Claude Code 782c1db8d8 feat(encrypt): add CBC→GCM re-encryption migrator + CLI engine flag ...

Phase 2 of the authenticated-encryption-at-rest proposal. Teaches the
existing SecretsMigrator an engine-migration mode (decrypt with the source
engine under the current SECRET_KEY, re-encrypt with a target engine) and
exposes it via `superset re-encrypt-secrets --engine aes-gcm`. The run is
transactional and idempotent per column, so existing installs can move from
AES-CBC to authenticated AES-GCM without bricking stored secrets. Default
engine is unchanged ("aes"); behavior is opt-in. Adds UPDATING.md runbook and
updates the SIP to reflect Phases 1–2 shipping here.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-05 11:41:45 -07:00

..

__init__.py

…

cache_test.py

…

csv_tests.py

fix(exports,email,logs): csv formula escaping, subject CRLF stripping, UTC log pruning (#40645)

2026-06-02 18:32:36 +01:00

currency_test.py

feat: Dynamic currency (#36416)

2026-01-16 21:58:41 -08:00

date_parser_tests.py

fix(date_parser): suppress noisy parsedatetime DEBUG logs (#33365) (#40144)

2026-05-17 19:58:08 -07:00

db.py

…

encrypt_test.py

feat(encrypt): add CBC→GCM re-encryption migrator + CLI engine flag

2026-06-05 11:41:45 -07:00

excel_tests.py

chore(excel): strip document metadata from Excel exports (#40661)

2026-06-02 11:48:36 -07:00

filters_test.py

…

json_tests.py

feat: support for import/export masked_encrypted_extra (backend) (#38077)

2026-03-04 11:26:28 -08:00

log_tests.py

…

map_type_tests.py

…

oauth2_tests.py

fix(OAuth2): Re-query the OAuth2 token to avoid stale reference (#40071)

2026-05-18 13:07:54 -03:00

profiler_test.py

chore(deps-dev): bump pyinstrument from 4.4.0 to 5.1.2 (#40377)

2026-06-01 13:34:12 -07:00

screenshot_test.py

feat: add option for hash algorithms (#35621)

2025-12-09 16:59:07 +00:00

slack_test.py

…

test_cache_manager.py

feat(cache): use configurable hash algorithm for flask-caching (#37361)

2026-01-26 10:19:51 -08:00

test_core.py

fix(exports,email,logs): csv formula escaping, subject CRLF stripping, UTC log pruning (#40645)

2026-06-02 18:32:36 +01:00

test_database.py

fix(db): Add MariaDB DDL fix for NOCYCLE syntax (#37582)

2026-04-22 19:01:20 -04:00

test_date_parsing.py

fix(utils): Suppress pandas date parsing warnings in normalize_dttm_col (#35042)

2025-09-08 18:17:33 -07:00

test_decorators.py

chore: proper current_app.config proxy usage (#34345)

2025-07-31 19:27:42 -07:00

test_file.py

…

test_hashing.py

feat: add option for hash algorithms (#35621)

2025-12-09 16:59:07 +00:00

test_impersonation_cache_key.py

fix: Enforce per-user caching on legacy API endpoint (#39789)

2026-04-30 18:04:33 -03:00

test_jinja_template_validator.py

fix(error-handling): jinja2 error handling improvements (#34803)

2025-09-02 17:29:07 -04:00

test_link_redirect.py

fix(redirect): normalize browser-stripped whitespace before protocol-relative check (#40566)

2026-06-03 12:56:10 +01:00

test_playwright_migration_working.py

fix: Enable Playwright migration with graceful Selenium fallback (#35063)

2025-09-23 10:47:45 -07:00

test_rison_filters.py

feat(dashboard): add Rison-encoded URL filter support (#39795)

2026-05-31 08:06:09 -04:00

test_screenshot_cache_fix.py

fix(screenshots): Only cache thumbnails when image generation succeeds (#36126)

2025-11-21 17:11:20 -08:00

test_screenshot_exception_handling.py

fix: make get_image() always return BytesIO (#34801)

2025-08-25 09:01:36 -04:00

test_screenshot_utils.py

fix(reports): add per-tile animation wait to prevent partial ECharts renders in tiled screenshots (#40694)

2026-06-04 16:43:34 -07:00

urls_tests.py

…

webdriver_test.py

fix(reports): guard null dashboard height in Playwright screenshots (#40179)

2026-05-21 09:19:29 -07:00