://github.com/apache/superset/pull/29798) Since 3.1.0, the intial schedule for an alert or report was mistakenly offset by the specified timezone's relation to UTC. The initial schedule should now begin at the correct time.
 - [30021](https://github.com/apache/superset/pull/30021) The `dev` layer in our Dockerfile no long includes firefox binaries, only Chromium to reduce bloat/docker-build-time.
 - [30099](https://github.com/apache/superset/pull/30099) Translations are no longer included in the default docker image builds. If your environment requires translations, you'll want to set the docker build arg `BUILD_TRANSACTION=true`.
-- [31262](https://github.com/apache/superset/pull/31262) NOTE: deprecated `pylint` in favor of `ruff` as our only python linter. Only affect development workflows positively (not the release itself). It should cover most important rules, be much faster, but some things linting rules that were enforced before may not be enforce in the exact same way as before.
-- [31173](https://github.com/apache/superset/pull/31173) Modified `fetch_csrf_token` to align with HTTP standards, particularly regarding how cookies are handled. If you encounter any issues related to CSRF functionality, please report them as a new issue and reference this PR for context.
-- [31385](https://github.com/apache/superset/pull/31385) Significant docker refactor, reducing access levels for the `superset` user, streamlining layer building, ...
 
 ### Potential Downtime
 

docker-compose.yml

@@ -25,6 +25,7 @@ x-superset-user: &superset-user root
 x-superset-depends-on: &superset-depends-on
   - db
   - redis
+  - superset-checks
 x-superset-volumes: &superset-volumes
   # /app/pythonpath_docker will be appended to the PYTHONPATH in the final container
   - ./docker:/app/docker
@@ -35,14 +36,11 @@ x-superset-volumes: &superset-volumes
 
 x-common-build: &common-build
   context: .
-  target: ${SUPERSET_BUILD_TARGET:-dev} # can use `dev` (default) or `lean`
+  target: dev
   cache_from:
     - apache/superset-cache:3.10-slim-bookworm
   args:
     DEV_MODE: "true"
-    INCLUDE_CHROMIUM: ${INCLUDE_CHROMIUM:-false}
-    INCLUDE_FIREFOX: ${INCLUDE_FIREFOX:-false}
-    BUILD_TRANSLATIONS: ${BUILD_TRANSLATIONS:-false}
 
 services:
   nginx:
@@ -133,6 +131,23 @@ services:
       - REDIS_PORT=6379
       - REDIS_SSL=false
 
+  superset-checks:
+    build:
+      context: .
+      target: python-base
+      cache_from:
+        - apache/superset-cache:3.10-slim-bookworm
+    container_name: superset_checks
+    command: ["/app/scripts/check-env.py"]
+    env_file:
+      - path: docker/.env # default
+        required: true
+      - path: docker/.env-local # optional override
+        required: false
+    user: *superset-user
+    healthcheck:
+      disable: true
+
   superset-init:
     build:
       <<: *common-build
@@ -160,12 +175,10 @@ services:
         # and build it on startup while firing docker-frontend.sh in dev mode, where
         # it'll mount and watch local files and rebuild as you update them
         DEV_MODE: "true"
-        BUILD_TRANSLATIONS: ${BUILD_TRANSLATIONS:-false}
     environment:
       # set this to false if you have perf issues running the npm i; npm run dev in-docker
       # if you do so, you have to run this manually on the host, which should perform better!
       BUILD_SUPERSET_FRONTEND_IN_DOCKER: true
-      NPM_RUN_PRUNE: false
       SCARF_ANALYTICS: "${SCARF_ANALYTICS:-}"
     container_name: superset_node
     command: ["/app/docker/docker-frontend.sh"]

docker/.env

@@ -17,7 +17,6 @@
 
 
 COMPOSE_PROJECT_NAME=superset
-DEV_MODE=true
 
 # database configurations (do not modify)
 DATABASE_DB=superset

docker/apt-install.sh

@@ -1,51 +0,0 @@
-#!/usr/bin/env bash
-#
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-set -euo pipefail
-
-# Ensure this script is run as root
-if [[ $EUID -ne 0 ]]; then
-  echo "This script must be run as root" >&2
-  exit 1
-fi
-
-# Check for required arguments
-if [[ $# -lt 1 ]]; then
-  echo "Usage: $0 <package1> [<package2> ...]" >&2
-  exit 1
-fi
-
-# Colors for better logging (optional)
-GREEN='\033[0;32m'
-RED='\033[0;31m'
-RESET='\033[0m'
-
-# Install packages with clean-up
-echo -e "${GREEN}Updating package lists...${RESET}"
-apt-get update -qq
-
-echo -e "${GREEN}Installing packages: $@${RESET}"
-apt-get install -yqq --no-install-recommends "$@"
-
-echo -e "${GREEN}Autoremoving unnecessary packages...${RESET}"
-apt-get autoremove -y
-
-echo -e "${GREEN}Cleaning up package cache and metadata...${RESET}"
-apt-get clean
-rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/* /tmp/* /var/tmp/*
-
-echo -e "${GREEN}Installation and cleanup complete.${RESET}"

docker/docker-bootstrap.sh

@@ -18,11 +18,6 @@
 
 set -eo pipefail
 
-# Make python interactive
-if [ "$DEV_MODE" == "true" ]; then
-    echo "Reinstalling the app in editable mode"
-    uv pip install -e .
-fi
 REQUIREMENTS_LOCAL="/app/docker/requirements-local.txt"
 # If Cypress run – overwrite the password for admin and export env variables
 if [ "$CYPRESS_CONFIG" == "true" ]; then
@@ -30,16 +25,12 @@ if [ "$CYPRESS_CONFIG" == "true" ]; then
     export SUPERSET_TESTENV=true
     export SUPERSET__SQLALCHEMY_DATABASE_URI=postgresql+psycopg2://superset:superset@db:5432/superset
 fi
-if [[ "$DATABASE_DIALECT" == postgres* ]] ; then
-    echo "Installing postgres requirements"
-    uv pip install -e .[postgres]
-fi
 #
 # Make sure we have dev requirements installed
 #
 if [ -f "${REQUIREMENTS_LOCAL}" ]; then
   echo "Installing local overrides at ${REQUIREMENTS_LOCAL}"
-  uv pip install --no-cache-dir -r "${REQUIREMENTS_LOCAL}"
+  pip install --no-cache-dir -r "${REQUIREMENTS_LOCAL}"
 else
   echo "Skipping local overrides"
 fi

docker/docker-frontend.sh

@@ -27,15 +27,10 @@ if [ "$BUILD_SUPERSET_FRONTEND_IN_DOCKER" = "true" ]; then
     echo "Building Superset frontend in dev mode inside docker container"
     cd /app/superset-frontend
 
-    if [ "$NPM_RUN_PRUNE" = "true" ]; then
-        echo "Running `npm run prune`"
-        npm run prune
-    fi
-
     echo "Running `npm install`"
     npm install
 
-    echo "Start webpack dev server"
+    echo "Running frontend"
     npm run dev
 
 else

docker/pip-install.sh

@@ -1,64 +0,0 @@
-#!/usr/bin/env bash
-#
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-set -euo pipefail
-
-# Default flag
-REQUIRES_BUILD_ESSENTIAL=false
-USE_CACHE=true
-
-# Filter arguments
-ARGS=()
-for arg in "$@"; do
-  case "$arg" in
-    --requires-build-essential)
-      REQUIRES_BUILD_ESSENTIAL=true
-      ;;
-    --no-cache)
-      USE_CACHE=false
-      ;;
-    *)
-      ARGS+=("$arg")
-      ;;
-  esac
-done
-
-# Install build-essential if required
-if $REQUIRES_BUILD_ESSENTIAL; then
-  echo "Installing build-essential for package builds..."
-  apt-get update -qq \
-    && apt-get install -yqq --no-install-recommends build-essential
-fi
-
-# Choose whether to use pip cache
-if $USE_CACHE; then
-  echo "Using pip cache..."
-  uv pip install "${ARGS[@]}"
-else
-  echo "Disabling pip cache..."
-  uv pip install --no-cache-dir "${ARGS[@]}"
-fi
-
-# Remove build-essential if it was installed
-if $REQUIRES_BUILD_ESSENTIAL; then
-  echo "Removing build-essential to keep the image lean..."
-  apt-get autoremove -yqq --purge build-essential \
-    && apt-get clean \
-    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
-fi
-
-echo "Python packages installed successfully."

docker/pythonpath_dev/superset_config.py

@@ -99,7 +99,7 @@ CELERY_CONFIG = CeleryConfig
 
 FEATURE_FLAGS = {"ALERT_REPORTS": True}
 ALERT_REPORTS_NOTIFICATION_DRY_RUN = True
-WEBDRIVER_BASEURL = "http://superset:8088/"  # When using docker compose baseurl should be http://superset_app:8088/  # noqa: E501
+WEBDRIVER_BASEURL = "http://superset:8088/"  # When using docker compose baseurl should be http://superset_app:8088/
 # The base URL for the email report hyperlinks.
 WEBDRIVER_BASEURL_USER_FRIENDLY = WEBDRIVER_BASEURL
 SQLLAB_CTAS_NO_LIMIT = True

docs/data/countries.json

@@ -63,7 +63,6 @@
     "Fiji",
     "Finland",
     "France",
-    "France (with overseas)",
     "France (regions)",
     "French Polynesia",
     "Gabon",

docs/docs/configuration/alerts-reports.mdx

@@ -53,14 +53,11 @@ To send alerts and reports to Slack channels, you need to create a new Slack App
    - `incoming-webhook`
    - `files:write`
    - `chat:write`
-   - `channels:read`
-   - `groups:read`
 4. At the top of the "OAuth and Permissions" section, click "install to workspace".
 5. Select a default channel for your app and continue.
    (You can post to any channel by inviting your Superset app into that channel).
 6. The app should now be installed in your workspace, and a "Bot User OAuth Access Token" should have been created. Copy that token in the `SLACK_API_TOKEN` variable of your `superset_config.py`.
-7. Ensure the feature flag `ALERT_REPORT_SLACK_V2` is set to True in `superset_config.py`
-8. Restart the service (or run `superset init`) to pull in the new configuration.
+7. Restart the service (or run `superset init`) to pull in the new configuration.
 
