Superset Dev 6ee48204a5 fix(tags): require ownership before bulk-deleting tags by name ...

DeleteTagsCommand.validate only checked that each named tag existed
before TagDAO.delete_tags removed it, cascading every org-wide
association with no ownership check. Require the caller to be an
admin or the tag's creator, and refuse to delete system-generated
tags (type:*, editor:*, favorited_by:*) through this route at all.

2026-08-21 00:42:26 -07:00

..

advanced_data_type

chore: bump rison to 2.0.0 (#39529)

2026-04-24 15:52:42 -04:00

annotation_layers

chore: bump rison to 2.0.0 (#39529)

2026-04-24 15:52:42 -04:00

async_events

feat(async): cancel running chart queries under GLOBAL_ASYNC_QUERIES (#42305)

2026-07-28 18:02:16 +03:00

available_domains

…

cachekeys

fix(cachekey): use data_cache for chart query result invalidation (#40493)

2026-06-26 18:01:14 -07:00

charts

fix(cache): warm native dashboard filter defaults (#43073)

2026-08-12 22:30:48 -07:00

css_templates

chore: bump rison to 2.0.0 (#39529)

2026-04-24 15:52:42 -04:00

dao

chore: Unset future flag in engines and sessions. (#43273)

2026-08-20 10:58:37 -07:00

dashboards

fix(dashboard): derive filter scope on read instead of serving a stale cache (#43252)

2026-08-17 19:23:19 +03:00

databases

fix(sqllab): use dialect-specific quote chars for autocomplete identifiers (#41492)

2026-08-13 14:04:38 -07:00

datasets

fix: hydrate JWT user before list API filters (#39946)

2026-08-10 14:18:28 -07:00

datasource

feat(multi-value): array-typed column filters with two-tier operators (ClickHouse MVP) (#41279)

2026-08-19 10:56:49 -07:00

db_engine_specs

feat: bump SQLAlchemy to 2.0 and flask-sqlalchemy to 3.1.1 (#42803)

2026-08-12 19:55:14 -07:00

deletion_retention

refactor(deletion-retention): add declarative purge policies (#42888)

2026-08-11 09:55:36 -07:00

embedded

fix(embedded): add Sec-Fetch-Dest defense-in-depth check on the embedded view (#40667)

2026-06-09 11:08:08 -07:00

explore

…

extensions

…

fixtures

chore: Unset future flag in engines and sessions. (#43273)

2026-08-20 10:58:37 -07:00

importexport

…

migrations

chore: Unset future flag in engines and sessions. (#43273)

2026-08-20 10:58:37 -07:00

queries

feat(mcp): per-resource token scopes with user-permission intersection (#42297)

2026-08-18 13:11:27 -04:00

reports

fix(dataset): improve dataset, report, and expression validation (#42929)

2026-08-12 20:13:45 -07:00

security

fix(rls): return a descriptive error for duplicate rule names (#42819)

2026-08-11 12:41:24 -07:00

sql_lab

fix(sql_lab): return 400 not 500 when raise_for_access hits malformed Jinja in results.py (#43145)

2026-08-14 15:02:47 -07:00

subjects

feat(subjects): scope principal listings and default new assets to creator groups (#42472)

2026-07-29 14:36:45 +02:00

tags

fix(tags): require ownership before bulk-deleting tags by name

2026-08-21 00:42:26 -07:00

tasks

chore(viz): remove legacy explore_json + viz.py pipeline (#41714)

2026-08-06 13:22:15 -07:00

themes

chore: bump rison to 2.0.0 (#39529)

2026-04-24 15:52:42 -04:00

users

feat(subjects): scope principal listings and default new assets to creator groups (#42472)

2026-07-29 14:36:45 +02:00

utils

fix(encrypt): stop naive padding from truncating secrets ending in '*' (#43074)

2026-08-13 13:15:37 -07:00

versioning

feat: bump SQLAlchemy to 2.0 and flask-sqlalchemy to 3.1.1 (#42803)

2026-08-12 19:55:14 -07:00

views

feat(soft-delete): Recently Archived view with restore and permanent delete (#41550)

2026-08-03 12:21:48 -07:00

__init__.py

…

access_tests.py

…

base_api_tests.py

fix(dashboard): align list OpenAPI schema (#43256)

2026-08-18 10:22:50 -07:00

base_tests.py

fix: hydrate JWT user before list API filters (#39946)

