Preset logo
Apache Superset Repo Recap: August 2026
SUPERSET DEVELOPERS

Apache Superset Repo Recap: August 2026

Evan Rusackas
Evan Rusackas
11 min read
2,098 words

August was a busy month for the Apache Superset™ community: 108 contributors merged 727 pull requests. The through-line was recoverability. Two long-running data-safety efforts crossed the finish line and flipped on by default in the same month — version history, so you can preview and restore prior versions of a chart or dashboard, and soft delete, so a deleted asset lands in a Recently Archived view instead of vanishing. Alongside them: a purpose-built mobile dashboard mode, a native Butterfly chart, Snowflake OAuth, and a broad sweep of embedded-security hardening.

The community kept growing, too. Superset gained more than 480 GitHub stars in August (now north of 74,500), welcomed 72 new contributors to the repo, and added another 87 members to the community Slack. Fifty people merged their very first Superset PR this month — welcome, all of you.

Highlights

Five things stood out this month. The long tail follows, grouped by area.

Version History Arrives, and Switches On by Default

Superset's entity version-history feature (SIP-210) landed its UI and then had its release gates flipped for general availability. With version history on, Explore's actions menu and a dashboard's actions menu gain "View version history," which opens a panel listing captured versions with author, timestamp, and descriptive change rows, plus search and an all-changes filter (#41551). Selecting a version previews it inertly — no writes possible — and Restore rewrites the entity as a new, append-only version, so history is never lost; "Open as new" forks a version into a new entity.

Two follow-ups took it to GA. #42801 flipped VERSION_HISTORY and ENABLE_VERSIONING_CAPTURE to on together — they aren't independently useful, since the panel reads what capture writes — and kept capture as a permanent operational kill-switch. And #42797 pinned version-history reads to a composite (id, uuid) key so an entity created under a recycled id can't inherit its predecessor's history, a prerequisite before capture ran on by default.

Soft Delete Reaches General Availability

Building on the soft-delete foundation laid earlier in the year, August shipped the user-facing half and turned it on. A new Recently Archived page (/archived/) lists archived charts, dashboards, and datasets with humanized archive age, the archiving user, per-type name search, and time-range presets, and adds per-row purge endpoints for irreversible single-row deletion (#41550).

Then #42800 flipped SOFT_DELETE to True and SOFT_DELETE_PURGE_DRY_RUN to False for GA. Deleting a chart, dashboard, or dataset now archives it — hidden from normal listings, recoverable from Recently Archived, and permanently removed only once SOFT_DELETE_RETENTION_DAYS (30 by default) elapses. Both flags stay in place as kill-switches, and a startup warning added in a prerequisite PR (#42641) catches a CELERY_CONFIG that forgot to register the retention task.

A Mobile-Friendly Dashboard Mode

Superset gained a purpose-built mobile viewing mode instead of scaling the desktop layout down to phone width, entirely opt-in behind MOBILE_CONSUMPTION_MODE (#37141). All mobile behavior keys off a single useIsMobile() hook, so there's one auditable kill switch. Route access is data-driven: routes opt in explicitly, and anything else renders a genuine "unsupported" page rather than CSS-hiding its controls, so keyboard and screen-reader users can't reach affordances that shouldn't be there.

Under the hood, charts report their true full-width and height so plugins size themselves correctly, the filter bar gained a first-class vertical mobile layout, and dashboard headers, the home page, and the top nav collapse into drawers. With the flag off, behavior is identical to master at every viewport.

A New Butterfly Chart

Superset picked up a native Butterfly chart (viz type butterfly) for comparing two metrics across the same categories — planned vs. actual, two time periods, or any paired measures (#43346). It takes one category dimension and two metrics, rendering one to the left of a central axis and one to the right to produce the familiar diverging-bar shape, with Explore controls for per-side colors and labels, legend, and axis formatting.

