[pull] master from apache:master#758

Merged

pull[bot] merged 13 commits into

code:masterfrom

Jun 3, 2026

Commits on Jun 3, 2026

fix(export): sanitize user-supplied CSV export filename (charts + SQL Lab) (#40632)

rusackas
and
claude
authored
fix(charts): apply DISALLOWED_SQL_FUNCTIONS gate to adhoc expressions (#40568)

sha174n
and
claude
authored
fix(embedding): add optional dataset allowlist to guest tokens (#39302)

sha174n
and
claude
authored
fix(api): enforce per-object ownership validation in chart, dataset, and report commands (#39303)

sha174n
and
claude
authored
fix(sqllab): quote CTAS target identifiers and validate tmp_table_name format (#40245)

sha174n
and
claude
authored
feat(docker): add environment-based debugger control (#40327)

authored
fix: apply dashboard access check in related_objects endpoints (#40333)

sha174n
and
claude
authored
fix(chart): standardize dashboard validation across chart create/update (#40336)

sha174n
and
claude
authored
fix(dataset): unify validation for stored and adhoc SQL expressions (#40392)

sha174n
and
claude
authored
fix(dashboards): narrow datasets payload to callers with read access (#40396)

sha174n
and
claude
authored
fix(views): enforce per-chart access check in legacy form_data endpoint (#40497)

sha174n
and
claude
authored
fix(redirect): normalize browser-stripped whitespace before protocol-relative check (#40566)

sha174n
and
claude
authored
ci: harden CI against Docker Hub registry flakes (retries + auth) (#40700)

rusackas
and
claude
authored