2026-08-10 14:18:28 -07:00

cache_tests.py

…

celery_tests.py

fix(sql-lab): improved SQL statement parsing and validation (#42928)

2026-08-11 19:35:43 -07:00

cli_tests.py

fix(cli): add --username option to import-directory command (#40994)

2026-07-17 12:34:38 -07:00

commands_test.py

feat(dashboard): expand all chart descriptions (#32958)

2026-08-06 14:47:30 -07:00

conftest.py

refactor: do not cascade to SqlMetric (#42221)

2026-07-21 10:26:01 -07:00

constants.py

…

core_tests.py

chore(viz): remove legacy explore_json + viz.py pipeline (#41714)

2026-08-06 13:22:15 -07:00

dashboard_tests.py

feat(hooks): add configurable post-creation hook for dashboards (#42837)

2026-08-06 16:11:55 +03:00

dashboard_utils.py

feat(datasets): soft-delete and restore (#40130)

2026-07-07 08:57:08 -07:00

datasource_tests.py

feat: bump SQLAlchemy to 2.0 and flask-sqlalchemy to 3.1.1 (#42803)

2026-08-12 19:55:14 -07:00

dict_import_export_tests.py

…

dynamic_plugins_tests.py

…

email_tests.py

chore(config): default SMTP_SSL_SERVER_AUTH to True (#40647)

2026-06-30 13:50:38 -07:00

event_logger_tests.py

fix(logging): stop noisy LocalProxy-not-mapped warning for guest users (#42306)

2026-07-24 13:06:20 -04:00

form_tests.py

…

import_export_tests.py

feat(dashboard): expand all chart descriptions (#32958)

2026-08-06 14:47:30 -07:00

insert_chart_mixin.py

feat: introduce Subject model and entity editors/viewers (#38831)

2026-07-08 11:00:03 -07:00

log_api_tests.py

refactor(frontend): centralize subdirectory URL prefixing behind nav helpers (#39925)

2026-07-01 11:20:13 -07:00

logging_configurator_tests.py

…

model_tests.py

chore: Unset future flag in engines and sessions. (#43273)

2026-08-20 10:58:37 -07:00

non_additive_totals_tests.py

feat(table): allow choosing Sum or Average for the "Show summary" totals row (#43027)

2026-08-13 13:15:23 -07:00

query_context_tests.py

fix(charts): align grain-less time comparisons safely (#43315)

2026-08-20 14:55:01 -07:00

result_set_tests.py

fix(result_set): preserve JSON/JSONB data as objects instead of strings (#38172)

2026-06-05 11:41:40 -07:00

security_tests.py

feat(security): add guest user attributes and get_guest_user_attribute() macro (#33924)

2026-08-08 16:56:07 -07:00

sql_validator_tests.py

…

sqla_models_tests.py

feat(multi-value): array-typed column filters with two-tier operators (ClickHouse MVP) (#41279)

2026-08-19 10:56:49 -07:00

sqllab_tests.py

fix(sqllab): apply SQL_QUERY_MUTATOR in SQL Lab when MUTATE_AFTER_SPLIT is set (#41127)

2026-07-20 15:36:45 -07:00

stats_logger_tests.py

…

strategy_tests.py

refactor(frontend): centralize subdirectory URL prefixing behind nav helpers (#39925)

2026-07-01 11:20:13 -07:00

superset_test_config_sqllab_backend_persist_off.py

…

superset_test_config_thumbnails.py

…

superset_test_config.py

feat: bump SQLAlchemy to 2.0 and flask-sqlalchemy to 3.1.1 (#42803)

2026-08-12 19:55:14 -07:00

superset_test_custom_template_processors.py

…

tagging_tests.py

feat: introduce Subject model and entity editors/viewers (#38831)

2026-07-08 11:00:03 -07:00

test_app.py

…

test_database_password_encoding.py

fix(db): preserve percent encoding in database passwords (#36783)

2026-06-13 13:52:00 -07:00

test_granular_export_api.py

chore: bump rison to 2.0.0 (#39529)

2026-04-24 15:52:42 -04:00

test_jinja_context.py

…

test_subdirectory_deployments.py

…

thumbnails_tests.py

feat(Reports&Alerts): remove Selenium support, require Playwright (#43028)

2026-08-11 16:06:26 -07:00

utils_tests.py

chore(viz): remove legacy explore_json + viz.py pipeline (#41714)

2026-08-06 13:22:15 -07:00