You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by ru...@apache.org on 2026/08/24 17:17:06 UTC
(superset) branch fix/mcp-request-validation-hardening updated (e1664869503 -> 7d6174a528e)
This is an automated email from the ASF dual-hosted git repository.
rusackas pushed a change to branch fix/mcp-request-validation-hardening
in repository https://gitbox.apache.org/repos/asf/superset.git
omit e1664869503 fix(mcp): address follow-up review feedback
omit 3ccb8def8f1 docs(mcp): update cache config scenarios to include the new opt-in flag
omit 4927a9db31b fix(mcp): install caching middleware on network entrypoint, recurse sanitization into nested lists, handle DB errors during restore editorship checks, fail closed on missing JWT keys
omit 66d48f85354 docs(mcp): trim explanatory comments to plain rationale
omit 604e973871e fix(mcp): sanitize HTTPException/ValueError text and recurse into nested params before logging
omit f762109c0aa fix(mcp): raise instead of returning None for a rejected guest-marked JWT
omit 35d04554a46 fix(mcp): install the auth provider in the module entrypoint's network-transport branch
omit 7cb6d9cf81b fix(mcp): gate restore_chart/restore_dashboard on editorship before naming the object
omit 39b0d578fb8 fix(mcp): refuse response caching unless the operator opts in to a shared cache
omit 8a45842b1e5 fix(mcp): drop email from find_users substring search
omit a8ca4ad8e5f fix(mcp): render templated SQL before the destructive-DDL check on empty template_params
omit f005cfa8e48 fix(mcp): require an explicit secret for HMAC-signed JWT verification
omit 30bd19364c2 fix(mcp): fail closed when the MCP auth provider cannot be built
add 7f1b41444c8 fix: add missing access checks to semantic-layer and theme endpoints (#43389)
add 15b98aa6da0 fix(plugin-chart-echarts): apply contribution before rename with time comparison (#43384)
add 3f10d8b1ccb fix(versioning): suppress automatic chart normalization changes (#43350)
add 649c062825a chore(deps): bump baseline-browser-mapping from 2.11.13 to 2.11.15 in /docs (#43444)
add f3142e7b15b fix(tags): fix broken import in daos/tag.py (#43466)
add 2810ebed9de fix(mcp): fail closed when the MCP auth provider cannot be built
add 11e439390f5 fix(mcp): require an explicit secret for HMAC-signed JWT verification
add 5cfbbe5b8fb fix(mcp): render templated SQL before the destructive-DDL check on empty template_params
add f35fd58cf0a fix(mcp): drop email from find_users substring search
add 0257d065398 fix(mcp): refuse response caching unless the operator opts in to a shared cache
add 586ab6830a0 fix(mcp): gate restore_chart/restore_dashboard on editorship before naming the object
add f2a6842cc00 fix(mcp): install the auth provider in the module entrypoint's network-transport branch
add fae54716a3f fix(mcp): raise instead of returning None for a rejected guest-marked JWT
add 65ced997b42 fix(mcp): sanitize HTTPException/ValueError text and recurse into nested params before logging
add f49f388590f docs(mcp): trim explanatory comments to plain rationale
add 2904cea905a fix(mcp): install caching middleware on network entrypoint, recurse sanitization into nested lists, handle DB errors during restore editorship checks, fail closed on missing JWT keys
add cfb70dbb3f2 docs(mcp): update cache config scenarios to include the new opt-in flag
add 7d6174a528e fix(mcp): address follow-up review feedback
This update added new revisions after undoing existing revisions.
That is to say, some revisions that were in the old version of the
branch are not in the new version. This situation occurs
when a user --force pushes a change and generates a repository
containing something like this:
* -- * -- B -- O -- O -- O (e1664869503)
\
N -- N -- N refs/heads/fix/mcp-request-validation-hardening (7d6174a528e)
You should already have received notification emails for all of the O
revisions, and so the following emails describe only the N revisions
from the common base, B.
Any revisions marked "omit" are not gone; other references still
refer to them. Any revisions marked "discard" are gone forever.
No new revisions were added by this update.
Summary of changes:
docs/package.json | 2 +-
docs/yarn.lock | 8 +-
.../tests/version-history/activity-log.spec.ts | 127 ++++++++-
.../src/Timeseries/buildQuery.ts | 7 +-
.../test/Timeseries/buildQuery.test.ts | 22 ++
.../src/explore/actions/hydrateExplore.test.ts | 76 +++++-
.../src/explore/actions/hydrateExplore.ts | 34 ++-
.../src/explore/actions/saveModalActions.test.ts | 248 ++++++++++++++++-
.../src/explore/actions/saveModalActions.ts | 97 ++++++-
.../features/versionHistory/normalization.test.ts | 158 +++++++++++
.../src/features/versionHistory/normalization.ts | 197 ++++++++++++++
.../src/features/versionHistory/reducer.test.ts | 56 ++++
.../src/features/versionHistory/reducer.ts | 133 ++++++++-
.../versionHistory/sessionLogMiddleware.test.ts | 46 +++-
.../versionHistory/sessionLogMiddleware.ts | 85 +++++-
.../src/features/versionHistory/types.ts | 41 +++
superset/charts/api.py | 8 +-
superset/charts/schemas.py | 24 ++
superset/commands/chart/update.py | 25 +-
superset/commands/semantic_layer/create.py | 8 +-
superset/commands/semantic_layer/delete.py | 19 +-
superset/commands/semantic_layer/update.py | 13 +-
superset/commands/tag/create.py | 7 +-
superset/commands/tag/update.py | 7 +-
superset/commands/tag/utils.py | 21 --
superset/commands/theme/import_themes.py | 12 +
superset/commands/theme/update.py | 10 +
superset/commands/utils.py | 25 ++
superset/daos/tag.py | 10 +-
superset/security/manager.py | 1 +
superset/semantic_layers/api.py | 37 +++
superset/semantic_layers/models.py | 20 ++
superset/themes/api.py | 2 +
superset/utils/core.py | 14 +-
superset/versioning/changes/listener.py | 2 +
superset/versioning/changes/normalization.py | 300 +++++++++++++++++++++
superset/versioning/changes/state.py | 14 +
.../themes/test_theme_api_permissions.py | 34 ++-
.../versioning/change_records_tests.py | 137 ++++++++++
.../commands/semantic_layer/create_test.py | 184 +++++++++++++
.../commands/semantic_layer/delete_test.py | 199 +++++++++++++-
.../commands/semantic_layer/update_test.py | 155 ++++++++++-
tests/unit_tests/commands/test_utils.py | 59 ++++
.../commands/theme/test_import_themes.py | 193 +++++++++++++
tests/unit_tests/semantic_layers/api_test.py | 161 +++++++++++
tests/unit_tests/semantic_layers/models_test.py | 84 ++++++
tests/unit_tests/tags/commands/update_test.py | 4 +-
tests/unit_tests/themes/commands_test.py | 51 ++++
tests/unit_tests/utils/test_core.py | 18 +-
tests/unit_tests/versioning/test_listener.py | 1 +
.../versioning/test_normalization_changes.py | 186 +++++++++++++
51 files changed, 3260 insertions(+), 122 deletions(-)
create mode 100644 superset-frontend/src/features/versionHistory/normalization.test.ts
create mode 100644 superset-frontend/src/features/versionHistory/normalization.ts
create mode 100644 superset/versioning/changes/normalization.py
create mode 100644 tests/unit_tests/commands/theme/test_import_themes.py
create mode 100644 tests/unit_tests/versioning/test_normalization_changes.py