port the condition expression to master (#61045)

Inspect dependency changes here: https://github.com/weavejester/hiccup/blob/2.0.0/CHANGELOG.md

Co-authored-by: Metabase bot <metabase-bot@metabase.com>
Co-authored-by: bryan <bryan.maass@gmail.com>

.clj-kondo/config.edn

@@ -68,6 +68,7 @@
   :metabase/validate-logging                           {:level :warning}
   :metabase/validate-mb-driver-tests                   {:level :warning}
   :metabase/validate-mb-once                           {:level :warning}
+  :metabase/discourage-millis-duration                 {:level :warning}
 
   :metabase/validate-deftest
   {:level :warning
@@ -501,6 +502,7 @@ metabase-enterprise.content-translation.routes-test/with-new-secret-key!
    clojure.core/ns                                                                                                           hooks.clojure.core.ns/lint-ns
    clojure.core/require                                                                                                      hooks.clojure.core.require/lint-require
    clojure.core/requiring-resolve                                                                                            hooks.clojure.core.require/lint-requiring-resolve
+   clojure.core/-                                                                                                            hooks.metabase.util.timing/discourage-millis-duration
    clojure.test/deftest                                                                                                      hooks.clojure.test/deftest
    clojure.test/is                                                                                                           hooks.clojure.test/is
    clojure.test/use-fixtures                                                                                                 hooks.clojure.test/use-fixtures
@@ -739,6 +741,7 @@ metabase-enterprise.content-translation.routes-test/with-new-secret-key!
   {:linters
    {:metabase/validate-escaped-single-quotes-in-i18n {:level :warning}
     :metabase/validate-string-or-str-args-to-i18n {:level :warning}
+    :metabase/discourage-millis-duration {:level :warning}
     :discouraged-var
     {clojure.core/with-redefs {:message "Don't use with-redefs outside of tests"}
      clojure.core/eval        {:message "Don't use eval outside of tests"}}}}

.clj-kondo/config/modules/config.edn

@@ -601,7 +601,9 @@
           metabase.lib.schema.join
           metabase.lib.schema.literal
           metabase.lib.schema.metadata
+          metabase.lib.schema.metadata.fingerprint
           metabase.lib.schema.parameter
+          metabase.lib.schema.ref
           metabase.lib.schema.template-tag
           metabase.lib.schema.temporal-bucketing
           metabase.lib.schema.util
@@ -1780,6 +1782,7 @@
            models
            plugins
            premium-features
+           search
            settings
            setup
            util

.clj-kondo/src/hooks/metabase/util/timing.clj

@@ -0,0 +1,16 @@
+(ns hooks.metabase.util.timing
+  "Custom CLJ Kondo hooks for timing-related linting rules."
+  (:require [clj-kondo.hooks-api :as api]))
+
+(defn discourage-millis-duration
+  "Discourage slow and unreliable duration calculations using System/currentTimeMillis "
+  [{:keys [node]}]
+  (let [sexpr (api/sexpr node)]
+    (when (and (list? sexpr) (= (first sexpr) '-) (>= (count sexpr) 2))
+      (let [first-arg (second sexpr)]
+        (when (= first-arg (list 'System/currentTimeMillis))
+          (api/reg-finding!
+           (assoc (meta node)
+                  :message "Avoid System/currentTimeMillis for calculating durations. Use u/start-timer and u/since-ms for more reliability."
+                  :type :metabase/discourage-millis-duration
+                  :level :warning)))))))

.github/team.json

@@ -8,7 +8,6 @@
         "romeovs",
         "bshepherdson",
         "metamben",
-        "appleby",
         "uladzimirdev",
         "wzimrin",
         "ericnormand",
@@ -40,7 +39,8 @@
         "oisincoveney",
         "npretto",
         "heypoom",
-        "sanex3339"
+        "sanex3339",
+        "lorem--ipsum"
       ]
     },
     {
@@ -51,7 +51,6 @@
         "piranha",
         "crisptrutski",
         "deniskaber",
-        "wotbrew",
         "spalt08",
         "stasgavrylov"
       ]
@@ -75,9 +74,6 @@
       "members": [
         "alxnddr",
         "kulyk",
-        "tsplude",
-        "lorem--ipsum",
-        "noahmoss",
         "bpander"
       ]
     },
@@ -93,9 +89,13 @@
       "name": "Metabot",
       "label": ".Team/Metabot",
       "members": [
+        "appleby",
+        "noahmoss",
         "retro",
         "sloansparger",
-        "somtom"
+        "somtom",
+        "wotbrew",
+        "tsplude"
       ]
     },
     {

