(superset) 01/15: docs: name the Oracle URI readers the denylist also refuses

[hu...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

hughhhh pushed a commit to branch hughhhh/pfm-6-explore-indicator
in repository https://gitbox.apache.org/repos/asf/superset.git

commit 45761af05e0567adca4e3441d8f238a43724648f
Author: Hugh A. Miles II <hu...@gmail.com>
AuthorDate: Wed Oct 14 13:28:49 2026 +0000

    docs: name the Oracle URI readers the denylist also refuses
    
    The note listed `dburitype` but not `geturi`, `xdburitype` or `httpuritype`,
    which `config.py` denies alongside it. An operator using
    `URIFACTORY.GETURI(...)` in SQL Lab or a chart would read this, see nothing
    about that function, and find it refused after upgrading -- even with
    `PARTITION_FILTER_MAPPING` off, since the denylist is not gated on the flag.
    
    Co-Authored-By: Claude Opus 5 (1M context) <no...@anthropic.com>
    Signed-off-by: Hugh A. Miles II <hu...@gmail.com>
---
 UPDATING.md | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/UPDATING.md b/UPDATING.md
index f554faa8af8..5fd6b8d9322 100644
--- a/UPDATING.md
+++ b/UPDATING.md
@@ -190,8 +190,12 @@ reattached to a reachable container by layout repair.
   such a gate to see. The same reasoning adds a new `oracle` entry naming
   `getxml`, `getxmltype`, `newcontext` and `newcontextfromhierarchy`, the
   `DBMS_XMLGEN` / `DBMS_XMLQUERY` calls that run a query handed to them as
-  text, and `dburitype`, which reads a table by path string; they are listed by
-  bare name because that is what the parser sees for a package-qualified call. The denylist is shared with SQL Lab and Charts, so a
+  text, and the URI readers that name a table by path string -- `dburitype`,
+  `xdburitype`, `httpuritype` and `geturi`, the last reached through
+  `URIFACTORY.GETURI(...)`. They are listed by bare name because that is what
+  the parser sees for a package-qualified call.
+
+  The denylist is shared with SQL Lab and Charts, so a
   deployment relying on any of these functions there will now see it refused --
   including a deployment that never enables `PARTITION_FILTER_MAPPING`, since
   the denylist is not gated on the feature flag. Override