A follow-up wired it into Superset's shared interactive-chart machinery, adding cross-filtering, drill to detail, and drill by. Because category labels can collide when a value is ambiguous, it builds a composite per-row key for selection and highlight state while still showing the human-readable label on the axis and in tooltips (#43684).

Snowflake OAuth 2.0 Authentication

Snowflake connections can now use OAuth 2.0 for per-user impersonation, closing a long-standing request and mirroring the pattern already used for Databricks and Google Sheets (#36856). With a configured OAuth client, query execution is attributed to the actual logged-in user rather than a shared service account, so Snowflake can see and audit the real end user.

The implementation is careful about the edges: OAuth is skipped outside a request context, so alert and report execution never attempts it, and it's skipped during Test Connection to avoid spurious auth failures. A custom auth-error type, matched against both raw and SQLAlchemy-wrapped Snowflake errors, drives Superset's existing re-authorization flow.

In the Works

Two large efforts progressed on feature branches rather than master in August. Dashboard v2, a new dashboard editing UI built on a gridstack layout, kept growing on its own branch (#42865, #43096), and the migration of Global Async Queries onto the Global Task Framework accumulated a stack of PRs on another (#43424). Neither was on master when August closed; the async-queries work merged on September 5 (#43407) and will get its due in next month's recap. A third effort, expanding testcontainers-based CI coverage to roughly fifteen real database dialects with the heavy ones gated to nightly runs, is likewise still stacked on an open PR against master (#43652, #43640, #43668, #43662).

Charts & Visualizations

  • Reintroduced the pivot table's "Show values as" option — % of row, column, or grand total — lost when SIP-216 removed the old per-metric aggregation control (#42761)
  • Gridline and axis-tick visibility checkboxes for ECharts timeseries charts (Bar, Line, Area, Step, Scatter, and more) (#43428)
  • A user-configurable label position (Auto, Top, Inside, Bottom, Left, Right) for bar and Mixed Timeseries value labels (#38695)
  • A "Truncate labels" control for timeseries tooltips, fixing labels that all looked identical once shortened (#43272)
  • A color picker in conditional formatting, replacing the fixed theme-token dropdown with arbitrary RGBA colors (#42053)
  • New NETWORK_THROUGHPUT and NETWORK_THROUGHPUT_FROM_BYTES number formats for bits/s and bytes/s (#42437)
  • MEDIAN, STDDEV_SAMP, and VAR_SAMP added as system-wide aggregates for any chart type on Postgres, MySQL, DuckDB, and Redshift (#42895)
  • A "Summary aggregation" control letting the Table totals row use Sum or Average instead of each metric's own aggregation (#43027)
  • An "Italy (regions and autonomous provinces)" country map that splits Trentino-Alto Adige into Trento and Bozen (#42309)
  • Optional ECharts ARIA descriptions for accessibility, defaulted off (#28171)

Dashboards & Filters

  • Server-side search for Explore filter values, so matches beyond the first cached 10,000-row page are findable, with a notice when a shown list is capped (#43518)
  • First-class filtering on array-typed (multi-value) columns, with ClickHouse as the initial dialect and operators like Contains any/all and Length comparisons (#41279)
  • Drill By can now scope to the clicked x-axis value, not only the series, fixing categorical drills that pulled in every category (#42296)
  • Cross-filtering extended to temporal x-axes, so clicking a bar on a no-groupby time chart filters other charts by that time bucket (#42792)
  • A tooltip on dashboard chart headers that renders a chart's markdown description from an info icon (#43271)
  • An "Expand all chart descriptions" action for dashboards (#32958)
  • A dashboard.slice.header.menu extension slot for injecting custom items into a chart's "…" menu (#43624)
  • An AFTER_ASSET_CREATE hook that fires after a dashboard is created, letting integrations react without patching core views (#42837)
  • An EXTRA_PANDAS_POSTPROCESSING_OPS config extension point for registering custom post-processing operations (#43337)
  • Deployments can register extra theme tokens (#42874)
  • A renderExtraFields prop on the chart and dashboard properties modals for injecting custom fields (#43622)
  • The embedded SDK gained a setDataMask method for setting filter state programmatically (#35754)