 Note: when you configure an alert or a report, the Slack channel list takes channel names without the leading '#' e.g. use `alerts` instead of `#alerts`.
 

docs/docs/configuration/databases.mdx

@@ -81,7 +81,6 @@ are compatible with Superset.
 | [TimescaleDB](/docs/configuration/databases#timescaledb)                | `pip install psycopg2`                                                             | `postgresql://<UserName>:<DBPassword>@<Database Host>:<Port>/<Database Name>`                                                                          |
 | [Trino](/docs/configuration/databases#trino)                            | `pip install trino`                                                                | `trino://{username}:{password}@{hostname}:{port}/{catalog}`                                                                                            |
 | [Vertica](/docs/configuration/databases#vertica)                        | `pip install sqlalchemy-vertica-python`                                            | `vertica+vertica_python://<UserName>:<DBPassword>@<Database Host>/<Database Name>`                                                                     |
-| [YDB](/docs/configuration/databases#ydb)                                | `pip install ydb-sqlalchemy`                                                       | `ydb://{host}:{port}/{database_name}`                                                                                                                  |
 | [YugabyteDB](/docs/configuration/databases#yugabytedb)                  | `pip install psycopg2`                                                             | `postgresql://<UserName>:<DBPassword>@<Database Host>/<Database Name>`                                                                                 |
 ---
 
@@ -1538,78 +1537,6 @@ Other parameters:
 - Load Balancer - Backup Host
 
 
-
-#### YDB
-
-The recommended connector library for [YDB](https://ydb.tech/) is
-[ydb-sqlalchemy](https://pypi.org/project/ydb-sqlalchemy/).
-
-##### Connection String
-
-The connection string for YDB looks like this:
-
-```
-ydb://{host}:{port}/{database_name}
-```
-
-##### Protocol
-You can specify `protocol` in the `Secure Extra` field at `Advanced / Security`:
-
-```
-{
-    "protocol": "grpcs"
-}
-```
-
-Default is `grpc`.
-
-
-##### Authentication Methods
-###### Static Credentials
-To use `Static Credentials` you should provide `username`/`password` in the `Secure Extra` field at `Advanced / Security`:
-
-```
-{
-    "credentials": {
-        "username": "...",
-        "password": "..."
-    }
-}
-```
-
-
-###### Access Token Credentials
-To use `Access Token Credentials` you should provide `token` in the `Secure Extra` field at `Advanced / Security`:
-
-```
-{
-    "credentials": {
-        "token": "...",
-    }
-}
-```
-
-
-##### Service Account Credentials
-To use Service Account Credentials, you should provide `service_account_json` in the `Secure Extra` field at `Advanced / Security`:
-
-```
-{
-    "credentials": {
-        "service_account_json": {
-            "id": "...",
-            "service_account_id": "...",
-            "created_at": "...",
-            "key_algorithm": "...",
-            "public_key": "...",
-            "private_key": "..."
-        }
-    }
-}
-```
-
-
-
 #### YugabyteDB
 
 [YugabyteDB](https://www.yugabyte.com/) is a distributed SQL database built on top of PostgreSQL.

docs/docs/contributing/development.mdx

@@ -32,9 +32,7 @@ cd superset
 Setting things up to squeeze a "hello world" into any part of Superset should be as simple as
 
 ```bash
-# getting docker compose to fire up services, and rebuilding if some docker layers have changed
-# using the `--build` suffix may be slower and optional if layers like py dependencies haven't changed
-docker compose up --build
+docker compose up
 ```
 
 Note that:
@@ -72,37 +70,6 @@ documentation.
 configured to be secure.
 :::
 
-### Supported environment variables
-
-Affecting the Docker build process:
-- **SUPERSET_BUILD_TARGET (default=dev):** which --target to build, either `lean` or `dev` are commonly used
-- **INCLUDE_FIREFOX (default=false):** whether to include the Firefox headless browser in the build
-- **INCLUDE_CHROMIUM (default=false):** whether to include the Firefox headless browser in the build
-- **BUILD_TRANSLATIONS(default=false):** whether to compile the translations from the .po files available
-
-For more env vars that affect your configuration, see this
-[superset_config.py](https://github.com/apache/superset/blob/master/docker/pythonpath_dev/superset_config.py)
-used in the `docker compose` context to assign env vars to the superset configuration.
-
-
-### Nuking the postgres database
-
-At times, it's possible to end up with your development database in a bad state, it's
-common while switching branches that contain migrations for instance, where the database
-version stamp that `alembic` manages is no longer available after switching branch.
-
-In that case, the easy solution is to nuke the postgres db and start fresh. Note that the full
-state of the database will be gone after doing this, so be cautious.
-
-```bash
-# first stop docker-compose if it's running
-docker-compose down
-# delete the volume containing the database
-docker volume rm superset_db_home
-# restart docker-compose, which will init a fresh database and load examples
-docker-compose up
-```
-
 ## Installing Development Tools
 
 :::note
@@ -255,19 +222,19 @@ If you add a new requirement or update an existing requirement (per the `install
 $ python3 -m venv venv
 $ source venv/bin/activate
 $ python3 -m pip install -r requirements/development.txt
-$ ./scripts/uv-pip-compile.sh
+$ pip-compile-multi --no-upgrade
 ```
 
-When upgrading the version number of a single package, you should run `./scripts/uv-pip-compile.sh` with the `-P` flag:
+When upgrading the version number of a single package, you should run `pip-compile-multi` with the `-P` flag:
 
 ```bash
-$ ./scripts/uv-pip-compile.sh -P some-package-to-upgrade
+$ pip-compile-multi -P my-package
 ```
 
-To bring all dependencies up to date as per the restrictions defined in `setup.py` and `requirements/*.in`, run `./scripts/uv-pip-compile.sh --upgrade`
+To bring all dependencies up to date as per the restrictions defined in `setup.py` and `requirements/*.in`, run pip-compile-multi` without any flags:
 
 ```bash
-$ ./scripts/uv-pip-compile.sh --upgrade
+$ pip-compile-multi
 ```
 
 This should be done periodically, but it is recommended to do thorough manual testing of the application to ensure no breaking changes have been introduced that aren't caught by the unit and integration tests.
@@ -488,113 +455,86 @@ pre-commit install
 
 A series of checks will now run when you make a git commit.
 
+Alternatively, it is possible to run pre-commit via tox:
+
+```bash
+tox -e pre-commit
+```
+
+Or by running pre-commit manually:
+
+```bash
+pre-commit run --all-files
+```
 
 ## Linting
 
-See [how tos](/docs/contributing/howtos#linting)
+### Python
 
-
-## GitHub Actions and `act`
-
-:::tip
-`act` compatibility of Superset's GHAs is not fully tested. Running `act` locally may or may not
-work for different actions, and may require fine tunning and local secret-handling.
-For those more intricate GHAs that are tricky to run locally, we recommend iterating
-directly on GHA's infrastructure, by pushing directly on a branch and monitoring GHA logs.
-For more targetted iteration, see the `gh workflow run --ref {BRANCH}` subcommand of the GitHub CLI.
-:::
-
-For automation and CI/CD, Superset makes extensive use of GitHub Actions (GHA). You
-can find all of the workflows and other assets under the `.github/` folder. This includes:
-- running the backend unit test suites (`tests/`)
-- running the frontend test suites (`superset-frontend/src/**.*.test.*`)
-- running our Cypress end-to-end tests (`superset-frontend/cypress-base/`)
-- linting the codebase, including all Python, Typescript and Javascript, yaml and beyond
-- checking for all sorts of other rules conventions
-
-When you open a pull request (PR), the appropriate GitHub Actions (GHA) workflows will
-automatically run depending on the changes in your branch. It's perfectly reasonable
-(and required!) to rely on this automation. However, the downside is that it's mostly an
-all-or-nothing approach and doesn't provide much control to target specific tests or
-iterate quickly.
-
-At times, it may be more convenient to run GHA workflows locally. For that purpose
-we use [act](https://github.com/nektos/act), a tool that allows you to run GitHub Actions (GHA)
-workflows locally. It simulates the GitHub Actions environment, enabling developers to
-test and debug workflows on their local machines before pushing changes to the repository. More
-on how to use it in the next section.
-
-:::note
-In both GHA and `act`, we can run a more complex matrix for our tests, executing against different
-database engines (PostgreSQL, MySQL, SQLite) and different versions of Python.
-This enables us to ensure compatibility and stability across various environments.
-:::
-
-### Using `act`
-
-First, install `act` -> https://nektosact.com/
-
-To list the workflows, simply:
+We use [Pylint](https://pylint.org/) for linting which can be invoked via:
 
 ```bash
-act --list
+# for python
+tox -e pylint
 ```
 
-To run a specific workflow:
+In terms of best practices please avoid blanket disabling of Pylint messages globally (via `.pylintrc`) or top-level within the file header, albeit there being a few exceptions. Disabling should occur inline as it prevents masking issues and provides context as to why said message is disabled.
+
+Additionally, the Python code is auto-formatted using [Black](https://github.com/python/black) which
+is configured as a pre-commit hook. There are also numerous [editor integrations](https://black.readthedocs.io/en/stable/integrations/editors.html)
+
+### TypeScript
 
 ```bash
-act pull_request --job {workflow_name} --secret GITHUB_TOKEN=$GITHUB_TOKEN --container-architecture linux/amd64
+cd superset-frontend
+npm ci
+# run eslint checks
+npm run eslint -- .
+# run tsc (typescript) checks
+npm run type
 ```
 
-In the example above, notice that:
-- we target a specific workflow, using `--job`
-- we pass a secret using `--secret`, as many jobs require read access (public) to the repo
-- we simulate a `pull_request` event by specifying it as the first arg,
-  similarly, we could simulate a `push` event or something else
-- we specify `--container-architecture`, which tends to emulate GHA more reliably
+If using the eslint extension with vscode, put the following in your workspace `settings.json` file:
 
-:::note
-`act` is a rich tool that offers all sorts of features, allowing you to simulate different
-events (pull_request, push, ...), semantics around passing secrets where required and much
-more. For more information, refer to [act's documentation](https://nektosact.com/)
-:::
-
-:::note
-Some jobs require secrets to interact with external systems and accounts that you may
-not have in your possession. In those cases you may have to rely on remote CI or parameterize the
-job further to target a different environment/sandbox or your own alongside the related
-secrets.
-:::
-
----
+```json
+"eslint.workingDirectories": [
+  "superset-frontend"
+]
+```
 
 ## Testing
 
 ### Python Testing
 
-#### Unit Tests
-
-For unit tests located in `tests/unit_tests/`, it's usually easy to simply run the script locally using:
+All python tests are carried out in [tox](https://tox.readthedocs.io/en/latest/index.html)
+a standardized testing framework.
+All python tests can be run with any of the tox [environments](https://tox.readthedocs.io/en/latest/example/basic.html#a-simple-tox-ini-default-environments), via,
 
 ```bash
-pytest tests/unit_tests/*
+tox -e <environment>
 ```
 
-#### Integration Tests
-
-For more complex pytest-defined integration tests (not to be confused with our end-to-end Cypress tests), many tests will require having a working test environment. Some tests require a database, Celery, and potentially other services or libraries installed.
-
-### Running Tests with `act`
-
-To run integration tests locally using `act`, ensure you have followed the setup instructions from the [GitHub Actions and `act`](#github-actions-and-act) section. You can run specific workflows or jobs that include integration tests. For example:
+For example,
 
 ```bash
-act --job test-python-38 --secret GITHUB_TOKEN=$GITHUB_TOKEN --event pull_request --container-architecture linux/amd64
+tox -e py38
 ```
 
-#### Running locally using a test script
+Alternatively, you can run all tests in a single file via,
 
-There is also a utility script included in the Superset codebase to run Python integration tests. The [readme can be found here](https://github.com/apache/superset/tree/master/scripts/tests).
+```bash
+tox -e <environment> -- tests/test_file.py
+```
+
+or for a specific test via,
+
+```bash
+tox -e <environment> -- tests/test_file.py::TestClassName::test_method_name
+```
+
+Note that the test environment uses a temporary directory for defining the
+SQLite databases which will be cleared each time before the group of test
+commands are invoked.
 
 There is also a utility script included in the Superset codebase to run python integration tests. The [readme can be
 found here](https://github.com/apache/superset/tree/master/scripts/tests)
@@ -605,7 +545,7 @@ To run all integration tests, for example, run this script from the root directo
 scripts/tests/run.sh
 ```
 
-You can run unit tests found in `./tests/unit_tests` with pytest. It is a simple way to run an isolated test that doesn't need any database setup:
+You can run unit tests found in './tests/unit_tests' for example with pytest. It is a simple way to run an isolated test that doesn't need any database setup
 
 ```bash
 pytest ./link_to_test.py
@@ -628,7 +568,7 @@ npm run test -- path/to/file.js
 
 ### Integration Testing
 
-We use [Cypress](https://www.cypress.io/) for integration tests. To open Cypress and explore tests first setup and run test server:
+We use [Cypress](https://www.cypress.io/) for integration tests. Tests can be run by `tox -e cypress`. To open Cypress and explore tests first setup and run test server:
 
 ```bash
 export SUPERSET_CONFIG=tests.integration_tests.superset_test_config
@@ -679,7 +619,7 @@ If you already have launched Docker environment please use the following command
 
 Launch environment:
 
-`CYPRESS_CONFIG=true docker compose up --build`
+`CYPRESS_CONFIG=true docker compose up`
 
 It will serve the backend and frontend on port 8088.
 
