Preset logo
Apache Superset Repo Recap: September 2026
SUPERSET DEVELOPERS

Apache Superset Repo Recap: September 2026

Evan Rusackas
Evan Rusackas
17 min read
3,395 words

September set a new high for merged pull requests in Apache Superset: 117 contributors merged 840 pull requests. Two threads stood out. Semantic views, already usable in parts of the app, closed their remaining gaps everywhere else — the Create Chart picker, the Charts list, Explore's Samples tab, and the permission model all caught up to treat a semantic view like any other datasource. And Global Async Queries, which last month's recap flagged as still cooking on its own branch, finally merged onto the Global Task Framework, retiring years of bespoke async plumbing in favor of the task system the rest of Superset already uses. Alongside those: fit-aware bar-chart labels, cleaner time axes, a native Candlestick chart, a new headless query API, and a long list of reliability and security fixes across SQL Lab, dashboards, reports, and embedded access.

The community kept growing, too. Superset gained more than 420 GitHub stars in September (now approaching 75,000), and added over 170 new members to the community Slack. Fifty-one people merged their very first Superset PR this month. Welcome, all of you.

Highlights

Semantic Views Become First-Class Everywhere

Semantic layers arrived earlier in the year, but a few entry points still treated semantic views as second-class next to regular datasets. September closed those gaps so a semantic view behaves like any dataset, wherever you work.

The Create Chart page now lists semantic views in the datasource picker when the SEMANTIC_LAYERS flag is on, so a user who connected a semantic layer can start a new chart from one the same way they already could from Explore and native filters (#43629). The Charts list was fixed to resolve a semantic-view chart's datasource name and link, instead of showing a blank Datasource column (#43649). Explore's Samples tab and Drill to Detail are now hidden for semantic views, which can't run adhoc-metric queries, instead of surfacing a raw 500 error (#42534). On the security side, write-only configuration fields (passwords, API keys) are now masked in semantic-layer API responses, with three previously-ungated endpoints brought behind the feature flag (#43474), and role-based permissions on semantic layers and views were tightened to match the same read/write tiers used everywhere else in Superset (#43783).

Global Async Queries Migrates onto the Global Task Framework

Before this month, Superset ran three separate async paths: Global Async Queries (GAQ) for dashboard and chart data, SQL Lab's own async execution, and the newer Global Task Framework (GTF) built for other background work. This PR — an epic that had been building on its own branch since before August's recap — migrates GAQ onto GTF and deletes GAQ's bespoke plumbing: AsyncQueryManager, the /api/v1/async_event/ endpoint, and the qc-<hash> cache-descriptor replay are all gone (#43407).

The design collapses async coordination onto the unit Superset already caches and executes around: each QueryObject. A POST /api/v1/chart/data call with async_mode now probes the per-query cache and returns immediately if everything's warm, or schedules one shared, deduplicated GTF task per missing query and returns a 202 with task ids to await. The client watches for completion over a shared websocket transport, with polling as a fallback, then re-issues the same request to read the now-warmed cache. Supporting work included a CoordinationService unifying locks, KV, pub/sub, and streams over Redis, worker heartbeats and orphaned-task reaping, and realtime updates to the Task List view as tasks complete.

Smarter, Fit-Aware Bar Chart Value Labels

Bar charts rendered their "Show Value" labels at a fixed inside position with no overflow handling, so narrow stacked segments and thin bars got truncated or overlapping text. This work adds a fit-aware Auto mode: for each bar or segment, the label stays inside when it fits, flips outside when it doesn't, and is omitted entirely on segments too thin to hold legible text (#43144). A new Bar-specific Value label position control (Auto, Inside End, Outside End, Inside Center, Inside Base) exposes the options. Existing saved charts are unaffected: a legacy or undefined position resolves to Outside End, so Auto is opt-in rather than a silent default change.

Cleaner Time Axes on Time-Series Charts

Two fixes made dense and weekly-grain time axes behave. Weekly-grain x-axis labels on ECharts line, bar, area, and scatter charts now land on the actual weekly data buckets instead of drifting to arbitrary weekdays and snapping to month starts, by pinning the axis to the real bucket timestamps (#43339). And on dense time series (for example, minute-grain data over a wide range), the axis formatter now blanks labels that would visually collide while always keeping the first and last date visible, so ticks no longer render stacked on top of each other (#43669).

