Evan 4415b8a400 feat(security): terminate active sessions when an account is disabled ...

Disabling a user account (active=False) terminates that user's
outstanding sessions on their next request via a per-user invalidation
epoch (user_attribute.sessions_invalidated_at). Works for both
client-side cookie sessions and server-side session stores. Inert for
users that were never disabled (NULL epoch). The migration backfills the
epoch for accounts already disabled at upgrade time.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-10 11:24:30 -07:00

..

advanced_data_type

chore: bump rison to 2.0.0 (#39529)

2026-04-24 15:52:42 -04:00

annotation_layers

chore: bump rison to 2.0.0 (#39529)

2026-04-24 15:52:42 -04:00

async_events

fix: raise random_key entropy and add expiry to async query tokens (#40638)

2026-06-08 16:24:06 -07:00

available_domains

chore: proper current_app.config proxy usage (#34345)

2025-07-31 19:27:42 -07:00

cachekeys

fix: Nested transaction is inactive when embedding dashboard (#30699)

2024-10-24 13:08:55 -03:00

charts

fix(charts): tighten chart schema input validation (query_context JSON, prophet/rolling bounds) (#40634)

2026-06-10 08:17:12 -07:00

cli

feat(embedded): add guest token revocation support (#40671)

2026-06-10 09:17:30 -07:00

columns

chore: remove sl_ tables (#28704)

2024-05-29 19:04:37 -07:00

commands

fix(rls): apply standard datasource access checks in RLS rule commands (#40650)

2026-06-09 11:24:12 -07:00

common

fix: use pd.to_numeric in df_metrics_to_num to handle string-encoded numerics from ClickHouse (#40190)

2026-06-09 10:28:34 -07:00

connectors

fix(dataset): unify validation for stored and adhoc SQL expressions (#40392)

2026-06-03 12:55:50 +01:00

core

feat: semantic layer extension (#37815)

2026-05-05 12:07:46 -04:00

css_templates

chore: bump rison to 2.0.0 (#39529)

2026-04-24 15:52:42 -04:00

daos

fix(uploads,dao): add zip-safety check to columnar reader and cap DAO page size (#40637)

2026-06-08 17:07:57 -07:00

dashboards

fix(schemas): tighten guest dataset fields, external_url protocols, ssh creds, prophet bounds (#40640)

2026-06-09 18:30:30 -07:00

databases

fix(schemas): tighten guest dataset fields, external_url protocols, ssh creds, prophet bounds (#40640)

2026-06-09 18:30:30 -07:00

datasets

fix(commands,api): enforce command validation, sanitize export filename/token, set cache TTLs (#40655)

2026-06-09 10:29:46 -07:00

datasource

feat: semantic layer extension (#37815)

2026-05-05 12:07:46 -04:00

db_engine_specs

fix: ODPS (MaxCompute) data source table preview failed (#38174)

2026-06-05 17:57:44 -07:00

distributed_lock

refactor(config): SIGNAL_CACHE_CONFIG → DISTRIBUTED_COORDINATION_CONFIG (#38395)

2026-03-04 09:40:21 -08:00

embedded

fix(embedded): add Sec-Fetch-Dest defense-in-depth check on the embedded view (#40667)

2026-06-09 11:08:08 -07:00

embedded_dashboard

…

examples

fix(examples): skip URI safety check for system imports (#37577)

2026-02-02 09:24:16 -08:00

explorables

feat: semantic layer extension (#37815)

2026-05-05 12:07:46 -04:00

explore

fix(ag-grid): persist AG Grid column filters in explore permalinks (#38393)

2026-03-11 01:56:24 +05:30

extensions

fix: harden ZIP safety checks (total-size cap, zero-division guard) and extension path matching (#40664)

2026-06-08 14:14:53 -07:00

importexport

fix(importexport): honor overwrite flag on /api/v1/assets/import (#39502)

2026-05-11 10:24:42 -07:00

initialization

feat(security): terminate active sessions when an account is disabled

2026-06-10 11:24:30 -07:00

key_value

feat(embedded): add guest token revocation support (#40671)

2026-06-10 09:17:30 -07:00

mcp_service

fix(mcp): enforce audience, algorithm, issuer binding, and token scopes (strict mode) (#40653)

2026-06-09 11:08:20 -07:00

migrations

feat(security): terminate active sessions when an account is disabled

2026-06-10 11:24:30 -07:00

models

feat(security): terminate active sessions when an account is disabled

2026-06-10 11:24:30 -07:00

queries

fix(commands,api): enforce command validation, sanitize export filename/token, set cache TTLs (#40655)