@@ -747,7 +687,7 @@ superset:
 Start Superset as usual
 
 ```bash
-docker compose up --build
+docker compose up
 ```
 
 Install the required libraries and packages to the docker container

docs/docs/contributing/howtos.mdx

@@ -170,10 +170,31 @@ npm run dev-server
 
 ### Python Testing
 
-`pytest`, backend by docker-compose is how we recommend running tests locally.
+All python tests are carried out in [tox](https://tox.readthedocs.io/en/latest/index.html)
+a standardized testing framework.
+All python tests can be run with any of the tox [environments](https://tox.readthedocs.io/en/latest/example/basic.html#a-simple-tox-ini-default-environments), via,
 
-For a more complex test matrix (against different database backends, python versions, ...) you
-can rely on our GitHub Actions by simply opening a draft pull request.
+```bash
+tox -e <environment>
+```
+
+For example,
+
+```bash
+tox -e py38
+```
+
+Alternatively, you can run all tests in a single file via,
+
+```bash
+tox -e <environment> -- tests/test_file.py
+```
+
+or for a specific test via,
+
+```bash
+tox -e <environment> -- tests/test_file.py::TestClassName::test_method_name
+```
 
 Note that the test environment uses a temporary directory for defining the
 SQLite databases which will be cleared each time before the group of test
@@ -225,7 +246,13 @@ npm run test -- path/to/file.js
 
 ### e2e Integration Testing
 
-For e2e testing, we recommend that you use a `docker-compose` backed-setup
+We use [Cypress](https://www.cypress.io/) for end-to-end integration
+tests. One easy option to get started quickly is to leverage `tox` to
+run the whole suite in an isolated environment.
+
+```bash
+tox -e cypress
+```
 
 Alternatively, you can go lower level and set things up in your
 development environment by following these steps:
@@ -571,24 +598,17 @@ pybabel compile -d superset/translations
 
 ### Python
 
-We use [ruff](https://github.com/astral-sh/ruff) for linting which can be invoked via:
+We use [Pylint](https://pylint.org/) for linting which can be invoked via:
 
-```
-# auto-reformat using ruff
-ruff format
-
-# lint check with ruff
-ruff check
-
-# lint fix with ruff
-ruff check --fix
+```bash
+# for python
+tox -e pylint
 ```
 
-Ruff configuration is located in our
-(pyproject.toml)[https://github.com/apache/superset/blob/master/pyproject.toml] file
+In terms of best practices please avoid blanket disabling of Pylint messages globally (via `.pylintrc`) or top-level within the file header, albeit there being a few exceptions. Disabling should occur inline as it prevents masking issues and provides context as to why said message is disabled.
 
-All this is configured to run in pre-commit hooks, which we encourage you to setup
-with `pre-commit install`
+Additionally, the Python code is auto-formatted using [Black](https://github.com/python/black) which
+is configured as a pre-commit hook. There are also numerous [editor integrations](https://black.readthedocs.io/en/stable/integrations/editors.html)
 
 ### TypeScript
 

docs/docs/installation/docker-builds.mdx

@@ -29,7 +29,7 @@ We have a set of build "presets" that each represent a combination of
 parameters for the build, mostly pointing to either different target layer
 for the build, and/or base image.
 
-Here are the build presets that are exposed through the `supersetbot docker` utility:
+Here are the build presets that are exposed through the `build_docker.py` script:
 
 - `lean`: The default Docker image, including both frontend and backend. Tags
   without a build_preset are lean builds (ie: `latest`, `4.0.0`, `3.0.0`, ...). `lean`
@@ -62,8 +62,8 @@ Here are the build presets that are exposed through the `supersetbot docker` uti
 
 
 For insights or modifications to the build matrix and tagging conventions,
-check the [supersetbot docker](https://github.com/apache-superset/supersetbot)
-subcommand and the [docker.yml](https://github.com/apache/superset/blob/master/.github/workflows/docker.yml)
+check the [build_docker.py](https://github.com/apache/superset/blob/master/scripts/build_docker.py)
+script and the [docker.yml](https://github.com/apache/superset/blob/master/.github/workflows/docker.yml)
 GitHub action.
 
 ## Key ARGs in Dockerfile

docs/docs/installation/docker-compose.mdx

@@ -76,8 +76,7 @@ on latest base images using `docker compose build --pull`. In most cases though,
 ### Option #1 - for an interactive development environment
 
 ```bash
-# The --build argument insures all the layers are up-to-date
-docker compose up --build
+docker compose up
 ```
 
 :::tip
@@ -96,14 +95,6 @@ perform those operations. In this case, we recommend you set the env var
 Simply trigger `npm i && npm run dev`, this should be MUCH faster.
 :::
 
-:::tip
-Sometimes, your npm-related state can get out-of-wack, running `npm run prune` from
-the `superset-frontend/` folder will nuke the various' packages `node_module/` folders
-and help you start fresh. In the context of `docker compose` setting
-`export NPM_RUN_PRUNE=true` prior to running `docker compose up` will trigger that
-from within docker. This will slow down the startup, but will fix various npm-related issues.
-:::
-
 ### Option #2 - build a set of immutable images from the local branch
 
 ```bash
@@ -236,11 +227,3 @@ may want to find the exact hostname you want to use, for that you can do `ifconf
 Docker for you. Alternately if you don't even see the `docker0` interface try (if needed with sudo)
 `docker network inspect bridge` and see if there is an entry for `"Gateway"` and note the IP
 address.
-
-## 4. To build or not to build
-
-When running `docker compose up`, docker will build what is required behind the scene, but
-may use the docker cache if assets already exist. Running `docker compose build` prior to
-`docker compose up` or the equivalent shortcut `docker compose up --build` ensures that your
-docker images matche the definition in the repository. This should only apply to the main
-docker-compose.yml file (default) and not to the alternative methods defined above.

docs/docs/installation/pypi.mdx

@@ -77,6 +77,10 @@ versions officially supported by Superset. We'd recommend using a Python version
 like [pyenv](https://github.com/pyenv/pyenv)
 (and also [pyenv-virtualenv](https://github.com/pyenv/pyenv-virtualenv)).
 
+:::tip
+To identify the Python version used by the official docker image, see the [Dockerfile](https://github.com/apache/superset/blob/master/Dockerfile). Additional docker images published for newer versions of Python can be found in [this file](https://github.com/apache/superset/blob/master/scripts/build_docker.py).
+:::
+
 Let's also make sure we have the latest version of `pip` and `setuptools`:
 
 ```bash
@@ -130,22 +134,21 @@ First, start by installing `apache-superset`:
 pip install apache-superset
 ```
 
-Then, define mandatory configurations, SECRET_KEY and FLASK_APP:
-```bash
-export SUPERSET_SECRET_KEY=YOUR-SECRET-KEY
-export FLASK_APP=superset
-```
-
 Then, you need to initialize the database:
 
 ```bash
 superset db upgrade
 ```
 
