fix: add allowlist to TabStateView.put

.github/workflows/claude.yml

@@ -76,7 +76,7 @@ jobs:
         fetch-depth: 1
 
     - name: Run Claude PR Action
-      uses: anthropics/claude-code-action@094bd24d575e7b30ac1576024817bf1a97c81262 # beta
+      uses: anthropics/claude-code-action@bee87b3258c251f9279e5371b0cc3660f37f3f77 # beta
       with:
         anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
         timeout_minutes: "60"

.github/workflows/ephemeral-env.yml

@@ -199,7 +199,7 @@ jobs:
 
       - name: Login to Amazon ECR
         id: login-ecr
-        uses: aws-actions/amazon-ecr-login@c962da2960ed15f492addc26fffa274485265950 # v2
+        uses: aws-actions/amazon-ecr-login@183a1442edf41672e66566b7fc560e297a290896 # v2
 
       - name: Load, tag and push image to ECR
         id: push-image
@@ -235,7 +235,7 @@ jobs:
 
       - name: Login to Amazon ECR
         id: login-ecr
-        uses: aws-actions/amazon-ecr-login@c962da2960ed15f492addc26fffa274485265950 # v2
+        uses: aws-actions/amazon-ecr-login@183a1442edf41672e66566b7fc560e297a290896 # v2
 
       - name: Check target image exists in ECR
         id: check-image

UPDATING.md

@@ -308,13 +308,13 @@ Note: Pillow is now a required dependency (previously optional) to support image
   There's a migration added that can potentially affect a significant number of existing charts.
 - [32317](https://github.com/apache/superset/pull/32317) The horizontal filter bar feature is now out of testing/beta development and its feature flag `HORIZONTAL_FILTER_BAR` has been removed.
 - [31590](https://github.com/apache/superset/pull/31590) Marks the begining of intricate work around supporting dynamic Theming, and breaks support for [THEME_OVERRIDES](https://github.com/apache/superset/blob/732de4ac7fae88e29b7f123b6cbb2d7cd411b0e4/superset/config.py#L671) in favor of a new theming system based on AntD V5. Likely this will be in disrepair until settling over the 5.x lifecycle.
-- [32432](https://github.com/apache/superset/pull/31260) Moves the List Roles FAB view to the frontend and requires `FAB_ADD_SECURITY_API` to be enabled in the configuration and `superset init` to be executed.
+- [32432](https://github.com/apache/superset/pull/32432) Moves the List Roles FAB view to the frontend and requires `FAB_ADD_SECURITY_API` to be enabled in the configuration and `superset init` to be executed.
 - [34319](https://github.com/apache/superset/pull/34319) Drill to Detail and Drill By is now supported in Embedded mode, and also with the `DASHBOARD_RBAC` FF. If you don't want to expose these features in Embedded / `DASHBOARD_RBAC`, make sure the roles used for Embedded / `DASHBOARD_RBAC`don't have the required permissions to perform D2D actions.
 
 ## 5.0.0
 
 - [31976](https://github.com/apache/superset/pull/31976) Removed the `DISABLE_LEGACY_DATASOURCE_EDITOR` feature flag. The previous value of the feature flag was `True` and now the feature is permanently removed.
-- [31959](https://github.com/apache/superset/pull/32000) Removes CSV_UPLOAD_MAX_SIZE config, use your web server to control file upload size.
+- [32000](https://github.com/apache/superset/pull/32000) Removes CSV_UPLOAD_MAX_SIZE config, use your web server to control file upload size.
 - [31959](https://github.com/apache/superset/pull/31959) Removes the following endpoints from data uploads: `/api/v1/database/<id>/<file type>_upload` and `/api/v1/database/<file type>_metadata`, in favour of new one (Details on the PR). And simplifies permissions.
 - [31844](https://github.com/apache/superset/pull/31844) The `ALERT_REPORTS_EXECUTE_AS` and `THUMBNAILS_EXECUTE_AS` config parameters have been renamed to `ALERT_REPORTS_EXECUTORS` and `THUMBNAILS_EXECUTORS` respectively. A new config flag `CACHE_WARMUP_EXECUTORS` has also been introduced to be able to control which user is used to execute cache warmup tasks. Finally, the config flag `THUMBNAILS_SELENIUM_USER` has been removed. To use a fixed executor for async tasks, use the new `FixedExecutor` class. See the config and docs for more info on setting up different executor profiles.
 - [31894](https://github.com/apache/superset/pull/31894) Domain sharding is deprecated in favor of HTTP2. The `SUPERSET_WEBSERVER_DOMAINS` configuration will be removed in the next major version (6.0)

