Preset logo
Apache Superset Repo Recap: June 2026
SUPERSET DEVELOPERS

Apache Superset Repo Recap: June 2026

Evan Rusackas
Evan Rusackas
6 min read
1,174 words

June was a big month by any measure: 132 contributors merged 767 pull requests. Two threads ran through it. The first is the extensions framework growing up, gaining a sanctioned way for AI chatbots to plug into Superset (SIP-214). The second is security, with a broad hardening push across guest tokens, passwords, encryption, and the WebSocket layer. Underneath both, the MCP tool catalog kept expanding, and the usual stream of charts, i18n, and infrastructure work rolled on.

The community grew alongside the code. Superset gained roughly 376 GitHub stars in June, welcomed 57 new contributors to the repo, and added another 74 members to the community Slack. Sixty-eight people merged their first Superset PR this month — welcome aboard.

Highlights

The Extensions Framework Grows a Chatbot (SIP-214)

June turned the extensions system from plumbing into a platform. The headline is a sanctioned way for AI chatbots (and similar tools) to integrate with Superset without managing their own DOM mounting or layout. SIP-214 introduced a Chat contribution type, adding chat and navigation namespaces to @apache-superset/core (#41205), with the superset.chatbot contribution point (#40439), its frontend entry point (#40440), and a dedicated chat contribution type (#41000) landing across the month.

Around that, the framework got the machinery to actually run and manage extensions: eager-loading at app-shell startup (#40441), an admin configuration UI (#40442), backend settings persistence with admin-only permissions (#40443), import/delete actions with a default-chatbot picker when several are registered (#40450), and context-sharing namespaces so an extension can read navigation, explore, dashboard, and dataset state (#40444). Extensions also gained lifecycle hooks for custom access control and ownership (#40707), plus static supply-chain controls — a denylist and version policy — to keep untrusted packages out (#40668).

A Security-Hardening Push

June brought a wide sweep of security work. Embedded deployments got guest token revocation, including per-dashboard revocation (#40699, #40671, #40676) and audit metadata recorded on token issuance (#41305). Account security tightened with an opt-in force-password-change on first use (#40669), a password complexity policy with a common-password blocklist (#40670), and session termination when an account is disabled (#40695).

At the infrastructure layer, a selectable encryption engine landed with an AES-GCM re-encryption migrator (#40654), SSH tunnels gained opt-in host key verification (#40673), and the WebSocket server started validating the upgrade Origin against an allowlist (#40625). Rounding it out, rejected field-access attempts and successful MCP JWT authentications are now recorded as security events (#41306, #40864).

The MCP Tool Catalog Keeps Expanding

May's MCP build-out kept going. Dashboard automation got the most attention: a tool for dashboard layout, theme, and CSS control alongside a fuller update_dashboard (#40399), plus duplicate_dashboard (#40959), manage_native_filters (#40960), remove_chart_from_dashboard (#40958), get_dashboard_datasets (#40961), and tags plus typed metadata on update_dashboard (#40957).

Elsewhere in the catalog: a create_dataset tool that registers physical tables as datasets (#40340), list_reports and get_report_info (#40348), a dashboards filter on list_charts (#40397), virtual-dataset metric support with better adhoc-SQL discoverability (#40935), a Big Number with Trendline aggregation field (#40775), and typed Pydantic response schemas on generate_explore_link (#39900).

Numbered Rows Come to the Table Chart

The Table v2 (AG Grid) chart gained an "Add numbered column" option under Visual formatting (#39284). When enabled, a fixed, non-sortable row-number column is pinned to the left of the grid and styled to stand apart from the data — a small quality-of-life win for anyone referencing rows by position.

On-Demand Report Triggers

Alerts and reports became easier to operate. A new "Trigger now" action fires a report schedule on demand instead of waiting for its cron, wired end-to-end from a list-view button to a new execute command with ownership checks and duplicate-request safety (#41336). The Alert/Report modal also gained a link-out button next to each content dropdown, so you can jump straight to the selected chart or dashboard in a new tab (#40525).

Charts & Visualizations

  • Cross-filter support on the Country Map chart, with click-to-filter selection and drill behaviors (#35859)
  • Cross-filtering from x-axis labels on bar, line, area, and scatter charts (#41111)
  • A full-range option for time-shift comparison, so intraday "today vs. yesterday" lines aren't truncated at the current hour (#41334)
  • Point radius controls for the Deck.gl GeoJSON layer (#33247)
  • Configurable y-axis range on the Boxplot chart (#24380)

SQL Lab & Databases

  • A native YDB SQLGlot dialect (#40170)
  • Restored public/private sheet selector on the Google Sheets connection form (#40466)

Embedded Analytics

  • A themeMode URL parameter to set an embedded dashboard's initial light/dark theme (#40760)
  • Guest token revocation for embedded dashboards (see Highlights) (#40699)
  • A fetchGuestToken timeout and refresh-timer cleanup in the embedded SDK (#40870)
  • Embedded dashboard E2E tests added to the Playwright CI suite (#39300)

