mirror of
https://github.com/apache/superset.git
synced 2026-07-18 20:55:47 +00:00
79e09ec1b3
Removes the deck.gl JS tooltip/onclick-href/data-mutator controls and the GeoJSON layer's label/icon JavaScript-mode generators, along with the ENABLE_JAVASCRIPT_CONTROLS feature flag that gated them (closes #41045). These let users write arbitrary JS, sandboxed via Node's vm module, to customize deck.gl tooltips/click behavior/data transforms; the flag defaulted off and saw negligible use. Removes the now-dead sandboxedEval() runtime (utils/sandbox.ts), its vm-browserify webpack polyfill and devDependency, and the underscore dependency it alone pulled into the deck.gl plugin. Cleans up the associated backend form_data-stripping mechanism, tests, fixtures, and docs for the removed feature. vm2 (the dependency this was originally suspected to pull in) turned out to be unrelated: it was only a transitive dev-dependency of the Cartodiagram plugin's geostyler dependency via typescript-json-schema, which has since dropped it upstream (>=0.68.0). Forced that resolution via an npm override, confirmed geostyler ships no code that touches typescript-json-schema at runtime, and verified the Cartodiagram plugin still builds and its full test suite passes. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>