.github/workflows/e2e-embedding-sdk-compatibility-tests.yml

@@ -1,15 +1,20 @@
 name: "[NOT REQUIRED] SDK Compatibility tests"
 
+# Note: these are currently never called, we're skipping them as they're failing, below is the original triggers
 on:
-  push:
-    branches:
-      - "master"
-      - "release-**"
-  pull_request:
-    types: [opened, synchronize, reopened]
-    branches:
-      - "master"
-      - "release-**"
+  workflow_call:
+
+# Original trigger (commented for reference):
+# on:
+#   push:
+#     branches:
+#       - "master"
+#       - "release-**"
+#   pull_request:
+#     types: [opened, synchronize, reopened]
+#     branches:
+#       - "master"
+#       - "release-**"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}

.github/workflows/fuzzing.yml

@@ -7,10 +7,10 @@ on:
       - "master"
       - "release-**"
     paths:
-      - "frontend/src/metabase-lib/expressions/**"
+      - "frontend/src/metabase/querying/expressions/**"
   pull_request:
     paths:
-      - "frontend/src/metabase-lib/expressions/**"
+      - "frontend/src/metabase/querying/expressions/**"
 
 jobs:
   fe-fuzz-lexifier:
@@ -24,7 +24,7 @@ jobs:
         uses: ./.github/actions/prepare-backend
         with:
           m2-cache-key: "cljs"
-      - run: yarn test-unit frontend/src/metabase-lib/v1/expressions/pratt/fuzz.lexifier.unit.spec.ts
+      - run: yarn test-unit frontend/src/metabase/querying/expressions/pratt/fuzz.lexifier.unit.spec.ts
         env:
           MB_FUZZ: 1
         name: Run fuzz testing on the lexifier
@@ -40,7 +40,7 @@ jobs:
         uses: ./.github/actions/prepare-backend
         with:
           m2-cache-key: "cljs"
-      - run: yarn test-unit frontend/src/metabase-lib/v1/expressions/fuzz.compiler.unit.spec.ts
+      - run: yarn test-unit frontend/src/metabase/querying/expressions/fuzz.compiler.unit.spec.ts
         env:
           MB_FUZZ: 1
         name: Run fuzz testing on the custom expression compiler
@@ -56,7 +56,7 @@ jobs:
         uses: ./.github/actions/prepare-backend
         with:
           m2-cache-key: "cljs"
-      - run: yarn test-unit frontend/src/metabase-lib/v1/expressions/fuzz.string.unit.spec.ts
+      - run: yarn test-unit frontend/src/metabase/querying/expressions/fuzz.string.unit.spec.ts
         env:
           MB_FUZZ: 1
         name: Run fuzz testing on the custom expression string quoter

bb.edn

@@ -155,8 +155,19 @@
 
   ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
   ;; Private Tasks:
-  ;; - hidden from `./bin/mage` listing and `bb tasks`
-  ;; - start with a `-`
+  ;; These tasks are more for internal tooling, e.g. for use from git hooks etc.
+  ;; - hidden from `./bin/mage` listing and `bb tasks`, these all - start with a `-`
+
+  -token-scan
+  {:doc        "Security token scanner for detecting leaked API keys and secrets"
+   :examples   [["./bin/mage -token-scan deps.edn bb.edn" "Scan specific files"]
+                ["./bin/mage -token-scan -v deps.edn" "Scan with verbose output"]
+                ["./bin/mage -token-scan -a" "Scan all files in the project"]]
+   :requires   [[mage.token-scan :as token-scan]]
+   :options    [["-a" "--all-files" "Scan all files in the project"]
+                ["-v" "--verbose" "Verbose output"]]
+   :arg-schema [:sequential [:string {:description "Files to scan"}]]
+   :task       (task! (token-scan/run-scan parsed))}
 
