You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by ha...@apache.org on 2026/05/14 14:51:49 UTC
(superset) branch sec/resolve-gha-vulns updated (d390c90f16d -> 0e83e836e7d)
This is an automated email from the ASF dual-hosted git repository.
hainenber pushed a change to branch sec/resolve-gha-vulns
in repository https://gitbox.apache.org/repos/asf/superset.git
from d390c90f16d fix(ci): resolve fixable GHA-related security issues
add 3363b481807 fix(spark): register Spark SQLAlchemy dialect so spark:// URIs resolve to SparkEngineSpec (#38299)
add 39ad6b200fb docs(update): fix typos in UPDATING.md (#40068)
add 2392c8e624a fix(Select): fix Russian translations for Select (#35751)
add 74451057355 fix(explore): explain disabled chart overwrite option (#39796)
add f2eee4ef464 fix(frontend): prevent LanguagePicker crash when locale is missing from LANGUAGES config (#39585)
add e94465208f5 fix(bar-chart): cap bar width so a single data point doesn't stretch across the chart (#39588)
add a77fec68d40 fix(drill-detail): make page-size selector functionally adjustable (#37975)
add 43a89f8710e chore(deps-dev): bump terser-webpack-plugin from 5.5.0 to 5.6.0 in /superset-frontend (#40061)
add 9160da0d27a chore(deps-dev): bump yeoman-test from 11.3.1 to 11.5.2 in /superset-frontend (#40058)
add fe22e060118 chore(deps): bump mermaid from 11.10.0 to 11.15.0 in /docs (#40038)
add 4c14e16e583 chore(deps): bump @babel/plugin-transform-modules-systemjs from 7.20.11 to 7.29.4 in /superset-frontend/cypress-base (#39982)
add 86ba63b0723 fix(dashboard): prevent duplicate subdirectory prefix when toggling fullscreen (#39534)
add d8b2c5872b7 chore(deps-dev): bump @swc/core from 1.15.32 to 1.15.33 in /superset-frontend (#39935)
add 4d0cc1d7a60 chore(deps): bump zod from 4.4.1 to 4.4.3 in /superset-frontend (#39904)
add fa06989ed71 fix(mcp): return requested update chart previews (#40077)
add af4dc3a9aa6 fix(re-encrypt): handle non-id PKs and make command idempotent (#40079)
add 1d220f7172c chore(deps-dev): update fs-extra requirement from ^11.3.4 to ^11.3.5 in /superset-frontend/packages/generator-superset (#39930)
add 0d9ecb76645 chore(deps-dev): update @types/node requirement from ^25.6.0 to ^25.7.0 in /superset-frontend/packages/superset-ui-core (#40059)
add e2a8a88d366 docs: Update documentation link for ENABLE_SUPERSET_META_DB (#40076)
add c59ab8bffdf feat(mcp): add data boundary instruction to harden against prompt injection (#40080)
add 940779ad5f1 feat(event-log): add event logging for embedded Superset (#40083)
add 6cebba49ca0 fix(AlertReportModal): TypeError when pasting text into the Alerts content form search field (#39298)
add 726d83d758d fix(mcp): remove stale created_by_fk filter references from MCP privacy layer (#39955)
add 6a1305fe530 chore(deps): update zod requirement from ^4.4.1 to ^4.4.3 in /superset-frontend/plugins/plugin-chart-echarts (#40091)
add 2c7e418d7bc chore(deps): bump @ant-design/icons from 6.2.2 to 6.2.3 in /docs (#40086)
add 9e749da93c6 chore(deps): bump ws from 8.20.0 to 8.20.1 in /superset-websocket (#40085)