+:::tip
+Note that some configuration is mandatory for production instances of Superset. In particular, Superset will not start without a user-specified value of SECRET_KEY. Please see [Configuring Superset](/docs/configuration/configuring-superset).
+:::
+
 Finish installing by running through the following commands:
 
 ```bash
 # Create an admin user in your metadata database (use `admin` as username to be able to load the examples)
+export FLASK_APP=superset
 superset fab create-admin
 
 # Load some data to play with

docs/docs/security/cves.mdx

@@ -2,15 +2,6 @@
 title: CVEs fixed by release
 sidebar_position: 2
 ---
-#### Version 4.1.0
-
-| CVE            | Title                                                                              | Affected |
-|:---------------|:-----------------------------------------------------------------------------------|---------:|
-| CVE-2024-53947 | Improper SQL authorisation, parse for specific postgres functions                  |  < 4.1.0 |
-| CVE-2024-53948 | Error verbosity exposes metadata in analytics databases                            |  < 4.1.0 |
-| CVE-2024-53949 | Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled |  < 4.1.0 |
-| CVE-2024-55633 | SQLLab Improper readonly query validation allows unauthorized write access         |  < 4.1.0 |
-
 #### Version 4.0.2
 
 | CVE            | Title                       | Affected |

docs/docusaurus.config.js

@@ -203,18 +203,13 @@ const config = {
       ({
         docs: {
           sidebarPath: require.resolve('./sidebars.js'),
-          editUrl:
-          ({versionDocsDirPath, docPath}) => {
-            if (docPath === 'intro.md') {
-              return 'https://github.com/apache/superset/edit/master/README.md'
-            }
-            return `https://github.com/apache/superset/edit/master/docs/${versionDocsDirPath}/${docPath}`
-          }
+          editUrl: 'https://github.com/apache/superset/edit/master/docs',
         },
         blog: {
           showReadingTime: true,
           // Please change this to your repo.
-          editUrl: 'https://github.com/facebook/docusaurus/edit/main/website/blog/',
+          editUrl:
+            'https://github.com/facebook/docusaurus/edit/main/website/blog/',
         },
         theme: {
           customCss: require.resolve('./src/styles/custom.css'),

docs/package.json

@@ -17,9 +17,9 @@
     "typecheck": "tsc"
   },
   "dependencies": {
-    "@algolia/client-search": "^5.18.0",
-    "@ant-design/icons": "^5.5.2",
-    "@docsearch/react": "^3.8.2",
+    "@algolia/client-search": "^5.12.0",
+    "@ant-design/icons": "^5.4.0",
+    "@docsearch/react": "^3.6.3",
     "@docusaurus/core": "^3.5.2",
     "@docusaurus/plugin-client-redirects": "^3.5.2",
     "@docusaurus/preset-classic": "^3.5.2",
@@ -29,12 +29,12 @@
     "@saucelabs/theme-github-codeblock": "^0.3.0",
     "@superset-ui/style": "^0.14.23",
     "@svgr/webpack": "^8.1.0",
-    "antd": "^5.22.2",
+    "antd": "^5.21.6",
     "buffer": "^6.0.3",
     "clsx": "^2.1.1",
     "docusaurus-plugin-less": "^2.0.2",
     "file-loader": "^6.2.0",
-    "less": "^4.2.1",
+    "less": "^4.2.0",
     "less-loader": "^11.0.0",
     "prism-react-renderer": "^2.4.0",
     "react": "^18.3.1",
@@ -42,15 +42,15 @@
     "react-github-btn": "^1.4.0",
     "react-svg-pan-zoom": "^3.13.1",
     "stream": "^0.0.3",
-    "swagger-ui-react": "^5.18.2",
+    "swagger-ui-react": "^5.17.14",
     "url-loader": "^4.1.1"
   },
   "devDependencies": {
-    "@docusaurus/module-type-aliases": "^3.6.3",
-    "@docusaurus/tsconfig": "^3.6.3",
+    "@docusaurus/module-type-aliases": "^3.5.2",
+    "@docusaurus/tsconfig": "^3.5.2",
     "@types/react": "^18.3.12",
-    "typescript": "^5.7.2",
-    "webpack": "^5.97.1"
+    "typescript": "^5.6.3",
+    "webpack": "^5.96.1"
   },
   "browserslist": {
     "production": [

docs/static/img/databases/ydb.svg

@@ -1,20 +0,0 @@
-<svg width="753" height="274" viewBox="0 0 753 274" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_28_1297)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M5 53.8669C5 37.6466 29.6243 29 60 29C90.3757 29 115 37.6466 115 53.8669V138.133C115 154.353 90.3757 163 60 163C29.6243 163 5 154.353 5 138.133V53.8669Z" fill="#2399FF"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M175 53.8669C175 37.6466 199.624 29 230 29C260.376 29 285 37.6466 285 53.8669V138.133C285 154.353 260.376 163 230 163C199.624 163 175 154.353 175 138.133V53.8669Z" fill="#2399FF"/>
-<path d="M177 85H113V103H177V85Z" fill="#2399FF"/>
-<path d="M173 157H115L81 111H59L105 173H183L229 111H207L173 157Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M89 145.867C89 129.647 113.624 121 144 121C174.376 121 199 129.647 199 145.867V230.133C199 246.353 174.376 255 144 255C113.624 255 89 246.353 89 230.133V145.867Z" fill="#2399FF"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M108.783 136.779C100.111 140.552 99 144.237 99 146C99 147.763 100.111 151.448 108.783 155.221C117.076 158.829 129.435 161 144 161C158.565 161 170.924 158.829 179.217 155.221C187.889 151.448 189 147.763 189 146C189 144.237 187.889 140.552 179.218 136.779C170.924 133.171 158.565 131 144 131C129.435 131 117.076 133.171 108.783 136.779Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M24.7825 44.7792C16.1105 48.5515 15 52.2365 15 54C15 55.7635 16.1105 59.4485 24.7825 63.2208C33.0763 66.8287 45.4354 69 60 69C74.5646 69 86.9237 66.8287 95.2175 63.2208C103.889 59.4485 105 55.7635 105 54C105 52.2365 103.889 48.5515 95.2175 44.7792C86.9237 41.1713 74.5646 39 60 39C45.4354 39 33.0763 41.1713 24.7825 44.7792Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M194.783 44.7792C186.111 48.5515 185 52.2365 185 54C185 55.7635 186.111 59.4485 194.783 63.2208C203.076 66.8287 215.435 69 230 69C244.565 69 256.924 66.8287 265.217 63.2208C273.889 59.4485 275 55.7635 275 54C275 52.2365 273.889 48.5515 265.218 44.7792C256.924 41.1713 244.565 39 230 39C215.435 39 203.076 41.1713 194.783 44.7792Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M694.131 64H634.75V210H705.026C730.974 210 750.243 191.821 750.243 166.963C750.243 150.15 740.93 137.39 726.201 130.891C733.027 124.143 737.168 115.224 737.168 104.858C737.168 81.2033 718.875 64 694.131 64ZM660.899 85.791V123.925H691.951C702.482 123.925 711.019 115.389 711.019 104.858C711.019 94.3277 702.482 85.791 691.951 85.791H660.899ZM660.899 188.209V145.716H702.847C714.581 145.716 724.093 155.229 724.093 166.963C724.093 178.697 714.581 188.209 702.847 188.209H660.899Z" fill="black"/>
-<path d="M352.716 64.0039H382.134L419.179 128.287L456.223 64.0039H485.641L432.308 155.472V210.004H406.049V155.472L352.716 64.0039Z" fill="black"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M496.008 64.0039H546.127C589.713 64.0039 619.127 92.3289 619.127 137.004C619.127 181.679 589.713 210.004 546.127 210.004H496.008V64.0039ZM522.157 188.213V85.7949H543.948C573.32 85.7949 592.978 104.364 592.978 137.004C592.978 169.644 573.32 188.213 543.948 188.213H522.157Z" fill="black"/>
-</g>
-<defs>
-<clipPath id="clip0_28_1297">
-<rect width="753" height="274" fill="white"/>
-</clipPath>
-</defs>
-</svg>

helm/superset/Chart.yaml

@@ -29,7 +29,7 @@ maintainers:
   - name: craig-rueda
     email: craig@craigrueda.com
     url: https://github.com/craig-rueda
-version: 0.13.5
+version: 0.13.3
 dependencies:
   - name: postgresql
     version: 12.1.6

helm/superset/README.md

@@ -23,7 +23,7 @@ NOTE: This file is generated by helm-docs: https://github.com/norwoodj/helm-docs
 
 # superset
 
-![Version: 0.13.5](https://img.shields.io/badge/Version-0.13.5-informational?style=flat-square)
+![Version: 0.13.3](https://img.shields.io/badge/Version-0.13.3-informational?style=flat-square)
 
 Apache Superset is a modern, enterprise-ready business intelligence web application
 
@@ -105,7 +105,6 @@ On helm this can be set on `extraSecretEnv.SUPERSET_SECRET_KEY` or `configOverri
 | init.jobAnnotations."helm.sh/hook-delete-policy" | string | `"before-hook-creation"` |  |
 | init.loadExamples | bool | `false` |  |
 | init.podAnnotations | object | `{}` |  |
-| init.podLabels | object | `{}` |  |
 | init.podSecurityContext | object | `{}` |  |
 | init.priorityClassName | string | `nil` | Set priorityClassName for init job pods |
 | init.resources | object | `{}` |  |

helm/superset/templates/init-job.yaml

@@ -23,12 +23,8 @@ kind: Job
 metadata:
   name: {{ template "superset.fullname" . }}-init-db
   namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ template "superset.name" . }}
-    chart: {{ template "superset.chart" . }}
-    release: {{ .Release.Name }}
-    heritage: {{ .Release.Service }}
   {{- if .Values.extraLabels }}
+  labels:
     {{- toYaml .Values.extraLabels | nindent 4 }}
   {{- end }}
   {{- if .Values.init.jobAnnotations }}
@@ -41,15 +37,6 @@ spec:
       {{- if .Values.init.podAnnotations }}
       annotations: {{- toYaml .Values.init.podAnnotations | nindent 8 }}
       {{- end }}
-      {{- if or .Values.extraLabels .Values.init.podLabels }}
-      labels:
-        {{- if .Values.extraLabels }}
-        {{- toYaml .Values.extraLabels | nindent 8 }}
-        {{- end }}
-        {{- if .Values.init.podLabels }}
-        {{- toYaml .Values.init.podLabels | nindent 8 }}
-        {{- end }}
-      {{- end }}
     spec:
       {{- if or (.Values.serviceAccount.create) (.Values.serviceAccountName) }}
       serviceAccountName: {{ template "superset.serviceAccountName" . }}

helm/superset/values.yaml

@@ -19,8 +19,7 @@
 # This is a YAML-formatted file.
 # Declare variables to be passed into your templates.
 
-# A README is automatically generated from this file to document it,
-# using helm-docs (see https://github.com/norwoodj/helm-docs)
+# A README is automatically generated from this file to document it, using helm-docs (see https://github.com/norwoodj/helm-docs)
 # To update it, install helm-docs and run helm-docs from the root of this chart
 
 # -- Provide a name to override the name of the chart
@@ -778,8 +777,6 @@ init:
   extraContainers: []
   ## Annotations to be added to init job pods
   podAnnotations: {}
-  # Labels to be added to init job pods
-  podLabels: {}
   podSecurityContext: {}
   containerSecurityContext: {}
   ## Tolerations to be added to init job pods

pyproject.toml

@@ -24,7 +24,7 @@ name = "apache-superset"