A New Candlestick Chart

Superset picked up a native Candlestick chart (viz_type: candlestick) for OHLC financial and range-style time series — a long-requested visualization (issues #20254 and #37653). It takes an x-axis column, an optional Series dimension to split multiple tickers, and Open/Close/High/Low metrics, rendering either a classic candlestick body or an OHLC-tick style, with moving-average overlays, direction or per-series coloring, and drill-to-detail via right-click (#43863).

A Headless Query API for Datasets and Semantic Views

Superset previously had no query API built for external consumers; the only option was POST /api/v1/chart/data, which forces callers to reverse-engineer an Explore query_context. This month added a headless, name-based REST endpoint: POST /api/v1/datasource/<type>/<id>/query accepts metrics, dimensions, filters, time range, grain, limit, offset, and order, with a companion GET endpoint for metadata and capabilities (#43527, docs). It works against both datasets and semantic views, reuses the existing caching, RLS, and post-processing pipeline, and adds an Arrow IPC result format for the new path. The two MCP tools (get_table, query_dataset) were refactored onto the same shared query helper.

See What Breaks Before You Purge a Dataset

Permanently deleting an archived dataset used to show a bare "type DELETE to confirm" modal with no mention of what it would orphan, even though the purge deliberately leaves dependent charts and dashboards in place. Purging a dataset now shows the same dependency warning that archiving already gives, listing the charts and dashboards that will be affected (with counts for objects the user can't see), before the confirmation is enabled (#43724). A backend impact endpoint fingerprints the exact affected set and rechecks it at submit time, so the warning can't silently go stale between preview and delete.

Inline Your Dashboard CSS @imports

Dashboard custom CSS containing @import has been rejected on save since the rule that blocks a dashboard from loading arbitrary remote stylesheets, but there was no in-product way to fix CSS that already used it, short of manually copying the imported stylesheet's contents into the editor. The CSS editor now detects @import and offers a Convert @import to inline CSS action that fetches each target from the browser and inlines its rules, preserving layer, media, and supports conditions (#43667). The most common real-world case is web fonts (Google Fonts and the like). The action only populates the editor; you still review the result and click Save yourself.

In the Works

Two large efforts kept progressing on feature branches rather than master in September. Dashboard v2, a new dashboard editing UI built on a gridstack layout, kept growing on its own branch. And now that Global Async Queries has moved onto the Global Task Framework, SQL Lab's own async execution is being migrated the same way, also still on its own branch. Neither was on master when September closed; both will get their due in a future recap once they land.

Charts & Visualizations

  • Pivot table CSV/XLSX exports and scheduled reports now apply the "Show values as" percent-of-row/column/total transform, matching what the chart shows on screen (#43718)
  • Conditional formatting gained manual min/max color-range bounds, diverging low/mid/high color scales, and percent-of-column bounds, so scales can stay stable as filters or data change (#43820)
  • Drag-and-drop a whole folder of columns and metrics from the Explore datasource panel directly onto group-by, dimension, or metric controls (#42483)
  • An opt-in migrate_viz path converts Table V1 charts to Table V2 (AG Grid), now that V2 has closed its remaining gaps — drill to detail, percent-metric mode, AUTO currency, and row-level conditional formatting (#42088)
  • A zebra-striping toggle for Table V2 (AG Grid) charts, on by default for charts migrated from the always-striped Table V1 (#44112)
  • Double-click a chart legend to isolate that series; double-click again to restore the rest (#44562)
  • Charts-list sorting by "Type" now follows the displayed visualization names rather than their internal slugs, correctly across paginated pages (#43634)
  • Creating or updating a chart with a non-table datasource type returns a clean 422 validation error instead of crashing with a 500 (#43500)
  • The Table chart's Time Grain control stays hidden in Raw Records mode instead of reappearing after a save or reload (#43802)
  • Dedicated "Certified by" and "Certification details" fields in Edit Dataset → Settings, so dataset certification metadata no longer requires hand-editing the raw Extra JSON (#43633)
  • A "Fill the entire time range" option for Resample controls, padding a series with zero/filled buckets across the whole queried window instead of only between its first and last data points (#42609)
  • Conditional formatting extended to the legacy CountryMap chart, coloring regions by threshold rules on the metric (#42941)