docs/developer_docs/testing/backend-testing.md

@@ -63,6 +63,109 @@ pytest tests/unit_tests/
 pytest tests/integration_tests/
 ```
 
+## Testing Alerts & Reports with Celery and MailHog
+
+The Alerts & Reports feature relies on Celery for task scheduling and execution. To test it locally, you need Redis (message broker), Celery Beat (scheduler), a Celery Worker (executor), and an SMTP server to receive email notifications.
+
+### Prerequisites
+
+- Redis running on `localhost:6379`
+- [MailHog](https://github.com/mailhog/MailHog) installed (a local SMTP server with a web UI for viewing caught emails)
+
+### superset_config.py
+
+Your `CeleryConfig` **must** include `beat_schedule`. When you define a custom `CeleryConfig` class in `superset_config.py`, it replaces the default entirely. If you omit `beat_schedule`, Celery Beat will start but never schedule any report tasks.
+
+```python
+from celery.schedules import crontab
+from superset.tasks.types import ExecutorType
+
+REDIS_HOST = "localhost"
+REDIS_PORT = "6379"
+
+class CeleryConfig:
+    broker_url = f"redis://{REDIS_HOST}:{REDIS_PORT}/0"
+    result_backend = f"redis://{REDIS_HOST}:{REDIS_PORT}/0"
+    broker_connection_retry_on_startup = True
+    imports = (
+        "superset.sql_lab",
+        "superset.tasks.scheduler",
+        "superset.tasks.thumbnails",
+        "superset.tasks.cache",
+    )
+    worker_prefetch_multiplier = 10
+    task_acks_late = True
+    beat_schedule = {
+        "reports.scheduler": {
+            "task": "reports.scheduler",
+            "schedule": crontab(minute="*", hour="*"),
+        },
+        "reports.prune_log": {
+            "task": "reports.prune_log",
+            "schedule": crontab(minute=0, hour=0),
+        },
+    }
+
+CELERY_CONFIG = CeleryConfig
+
+# SMTP settings pointing to MailHog
+SMTP_HOST = "localhost"
+SMTP_PORT = 1025
+SMTP_STARTTLS = False
+SMTP_SSL = False
+SMTP_USER = ""
+SMTP_PASSWORD = ""
+SMTP_MAIL_FROM = "superset@localhost"
+
+# Must match where your frontend is running
+WEBDRIVER_BASEURL = "http://localhost:9000/"
+
+ALERT_REPORTS_EXECUTE_AS = [ExecutorType.OWNER]
+
+FEATURE_FLAGS = {
+    "ALERT_REPORTS": True,
+    # Recommended for better screenshot support (WebGL/DeckGL charts)
+    "PLAYWRIGHT_REPORTS_AND_THUMBNAILS": True,
+}
+```
+
+:::note
+Do not include `"superset.tasks.async_queries"` in `CeleryConfig.imports` unless you need Global Async Queries. That module accesses `current_app.config` at import time and will crash the worker with a "Working outside of application context" error.
+:::
+
+### Starting the Services
+
+Start MailHog, then Celery Beat and Worker in separate terminals:
+
+```bash
+# Terminal 1 - MailHog (SMTP on :1025, Web UI on :8025)
+MailHog
+
+# Terminal 2 - Celery Beat (scheduler)
+celery --app=superset.tasks.celery_app:app beat --loglevel=info
+
+# Terminal 3 - Celery Worker (executor)
+celery --app=superset.tasks.celery_app:app worker --concurrency=1 --loglevel=info
+```
+
+Use `--concurrency=1` to limit resource usage on your dev machine.
+
+### Verifying the Setup
+
+1. **Beat** should log `Scheduler: Sending due task reports.scheduler (reports.scheduler)` once per minute
+2. **Worker** should log `Scheduling alert <name> eta: <timestamp>` for each active report
+3. Create a test report in **Settings > Alerts & Reports** with a `* * * * *` cron schedule
+4. Check **http://localhost:8025** (MailHog web UI) for the email within 1-2 minutes
+
+### Troubleshooting
+
+| Problem | Solution |
+|---|---|
+| Beat shows no output | Ensure `beat_schedule` is defined in your `CeleryConfig` and `--loglevel=info` is set |
+| "Report Schedule is still working, refusing to re-compute" | Previous executions are stuck. Reset with: `UPDATE report_schedule SET last_state = 'Not triggered' WHERE id = <id>;` |
+| Task backlog overwhelming the worker | Flush Redis: `redis-cli FLUSHDB`, then restart Beat and Worker |
+| Screenshot timeout | Ensure your frontend dev server is running and `WEBDRIVER_BASEURL` matches its URL |
+
 ---
 
 *This documentation is under active development. Check back soon for updates!*

docs/package.json

@@ -68,9 +68,9 @@
     "@storybook/theming": "^8.6.15",
     "@superset-ui/core": "^0.20.4",
     "@swc/core": "^1.15.21",
-    "antd": "^6.3.4",
-    "baseline-browser-mapping": "^2.10.11",
-    "caniuse-lite": "^1.0.30001781",
+    "antd": "^6.3.5",
+    "baseline-browser-mapping": "^2.10.13",
+    "caniuse-lite": "^1.0.30001784",
     "docusaurus-plugin-openapi-docs": "^4.6.0",
     "docusaurus-theme-openapi-docs": "^4.6.0",
     "js-yaml": "^4.1.1",
@@ -106,7 +106,7 @@
     "globals": "^17.4.0",
     "prettier": "^3.8.1",
     "typescript": "~5.9.3",
-    "typescript-eslint": "^8.57.2",
+    "typescript-eslint": "^8.58.0",
     "webpack": "^5.105.4"
   },
   "browserslist": {