 description = "A modern, enterprise-ready business intelligence web application"
 readme = "README.md"
 dynamic = ["version", "scripts", "entry-points"]
-requires-python = ">=3.9"
+requires-python = "~=3.9"
 license = { file="LICENSE.txt" }
 authors = [
     { name = "Apache Software Foundation", email = "dev@superset.apache.org" },
@@ -53,8 +53,8 @@ dependencies = [
     "flask-migrate>=3.1.0, <4.0",
     "flask-session>=0.4.0, <1.0",
     "flask-wtf>=1.1.0, <2.0",
+    "func_timeout",
     "geopy",
-    "greenlet>=3.0.3, <=3.1.1",
     "gunicorn>=22.0.0; sys_platform != 'win32'",
     "hashids>=1.3.1, <2",
     # known issue with holidays 0.26.0 and above related to prophet lib #25017
@@ -69,11 +69,7 @@ dependencies = [
     "nh3>=0.2.11, <0.3",
     "numpy==1.23.5",
     "packaging",
-    # --------------------------
-    # pandas and related (wanting pandas[performance] without numba as it's 100+MB and not needed)
-    "pandas[excel]>=2.0.3, <2.1",
-    "bottleneck",
-    # --------------------------
+    "pandas[performance]>=2.0.3, <2.1",
     "parsedatetime",
     "paramiko>=3.4.0",
     "pgsanity",
@@ -94,9 +90,7 @@ dependencies = [
     "slack_sdk>=3.19.0, <4",
     "sqlalchemy>=1.4, <2",
     "sqlalchemy-utils>=0.38.3, <0.39",
-    # known breaking changes in sqlglot 25.25.0
-    #https://github.com/tobymao/sqlglot/blob/main/CHANGELOG.md#v25250---2024-10-14
-    "sqlglot>=25.24.0,<25.25.0",
+    "sqlglot>=25.24.0,<26",
     "sqlparse>=0.5.0",
     "tabulate>=0.8.9, <0.9",
     "typing-extensions>=4, <5",
@@ -141,6 +135,7 @@ gevent = ["gevent>=23.9.1"]
 gsheets = ["shillelagh[gsheetsapi]>=1.2.18, <2"]
 hana = ["hdbcli==2.4.162", "sqlalchemy_hana==0.4.0"]
 hive = [
+    "boto3",
     "pyhive[hive]>=0.6.5;python_version<'3.11'",
     "pyhive[hive_pure_sasl]>=0.7.0",
     "tableschema",
@@ -163,7 +158,7 @@ pinot = ["pinotdb>=5.0.0, <6.0.0"]
 playwright = ["playwright>=1.37.0, <2"]
 postgres = ["psycopg2-binary==2.9.6"]
 presto = ["pyhive[presto]>=0.6.5"]
-trino = ["trino>=0.328.0"]
+trino = ["boto3", "trino>=0.328.0"]
 prophet = ["prophet>=1.1.5, <2"]
 redshift = ["sqlalchemy-redshift>=0.8.1, <0.9"]
 rockset = ["rockset-sqlalchemy>=0.0.1, <1"]
@@ -182,19 +177,21 @@ netezza = ["nzalchemy>=11.0.2"]
 starrocks = ["starrocks>=1.0.0"]
 doris = ["pydoris>=1.0.0, <2.0.0"]
 oceanbase = ["oceanbase_py>=0.0.1"]
-ydb = ["ydb-sqlalchemy>=0.1.2"]
 development = [
     "docker",
     "flask-testing",
     "freezegun",
+    "greenlet>=2.0.2",
     "grpcio>=1.55.3",
     "openapi-spec-validator",
     "parameterized",
+    "pip-compile-multi",
     "pre-commit",
     "progress>=1.5,<2",
     "psutil",
     "pyfakefs",
     "pyinstrument>=4.0.2,<5",
+    "pylint",
     "pytest<8.0.0", # hairy issue with pytest >=8 where current_app proxies are not set in time
     "pytest-cov",
     "pytest-mock",
@@ -202,6 +199,7 @@ development = [
     "ruff",
     "sqloxide",
     "statsd",
+    "tox",
 ]
 
 [project.urls]
@@ -214,7 +212,7 @@ combine_as_imports = true
 include_trailing_comma = true
 line_length = 88
 known_first_party = "superset"
-known_third_party = "alembic, apispec, backoff, celery, click, colorama, cron_descriptor, croniter, cryptography, dateutil, deprecation, flask, flask_appbuilder, flask_babel, flask_caching, flask_compress, flask_jwt_extended, flask_login, flask_migrate, flask_sqlalchemy, flask_talisman, flask_testing, flask_wtf, freezegun, geohash, geopy, holidays, humanize, isodate, jinja2, jwt, markdown, markupsafe, marshmallow, msgpack, nh3, numpy, pandas, parameterized, parsedatetime, pgsanity, polyline, prison, progress, pyarrow, sqlalchemy_bigquery, pyhive, pyparsing, pytest, pytest_mock, pytz, redis, requests, selenium, setuptools, shillelagh, simplejson, slack, sqlalchemy, sqlalchemy_utils, sqlparse, typing_extensions, urllib3, werkzeug, wtforms, wtforms_json, yaml"
+known_third_party = "alembic, apispec, backoff, celery, click, colorama, cron_descriptor, croniter, cryptography, dateutil, deprecation, flask, flask_appbuilder, flask_babel, flask_caching, flask_compress, flask_jwt_extended, flask_login, flask_migrate, flask_sqlalchemy, flask_talisman, flask_testing, flask_wtf, freezegun, geohash, geopy, holidays, humanize, isodate, jinja2, jwt, markdown, markupsafe, marshmallow, msgpack, nh3, numpy, pandas, parameterized, parsedatetime, pgsanity, pkg_resources, polyline, prison, progress, pyarrow, sqlalchemy_bigquery, pyhive, pyparsing, pytest, pytest_mock, pytz, redis, requests, selenium, setuptools, shillelagh, simplejson, slack, sqlalchemy, sqlalchemy_utils, sqlparse, typing_extensions, urllib3, werkzeug, wtforms, wtforms_json, yaml"
 multi_line_output = 3
 order_by_type = false
 
@@ -238,10 +236,172 @@ disallow_untyped_calls = false
 disallow_untyped_defs = false
 disable_error_code = "annotation-unchecked"
 
+[tool.tox]
+legacy_tox_ini = """
+# Remember to start celery workers to run celery tests, e.g.
+# celery --app=superset.tasks.celery_app:app worker -Ofair -c 2
+[testenv]
+basepython = python3.10
+ignore_basepython_conflict = true
+commands =
+    superset db upgrade
+    superset init
+    superset load-test-users
+    # use -s to be able to use break pointers.
+    # no args or tests/* can be passed as an argument to run all tests
+    pytest -s {posargs}
+deps =
+    -rrequirements/development.txt
+setenv =
+    PYTHONPATH = {toxinidir}
+    SUPERSET_TESTENV = true
+    SUPERSET_CONFIG = tests.integration_tests.superset_test_config
+    SUPERSET_HOME = {envtmpdir}
+    mysql: SUPERSET__SQLALCHEMY_DATABASE_URI = mysql://mysqluser:mysqluserpassword@localhost/superset?charset=utf8
+    postgres: SUPERSET__SQLALCHEMY_DATABASE_URI = postgresql+psycopg2://superset:superset@localhost/test
+    sqlite: SUPERSET__SQLALCHEMY_DATABASE_URI = sqlite:////{envtmpdir}/superset.db
+    sqlite: SUPERSET__SQLALCHEMY_EXAMPLES_URI = sqlite:////{envtmpdir}/examples.db
+    mysql-presto: SUPERSET__SQLALCHEMY_DATABASE_URI = mysql://mysqluser:mysqluserpassword@localhost/superset?charset=utf8
+    # docker run -p 8080:8080 --name presto starburstdata/presto
+    mysql-presto: SUPERSET__SQLALCHEMY_EXAMPLES_URI = presto://localhost:8080/memory/default
+    # based on https://github.com/big-data-europe/docker-hadoop
+    # clone the repo & run docker compose up -d to test locally
+    mysql-hive: SUPERSET__SQLALCHEMY_DATABASE_URI = mysql://mysqluser:mysqluserpassword@localhost/superset?charset=utf8
+    mysql-hive: SUPERSET__SQLALCHEMY_EXAMPLES_URI = hive://localhost:10000/default
+    # make sure that directory is accessible by docker
+    hive: UPLOAD_FOLDER = /tmp/.superset/app/static/uploads/
+usedevelop = true
+allowlist_externals =
+    npm
+    pkill
+
+[testenv:cypress]
+setenv =
+    PYTHONPATH = {toxinidir}
+    SUPERSET_TESTENV = true
+    SUPERSET_CONFIG = tests.integration_tests.superset_test_config
+    SUPERSET_HOME = {envtmpdir}
+commands =
+    npm install -g npm@'>=6.5.0'
+    pip install -e {toxinidir}/
+    {toxinidir}/superset-frontend/cypress_build.sh
+commands_post =
+    pkill -if "python {envbindir}/flask"
+
+[testenv:cypress-dashboard]
+setenv =
+    PYTHONPATH = {toxinidir}
+    SUPERSET_TESTENV = true
+    SUPERSET_CONFIG = tests.integration_tests.superset_test_config
+    SUPERSET_HOME = {envtmpdir}
+commands =
+    npm install -g npm@'>=6.5.0'
+    pip install -e {toxinidir}/
+    {toxinidir}/superset-frontend/cypress_build.sh dashboard
+commands_post =
+    pkill -if "python {envbindir}/flask"
+
+[testenv:cypress-explore]
+setenv =
+    PYTHONPATH = {toxinidir}
+    SUPERSET_TESTENV = true
+    SUPERSET_CONFIG = tests.integration_tests.superset_test_config
+    SUPERSET_HOME = {envtmpdir}
+commands =
+    npm install -g npm@'>=6.5.0'
+    pip install -e {toxinidir}/
+    {toxinidir}/superset-frontend/cypress_build.sh explore
+commands_post =
+    pkill -if "python {envbindir}/flask"
+
+[testenv:cypress-sqllab]
+setenv =
+    PYTHONPATH = {toxinidir}
+    SUPERSET_TESTENV = true
+    SUPERSET_CONFIG = tests.integration_tests.superset_test_config
+    SUPERSET_HOME = {envtmpdir}
+commands =
+    npm install -g npm@'>=6.5.0'
+    pip install -e {toxinidir}/
+    {toxinidir}/superset-frontend/cypress_build.sh sqllab
+commands_post =
+    pkill -if "python {envbindir}/flask"
+
+[testenv:cypress-sqllab-backend-persist]
+setenv =
+    PYTHONPATH = {toxinidir}
+    SUPERSET_TESTENV = true
+    SUPERSET_CONFIG = tests.integration_tests.superset_test_config
+    SUPERSET_HOME = {envtmpdir}
+commands =
+    npm install -g npm@'>=6.5.0'
+    pip install -e {toxinidir}/
+    {toxinidir}/superset-frontend/cypress_build.sh sqllab
+commands_post =
+    pkill -if "python {envbindir}/flask"
+
+[testenv:eslint]
+changedir = {toxinidir}/superset-frontend
+commands =
+    npm run lint
+deps =
+
+[testenv:fossa]
+commands =
+    {toxinidir}/scripts/fossa.sh
+deps =
+passenv = *
+
+[testenv:javascript]
+commands =
+    npm install -g npm@'>=6.5.0'
+    {toxinidir}/superset-frontend/js_build.sh
+deps =
+
+[testenv:license-check]
+commands =
+    {toxinidir}/scripts/check_license.sh
+passenv = *
+whitelist_externals =
+    {toxinidir}/scripts/check_license.sh
+deps =
+
+[testenv:pre-commit]
+commands =
+    pre-commit run --all-files
+deps =
+    -rrequirements/development.txt
+skip_install = true
+
+[testenv:pylint]
+commands =
+    pylint superset
+deps =
+    -rrequirements/development.txt
+
+[testenv:thumbnails]
+setenv =
+    SUPERSET_CONFIG = tests.integration_tests.superset_test_config_thumbnails
+deps =
+    -rrequirements/development.txt
+
+[tox]
+envlist =
+    cypress-dashboard
+    cypress-explore
+    cypress-sqllab
+    cypress-sqllab-backend-persist
+    eslint
+    fossa
+    javascript
+    license-check
+    pre-commit
+    pylint
+skipsdist = true
+"""
 [tool.ruff]
 # Exclude a variety of commonly ignored directories.
 exclude = [
-    "**/*.ipynb",
     ".bzr",
     ".direnv",
     ".eggs",
@@ -275,8 +435,8 @@ exclude = [
 line-length = 88
 indent-width = 4
 
-# Assume Python 3.9
-target-version = "py39"
+# Assume Python 3.8
+target-version = "py310"
 
 [tool.ruff.lint]
 # Enable Pyflakes (`F`) and a subset of the pycodestyle (`E`)  codes by default.
@@ -287,27 +447,11 @@ select = [
     "E4",
     "E7",
     "E9",
+    "F",
     "PT009",
     "TRY201",
-    "B",
-    "C",
-    "E",
-    "F",
-    "F",
-    "I",
-    "N",
-    "PT",
-    "Q",
-    "S",
-    "T",
-    "W",