   -repl
   {:doc      "Eval a string of clojure code in the backend dev server"
@@ -175,8 +186,7 @@
                    code (first (:arguments parsed))
                    port (or (:port (:options parsed))
                             (slurp ".nrepl-port")
-                            (do (println (c/red "No port specified, and no .nrepl-port file found."))
-                                (System/exit 1)))
+                            (throw (ex-info (c/red "No port specified, and no .nrepl-port file found.") {:babashka/exit 1})))
                    nns (or (:namespace (:options parsed)) "user")]
                (nrepl-eval nns code port))}
 

bin/build/src/build.clj

@@ -108,7 +108,7 @@
             steps   (keys all-steps)}}]
    (let [version (or version
                      (version-properties/current-snapshot-version edition))
-         start-time-ms (System/currentTimeMillis)]
+         timer         (u/start-timer)]
      (u/step (format "Running build steps for %s version %s: %s"
                      (case edition
                        :oss "Community (OSS) Edition"
@@ -121,7 +121,7 @@
                                                       {:step        step-name
                                                        :valid-steps (keys all-steps)})))]]
          (step-fn {:version version, :edition edition})
-         (u/announce "Did %s in %d ms." step-name (- (System/currentTimeMillis) start-time-ms)))
+         (u/announce "Did %s in %d ms." step-name (u/since-ms timer)))
        (u/announce "All build steps finished.")))))
 
 (defn build-cli

bin/build/src/build/uberjar.clj

@@ -23,10 +23,10 @@
   (u/filename u/project-root-directory "target" "uberjar" "metabase.jar"))
 
 (defn- do-with-duration-ms [thunk f]
-  (let [start-time-ms (System/currentTimeMillis)
-        result        (thunk)
-        duration      (- (System/currentTimeMillis) start-time-ms)]
-    (f duration)
+  (let [timer      (u/start-timer)
+        result     (thunk)
+        elapsed-ms (u/since-ms timer)]
+    (f elapsed-ms)
     result))
 
 (defmacro ^:private with-duration-ms [[duration-ms-binding] & body]

bin/build/src/build_drivers/build_driver.clj

@@ -24,8 +24,8 @@
    (build-driver! driver edition nil))
 
   ([driver edition {:keys [project-dir target-dir], :as options}]
-   (let [edition       (or edition :oss)
-         start-time-ms (System/currentTimeMillis)]
+   (let [edition (or edition :oss)
+         timer   (u/start-timer)]
      (binding [c/*driver-project-dir* (or project-dir
                                           c/*driver-project-dir*)
                c/*target-directory*   (or target-dir
@@ -35,5 +35,5 @@
          (copy-source-files/copy-source-files! driver edition)
          (compile-source-files/compile-clojure-source-files! driver edition)
          (create-uberjar/create-uberjar! driver edition)
-         (u/announce "Built %s driver in %d ms." driver (- (System/currentTimeMillis) start-time-ms))
+         (u/announce "Built %s driver in %d ms." driver (u/since-ms timer))
          (verify/verify-driver driver))))))

bin/build/src/build_drivers/compile_source_files.clj

@@ -44,10 +44,10 @@
   "Compile the Clojure source files for a driver."
   [driver edition]
   (u/step "Compile clojure source files"
-    (let [start-time-ms (System/currentTimeMillis)
-          source-paths  (driver-source-paths driver edition)
-          target-dir    (c/compiled-source-target-dir driver)
-          namespaces    (source-path-namespaces source-paths)]
+    (let [timer        (u/start-timer)
+          source-paths (driver-source-paths driver edition)
+          target-dir   (c/compiled-source-target-dir driver)
+          namespaces   (source-path-namespaces source-paths)]
       (u/announce "Compiling Clojure source files in %s to %s" (pr-str source-paths) target-dir)
       (u/create-directory-unless-exists! target-dir)
       (u/announce "Compiling namespaces %s" (pr-str namespaces))
@@ -57,4 +57,4 @@
           (compile a-namespace)))
       (u/announce "Compiled %d namespace(s) in %d ms."
                   (count namespaces)
-                  (- (System/currentTimeMillis) start-time-ms)))))
+                  (u/since-ms timer)))))

bin/build/src/build_drivers/copy_source_files.clj

@@ -25,12 +25,12 @@
   "Copy source files into the build driver JAR."
   [driver edition]
   (u/step (format "Copy %s source files" driver)
-    (let [start-time-ms (System/currentTimeMillis)
-          dirs          (:paths (c/driver-edn driver edition))]
+    (let [timer (u/start-timer)
+          dirs  (:paths (c/driver-edn driver edition))]
       (assert (every? u/absolute? dirs)
               (format "All dirs should be absolute, got: %s" (pr-str dirs)))
       (u/announce "Copying files in %s" (pr-str dirs))
       (copy-files dirs (c/compiled-source-target-dir driver))
       (u/announce "Copied files in %d directories in %d ms."
                   (count dirs)
-                  (- (System/currentTimeMillis) start-time-ms)))))
+                  (u/since-ms timer)))))

