Apache Superset
Bug fixes and improvements to the open source BI platform I use every day at work: dashboards, database engines, SQL parsing, the MCP server and the Italian translation.
- Role
- Contributor
- When
- March 2026 to present
- Stack
- Python, TypeScript, React, SQLAlchemy, Flask
Context
Apache Superset is an open source data exploration and dashboard platform maintained by the Apache Software Foundation. I use it at work to build reporting for hospitals, which is why most of my contributions are about dashboards, database connections, permissions and SQL handling: fixing them upstream means every deployment benefits, not just mine.
Every pull request goes through review by the project committers and has to pass Superset's CI (Python and frontend unit tests, linting, type checks) before it can be merged. The full list, with the current status of each one, is at the bottom of this page.
What I contributed
Database and permission fixes. Datasets created from CSV, Excel or columnar uploads were saved without a catalog on databases that support catalogs (PostgreSQL, Databricks, Trino). Their permission string ended up in the wrong format, so non admin users could not see datasets they were entitled to. The fix sets the default catalog at upload time (#43586). In a similar spirit, the dashboard filter state API returned 401 Unauthorized to regular users because of a decorator that checked a permission nobody could be granted. Access is already enforced at the command level, so the decorator was removed (#43564).
Databricks boolean filters. Native filters on boolean columns failed on Databricks with a type mismatch, because the dialect rendered False as 0 inside an IN clause. The fix makes boolean filters use equality operators that Databricks accepts (#44355).
SQL formatting. When a statement ended with a semicolon followed by a -- comment, the comment could be moved inside an optimizer hint and corrupt it. I changed the comment relocation logic so it targets the right node of the syntax tree (#43565).
MCP server. Superset ships an MCP server that lets AI agents create charts and dashboards. I added a sort_by option to XY chart configs, which previously always sorted categories alphabetically (#44464), and fixed chart creation and dashboard copies on installations that extend the default user model (#45036).
Smaller fixes. Prophet forecasting options now only accept time grains Prophet can actually handle (#43585); interactive icons were moved out of <label> elements in the Explore control headers for valid HTML (#43584); and several database engine specs gained the metadata blocks the documentation is generated from (#43566).
Italian translation. Three pull requests brought the Italian message catalog to zero untranslated and zero fuzzy entries, with a script check that every format placeholder survived translation unchanged (#43274).
How the work is done
Superset is a large codebase with a Python backend and a React frontend, and the review bar is high. Each of the bug fixes above ships with unit tests that reproduce the original problem, which makes it easier for reviewers to see the bug before they look at the change. Not every proposal lands: some of my pull requests were closed in favour of a different approach or are still waiting for review, and they are listed below as they are.
Pull requests
12 merged, 9 open, 8 closed. Status synced from GitHub.
- openfix(security): widen cryptography and msgpack ranges and bump pyarrow floor to resolve Trivy vulnerabilities (#45087)Oct 11, 2026
- opentest(db_engine_specs): add unit test coverage for cockroachdb, motherduck, dynamodb, firebolt, gsheets, synapse, oceanbaseOct 11, 2026
- openfix(dashboards): prevent horizontal filter bar from vanishing on cross-filter (#45050)Oct 7, 2026
- openfix(dashboard): remap native filter scopes when duplicating charts on save asOct 6, 2026
- openfix(dashboard): respect DASHBOARD_AUTO_REFRESH_INTERVALS configuration in refresh dropdownOct 6, 2026
- mergedfix(mcp): support custom user models during dashboard and chart operationsOct 6, 2026
- closedfix(pandas): prevent duplicate column labels in mixed overwrite and rename postprocessingOct 6, 2026
- openfix(explore): prevent duplicate onChange calls in RadioButtonControl (#44921)Oct 3, 2026
- openfix(select): comprehensive hardening for option deduplication and new option handlingOct 2, 2026
- mergedfix(mcp): add sort_by option to XYChartConfig (#42627)Sep 20, 2026
- openfix(dashboards): update last modified timestamp when adding chart to dashboard (#44305)Sep 16, 2026
- mergedfix(databricks): enable equality operators for boolean filters (#36765)Sep 16, 2026
- openfeat(db_engine_specs): complete metadata definitions and add missing unit test suitesAug 30, 2026
- closedfeat(db_engine_specs): improve DB2 time grain expressions using DATE_TRUNC (#43231)Aug 30, 2026
- closedtest(db_engine_specs): add unit test coverage for cockroachdb, motherduck, dynamodb, firebolt, gsheets, synapse, oceanbaseAug 30, 2026
- mergedfix(charts): restrict Prophet time grain schema validation to supported Prophet grainsAug 27, 2026
- mergedfix(database): set default catalog on dataset created from file uploadsAug 27, 2026
- mergedrefactor(explore): move optional icons outside label elementAug 27, 2026
- mergedfeat(db_engine_specs): add metadata blocks to all remaining incomplete engine specsAug 26, 2026
- mergedfix(dashboard): remove @has_access_api from filter state REST APIAug 26, 2026
- mergedfix(sql): preserve optimizer hints when formatting semicolon-terminated statements with trailing commentsAug 26, 2026
- mergedchore(i18n): complete Italian translations with 100% placeholder validationAug 18, 2026
- closedTestprivJun 3, 2026
- closedFix readme linkMay 27, 2026
- closedfix: resolve SettingWithCopyWarning in histogram postprocessingMay 27, 2026
- closedfix(docs): use absolute URL for docker-builds link in 4.1 release notesMay 27, 2026
- closedfeat(scripts): cross-platform Python port of po2json.sh, retire the shell scriptApr 28, 2026
- mergedchore(i18n): update Italian messages.po translationsMar 30, 2026
- mergedfeat(i18n): update Italian messages.poMar 24, 2026