Daniel Vaz Gaspar

`CSV_UPLOAD_MAX_SIZE` only affects CSV uploads as the name implies, yet we have Excel and columnar upload also. Also this prevention should be made at the webserver level using `max_body_size` or...

chore: deprecate multiple old APIs

2

### SUMMARY Deprecates multiple old API endpoints and removes unused code: List of deprecated endpoints: ``` SliceModelView.add>, SliceModelView.api_delete>, SliceModelView.api_read>, SliceModelView.delete>, SliceModelView.download>, SliceModelView.edit>, SliceModelView.list>, SliceModelView.show>, SavedQueryView.add>, SavedQueryView.api_create>, SavedQueryView.api_delete>, SavedQueryView.api_get>, SavedQueryView.api_read>, SavedQueryView.api_update>,...

chore: bump gunicorn to 22.0.0

1

### SUMMARY Bump gunicorn to address a potencial vulnerability https://docs.gunicorn.org/en/latest/news.html#id1 ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF ### TESTING INSTRUCTIONS ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [...

fix: bump sqlparse to 0.5.0

3

### SUMMARY Bumps sqlparse to 0.5.0 to address a potencial vulnerability. Followup from: https://github.com/apache/superset/pull/28042 Don't think we will have breaking changes here, I think that our upper bound was a...

fix: improve df to records performance

1

### SUMMARY Leverages `to_dict` https://pandas.pydata.org/docs/reference/api/pandas.DataFrame.to_dict.html from pandas. To improve speed. Simple benchmark results: ``` Time taken with old (rows 10000): 0.024200916290283203 Time taken with new (rows 10000): 0.006799936294555664 Percentage improvement:...

chore: support sqlalchemy 2.x and flask-sqlalchemy 3 (breaking)

13

### Description - Added config option to not create FAB's tables FAB_CREATE_DB - Flask-SQLAlchemy singleton is now created by FAB, import from flask_appbuilder.extensions import db. This means init now is...

### Description chore: bump cryptography to 42.0.4 ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Is CRUD MVC related. - [ ] Is Auth, RBAC security...

fix: dashboard performance

3

### SUMMARY This PR introduces a substantial performance improvement to the dashboard list page. We have noticed that `json_metadata` and `position_json` can contain huge payloads on dashboards that contain a...

fix: adds the ability to disallow SQL functions per engine

1

### SUMMARY Adds a new configuration key named `DISALLOWED_SQL_FUNCTIONS` that defines disallowed function per engine on SQL statements. These functions will be disallowed on SQLLab and Charts. ### BEFORE/AFTER SCREENSHOTS...

### Description ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Is CRUD MVC related. - [ ] Is Auth, RBAC security related. - [ ] Changes...