bin/build/src/build_drivers/create_uberjar.clj

@@ -79,7 +79,7 @@
   "Build a driver jar for `driver`, either an `:oss` or `:ee` `edition`."
   [driver edition]
   (u/step (format "Write %s %s uberjar -> %s" driver edition (c/driver-jar-destination-path driver))
-    (let [start-time-ms (System/currentTimeMillis)]
+    (let [timer (u/start-timer)]
       (b/uber
        {:class-dir         (c/compiled-source-target-dir driver)
         :uber-file         (c/driver-jar-destination-path driver)
@@ -89,4 +89,4 @@
         ;; we need to skip this file since on MacOS it conflicts with other licenses, see:
         ;; https://ask.clojure.org/index.php/13231/switch-tools-build-pull-from-jars-rather-than-exploding-onto
         :exclude           ["META-INF/LICENSE"]})
-      (u/announce "Created uberjar in %d ms." (- (System/currentTimeMillis) start-time-ms)))))
+      (u/announce "Created uberjar in %d ms." (u/since-ms timer)))))

bin/build/src/metabuild_common/core.clj

@@ -55,6 +55,8 @@
 
  [misc
   parse-as-keyword
+  since-ms
+  start-timer
   varargs]
 
  [out

bin/build/src/metabuild_common/misc.clj

@@ -13,6 +13,16 @@
   (vary-meta `(into-array ~klass ~objects)
              assoc :tag (format "[L%s;" (.getCanonicalName ^Class (ns-resolve *ns* klass)))))
 
+(defn start-timer
+  "Return a relative timestamp for tracking durations. Treat this as opaque, it does not correspond to wallclock time."
+  []
+  (System/nanoTime))
+
+(defn since-ms
+  "Return how many milliseconds have elapsed since the given timer was started."
+  [timer]
+  (quot (- (System/nanoTime) timer) 1000000))
+
 (defn parse-as-keyword
   "Like [[clojure.core/keyword]], but with a couple of tweaks to make it better for parsing command-line args:
 

bin/mage.bb

@@ -8,12 +8,11 @@
    [babashka.tasks :as bt]
    [clojure.string :as str]
    [mage.color :as c]
-   [mage.shell :as sh]
    [mage.util :as u]))
 
 (set! *warn-on-reflection* true)
 
-(defn lolcat [f]
+(defn- lolcat [f]
   (if (try (u/sh "command -v lolcat")
            (catch Exception _ false))
     (bt/shell (str "lolcat " f))
@@ -22,7 +21,7 @@
       (when (> (rand) 0.8)
         (println (c/yellow "Tip: install lolcat for a better experience!"))))))
 
-(defn invalid-task? []
+(defn- invalid-task? []
   (let [task-name (first *command-line-args*)]
     (when-not (contains? (set (u/all-bb-tasks-list)) task-name)
       (println (c/red (str "Unknown task: " task-name)))
@@ -33,7 +32,7 @@
         (filter (fn [x] (str/starts-with? x "-"))
                 (str/split-lines (slurp "zen.md")))))
 
-(defn tip-o-day []
+(defn- tip-o-day []
   (rand-nth
    (concat ["Did you know? You can use `./bin/mage <task> --help` to get more information about a specific task."
             "Pro tip: Use `./bin/mage <task>` to run a specific task."
@@ -51,6 +50,18 @@
   (println (u/sh "./bin/bb tasks"))
   (println (tip-o-day)))
 