Dashboards & Filters

  • Setting or unsetting the system default/dark theme from the Themes admin page now applies live, without a full page refresh (#43778)
  • Batched dataset lookups during dashboard export so each referenced dataset is fetched and exported once instead of once per filter or chart target (benchmarked 2.4x–9.4x faster) (#43017)
  • "Export Data to Excel" now works even with no export storage configured — the server builds the workbook during the request and returns it directly, bounded by a new row budget (#44082)
  • Nested dashboard tab bars now stick below the sticky header while scrolling, with each deeper level stacking beneath the one above it (#43940)
  • Fixed duplicate cross-filter chips appearing in the dashboard FilterBar's "More filters" popover (#43949)
  • A dashboard with a corrupted stored layout (dangling children, cycles, malformed nodes) no longer 500s on save, and can now be repaired by submitting a corrected layout (#43575)
  • Dashboards can now be pinned to the built-in default/dark system themes, not just custom ones, regardless of a viewer's own OS/browser preference (#44361)
  • The native "Value" filter's "Select all (N)" badge now stays pinned to the full column count instead of flickering to a search-scoped number while typing (#43460)
  • Dashboard image export no longer lets a horizontally scrolling table chart paint its off-screen columns over neighboring charts (#44414)
  • A configurable display format for the native Time range filter, letting dashboard authors choose how the evaluated range shows in the filter pill and tooltip (#44237)
  • Native filters' cascade (parent/child) dependencies are now driven by chart metadata instead of a hardcoded list, so third-party filter plugins can opt in without a core change (#43223)

SQL Lab & Databases

  • Saving a SQL Lab query as a dataset now reports the actual reason a save failed (bad SQL, missing table/column, dropped permissions) instead of a bare "Fatal error" toast (#43334)
  • Snowflake OAuth2 connections now force a token refresh and retry once when Snowflake rejects a still-valid-looking access token, instead of forcing an unnecessary interactive re-authorization (#43623)
  • Snowflake columns whose physical name is an explicitly quoted, case-sensitive lowercase identifier (e.g. "id", "name") now generate correctly quoted SQL instead of "column not found" errors (#43312)
  • Fixed a crash in SQL Lab's Run-button dropdown (the CTAS/CVAS split button) after an antd upgrade removed the prop it relied on (#43849)
  • Large CSV exports now stream immediately instead of first executing and materializing the full result set, so proxies no longer drop the connection while waiting (#44624)
  • Database create/update API responses now mask secrets (OAuth2 client secrets, service-account keys) the same way the read endpoint already did (#44733)
  • MySQL's SSL/TLS toggle (and saved ssl=1 connections) now fails closed instead of silently falling back to an unencrypted connection (#44723)
  • Oracle gained real query cancellation in SQL Lab; stopping a query now actually cancels it on the database instead of reporting failure while it keeps running (#44704)
  • A proper Databend SQL dialect, fixing a long list of silent mis-renderings (SETTINGS clauses, digit separators, JSON paths, date arithmetic) that previously fell back to generic SQL (#43964)
  • Restored SQL code folding in the SQL Lab editor, lost when the legacy Ace SQL mode was swapped in without folding rules (#44236)

MCP & AI

Fixes and new tools for the MCP server this month:

  • Four more chart types gained native MCP support: Gauge, Treemap, Bubble, and a typed Gantt chart, so AI clients can create each directly through generate_chart (#43568, #43569, #43572, #43737)
  • get_dashboard_data, a new tool returning a compact, filter-aware summary across every chart on a dashboard in one call (#44113)
  • update_dataset, delete_dataset, and restore_dataset tools, so agents can edit a virtual dataset's SQL and metadata, trash it, or restore it, with editorship enforced (#44337)
  • create_dataset_metric and delete_dataset_metric tools for managing a dataset's saved metrics (#44580)
  • list_datasets now searches description and schema text too, and an optional per-role dataset allowlist can scope which datasets MCP tools can see at all (#44146)
  • get_catalog, a read-only, permission-filtered inventory tool for browsing the databases, datasets, charts, and dashboards a calling user can see, without pulling the heavier list-tool payloads (#44694)
  • An apply_dashboard_filters tool lets a chat client apply native filter values to an existing dashboard via a per-user permalink, without touching the saved dashboard (#44096)
  • Dropped the tiktoken dependency, whose vocabulary download could crash cold starts on locked-down hosts, and switched the response-size guard to exact byte length (#44508)
  • get_chart_info can now read back an Explore permalink directly, so links from generate_explore_link or Explore's Share button work without expiring the way a form-data key does (#44338)