SQL Lab & Databases

  • Snowflake OAuth 2.0 authentication for per-user impersonation (see Highlights) (#36856)
  • An is_database_engine_error() helper that marks connection errors from configured databases, so extensions can tell them apart from metadata-DB errors (#42996)
  • Retry of the dataset table-metadata preview after OAuth2 authorization, surfacing the real error and re-fetching instead of a blank state (#42581)
  • SQL Lab retries its table-metadata preview after an OAuth2 redirect (#42390)
  • SQL Lab query owners can now create charts from their own queries without all_datasource_access (#42479)
  • AUTH_REMOTE_USER works out of the box again; the SPA login view had silently shadowed it since the 6.0 login migration (#42949)
  • Chart data API responses now include query lifecycle timing (#37516)
  • Dataset exports preserve metric and column UUIDs (#42393)

MCP & AI

  • Per-resource MCP token scopes (superset:<resource>:<action>) on top of the flat read/write scopes, wiring FAB's previously inert ApiKey.scopes column into both issuance validation and runtime enforcement, with a UI scope picker — a key can never be scoped beyond the issuing user's own RBAC (#42297)
  • Observability for the MCP service: StatsD/Prometheus metrics, audit-log reliability fixes, and a pluggable error-tracking hook for wiring in something like Sentry (#41921)
  • An optional tri-state certified filter on the list_datasets and list_charts tools (#42656)
  • A feature-gated adapter for an extension-provided AG Grid "Interactive Pivot" visualization (#43480)
  • get_dashboard_info can accept a filter_state directly, unblocking embedded guest users who can't mint permalinks (#43688)

Reports & Alerts

  • Configurable retry-on-failure for scheduled reports: 1–10 attempts with exponential backoff, optional delivery after retries are exhausted, and per-attempt notifications, all in a new "Error handling" section, opt-in behind the ALERT_REPORTS_RETRY feature flag (#42481, #43553)
  • A per-schedule toggle to include or exclude the "Explore in Superset" link in a report's notifications (#42494)
  • Selenium support removed from the screenshot, thumbnail, and report pipeline — Playwright is now the sole browser-automation backend (#43028)
  • Scheduled report execution now enforces a single per-execution deadline and a real dashboard-readiness check before capturing (#42624)
  • Alerts fail closed instead of delivering a blank screenshot, and report PDFs no longer come out blank or partial from virtualized charts (#43031, #43348)

Core & Infrastructure

  • The legacy explore_json endpoints and viz.py visualization pipeline removed, a breaking change for anything still calling the old endpoint (#41714)
  • SQLAlchemy bumped to 2.0 (and flask-sqlalchemy to 3.1.1), a foundational step in the ongoing 2.0 migration (#42803)
  • Follow-through on that bump: the now-redundant future flags unset on engines and sessions (#43273)
  • Frontend formatting migrated from Prettier to Oxfmt, roughly 30x faster across the codebase (#42434)
  • The docs project's linting moved to oxlint with the type-aware oxlint-tsgolint plugin as part of a TypeScript 7 upgrade (#43691)
  • PRs with merge conflicts now auto-labeled requires:rebase in CI (#42504)

Security

August brought a broad sweep of hardening, much of it around embedded and guest access:

  • Guest tokens can now carry arbitrary user attributes, exposed to SQL templates via a new get_guest_user_attribute() Jinja macro for multi-tenant row-level filtering (#33924)
  • Data-permission errors turned into an actionable, self-service flow with owner contacts and a "Request access" link instead of raw issue-code jargon (#41843)
  • The brace-expansion dependency upgraded to address CVE-2026-14257 (#42435)

A broader batch of defensive fixes also landed across embedded guest access, exports, and account handling. Details will follow in the security advisories that accompany the next release.