-]
-ignore = [
-    "S101",
-    "PT006",
-    "T201",
-    "N999",
 ]
+ignore = []
 
 extend-select = ["I"]
 
@@ -360,35 +504,3 @@ docstring-code-format = false
 # This only has an effect when the `docstring-code-format` setting is
 # enabled.
 docstring-code-line-length = "dynamic"
-
-[tool.liccheck]
-requirement_txt_file = "requirements/base.txt"
-authorized_licenses = [
-    "academic free license (afl)",
-    "apache license 2.0",
-    "apache software",
-    "apache software, bsd",
-    "bsd",
-    "isc license (iscl)",
-    "isc license",
-    "mit",
-    "mozilla public license 2.0 (mpl 2.0)",
-    "osi approved",
-    "osi approved",
-    "python software foundation",
-    "the unlicense (unlicense)",
-    "the unlicense",
-]
-[tool.liccheck.authorized_packages]
-# --------------------------------------------------------------
-# These are ok, checked manually
-# Seems ok, might need legal review
-# https://github.com/urschrei/pypolyline/blob/master/LICENSE.md
-polyline = "2"
-# Apache 2.0 https://github.com/hkwi/python-geohash
-python-geohash = "0"
-# --------------------------------------------------------------
-
-# TODO REMOVE THESE DEPS FROM CODEBASE
-paramiko = "3"  # GPL
-pyxlsb = "1"  # GPL

requirements/base.in

@@ -16,15 +16,7 @@
 # specific language governing permissions and limitations
 # under the License.
 #
+-e file:.
 urllib3>=1.26.18
 werkzeug>=3.0.1
 numexpr>=2.9.0
-
-# 5.0.0 has a sensitive deprecation used in other libs
-# -> https://github.com/aio-libs/async-timeout/blob/master/CHANGES.rst#500-2024-10-31
-async_timeout>=4.0.0,<5.0.0
-
-# playwright requires greenlet==3.0.3
-# submitted a PR to relax deps in 11/2024
-# https://github.com/microsoft/playwright-python/pull/2669
-greenlet==3.0.3

requirements/base.txt

@@ -1,17 +1,22 @@
-# This file was autogenerated by uv via the following command:
-#    uv pip compile pyproject.toml requirements/base.in -o requirements/base.txt
-alembic==1.14.0
+# SHA1:85649679306ea016e401f37adfbad832028d2e5f
+#
+# This file is autogenerated by pip-compile-multi
+# To update, run:
+#
+#    pip-compile-multi
+#
+-e file:.
+    # via -r requirements/base.in
+alembic==1.13.1
     # via flask-migrate
-amqp==5.3.1
+amqp==5.2.0
     # via kombu
-apispec==6.3.0
+apispec[yaml]==6.3.0
     # via flask-appbuilder
 apsw==3.46.0.0
     # via shillelagh
 async-timeout==4.0.3
-    # via
-    #   -r requirements/base.in
-    #   redis
+    # via redis
 attrs==24.2.0
     # via
     #   cattrs
@@ -20,38 +25,38 @@ attrs==24.2.0
 babel==2.16.0
     # via flask-babel
 backoff==2.2.1
-    # via apache-superset (pyproject.toml)
-bcrypt==4.2.1
+    # via apache-superset
+bcrypt==4.1.3
     # via paramiko
-billiard==4.2.1
+billiard==4.2.0
     # via celery
 blinker==1.9.0
     # via flask
-bottleneck==1.4.2
-    # via apache-superset (pyproject.toml)
+bottleneck==1.3.8
+    # via pandas
 brotli==1.1.0
     # via flask-compress
 cachelib==0.9.0
     # via
     #   flask-caching
     #   flask-session
-cachetools==5.5.0
+cachetools==5.3.3
     # via google-auth
 cattrs==24.1.2
     # via requests-cache
 celery==5.4.0
-    # via apache-superset (pyproject.toml)
-certifi==2024.8.30
+    # via apache-superset
+certifi==2024.2.2
     # via requests
 cffi==1.17.1
     # via
     #   cryptography
     #   pynacl
-charset-normalizer==3.4.0
+charset-normalizer==3.3.2
     # via requests
 click==8.1.7
     # via
-    #   apache-superset (pyproject.toml)
+    #   apache-superset
     #   celery
     #   click-didyoumean
     #   click-option-group
@@ -62,41 +67,37 @@ click==8.1.7
 click-didyoumean==0.3.1
     # via celery
 click-option-group==0.5.6
-    # via apache-superset (pyproject.toml)
+    # via apache-superset
 click-plugins==1.1.1
     # via celery
 click-repl==0.3.0
     # via celery
 colorama==0.4.6
     # via
-    #   apache-superset (pyproject.toml)
+    #   apache-superset
     #   flask-appbuilder
-cron-descriptor==1.4.5
-    # via apache-superset (pyproject.toml)
-croniter==5.0.1
-    # via apache-superset (pyproject.toml)
-cryptography==43.0.3
+cron-descriptor==1.4.3
+    # via apache-superset
+croniter==2.0.5
+    # via apache-superset
+cryptography==42.0.8
     # via
-    #   apache-superset (pyproject.toml)
+    #   apache-superset
     #   paramiko
     #   pyopenssl
-defusedxml==0.7.1
-    # via odfpy
-deprecated==1.2.15
+deprecated==1.2.14
     # via limits
 deprecation==2.1.0
-    # via apache-superset (pyproject.toml)
-dnspython==2.7.0
+    # via apache-superset
+dnspython==2.6.1
     # via email-validator
-email-validator==2.2.0
+email-validator==2.1.1
     # via flask-appbuilder
-et-xmlfile==2.0.0
-    # via openpyxl
 exceptiongroup==1.2.2
     # via cattrs
 flask==2.3.3
     # via
-    #   apache-superset (pyproject.toml)
+    #   apache-superset
     #   flask-appbuilder
     #   flask-babel
     #   flask-caching
@@ -109,64 +110,65 @@ flask==2.3.3
     #   flask-sqlalchemy
     #   flask-wtf
 flask-appbuilder==4.5.2
-    # via apache-superset (pyproject.toml)
+    # via apache-superset
 flask-babel==2.0.0
     # via flask-appbuilder
 flask-caching==2.3.0
-    # via apache-superset (pyproject.toml)
-flask-compress==1.17
-    # via apache-superset (pyproject.toml)
-flask-jwt-extended==4.7.1
+    # via apache-superset
+flask-compress==1.15
+    # via apache-superset
+flask-jwt-extended==4.6.0
     # via flask-appbuilder
-flask-limiter==3.8.0
+flask-limiter==3.7.0
     # via flask-appbuilder
 flask-login==0.6.3
     # via
-    #   apache-superset (pyproject.toml)
+    #   apache-superset
     #   flask-appbuilder
 flask-migrate==3.1.0
-    # via apache-superset (pyproject.toml)
+    # via apache-superset
 flask-session==0.8.0
-    # via apache-superset (pyproject.toml)
+    # via apache-superset
 flask-sqlalchemy==2.5.1
     # via
     #   flask-appbuilder
     #   flask-migrate
 flask-talisman==1.1.0
-    # via apache-superset (pyproject.toml)
-flask-wtf==1.2.2
+    # via apache-superset
+flask-wtf==1.2.1
     # via
-    #   apache-superset (pyproject.toml)
+    #   apache-superset
     #   flask-appbuilder
+func-timeout==4.3.5
+    # via apache-superset
 geographiclib==2.0
     # via geopy
 geopy==2.4.1
-    # via apache-superset (pyproject.toml)
-google-auth==2.36.0
+    # via apache-superset
+google-auth==2.29.0
     # via shillelagh
 greenlet==3.0.3
     # via
-    #   -r requirements/base.in
-    #   apache-superset (pyproject.toml)
     #   shillelagh
-gunicorn==23.0.0
-    # via apache-superset (pyproject.toml)
+    #   sqlalchemy
+gunicorn==22.0.0
+    # via apache-superset
 hashids==1.3.1
-    # via apache-superset (pyproject.toml)
+    # via apache-superset
 holidays==0.25
-    # via apache-superset (pyproject.toml)
-humanize==4.11.0
-    # via apache-superset (pyproject.toml)
-idna==3.10
+    # via apache-superset
+humanize==4.9.0
+    # via apache-superset
+idna==3.7
     # via
     #   email-validator
     #   requests
-importlib-metadata==8.5.0
-    # via apache-superset (pyproject.toml)
-importlib-resources==6.4.5
+importlib-metadata==7.1.0
+    # via apache-superset
+importlib-resources==6.4.0
     # via limits
-isodate==0.7.2
-    # via apache-superset (pyproject.toml)
+isodate==0.6.1
+    # via apache-superset
 itsdangerous==2.2.0
     # via
     #   flask
@@ -175,22 +177,24 @@ jinja2==3.1.4
     # via
     #   flask
     #   flask-babel
-jsonpath-ng==1.7.0
-    # via apache-superset (pyproject.toml)
+jsonpath-ng==1.6.1
+    # via apache-superset
 jsonschema==4.17.3
     # via flask-appbuilder
-kombu==5.4.2
+kombu==5.3.7
     # via celery
 korean-lunar-calendar==0.3.1
     # via holidays
-limits==3.13.0
+limits==3.12.0
     # via flask-limiter
-mako==1.3.6
+llvmlite==0.42.0
+    # via numba
+mako==1.3.5
     # via
-    #   apache-superset (pyproject.toml)
     #   alembic
-markdown==3.7
-    # via apache-superset (pyproject.toml)
+    #   apache-superset
+markdown==3.6
+    # via apache-superset
 markdown-it-py==3.0.0
     # via rich
 markupsafe==3.0.2
@@ -199,7 +203,7 @@ markupsafe==3.0.2
     #   mako
     #   werkzeug
     #   wtforms
-marshmallow==3.23.1
+marshmallow==3.21.2
     # via
     #   flask-appbuilder
     #   marshmallow-sqlalchemy
@@ -208,29 +212,30 @@ marshmallow-sqlalchemy==0.28.2
 mdurl==0.1.2
     # via markdown-it-py
 msgpack==1.0.8
-    # via apache-superset (pyproject.toml)
+    # via apache-superset
 msgspec==0.18.6
     # via flask-session
-nh3==0.2.19
-    # via apache-superset (pyproject.toml)
-numexpr==2.10.2
-    # via -r requirements/base.in
+nh3==0.2.17
+    # via apache-superset
+numba==0.59.1
+    # via pandas
+numexpr==2.10.1
+    # via
+    #   -r requirements/base.in
+    #   pandas
 numpy==1.23.5
     # via
-    #   apache-superset (pyproject.toml)
+    #   apache-superset
     #   bottleneck
+    #   numba
     #   numexpr
     #   pandas
     #   pyarrow
-odfpy==1.4.1
-    # via pandas
-openpyxl==3.1.5
-    # via pandas
 ordered-set==4.1.0
     # via flask-limiter
-packaging==24.2
+packaging==23.2
     # via
-    #   apache-superset (pyproject.toml)
+    #   apache-superset
     #   apispec
     #   deprecation
     #   gunicorn
@@ -238,54 +243,54 @@ packaging==24.2
     #   marshmallow
     #   marshmallow-sqlalchemy
     #   shillelagh
-pandas==2.0.3
-    # via apache-superset (pyproject.toml)
-paramiko==3.5.0
+pandas[performance]==2.0.3
+    # via apache-superset
+paramiko==3.4.0
     # via
-    #   apache-superset (pyproject.toml)
+    #   apache-superset
     #   sshtunnel
 parsedatetime==2.6
-    # via apache-superset (pyproject.toml)
+    # via apache-superset
 pgsanity==0.2.9
-    # via apache-superset (pyproject.toml)
+    # via apache-superset
 platformdirs==3.8.1
     # via requests-cache
 ply==3.11
     # via jsonpath-ng
 polyline==2.0.2
-    # via apache-superset (pyproject.toml)
+    # via apache-superset
 prison==0.2.1
     # via flask-appbuilder
-prompt-toolkit==3.0.48
+prompt-toolkit==3.0.44
     # via click-repl
 pyarrow==14.0.2
-    # via apache-superset (pyproject.toml)
-pyasn1==0.6.1
+    # via apache-superset
+pyasn1==0.6.0
     # via
     #   pyasn1-modules
     #   rsa
-pyasn1-modules==0.4.1
+pyasn1-modules==0.4.0
     # via google-auth
 pycparser==2.22
     # via cffi
 pygments==2.18.0
     # via rich
-pyjwt==2.10.1
+pyjwt==2.8.0
     # via
-    #   apache-superset (pyproject.toml)
+    #   apache-superset
     #   flask-appbuilder