Reports & Alerts

  • Dashboard PDF/PNG and chart screenshot exports now expand clipped, scrollable content (dense AG Grid tables and the like) instead of cutting it off (#43979)
  • Alert retries — previously reports-only — are now available behind the same retry flag, with an atomic execution claim so duplicate or superseded attempts can't also deliver (#44336)
  • Embedded report content now reports its own height independent of the iframe's height, so hosts that size the iframe from it stop growing it on every poll (#44313)
  • Dashboard screenshots are now marked "Updated" only once a screenshot was actually captured in a stable, fully rendered state, instead of caching an incomplete capture (#44144)
  • Slack report and alert recipients must now be a real channel id; a channel name returns a clear error instead of silently never delivering (#42850)
  • Cleaned up stale Selenium references in screenshot-related messages and docs, now that Playwright is the only screenshot backend (#44244)

Core & Infrastructure

  • TypeScript 7 upgrades landed across the frontend, the embedded SDK, and the websocket service, each migrating its lint toolchain to the TS7-compatible oxlint/tsgolint (#43702, #43703)
  • The JavaScript build/tooling files in superset-frontend were migrated to ES modules; build output is unaffected (#43686)
  • Two optional config hooks, EXTRA_ASSET_EXPORT_FIELDS and EXTRA_ASSET_IMPORT_HANDLER, let deployments carry their own metadata through chart and dashboard export/import without forking the export commands (#43763)
  • Opt-in gunicorn StatsD metrics in the Docker entrypoint, alongside Superset's existing StatsD logger (#32487)
  • A testcontainers-based CI suite now runs real-database round-trip tests across a dozen-plus db_engine_specs dialects on a nightly cron and on path-scoped PRs (#43502)
  • The current-Python unit-test job now runs in parallel via pytest-xdist, cutting it from roughly 27 minutes to 14 and fixing the timeout it kept hitting (#44178)
  • A functional index on ab_user(lower(username)) so case-insensitive login uses an index probe instead of a sequential scan on nearly every request (#43939)
  • The default apache/superset Docker image is now batteries-included (Postgres/MySQL drivers, MCP dependencies, headless Chromium); the old minimal image moved to -lean tags (#44100)

Security

A sweep of roughly 30 CI hardening fixes also landed across nearly every workflow and test-matrix job this month — self-repository action-reference syntax and suppressing false positives from the project's own Zizmor security scanner — which won't get individual bullets here but are worth knowing about if you maintain a fork's CI.

  • Database schema/catalog listing endpoints no longer 500 for users with only schema- or catalog-level access when a warm cache returns names as a list instead of a set (#43800)
  • Guest users loading an embedded chart with corrupted internal chart state now get a clean, denied response instead of a raw server error (#43795)
  • Fixed a regression where guest-user error sanitization could turn legitimate error responses (like a 504 gateway timeout) into bare 500s when the request principal couldn't be resolved (#43834)
  • Closed several gaps in Row-Level-Security enforcement for guest sessions, so RLS scoping now applies consistently
  • Tightened guest-token request validation for embedded charts
  • Theme editing and deletion is now scoped to a theme's designated editors or admins, instead of anyone holding the broader Theme write permission — a breaking change for Alpha-style roles, documented in UPDATING.md (#42404)
  • Deprecated permissions left over from old upgrades are now cleaned up by migration, instead of accumulating indefinitely on long-lived installs (#44142)
  • Container image vulnerability scanning was restored in CI using Grype, after the previous scanner was removed following a supply-chain compromise (#44035)
  • Resolved five Dependabot security alerts in the frontend and Cypress lockfiles (fflate, image-size, js-yaml, smol-toml) (#44740)

Internationalization

  • A large batch of Slovenian (sl) translation additions and corrections, filling in previously missing strings (#43735)
  • Improved Simplified Chinese translations across chart configuration, archive/recovery, SQL Lab, and validation error messages (#43813)
  • Fixed a crash on every SQL Lab query under the Slovak locale, caused by a translated progress message that referenced placeholder names the code never passes (#44587)
  • Cleared 1,188 fuzzy translations across 18 language catalogs whose placeholders didn't match the English source, so the UI now falls back to English instead of crashing or showing a literal %s (#44611)
  • Two module-level error messages were resolved once at import time and served in the default locale to every user forever; switched to lazy evaluation so they translate correctly per-request (#44180)
  • Added a CI guard that catches the translation template drifting from source after discovering it had fallen 432 strings behind, leaving that many strings untranslatable in every language (#44467)
  • Regenerated the translation template after a prior PR added new translatable strings without updating it (#44509)
  • Fixed two messages that were silently untranslatable because they built their text with an f-string rather than gettext's parameterized form (#44584)
  • Non-English translation catalogs are now documented as versioned, cacheable scripts rather than inlined into every page's HTML (#43904)
  • Dropped the legacy po2json dependency entirely, rebuilding the .po → Jed JSON pipeline on gettext-parser instead (#44742)

