Preset logo
Apache Superset Repo Recap: July 2026
SUPERSET DEVELOPERS

Apache Superset Repo Recap: July 2026

Evan Rusackas
Evan Rusackas
9 min read
1,764 words

July was the busiest month of the year so far for the Apache Superset™ community: 132 contributors merged 664 pull requests. The through-line was foundations. A unified Subject model reworked how access control is expressed across the project, soft deletes finally landed for charts, dashboards, and datasets, and theming grew a set of backend knobs that let deployers restyle Superset without forking it. Around those, Excel exports showed up in nearly every corner of the app, the MCP service kept expanding, and a large translation effort backfilled dozens of locales.

The community grew alongside the code. Superset gained nearly 500 GitHub stars in July (now past 74,000), welcomed 47 new contributors to the repo, and added another 78 members to the community Slack. Fifty-seven people merged their very first Superset PR this month — welcome, all of you.

Highlights

A Unified Subject Access Model

The month's largest structural change is a new Subject abstraction from villebro that can represent a User, Role, or Group as a single entity (#38831). The motivation is that DASHBOARD_RBAC had tied dashboard visibility to Roles as a stopgap before Groups existed, which conflated capability grants with resource assignment. The new model separates the two: subject-based Editors replace owners for edit permissions on dashboards, charts, datasets, and alerts/reports, and an opt-in ENABLE_VIEWERS flag adds subject-based Viewers for dashboard and chart visibility, replacing DASHBOARD_RBAC. RLS rules move from Roles to Subjects, and a migration seeds the new junction tables from the legacy owner/role tables. This is a breaking change, so it ships with a documented upgrade path.

A follow-up added a read-only Subject REST API at GET /api/v1/security/subject/ and a SubjectDAO (#41897), so callers (and extension authors) can resolve the subject entity for a given user, role, or group id, with the same DAO wired into the extensions framework.

Excel Exports, Everywhere

July was the month Superset got serious about Excel. From a dashboard, a new async Export Data to Excel action (#41133, from hughhhh) runs each chart's query under the requesting user, merges in the dashboard's live filters, streams the results into a multi-sheet workbook, uploads it to S3, and emails the user a pre-signed link. Non-table charts can be rendered as images into the same workbook. The feature is off by default until an S3 bucket, a Celery worker, and SMTP are configured.

Alerts & Reports gained XLSX too: a "Send as Excel" option for chart-based reports delivers a formatted spreadsheet by email, Slack, or webhook, reusing the same formula-injection-safe export path as a chart's normal Excel download (#41424, from first-time contributor gr33nak; email delivery also came in through #40885).

Charts got higher-fidelity exports as well: PNG (with a transparent or solid background) and PDF export are now available from both the Explore chart menu and the dashboard slice header, alongside the existing JPEG option (#38535).

Theming You Can Configure from the Backend

A cluster of theming work made Superset's look far more configurable from superset_config.py, with defaults preserved so existing deployments see zero visual change unless they opt in. Core components now read optional theme tokens for button sizing and radius, label radius, select focus outline, dashboard tile borders, and navbar logo visibility (#40985), and a matching set of tokens covers AG Grid results tables like SQL Lab (#41031), both from anamitraadhikari.

A separate THEME_DEFAULT_MODE setting lets admins pick which mode a new session starts in — light, dark, or matching the OS — instead of always following the operating system (#41007, from madhushreeag).

Soft Deletes Land for Charts, Dashboards, and Datasets

May introduced the soft-delete substrate (SIP-208); July wired it into real resources. Charts, dashboards, and datasets now support soft delete and restore (#40128, #40129, #40130, all from mikebridge): a DELETE stamps a deleted_at timestamp and hides the object instead of removing it, and a new restore endpoint brings it back. The whole feature ships dark behind a SOFT_DELETE flag that gates both the read and write paths (#41166), so default behavior is unchanged until a deployment turns it on. The MCP server picked up matching restore_chart/restore_dashboard tools and a "trash" listing so agents can work with the same undo safety net.

Half-Donuts for the Pie Chart

The Pie chart previously only rendered full circles. After an extended review cycle, SBIN2010 added Start angle and Swept angle controls that let you render partial arcs, including half-donuts, with the total-value label and legend re-centered to match the arc (#35459).