     #   flask-jwt-extended
 pynacl==1.5.0
     # via paramiko
-pyopenssl==24.2.1
+pyopenssl==24.1.0
     # via shillelagh
-pyparsing==3.2.0
-    # via apache-superset (pyproject.toml)
+pyparsing==3.1.2
+    # via apache-superset
 pyrsistent==0.20.0
     # via jsonschema
 python-dateutil==2.9.0.post0
     # via
-    #   apache-superset (pyproject.toml)
+    #   apache-superset
     #   celery
     #   croniter
     #   flask-appbuilder
@@ -293,52 +298,51 @@ python-dateutil==2.9.0.post0
     #   pandas
     #   shillelagh
 python-dotenv==1.0.1
-    # via apache-superset (pyproject.toml)
+    # via apache-superset
 python-geohash==0.8.5
-    # via apache-superset (pyproject.toml)
+    # via apache-superset
 pytz==2024.2
     # via
     #   croniter
     #   flask-babel
     #   pandas
-pyxlsb==1.0.10
-    # via pandas
-pyyaml==6.0.2
+pyyaml==6.0.1
     # via
-    #   apache-superset (pyproject.toml)
+    #   apache-superset
     #   apispec
 redis==4.6.0
-    # via apache-superset (pyproject.toml)
+    # via apache-superset
 requests==2.32.2
     # via
     #   requests-cache
     #   shillelagh
 requests-cache==1.2.0
     # via shillelagh
-rich==13.9.4
+rich==13.7.1
     # via flask-limiter
 rsa==4.9
     # via google-auth
 selenium==3.141.0
-    # via apache-superset (pyproject.toml)
-shillelagh==1.2.18
-    # via apache-superset (pyproject.toml)
+    # via apache-superset
+shillelagh[gsheetsapi]==1.2.18
+    # via apache-superset
 shortid==0.1.2
-    # via apache-superset (pyproject.toml)
-simplejson==3.19.3
-    # via apache-superset (pyproject.toml)
+    # via apache-superset
+simplejson==3.19.2
+    # via apache-superset
 six==1.16.0
     # via
+    #   isodate
     #   prison
     #   python-dateutil
     #   url-normalize
     #   wtforms-json
-slack-sdk==3.33.4
-    # via apache-superset (pyproject.toml)
-sqlalchemy==1.4.54
+slack-sdk==3.27.2
+    # via apache-superset
+sqlalchemy==1.4.52
     # via
-    #   apache-superset (pyproject.toml)
     #   alembic
+    #   apache-superset
     #   flask-appbuilder
     #   flask-sqlalchemy
     #   marshmallow-sqlalchemy
@@ -346,29 +350,27 @@ sqlalchemy==1.4.54
     #   sqlalchemy-utils
 sqlalchemy-utils==0.38.3
     # via
-    #   apache-superset (pyproject.toml)
+    #   apache-superset
     #   flask-appbuilder
-sqlglot==25.24.5
-    # via apache-superset (pyproject.toml)
-sqlparse==0.5.2
-    # via apache-superset (pyproject.toml)
+sqlglot==25.24.0
+    # via apache-superset
+sqlparse==0.5.0
+    # via apache-superset
 sshtunnel==0.4.0
-    # via apache-superset (pyproject.toml)
+    # via apache-superset
 tabulate==0.8.10
-    # via apache-superset (pyproject.toml)
+    # via apache-superset
 typing-extensions==4.12.2
     # via
-    #   apache-superset (pyproject.toml)
     #   alembic
+    #   apache-superset
     #   cattrs
     #   flask-limiter
     #   limits
-    #   rich
     #   shillelagh
-tzdata==2024.2
+tzdata==2024.1
     # via
     #   celery
-    #   kombu
     #   pandas
 url-normalize==1.4.3
     # via requests-cache
@@ -392,23 +394,19 @@ werkzeug==3.1.3
     #   flask-appbuilder
     #   flask-jwt-extended
     #   flask-login
-wrapt==1.17.0
+wrapt==1.16.0
     # via deprecated
 wtforms==3.2.1
     # via
-    #   apache-superset (pyproject.toml)
+    #   apache-superset
     #   flask-appbuilder
     #   flask-wtf
     #   wtforms-json
 wtforms-json==0.3.5
-    # via apache-superset (pyproject.toml)
-xlrd==2.0.1
-    # via pandas
+    # via apache-superset
 xlsxwriter==3.0.9
-    # via
-    #   apache-superset (pyproject.toml)
-    #   pandas
-zipp==3.21.0
+    # via apache-superset
+zipp==3.19.0
     # via importlib-metadata
-zstandard==0.23.0
+zstandard==0.22.0
     # via flask-compress

requirements/development.in

@@ -16,4 +16,5 @@
 # specific language governing permissions and limitations
 # under the License.
 #
--e .[development,bigquery,cors,druid,gevent,gsheets,mysql,postgres,presto,prophet,trino,thumbnails]
+-r base.in
+-e .[development,bigquery,cors,druid,gevent,gsheets,hive,mysql,playwright,postgres,presto,prophet,trino,thumbnails]

requirements/translations.in

@@ -1 +0,0 @@
-babel

requirements/translations.txt

@@ -1,4 +0,0 @@
-# This file was autogenerated by uv via the following command:
-#    uv pip compile requirements/translations.in -o requirements/translations.txt
-babel==2.16.0
-    # via -r requirements/translations.in

scripts/benchmark_migration.py

@@ -70,7 +70,7 @@ def extract_modified_tables(module: ModuleType) -> set[str]:
     return tables
 
 
-def find_models(module: ModuleType) -> list[type[Model]]:  # noqa: C901
+def find_models(module: ModuleType) -> list[type[Model]]:
     """
     Find all models in a migration script.
     """
@@ -94,7 +94,7 @@ def find_models(module: ModuleType) -> list[type[Model]]:  # noqa: C901
     # downgrade
     sqlalchemy_uri = current_app.config["SQLALCHEMY_DATABASE_URI"]
     engine = create_engine(sqlalchemy_uri)
-    Base = automap_base()  # noqa: N806
+    Base = automap_base()
     Base.prepare(engine, reflect=True)
     seen = set()
     while tables:
@@ -138,7 +138,7 @@ def find_models(module: ModuleType) -> list[type[Model]]:  # noqa: C901
 @click.option("--limit", default=1000, help="Maximum number of entities.")
 @click.option("--force", is_flag=True, help="Do not prompt for confirmation.")
 @click.option("--no-auto-cleanup", is_flag=True, help="Do not remove created models.")
-def main(  # noqa: C901
+def main(
     filepath: str, limit: int = 1000, force: bool = False, no_auto_cleanup: bool = False
 ) -> None:
     auto_cleanup = not no_auto_cleanup

scripts/build_docker.py

@@ -0,0 +1,294 @@
+#!/usr/bin/env python3
+
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+import os
+import re
+import subprocess
+from textwrap import dedent
+
+import click
+
+REPO = "apache/superset"
+CACHE_REPO = f"{REPO}-cache"
+BASE_PY_IMAGE = "3.10-slim-bookworm"
+
+
+def run_cmd(command: str, raise_on_failure: bool = True) -> str:
+    process = subprocess.Popen(
+        command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True
+    )
+
+    output = ""
+    if process.stdout is not None:
+        for line in iter(process.stdout.readline, ""):
+            print(line.strip())  # Print the line to stdout in real-time
+            output += line
+
+    process.wait()  # Wait for the subprocess to finish
+
+    if process.returncode != 0 and raise_on_failure:
+        raise subprocess.CalledProcessError(process.returncode, command, output)
+    return output
+
+
+def get_git_sha() -> str:
+    return run_cmd("git rev-parse HEAD").strip()
+
+
+def get_build_context_ref(build_context: str) -> str:
+    """
+    Given a context, return a ref:
+    - if context is pull_request, return the PR's id
+    - if context is push, return the branch
+    - if context is release, return the release ref
+    """
+
+    event = os.getenv("GITHUB_EVENT_NAME")
+    github_ref = os.getenv("GITHUB_REF", "")
+
+    if event == "pull_request":
+        github_head_ref = os.getenv("GITHUB_HEAD_REF", "")
+        return re.sub("[^a-zA-Z0-9]", "-", github_head_ref)[:40]
+    elif event == "release":
+        return re.sub("refs/tags/", "", github_ref)[:40]
+    elif event == "push":
+        return re.sub("[^a-zA-Z0-9]", "-", re.sub("refs/heads/", "", github_ref))[:40]
+    return ""
+
+
+def is_latest_release(release: str) -> bool:
+    output = (
+        run_cmd(
+            f"./scripts/tag_latest_release.sh {release} --dry-run",
+            raise_on_failure=False,
+        )
+        or ""
+    )
+    return "SKIP_TAG::false" in output
+
+
+def make_docker_tag(l: list[str]) -> str:  # noqa: E741
+    return f"{REPO}:" + "-".join([o for o in l if o])
+
+
+def get_docker_tags(
+    build_preset: str,
+    build_platforms: list[str],
+    sha: str,
+    build_context: str,
+    build_context_ref: str,
+    force_latest: bool = False,
+) -> set[str]:
+    """
+    Return a set of tags given a given build context
+    """
+    tags: set[str] = set()
+    tag_chunks: list[str] = []
+
+    is_latest = is_latest_release(build_context_ref)
+
+    if build_preset != "lean":
+        # Always add the preset_build name if different from default (lean)
+        tag_chunks += [build_preset]
+
+    if len(build_platforms) == 1:
+        build_platform = build_platforms[0]
+        short_build_platform = build_platform.replace("linux/", "").replace("64", "")
+        if short_build_platform != "amd":
+            # Always a platform indicator if different from default (amd)
+            tag_chunks += [short_build_platform]
+
+    # Always craft a tag for the SHA
+    tags.add(make_docker_tag([sha] + tag_chunks))
+    # also a short SHA, cause it's nice
+    tags.add(make_docker_tag([sha[:7]] + tag_chunks))
+
+    if build_context == "release":
+        # add a release tag
+        tags.add(make_docker_tag([build_context_ref] + tag_chunks))
+        if is_latest or force_latest:
+            # add a latest tag
+            tags.add(make_docker_tag(["latest"] + tag_chunks))
+    elif build_context == "push" and build_context_ref == "master":
+        tags.add(make_docker_tag(["master"] + tag_chunks))
+    elif build_context == "pull_request":
+        tags.add(make_docker_tag([f"pr-{build_context_ref}"] + tag_chunks))
+    return tags
+
+
+def get_docker_command(
+    build_preset: str,
+    build_platforms: list[str],
+    is_authenticated: bool,
+    sha: str,
+    build_context: str,
+    build_context_ref: str,
+    force_latest: bool = False,
+) -> str:
+    tag = ""  # noqa: F841
+    build_target = ""
+    py_ver = BASE_PY_IMAGE
+    docker_context = "."
+
+    if build_preset == "dev":
+        build_target = "dev"
+    elif build_preset == "lean":
+        build_target = "lean"
+    elif build_preset == "py311":
+        build_target = "lean"
+        py_ver = "3.11-slim-bookworm"
+    elif build_preset == "websocket":
+        build_target = ""
+        docker_context = "superset-websocket"
+    elif build_preset == "ci":
+        build_target = "ci"
+    elif build_preset == "dockerize":
+        build_target = ""
+        docker_context = "-f dockerize.Dockerfile ."
+    else:
+        print(f"Invalid build preset: {build_preset}")
+        exit(1)
+
+    # Try to get context reference if missing
+    if not build_context_ref:
+        build_context_ref = get_build_context_ref(build_context)
+
+    tags = get_docker_tags(
+        build_preset,
+        build_platforms,
+        sha,
+        build_context,
+        build_context_ref,
+        force_latest,
+    )
+    docker_tags = ("\\\n" + 8 * " ").join([f"-t {s} " for s in tags])
+
+    docker_args = "--load" if not is_authenticated else "--push"
+    target_argument = f"--target {build_target}" if build_target else ""
+
+    cache_ref = f"{CACHE_REPO}:{py_ver}"
+    if len(build_platforms) == 1:
+        build_platform = build_platforms[0]
+        short_build_platform = build_platform.replace("linux/", "").replace("64", "")
+        cache_ref = f"{CACHE_REPO}:{py_ver}-{short_build_platform}"
+    platform_arg = "--platform " + ",".join(build_platforms)
+
+    cache_from_arg = f"--cache-from=type=registry,ref={cache_ref}"
+    cache_to_arg = (
+        f"--cache-to=type=registry,mode=max,ref={cache_ref}" if is_authenticated else ""
+    )
+    build_arg = f"--build-arg PY_VER={py_ver}" if py_ver else ""
+    actor = os.getenv("GITHUB_ACTOR")
+
+    return dedent(
+        f"""\
+        docker buildx build \\
+        {docker_args} \\
+        {docker_tags} \\
+        {cache_from_arg} \\
+        {cache_to_arg} \\
+        {build_arg} \\
+        {platform_arg} \\
+        {target_argument} \\
+        --label sha={sha} \\
+        --label target={build_target} \\
+        --label build_trigger={build_context} \\
+        --label base={py_ver} \\
+        --label build_actor={actor} \\
+        {docker_context}"""
+    )
+
+
+@click.command()
+@click.argument(
+    "build_preset",
+    type=click.Choice(["lean", "dev", "dockerize", "websocket", "py311", "ci"]),
+)
+@click.argument("build_context", type=click.Choice(["push", "pull_request", "release"]))
+@click.option(
+    "--platform",
+    type=click.Choice(["linux/arm64", "linux/amd64"]),
+    default=["linux/amd64"],
+    multiple=True,
+)
+@click.option("--build_context_ref", help="a reference to the pr, release or branch")
+@click.option("--dry-run", is_flag=True, help="Run the command in dry-run mode.")
+@click.option("--verbose", is_flag=True, help="Print more info")
+@click.option(
+    "--force-latest", is_flag=True, help="Force the 'latest' tag on the release"
+)
+def main(
+    build_preset: str,
+    build_context: str,
+    build_context_ref: str,
+    platform: list[str],
+    dry_run: bool,
+    force_latest: bool,
+    verbose: bool,
+) -> None:
+    """
+    This script executes docker build and push commands based on given arguments.
+    """
+
+    is_authenticated = (
+        True if os.getenv("DOCKERHUB_TOKEN") and os.getenv("DOCKERHUB_USER") else False
+    )
+
+    if force_latest and build_context != "release":
+        print(
+            "--force-latest can only be applied if the build context is set to 'release'"
+        )
+        exit(1)
+
+    if build_context == "release" and not build_context_ref.strip():
+        print("Release number has to be provided")
+        exit(1)
+
+    docker_build_command = get_docker_command(
+        build_preset,
+        platform,
+        is_authenticated,
+        get_git_sha(),
+        build_context,
+        build_context_ref,
+        force_latest,
+    )
+
+    if not dry_run:
+        print("Executing Docker Build Command:")
+        print(docker_build_command)
+        script = ""
+        if os.getenv("DOCKERHUB_USER"):
+            script = dedent(
+                f"""\
+                docker logout
+                docker login --username "{os.getenv("DOCKERHUB_USER")}" --password "{os.getenv("DOCKERHUB_TOKEN")}"
+                DOCKER_ARGS="--push"
+                """
+            )
+        script = script + docker_build_command
+        if verbose:
+            run_cmd("cat Dockerfile")
+        stdout = run_cmd(script)  # noqa: F841
+    else:
+        print("Dry Run - Docker Build Command:")
+        print(docker_build_command)
+
+
+if __name__ == "__main__":
+    main()

scripts/cancel_github_workflows.py

@@ -49,7 +49,7 @@ github_repo = os.environ.get("GITHUB_REPOSITORY", "apache/superset")
 def request(
     method: Literal["GET", "POST", "DELETE", "PUT"], endpoint: str, **kwargs: Any
 ) -> dict[str, Any]:
-    resp = requests.request(  # noqa: S113
+    resp = requests.request(
         method,
         f"https://api.github.com/{endpoint.lstrip('/')}",
         headers={"Authorization": f"Bearer {github_token}"},
@@ -152,7 +152,7 @@ Date:   {date_str}
     help="Whether to also cancel running workflows.",
 )
 @click.argument("branch_or_pull", required=False)
-def cancel_github_workflows(  # noqa: C901
+def cancel_github_workflows(
     branch_or_pull: Optional[str],
     repo: str,
     event: list[str],

scripts/change_detector.py

@@ -51,12 +51,12 @@ GITHUB_TOKEN = os.environ.get("GITHUB_TOKEN")
 
 def fetch_files_github_api(url: str):  # type: ignore
     """Fetches data using GitHub API."""
-    req = Request(url)  # noqa: S310
+    req = Request(url)
     req.add_header("Authorization", f"Bearer {GITHUB_TOKEN}")
     req.add_header("Accept", "application/vnd.github.v3+json")
 
     print(f"Fetching from {url}")
-    with urlopen(req) as response:  # noqa: S310
+    with urlopen(req) as response:
         body = response.read()
         return json.loads(body)
 
@@ -95,21 +95,15 @@ def print_files(files: List[str]) -> None:
     print("\n".join([f"- {s}" for s in files]))
 
 
-def is_int(s: str) -> bool:
-    return bool(re.match(r"^-?\d+$", s))
-
-
 def main(event_type: str, sha: str, repo: str) -> None:
     """Main function to check for file changes based on event context."""
     print("SHA:", sha)
     print("EVENT_TYPE", event_type)
-    files = None
     if event_type == "pull_request":
         pr_number = os.getenv("GITHUB_REF", "").split("/")[-2]
-        if is_int(pr_number):
-            files = fetch_changed_files_pr(repo, pr_number)
-            print("PR files:")
-            print_files(files)
+        files = fetch_changed_files_pr(repo, pr_number)
+        print("PR files:")
+        print_files(files)
 
     elif event_type == "push":
         files = fetch_changed_files_push(repo, sha)
@@ -125,12 +119,12 @@ def main(event_type: str, sha: str, repo: str) -> None:
     changes_detected = {}
     for group, regex_patterns in PATTERNS.items():
         patterns_compiled = [re.compile(p) for p in regex_patterns]
-        changes_detected[group] = files is None or detect_changes(
+        changes_detected[group] = event_type == "workflow_dispatch" or detect_changes(
             files, patterns_compiled
         )
 
     # Output results
-    output_path = os.getenv("GITHUB_OUTPUT") or "/tmp/GITHUB_OUTPUT.txt"  # noqa: S108
+    output_path = os.getenv("GITHUB_OUTPUT") or "/tmp/GITHUB_OUTPUT.txt"
     with open(output_path, "a") as f:
         for check, changed in changes_detected.items():
             if changed:
@@ -139,8 +133,8 @@ def main(event_type: str, sha: str, repo: str) -> None:
 
 
 def get_git_sha() -> str:
-    return os.getenv("GITHUB_SHA") or subprocess.check_output(  # noqa: S603
-        ["git", "rev-parse", "HEAD"]  # noqa: S607
+    return os.getenv("GITHUB_SHA") or subprocess.check_output(
+        ["git", "rev-parse", "HEAD"]
     ).strip().decode("utf-8")
 
 

scripts/check-env.py

@@ -47,7 +47,7 @@ class Requirement:
 
     def get_version(self) -> Optional[str]:
         try:
-            version = subprocess.check_output(self.command, shell=True).decode().strip()  # noqa: S602
+            version = subprocess.check_output(self.command, shell=True).decode().strip()
             if self.version_post_process:
                 version = self.version_post_process(version)
             return version.split()[-1]
@@ -76,7 +76,7 @@ class Requirement:
     def format_result(self) -> str:
         ideal_range_str = f"{self.ideal_range[0]} - {self.ideal_range[1]}"
         supported_range_str = f"{self.supported_range[0]} - {self.supported_range[1]}"
-        return f"{self.status.split()[0]} {self.name:<25} {self.version or 'N/A':<25} {ideal_range_str:<25} {supported_range_str:<25}"  # noqa: E501
+        return f"{self.status.split()[0]} {self.name:<25} {self.version or 'N/A':<25} {ideal_range_str:<25} {supported_range_str:<25}"
 
 
 def check_memory(min_gb: int) -> str:
@@ -101,9 +101,8 @@ def get_cpu_info() -> str:
 def get_docker_platform() -> str:
     try:
         output = (
-            subprocess.check_output(  # noqa: S602
-                "docker info --format '{{.OperatingSystem}}'",  # noqa: S607
-                shell=True,  # noqa: S607
+            subprocess.check_output(
+                "docker info --format '{{.OperatingSystem}}'", shell=True
             )
             .decode()
             .strip()
@@ -118,7 +117,7 @@ def get_docker_platform() -> str:
 @click.command(
     help="""
 This script checks the local environment for various software versions and other requirements, providing feedback on whether they are ideal, supported, or unsupported.
-"""  # noqa: E501
+"""
 )
 @click.option(
     "--docker", is_flag=True, help="Check Docker and Docker Compose requirements"
@@ -129,7 +128,7 @@ This script checks the local environment for various software versions and other
     help="Check frontend requirements (npm, Node.js, memory)",
 )
 @click.option("--backend", is_flag=True, help="Check backend requirements (Python)")
-def main(docker: bool, frontend: bool, backend: bool) -> None:  # noqa: C901
+def main(docker: bool, frontend: bool, backend: bool) -> None:
     requirements = [
         Requirement(
             "python",

scripts/cypress_run.py

@@ -74,7 +74,7 @@ def run_cypress_for_test_file(
             print(f"DRY RUN: {cmd}")
             return 0
 
-        process = subprocess.Popen(  # noqa: S602
+        process = subprocess.Popen(
             cmd,
             shell=True,
             stdout=subprocess.PIPE,

scripts/erd/erd.py

@@ -171,7 +171,7 @@ def generate_erd(file_path: str) -> None:
     """
     data = introspect_models()
     templates_path = os.path.dirname(__file__)
-    env = jinja2.Environment(loader=jinja2.FileSystemLoader(templates_path))  # noqa: S701
+    env = jinja2.Environment(loader=jinja2.FileSystemLoader(templates_path))
 
     # Load the template
     template = env.get_template("erd.template.puml")