Internationalization

  • A new Tamil (ta) locale (#38962)
  • Non-English translation catalogs now served as versioned, immutable-cacheable scripts instead of inlined into every page's HTML, cutting up to ~237KB of non-cacheable payload per response (#41780)
  • The 85 remaining untranslated French strings filled in (#42577)
  • Correctness fixes across the Spanish catalog, Traditional Chinese count labels reviewed, and Italian translations completed with placeholder validation (#42728, #43063, #43274)
  • The language-pack endpoint made public so embedded dashboards can load translations (#42438)

Dependency Updates

  • Dependabot stayed busy, with 267 dependency-update PRs merged in August keeping frontend and backend packages current for security and stability.

Contributors

August's work came from 108 contributors:

0xdorian-sm, Abdrihman-Hussein, Abdulrehman-PIAIC80387, alexandrusoare, Always-prog, aminghadersohi, AmoghAtreya, anishtilekar, Antonio-RiveroMartnez, anupamme, AryaKetanShCt, ASolarers-Rodriguez, AurimasNav, ayush-sharaf, ayush-singh-0601, Bernedotcom2312, betodealmeida, bikash-barnwal, bmuraykhi, brodmart, bxsx, castodius, chkang83, DamianPendrak, dangdtr, DanielSwift1992, daviddallakyan2005, Dmitry-Kucher, drivaspreset, durgaprasadml, endimonan, EnxDev, eschutho, EvanGruhlkey, fitzee, FrancescoCastaldi, frassinier, gabotorresruiz, gerbermichi, gkneighb, glaterza, goingforstudying-ctrl, greggailly, hainenber, Herestothegamers, htamakos, hughhhh, hy144328, I3eka, itzmzn, jayakarkatika, jenwitteng, jesperct, jethac, juliannfpreset, justinpark, kasiazjc, kgabryje, krishn1301, LALITH0110, liang-wenjie, lucky-y8, luizotavio32, lum4chi, madhushreeag, MallikarjunaReddyN, MannXo, massucattoj, michael-s-molina, mike-lmctl, mikebridge, Milad93R, mistercrunch, msyavuz, no-hup, NoiceHax, nrps9909, nytai, onheap, prathamesh04, rad-pat, rebenitez1802, reveha, rlei-odes, rusackas, russlan23, s1ny1998, sadpandajoe, sancho11, SBIN2010, SEPURI-SAI-KRISHNA, sha174n, shivamgoel, SkinnyPigeon, thedeceptio, varadendrasimha511, verdier, vhogberg, vijay-loopr, villebro, Vitor-Avila, vjymisal0, waterWang, WhoamiI00, Yash2412, yousoph, ytihianine, YuriyKrasilnikov

First-Time Contributors

A warm welcome to August's 50 first-time contributors: 0xdorian-sm, Abdrihman-Hussein, anishtilekar, anupamme, AryaKetanShCt, AurimasNav, ayush-singh-0601, Bernedotcom2312, bikash-barnwal, bmuraykhi, brodmart, bxsx, chkang83, dangdtr, DanielSwift1992, daviddallakyan2005, Dmitry-Kucher, drivaspreset, EvanGruhlkey, glaterza, Herestothegamers, htamakos, I3eka, itzmzn, jayakarkatika, jethac, krishn1301, LALITH0110, liang-wenjie, lucky-y8, MannXo, mike-lmctl, Milad93R, no-hup, NoiceHax, nrps9909, onheap, rlei-odes, russlan23, s1ny1998, sancho11, shivamgoel, thedeceptio, varadendrasimha511, verdier, vjymisal0, waterWang, WhoamiI00, Yash2412, ytihianine

Get Involved

Want to be part of next month's recap? There's a place for everyone:

See you next month.

Subscribe to our blog updates

Receive a weekly digest of new blog posts

Close