add aebc6fbf344 chore(deps-dev): bump @types/node from 25.6.0 to 25.7.0 in /superset-websocket (#40052)
add b4cb780e748 chore(deps): update ace-builds requirement from ^1.43.6 to ^1.44.0 in /superset-frontend/packages/superset-ui-core (#40017)
add 5d40d8aeac7 chore(deps): bump actions/dependency-review-action from 4.9.0 to 5.0.0 (#40016)
add 577085eeceb chore(deps-dev): bump fast-uri from 3.0.1 to 3.1.2 in /superset-embedded-sdk (#39978)
add 8074ae2e38c chore(deps): bump fast-uri from 3.1.0 to 3.1.2 in /superset-frontend/cypress-base (#39974)
add 803fed28b89 chore(deps): update react requirement from ^19.2.5 to ^19.2.6 in /superset-frontend/plugins/legacy-plugin-chart-chord (#39929)
add cdddb99e9ac chore(deps): bump yeoman-generator from 8.1.2 to 8.2.2 in /superset-frontend (#39880)
add 6216e574909 chore(deps): bump react-syntax-highlighter from 16.1.0 to 16.1.1 in /superset-frontend (#39698)
add a50de459aea fix(dashboard): restore spacing for charts inside Tabs layout (#38729)
add 85c44110414 chore(deps-dev): bump @babel/plugin-transform-modules-systemjs from 7.25.0 to 7.29.4 in /superset-embedded-sdk (#39983)
add 1a7a14c3573 fix(explore): remove leftover debug console.log in ZoomConfigControl (#39991)
add 817814d4f65 chore: Bump core packages to 0.1.0 (#40029)
add 2a1dcb79e37 fix(mcp): expose table chart type labels in chart responses (#40060)
add 958d4aa3dec fix(export): fix double app-root prefix in chart/drill-detail export URLs (#39710)
add d7fa9301cca fix(dashboard): restore top-level tab drop target for dashboards with content (#39423)
add 992f561ab9e chore(deps): bump mapbox-gl from 3.23.0 to 3.23.1 in /superset-frontend (#39879)
add c233bf61713 chore(deps-dev): bump baseline-browser-mapping from 2.10.24 to 2.10.29 in /superset-frontend (#39903)
add d6c458abd41 chore(deps-dev): bump oxlint from 1.62.0 to 1.63.0 in /superset-frontend (#39937)
add d690aa7eb4c chore(deps): bump immer from 11.1.4 to 11.1.7 in /superset-frontend (#39941)
add 17a5f693393 chore(deps): bump chrono-node from 2.9.0 to 2.9.1 in /superset-frontend (#39939)
add 5bad4f55fb5 chore(deps-dev): bump @playwright/test from 1.59.1 to 1.60.0 in /superset-frontend (#40088)
add 21e62d594eb chore(deps-dev): bump wait-on from 9.0.6 to 9.0.10 in /superset-frontend (#40087)
add 676979643fe chore(deps-dev): bump @babel/preset-env from 7.29.3 to 7.29.5 in /superset-frontend (#39934)
add 48530cb8884 chore(deps-dev): bump @babel/register from 7.28.6 to 7.29.3 in /superset-frontend (#39818)
add d1e9a5df06c chore(docs): clean up version-cutting tooling and finish developer_portal rename (#39837)
add 01224007daf fix(mixed-timeseries): preserve all-NaN metric columns after pivot when Jinja evaluates to NULL (#40005)
add a62bf2b0bb7 fix: chart rendering race condition and homepage connection reset (#40065)
add e56883baef6 fix(ci): handle schedule event in change_detector and actually trigger all-changed (#40105)
add 64dae07675e chore(deps): bump markdown-to-jsx from 9.7.16 to 9.8.0 in /superset-frontend (#40111)
add 0e83e836e7d Merge branch 'master' into sec/resolve-gha-vulns
No new revisions were added by this update.
