[pull] master from apache:master#756

Merged

pull[bot] merged 11 commits into

code:masterfrom

Jun 3, 2026

Commits on Jun 2, 2026

fix(dashboard): address post-approval review feedback on #40528 (#40685)

rusackas
and
claude
authored
chore(key_value): prune expired entries from the key-value store (#40663)

authored
fix(mcp): address post-approval review feedback on auth logging PR #40646 (#40684)

rusackas
and
claude
authored
fix(reports): sanitize error text in email notification template (#40641)

rusackas
and
claude
authored
fix(sqllab): require dataset match for raw query access (#40409)

sha174n
and
claude
authored
feat(ydb): switch to native YDB sqlglot dialect (#40170)
vgvoleg
authored
fix(core): restrict allowed CSS properties in sanitized HTML (#40627)

rusackas
and
claude
authored
fix(reports): guard SUCCESS-state report execution against duplicate sends and stuck WORKING state (#40657)

rusackas
and
claude
authored
fix(models): HTML-escape data-controlled values in dashboard_link and Slice.icons (#40639)

rusackas
and
claude
authored
fix(charts): sanitize tooltip HTML across nvd3, rose and partition plugins (#40502)

authored
ci(bashlib): drop the dead bc-based NONCE (perf + reliability) (#40691)

rusackas
and
claude
authored