Real-Time & WebSockets

  • Backpressure handling for slow consumers (#40857)
  • Configurable per-channel and total connection limits (#40856)
  • Improved operational logging and crash safety (#40868)
  • Origin allowlist validation on the WebSocket upgrade (see Highlights) (#40625)

Security

  • Guest token revocation, password policies, encryption engine, and SSH host key verification (see Highlights)
  • Static supply-chain controls for extensions — denylist plus version policy (#40668)
  • An optional maximum file size for data uploads (#40860)

Internationalization

  • Romanian translations (#36712)
  • Serbian translations, both Cyrillic and Latin (#41137)
  • Updated Spanish translations (#41265)

Core & Infrastructure

  • Node upgraded to v24 for the build toolchain (#40835)
  • The embedded SDK and WebSocket packages migrated from Jest to Vitest (#38308)
  • pretty-ms replaced with the native Intl.DurationFormat API for localized duration formatting (#39330)
  • Dataset, chart, and dashboard POST responses now return the server-generated uuid (#37806)
  • Deterministic field generation for dashboard exports, for cleaner diffs (#36339)
  • A CI workflow that auto-syncs pinned requirements/*.txt for pip Dependabot PRs (#40557)

Dependency Updates

  • Dependabot stayed busy, with 248 dependency-update PRs merged in June keeping frontend and backend packages current for security and stability.

Contributors

June's work came from 132 contributors:

1Burhanuddin, 4RH1T3CT0R7, abdelghanibelgaid, Abdulrehman-PIAIC80387, abhyuday-tomar, abhyudaytomar, alekseyolg, alex-poor, alexandrusoare, Always-prog, aminghadersohi, AndreMeyerr, arpitjain099, ayush-sharaf, ayushanand13, ayushsharaf, betodealmeida, Bierbarbar, BinhPhamQuang, bobjo-daangn, bogdanmoale, Bungic, cezudas, chaselynisabella, cin, Cloud-Architect-Emma, ColeMurray, crabulous, DamianPendrak, danteGiuliano, debabsah, Debaoss, dinesh-zemoso, dmunozv04, dpgaspar, durgaprasadml, dylancavalcante, EnxDev, eschutho, Facyla, faisal2901, fallintoplace, feehgrossi, felipegr0ssi, fitzee, FullStackChef, gabotorresruiz, geido, GEMajlis, gerbermichi, gkneighb, greggailly, hainenber, haje01, Harshit-Tiwary, hy144328, iercan, imad-hl, innovark37, jakubhruby, jakubhrubyorgis, jaymasiwal, jesperct, joaopamaral, justinpark, kasiazjc, kgabryje, KH-Coder865, Kilobyte9304, Krishnachaitanyakc, ksnikiforov, luizotavio32, madhushreeag, MAGHC, MallikarjunaReddyN, malon64, massucattoj, MelikHajlawi, melikmertd, michael-s-molina, Mine-Echo, mjlshen, msyavuz, nitishagar, nytai, oceantume, omkarhall, onurtashan, ozguryuksel, pengwk, piopy, puneetdixit200, qlimenoque, rabumaabraham, rad-pat, rdubois-kh, reveha, richardfogaca, rijekaDrina, ruhz3, rusackas, sadpandajoe, SBIN2010, semohr, serverdevil, sfirke, sha174n, shashbha14, shivamsahu-tech, Shlummie, sinanshamsudheen, sitelight, SkinnyPigeon, sofeel, sofiankhalfi-kosmos, sr425, stevensuting, thober35, timitos, Ujjwaljain16, VanessaGiannoni, Vansh5632, vgvoleg, vhogberg, vighneshtule, villebro, Vitor-Avila, xyb, yousoph, ysinghc, zhutong6688

First-Time Contributors

A warm welcome to June's 68 first-time contributors: 1Burhanuddin, 4RH1T3CT0R7, abdelghanibelgaid, abhyudaytomar, AndreMeyerr, ayush-sharaf, ayushanand13, BinhPhamQuang, bobjo-daangn, bogdanmoale, Bungic, cezudas, cin, ColeMurray, crabulous, danteGiuliano, debabsah, Debaoss, dinesh-zemoso, durgaprasadml, dylancavalcante, Facyla, faisal2901, fallintoplace, felipegr0ssi, FullStackChef, GEMajlis, gkneighb, haje01, Harshit-Tiwary, hy144328, imad-hl, KH-Coder865, Kilobyte9304, ksnikiforov, MAGHC, MallikarjunaReddyN, malon64, MelikHajlawi, melikmertd, Mine-Echo, mjlshen, oceantume, omkarhall, ozguryuksel, pengwk, piopy, puneetdixit200, qlimenoque, rabumaabraham, reveha, rijekaDrina, ruhz3, serverdevil, shashbha14, shivamsahu-tech, Shlummie, sinanshamsudheen, sitelight, sofiankhalfi-kosmos, sr425, stevensuting, thober35, timitos, Vansh5632, vhogberg, vighneshtule, xyb

Get Involved

Want to be part of next month's recap? There's a place for everyone:

See you next month.

Subscribe to our blog updates

Receive a weekly digest of new blog posts

Close