Charts & Visualizations

  • Header tooltips for the AG Grid table chart, wiring column and metric descriptions from the datasource into the grid for parity with the legacy table plugin (#39287)
  • The AG Grid table's "Show summary" option now works in Raw Records mode, as a per-column SUM over the full filtered dataset (#41754)
  • The "Force categorical" x-axis toggle now appears for temporal columns, not only numeric ones, so tick marks line up with time-grain buckets (#41221)
  • Fixed deck.gl Multiple Layers charts drawing scatterplot points in a single fallback color instead of the configured categorical palette (#41490)
  • Fixed trendline stroke clipping at the edges of the Big Number with Trendline chart (#37918)
  • The deck.gl GeoJson Polygon chart's default tooltip now shows the configured metric value without a custom template (#41341)

Dashboards & Filters

  • A new NativeFilterOptionsStrategy cache warm-up pre-populates native filter dropdown option queries, so the first user to open a filter after cache expiry no longer triggers a fresh database query (#41531)
  • Vertical alignment guides and a floating height indicator when resizing a dashboard chart, mirroring the column guides already shown during horizontal resizing (#41079)
  • Fixed a crash where saving a chart customization or native filter wiped the other type from the shared filter map (#42032)
  • Chart tiles render a themed border at rest again, fixing a regression that left tiles with no visible boundary (#41731)

SQL Lab & Databases

  • OAuth 2.0 authentication for Databricks connections across AWS, Azure, and GCP workspaces, so users can authenticate with personal accounts instead of shared tokens (#41421)
  • A validation spinner and real-time duplicate-name checking in the database connection modal, instead of discovering a taken name only after clicking Connect (#36880)
  • A new engine spec for Apache DataFusion over the Arrow Flight SQL protocol, selectable in the connection UI (#42374)
  • IS NULL / IS NOT NULL support for the Kusto KQL engine spec (#37890)
  • Fixed the "Filter results" search box in SQL Lab so typing filters the results table again (#41625)
  • SQL Lab's table selector now warns when the list is truncated so you know to refine your search (#41617)

MCP & AI

Superset's MCP (Model Context Protocol) service kept widening what AI assistants can do with Superset:

  • Semantic layer tools (list_metrics, get_table, get_compatible_dimensions, get_compatible_metrics) that let clients discover metrics and dimensions and run tabular queries against both built-in datasets and external semantic views (#41611)
  • Theme tools (list_themes, get_theme_info, create_theme) so an agent can discover, inspect, and create reusable design-token themes that dashboards reference by id (#41497)
  • delete_chart/delete_dashboard, restore_chart/restore_dashboard, and a deleted_state trash listing to pair with the new soft-delete support (#41472, #41842, #41855)
  • New chart-type plugins for histogram, box plot, and waterfall charts, plus an extensible plugin registry for generate_chart (#41860, #42070, #39922)
  • Embedded guest-token authentication, scoped so guest data reads stay within the token's own dashboards (#41003, #41753)
  • A /health HTTP endpoint and dashboard owner, role, and certification management tools (#41755, #41606)
  • Fixed a time-grain bug where a temporal column stored as VARCHAR (such as Hive/Presto partition columns) was silently treated as non-temporal (#42288)

Security

  • Resolved outstanding vulnerability alerts across superset-frontend, superset-embedded-sdk, and docs by bumping vulnerable transitive dependencies (#41776)
  • Closed a user-enumeration hole in the MCP find_users tool by escaping SQL LIKE wildcards, so a query of % no longer returns every user (#41593)
  • Enforced write permission on nested objects created by the legacy (v0) import paths, closing a permission bypass (#42205)
  • The chart data API now returns HTTP 403 instead of 500 when a SupersetSecurityException is raised during request validation (#41865)
  • An RLS filter indicator badge on the dataset list, Explore datasource control, and combined Datasources list, including filters silently inherited by a virtual dataset from its physical tables (#38807)

Internationalization

July ran a large AI-assisted translation effort, with dozens of locales backfilled using the repo's own tooling. Every machine-generated entry is marked fuzzy so it can't reach end users without human review, and native-speaker corrections were folded in where contributors provided them.

