apache/superset
Apache Superset is a Data Visualization and Data Exploration Platform
How superset is put together
Apache Superset is a modern, enterprise-ready business intelligence web application that lets users explore, visualize, and manage data across many SQL databases. The backend is a Python Flask application built on Flask-AppBuilder with SQLAlchemy, Celery for async tasks, and Redis/database-backed metadata; the frontend is a large TypeScript/React monorepo (managed with Lerna and webpack). A separate Node.js WebSocket service (superset-websocket) handles real-time/async query messaging, and an embedded SDK plus extensions CLI support embedding and pluggable engines. Data flows from user-configured data sources through SQLAlchemy db_engine_specs and SQL Lab into pandas result sets that feed React visualization plugins.
Languages
Frameworks
Datastores
Infrastructure
Major components
superset (Python backend)
Core Flask application providing the BI web app, REST APIs, SQL Lab, and metadata models.
superset/db_engine_specs
Pluggable SQLAlchemy dialect adapters that integrate the dozens of supported analytical databases.
superset-frontend
TypeScript/React monorepo (packages + plugins) rendering the UI, dashboards, and visualization charts.
superset-websocket
Standalone Node.js service delivering real-time/async query status over WebSockets.
superset-core
Python core package providing shared types and APIs for building Superset backend extensions and integrations.
superset-embedded-sdk
TypeScript SDK for embedding Superset dashboards/charts into external applications via iframe and JWT.
superset-extensions-cli
Python CLI for scaffolding and managing Superset extensions.
docker / RELEASING
Container images, bootstrap scripts, and release tooling for building and publishing Superset.
A quieter week of dependency upkeep paired with a new Snowflake sign-in option and a batch of usability and data-handling fixes.
4 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A quieter week of dependency upkeep paired with a new Snowflake sign-in option and a batch of usability and data-handling fixes.
Week of 2026-08-17
A major security-hardening week that closed injection, SSRF, and access-control gaps while also adding cross-filtering and new statistical functions.
Week of 2026-08-10
The busiest week focused heavily on the MCP integration, OAuth token handling, and reliability fixes across SQL Lab and dashboards.
Week of 2026-08-03
A lighter week mixing accessibility and security features with translation updates and dependency upgrades.
Over the past four weeks, Superset shipped a steady stream of bug fixes, dependency upkeep, and targeted new features, with a notable mid-month security push in the week of Aug 17 that hardened SQL injection, SSRF, import validation, and access-checking across many surfaces. Alongside routine dependency bumps, the team added meaningful capabilities such as Snowflake OAuth 2.0 sign-in, cross-filtering on time-based charts, new statistical aggregate functions, and richer embedding and theming controls. Overall the arc shows a mature project balancing reliability and safety improvements with incremental user-facing enhancements.
Week by week
2026-08-24A quieter week of dependency upkeep paired with a new Snowflake sign-in option and a batch of usability and data-handling fixes.latest6 changes
Feature
Snowflake OAuth 2.0 sign-in
Users can now connect to Snowflake databases using modern OAuth 2.0 authentication instead of only passwords.
Fix
Chart owners can save charts without full data access
People who own a SQL Lab query can now create charts from it even if they lack blanket access to every data source.
Fix
Clearer chart and dataset deletion dialogs
Deleting a chart now correctly shows the archive dialog and names where the item can be recovered from.
Fix
More reliable filtering and dates
Fixed filter behavior for Google Sheets date columns, custom time-shift errors, and column-label matching in Explore.
Fix
Restored and hardened automated CI checks
Brought back scheduled continuous-integration checks and tightened authentication and request validation on the MCP integration.
Chore
Routine dependency updates
Bumped many frontend and backend libraries such as antd, dayjs, SQLAlchemy, and pyarrow to current versions.
2026-08-17A major security-hardening week that closed injection, SSRF, and access-control gaps while also adding cross-filtering and new statistical functions.6 changes
Fix
Broad security hardening pass
Tightened protections against SQL injection, SSRF, spreadsheet-formula injection, and untrusted content in chart tooltips and popups.
Fix
Stronger access and import validation
Re-checked user access against rendered SQL and tightened ownership and validation checks when importing assets.
Feature
Cross-filtering on time-based charts
Clicking a bar or label on a temporal axis can now filter the rest of the dashboard.
Feature
New statistical aggregate functions
Added median, sample standard deviation, and sample variance as built-in aggregation options.
Fix
SQL Lab and Explore usability fixes
Prevented saving datasets before a query succeeds, fixed permalink copying, and corrected default PostgreSQL port handling.
Fix
Fail-safe MCP authentication
The MCP integration now denies access safely when its authentication setup encounters an error.
2026-08-10The busiest week focused heavily on the MCP integration, OAuth token handling, and reliability fixes across SQL Lab and dashboards.6 changes
Fix
Many MCP integration improvements
Validated chart queries before saving, fixed audit logging, honored caching settings, and hardened the embedded guest data path.
Feature
Embedded dashboard data-masking API
Added a setDataMask method so apps embedding Superset can programmatically apply filters.
Fix
Async queries no longer stuck 'Running'
Fixed a bug where SQL Lab background queries could appear to run forever without finishing.
Fix
Safer OAuth token management
Enforced one OAuth2 token per user and database to avoid conflicting credentials.
Fix
Sturdier imports and error handling
Isolated per-tag imports to prevent one failure poisoning the batch and returned clearer error codes for bad queries.
Chore
Dependency and CI maintenance
Patched a vulnerable transitive dependency, tightened workflow permissions, and updated numerous libraries.
2026-08-03A lighter week mixing accessibility and security features with translation updates and dependency upgrades.6 changes
Feature
Accessibility labels on charts
Enabled screen-reader-friendly aria-labels on ECharts visualizations.
Feature
Clearer data-permission errors
Permission denials now give actionable messages that let users request access to the data they need.
Feature
Color picker for conditional formatting
Replaced the limited color drop-down with a full color picker when setting conditional formatting rules.
Refactor
Faster dashboard loading
Removed repeated redundant database queries when building dashboard context.
Fix
Correct timezone and error labeling
Applied timezone offsets when converting local time boundaries and stopped mislabeling database errors as missing-column errors.
Chore
Translations and dependency updates
Improved Chinese, Italian, French, and Spanish translations, added a Tamil locale, and upgraded libraries including a major NumPy bump.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required