Summary of changes:
.github/workflows/dependency-review.yml | 2 +-
.rat-excludes | 3 +
UPDATING.md | 8 +-
docs/DOCS_CLAUDE.md | 33 +-
docs/README.md | 56 +-
docs/components/versions.json | 1 -
docs/developer_docs/versions.json | 1 -
docs/developer_portal_versions.json | 1 -
docs/package.json | 8 +-
docs/scripts/manage-versions.mjs | 259 ++++++++--
docs/src/theme/DocVersionBadge/index.js | 28 +-
docs/src/theme/DocVersionBanner/index.js | 121 -----
docs/src/theme/DocVersionBanner/styles.module.css | 49 --
docs/static/feature-flags.json | 2 +-
docs/tutorials_versions.json | 3 -
docs/yarn.lock | 340 ++++--------
scripts/change_detector.py | 16 +-
superset-core/pyproject.toml | 2 +-
superset-embedded-sdk/package-lock.json | 568 +++++++--------------
superset-extensions-cli/pyproject.toml | 2 +-
superset-frontend/cypress-base/package-lock.json | 427 ++++++++--------
superset-frontend/package-lock.json | 453 ++++++++--------
superset-frontend/package.json | 24 +-
.../packages/generator-superset/package.json | 6 +-
.../packages/superset-core/package.json | 4 +-
.../packages/superset-ui-core/package.json | 6 +-
.../src/chart/components/createLoadableRenderer.ts | 130 +++--
.../src/components/Select/Select.tsx | 6 +-
.../plugins/legacy-plugin-chart-chord/package.json | 2 +-
.../plugins/legacy-plugin-chart-rose/src/Rose.ts | 11 +-
.../src/Timeseries/transformers.ts | 3 +
.../plugin-chart-point-cluster-map/package.json | 2 +-
.../Chart/DrillDetail/DrillDetailPane.test.tsx | 78 +++
.../Chart/DrillDetail/DrillDetailPane.tsx | 26 +-
.../src/components/Chart/chartAction.ts | 21 +-
.../src/components/Chart/chartActions.test.ts | 72 +++
.../DashboardBuilder/DashboardBuilder.test.tsx | 46 ++
.../DashboardBuilder/DashboardBuilder.tsx | 7 +-
.../dashboard/components/Header/Header.test.tsx | 91 ++++
.../Header/useHeaderActionsDropdownMenu.tsx | 13 +-
.../src/dashboard/util/getDashboardUrl.test.ts | 10 +
superset-frontend/src/embedded/index.tsx | 8 +-
.../src/explore/components/SaveModal.test.tsx | 29 +-
.../src/explore/components/SaveModal.tsx | 17 +-
.../ZoomConfigControl/ZoomConfigControl.tsx | 1 -
.../src/explore/exploreUtils/exportChart.test.ts | 26 +-
.../src/explore/exploreUtils/index.ts | 15 +-
.../src/features/alerts/AlertReportModal.test.tsx | 24 +
.../src/features/alerts/AlertReportModal.tsx | 9 +-
.../src/features/home/LanguagePicker.tsx | 14 +-
.../src/middleware/loggerMiddleware.ts | 9 +-
.../Spin/index.tsx => src/types/emotion-jest.d.ts} | 2 +-
superset-frontend/src/utils/pathUtils.test.ts | 16 +
superset-frontend/src/utils/pathUtils.ts | 10 +-
superset-frontend/src/views/index.tsx | 7 +-
superset-frontend/src/views/menu.tsx | 39 +-
superset-websocket/package-lock.json | 44 +-
superset-websocket/package.json | 4 +-
superset/cli/update.py | 22 +-
superset/config.py | 2 +-
superset/db_engine_specs/spark.py | 6 +-
superset/mcp_service/app.py | 15 +
superset/mcp_service/chart/chart_utils.py | 11 +
superset/mcp_service/chart/preview_utils.py | 2 +
superset/mcp_service/chart/schemas.py | 6 +
superset/mcp_service/chart/tool/generate_chart.py | 9 +-
.../mcp_service/chart/tool/update_chart_preview.py | 39 +-
.../explore/tool/generate_explore_link.py | 6 +
superset/mcp_service/privacy.py | 31 +-
superset/utils/encrypt.py | 173 +++++--
superset/utils/pandas_postprocessing/pivot.py | 78 ++-
tests/integration_tests/cli_tests.py | 42 ++
tests/integration_tests/utils/encrypt_tests.py | 219 +++++++-
.../mcp_service/chart/test_chart_schemas.py | 16 +
.../mcp_service/chart/test_chart_utils.py | 22 +
.../mcp_service/chart/tool/test_generate_chart.py | 55 +-
.../chart/tool/test_update_chart_preview.py | 74 +++
.../explore/tool/test_generate_explore_link.py | 35 ++
tests/unit_tests/mcp_service/test_mcp_config.py | 28 +
.../unit_tests/pandas_postprocessing/test_pivot.py | 243 +++++++++
tests/unit_tests/sql/test_spark_dialect.py | 94 ++++
81 files changed, 2849 insertions(+), 1594 deletions(-)
delete mode 100644 docs/components/versions.json
delete mode 100644 docs/developer_docs/versions.json
delete mode 100644 docs/developer_portal_versions.json
delete mode 100644 docs/src/theme/DocVersionBanner/index.js
delete mode 100644 docs/src/theme/DocVersionBanner/styles.module.css
delete mode 100644 docs/tutorials_versions.json
copy superset-frontend/{packages/superset-ui-core/src/components/Spin/index.tsx => src/types/emotion-jest.d.ts} (95%)
create mode 100644 tests/unit_tests/sql/test_spark_dialect.py