Documentation

  • Added Veremes to the "Superset users in the wild" list (#43754)
  • Added Savantly to the "Superset users in the wild" list (#44108)
  • Replaced dead "Release Notes" anchor links (homepage nav, README, and three versioned docs pages) with links to the GitHub releases page (#43780, #43803)
  • Documented the resultsGrid* SQL Lab results-grid tokens and a new "Component Sizing & Style Tokens" section covering button, label, select, and dashboard-tile tokens, plus the HIDE_NAVBAR_LOGO flag, in the theming docs (#43638, #43639)
  • Documented AG Grid's "Show Summary" behavior for Raw Records mode in the dashboard-creation guide (#43905)

Dependency Updates

  • Dependabot stayed busy, with 259 dependency-update PRs merged in September keeping frontend, backend, docs, and websocket packages current.

Contributors

September's work came from 117 contributors:

7487, aadhyap, Abdulrehman-PIAIC80387, abhinav-phi, AdalbertMemSQL, Adarsh-Me, aipiJuancho, akashchamp, Aleem89, alexandrusoare, aminghadersohi, AmoghAtreya, anamitraadhikari, AryaKetanShCt, ashah65, BALAJI-CODE-collab, bazhil, bertolikimberly, bikash-barnwal, bikashJMV, bouhalimedaziz, ayush-singh-0601, chadek, chollinger93, ColtenOuO, danielalyoshin, daviddallakyan2005, deepujain, dennisimoo, denys1204, devansh173, DeVaNsHk72, developer-rpai, Donnype, dpgaspar, durgaprasadml, endimonan, EnxDev, eschutho, fitzee, flcrom, fparodimoraes, FrancescoCastaldi, gabotorresruiz, geido, gkneighb, glaterza, gps23, greggailly, hainenber, hughhhh, I3eka, iercan, jenwitteng, joey, juliannfpreset, kanobi, khaa-dv, KHARSHAVARDHAN-eng, kokhlo, Kunal8954, lf-novelt, liang-wenjie, luoianun, Mafi, Mayank Aggarwal, michael-s-molina, mikebridge, mkramer5454, MsfPablo, msyavuz, n4uu, nacretion, no-hup, NoiceHax, nytai, onionhammer, plaes, rad-pat, raphaelsales, rebenitez1802, rlei, rlei-odes, rusackas, rutgermeuzelaar, s1ny1998, sadpandajoe, sakshipatil-hue, sanyamk23, saurabhdamle11, SBIN2010, SEPURI-SAI-KRISHNA, seunggabi, sfirke, sha174n, Shaitan, shaurya, Shaurya, shivamgoel, shoemoney, sonfire186, tien238lnd, tushardhawas, Ujjwaljain16, vardh-man, verdier, vhogberg, Vicinius, viet-nv, viharnani, villebro, Vitor-Avila, wangfenjin, WhoamiI00, wuhyn, yousoph, YuriyKrasilnikov

First-Time Contributors

A warm welcome to September's 51 first-time contributors: 7487, aadhyap, abhinav-phi, Adarsh-Me, aipiJuancho, akashchamp, Aleem89, BALAJI-CODE-collab, bazhil, bouhalimedaziz, chadek, chollinger93, ColtenOuO, danielalyoshin, deepujain, dennisimoo, denys1204, devansh173, DeVaNsHk72, developer-rpai, Donnype, flcrom, fparodimoraes, gps23, kanobi, khaa-dv, KHARSHAVARDHAN-eng, kokhlo, Kunal8954, lf-novelt, luoianun, MsfPablo, n4uu, nacretion, onionhammer, plaes, raphaelsales, rutgermeuzelaar, sakshipatil-hue, sanyamk23, saurabhdamle11, seunggabi, shoemoney, sonfire186, tien238lnd, tushardhawas, Vicinius, viet-nv, viharnani, wangfenjin, wuhyn

Get Involved

Want to be part of next month's recap? There's a place for everyone:

Running Superset at your company? Add your GitHub handle and organization to the Superset users in the wild list.

See you next month.

Subscribe to our blog updates

Receive a weekly digest of new blog posts

Close