2026-06-09 10:29:46 -07:00

reports

fix(reports): stamp email subject date at send time, not import time (#40693)

2026-06-04 12:03:28 -07:00

row_level_security

fix(rls): apply standard datasource access checks in RLS rule commands (#40650)

2026-06-09 11:24:12 -07:00

security

feat(security): terminate active sessions when an account is disabled

2026-06-10 11:24:30 -07:00

semantic_layers

chore(deps): bump pyarrow from 20.0.0 to 24.0.0 (#39756)

2026-06-09 12:51:33 -07:00

sql

fix: ODPS (MaxCompute) data source table preview failed (#38174)

2026-06-05 17:57:44 -07:00

sql_validators

feat(sqllab): syntax validation for sqlite-based DB engine specs (#38698)

2026-04-20 18:29:51 -04:00

sqllab

fix(sqllab): quote CTAS target identifiers and validate tmp_table_name format (#40245)

2026-06-03 12:55:25 +01:00

static

chore: remove redundant service-worker.js placeholder (#38348)

2026-03-03 01:43:17 -08:00

tables

chore: remove sl_ tables (#28704)

2024-05-29 19:04:37 -07:00

tags

chore: bump rison to 2.0.0 (#39529)

2026-04-24 15:52:42 -04:00

tasks

fix: cache warmup using WebDriver for reliable authentication (#38449)

2026-06-05 16:36:30 -07:00

templates

fix: replace deprecated appbuilder.app with current_app (#40876)

2026-06-09 15:01:43 -07:00

temporary_cache

chore: set up ruff as a new linter/formatter (#28158)

2024-04-24 17:19:53 -07:00

themes

fix(commands,api): enforce command validation, sanitize export filename/token, set cache TTLs (#40655)

2026-06-09 10:29:46 -07:00

thumbnails

fix(thumbnails): stabilize digest by sorting datasources and charts (#38079)

2026-02-20 09:51:35 +01:00

translations

fix(schemas): tighten guest dataset fields, external_url protocols, ssh creds, prophet bounds (#40640)

2026-06-09 18:30:30 -07:00

utils

fix(schemas): tighten guest dataset fields, external_url protocols, ssh creds, prophet bounds (#40640)

2026-06-09 18:30:30 -07:00

views

fix(dashboard): URL-encode native_filters in permalink redirect (#40660)

2026-06-09 11:37:08 -07:00

__init__.py

feat: Use DuckDB for examples data in Docker development environment (#34831)

2025-08-25 12:37:28 -07:00

app.py

fix(extensions): add cache headers and strip Vary: Cookie for extension static assets (#40120)

2026-05-15 09:23:39 -03:00

config.py

feat(embedded): add guest token revocation support (#40671)

2026-06-10 09:17:30 -07:00

constants.py

fix: reject default guest/async JWT secrets at startup (#40649)

2026-06-08 16:53:37 -07:00

custom_database_errors.py

feat(db): custom database error messages (#34674)

2025-10-01 14:29:57 +03:00

dataframe.py

fix(result_set): preserve JSON/JSONB data as objects instead of strings (#38172)

2026-06-05 11:41:40 -07:00

errors.py

chore: enforce more ruff rules (#31447)

2024-12-18 17:41:34 -08:00

exceptions.py

fix: OAuth2 exception should be 403 (#40074)

2026-05-15 14:53:02 -03:00

forms.py

refactor: Unify all json.(loads|dumps) usage to utils.json (#28702)

2024-05-28 14:17:41 -07:00

jinja_context.py

fix(jinja): expose dialect-escaped companion value on get_filters() (#40531)

2026-06-03 21:53:12 +01:00

legacy.py

chore: set up ruff as a new linter/formatter (#28158)

2024-04-24 17:19:53 -07:00

result_set.py

chore(deps): bump pyarrow from 20.0.0 to 24.0.0 (#39756)

2026-06-09 12:51:33 -07:00

schemas.py

…

sql_lab.py

fix(sqllab): prevent corrupted query state from blocking SQL Lab access (#40580)

2026-06-09 10:51:45 +01:00

stats_logger.py

refactor: Enable G logging rules and comprehensive ruff improvements (#35081)

2025-09-15 12:42:49 -07:00

superset_typing.py

feat: semantic layer extension (#37815)

2026-05-05 12:07:46 -04:00

viz.py

fix(viz): gate stacktrace behind SHOW_STACKTRACE and allowlist resample method (#40636)

2026-06-08 16:09:59 -07:00