  • A do-not-translate registry and a #. do-not-translate marker standard so literal tokens (icon names, SQL keywords, enum values, API field names) are never machine-translated (#41651)
  • A fully backfilled Japanese catalog, with native-speaker corrections merged before release (#41466)
  • Arabic, Catalan, Persian, Finnish, Thai, and Turkish exposed in the LANGUAGES config so operators can now select them (#41827)
  • 209 community French translation improvements adopted from an otherwise un-mergeable PR (#41752)

Core & Infrastructure

  • Ant Design upgraded from v5 to v6 as a visually-unchanged parity upgrade (#41636)
  • Base infrastructure for entity version history across charts, dashboards, and datasets via SQLAlchemy-Continuum, shipped gated off so it deploys inert until enabled (#41176)
  • A first-class Storage API for extensions, giving extension code a namespaced way to persist data across browser, cache, and database tiers instead of ad-hoc localStorage hacks (#39171)

Dependency Updates

  • Dependabot stayed busy, with 197 dependency-update PRs merged in July keeping frontend and backend packages current for security and stability.

Contributors

July's work came from 132 contributors:

42dot-jaehoon-kim, abderbejaoui, Abdulrehman-PIAIC80387, Abhiiishek44, adolfotcar, ag-ramachandran, aikawa-ohno, akshatsinha0, albundy83, alephys26, alex-poor, alexandrusoare, amaannawab923, aminghadersohi, anamitraadhikari, Antonio-RiveroMartnez, asdf2014, ASolarers-Rodriguez, atrsa, Austin-X, betodealmeida, brianmmaina, carlosribeiro-plaid, coderfender, DamianPendrak, Darth-ATA, devops-sewhan-kim, dhimasardinata, dmunozv04, dpgaspar, drummerwolli, drzackyll, durgaprasadml, Elengar, EnxDev, eschutho, EUbaldiEC, Eyang0612, FilippoNardin, fitzee, fnardin-maystreet, gabotorresruiz, gabrielwong159, GagandeepSingh20, gfody, gkneighb, goingforstudying-ctrl, goldjee, gr33nak, hainenber, hantmac, HaroldWrenFinch, hoon-e, hughhhh, hy144328, igor-tech, imad-hl, Imamatdin, innovark37, isaac-jaynes-imperva, J0s3-H3nr1qu3, Jacobdavis12, jaymasiwal, jeanpommier, jenwitteng, jesperct, justinpark, Keonik1, kevin-lann, kgabryje, Khrol, kimsehwan96, kleostouraiti, kominma3, KrupaVadher, lguichard78, LohitG, luca-vercelli, lucargir, luizotavio32, madhushreeag, marunrun, massucattoj, matebenyovszky, mathiasi, Mattc1221, michael-s-molina, mikebridge, mistercrunch, mkramer5454, mlablouba, MouhibKhammassi, moussaoutlook, msyavuz, mysticalayushi, nicob3y, nitishagar, Open2Loop, Pawansingh3889, philipljh, prathamesh04, pSpitzner, ramiroaquinoromero, rdg0, rebenitez1802, RehanIslam09, reveha, richardfogaca, rish106-hub, rsbhatti, rsprudencio, rusackas, sadpandajoe, SBIN2010, schoel-bis, SEPURI-SAI-KRISHNA, serdukow, sha174n, shelkesays, singlaamitesh, SkinnyPigeon, suvankardas216, Ujjwaljain16, vhogberg, ViktorGo86, villebro, worker24h, worldlyjohn, YinkaMetrics, younsl, yousoph, YuriyKrasilnikov

First-Time Contributors

A warm welcome to July's 57 first-time contributors: abderbejaoui, Abhiiishek44, adolfotcar, albundy83, alephys26, atrsa, brianmmaina, carlosribeiro-plaid, Darth-ATA, dhimasardinata, drzackyll, Elengar, EUbaldiEC, fnardin-maystreet, gabrielwong159, GagandeepSingh20, gfody, goingforstudying-ctrl, gr33nak, HaroldWrenFinch, hoon-e, igor-tech, Imamatdin, J0s3-H3nr1qu3, Jacobdavis12, jeanpommier, jenwitteng, Keonik1, kevin-lann, KrupaVadher, lguichard78, LohitG, luca-vercelli, lucargir, mathiasi, MouhibKhammassi, moussaoutlook, mysticalayushi, Open2Loop, Pawansingh3889, philipljh, prathamesh04, pSpitzner, rdg0, RehanIslam09, rish106-hub, rsprudencio, SEPURI-SAI-KRISHNA, serdukow, shelkesays, singlaamitesh, suvankardas216, ViktorGo86, worker24h, worldlyjohn, YinkaMetrics, younsl

Get Involved

Want to be part of next month's recap? There's a place for everyone:

See you next month.

Subscribe to our blog updates

Receive a weekly digest of new blog posts

Close