+(defn- summarize-exception [^Exception e]
+  (cond-> {:exception-type (-> e class .getName)
+           :ex-message (.getMessage e)}
+
+    ;; Include ex-data if it's an ExceptionInfo
+    (instance? clojure.lang.ExceptionInfo e)
+    (assoc :data (ex-data e))
+
+    ;; Recursively handle cause
+    (.getCause e)
+    (assoc :cause (summarize-exception (.getCause e)))))
+
 (defn -main [& _]
   (cond
     ;; help
@@ -73,12 +84,31 @@
         (binding [*command-line-args* args]
           (try (bt/run task)
                (catch Exception e
+                 ;; To signal a problem in your mage task:
+                 ;; - Exceptions get summarized unless you set MAGE_DEBUG in your environment
+                 ;;   so they aren't so noisy
+                 ;; - The ex-message will be printed
+                 ;; - The ex-data will be printed
+                 ;;   - the (optional) `:babashka/exit` ex-data key will be used to determine the exit code
+                 ;;   - the (optional) `:mage/error` ex-data key will suppress printing the entire exception,
+                 ;;     use this when you know what the problem is and want to avoid noise
+                 ;;
+                 ;; Avoid using `System/exit` in your tasks, as it will hurt repl-ability of tasks: it will close the repl!
                  (let [message (ex-message e)
                        data (ex-data e)]
-                   (when e       (println (c/yellow "\nException:\n") e))
-                   (when message (println (c/red    (c/reverse-color "Error     :")) message))
-                   (when data    (println (c/yellow (c/reverse-color "Error data:")) data))
-                   (System/exit (:mage/exit-code data 1))))))))))
+                   (when (and e (not (:mage/error data)))
+                     (println (c/yellow "\nException:\n")
+                              (cond-> e
+                                (not (u/env "MAGE_DEBUG" (constantly nil)))
+                                summarize-exception)))
+                   (when (and message (not (str/blank? message)))
+                     (println (c/red (c/reverse-color "ex-message : ")) message))
+                   (when data
+                     (println (c/yellow (c/reverse-color "ex-data    : ")) (pr-str
+                                                                            (dissoc data :mage/error))))
+                   (when (:mage/error data)
+                     (println (c/blue (c/reverse-color "mage/error : ")) (:mage/error data)))
+                   (System/exit (:babashka/exit data 1))))))))))
 
 (when (= *file* (System/getProperty "babashka.file"))
   (-main))

deps.edn

@@ -64,7 +64,7 @@
   com.vladsch.flexmark/flexmark-ext-autolink
   {:mvn/version "0.64.8"}             ; Flexmark extension for auto-linking bare URLs
   commons-codec/commons-codec               {:mvn/version "1.18.0"}             ; Apache Commons -- useful codec util fns
-  commons-io/commons-io                     {:mvn/version "2.19.0"}             ; Apache Commons -- useful IO util fns
+  commons-io/commons-io                     {:mvn/version "2.20.0"}             ; Apache Commons -- useful IO util fns
   commons-net/commons-net                   {:mvn/version "3.11.1"}             ; Apache Commons -- useful network utils. Transitive dep of Snowplow, pinned due to CVE-2021-37533
   commons-validator/commons-validator       {:mvn/version "1.9.0"               ; Apache Commons -- useful validation util fns
                                              :exclusions  [commons-beanutils/commons-beanutils
@@ -78,7 +78,7 @@
                                              :exclusions  [org.apache.poi/poi
                                                            org.apache.poi/poi-ooxml]}
   environ/environ                           {:mvn/version "1.2.0"}              ; env vars/Java properties abstraction
-  hiccup/hiccup                             {:mvn/version "1.0.5"}              ; HTML templating
+  hiccup/hiccup                             {:mvn/version "2.0.0"}              ; HTML templating
   inflections/inflections                   {:mvn/version "0.14.2"}             ; Clojure/Script library used for prularizing words
   instaparse/instaparse                     {:mvn/version "1.5.0"}              ; Make your own parser
   io.github.camsaul/toucan2                 {:mvn/version "1.0.565"}
@@ -250,7 +250,6 @@
     {:mvn/version "0.4.0"}                     ; Enables easy memory measurement
     com.gfredericks/test.chuck   {:mvn/version "0.2.15"}                    ; generating strings from regexes (useful with malli)
     criterium/criterium          {:mvn/version "0.4.6"}                     ; benchmarking library
-    dev.weavejester/hashp        {:mvn/version "0.4.0"}                     ; debugging/spying utility
     djblue/portal                {:mvn/version "0.59.1"}                    ; ui for inspecting values
     io.github.camsaul/humane-are {:mvn/version "1.0.2"}                     ; cleaner test output
     io.github.metabase/hawk      {:sha "1fe839cfa48549e21b89c6418c747895eda7e7bc"} ; test runner
@@ -259,6 +258,7 @@
                                   :exclusions
                                   [org.ow2.asm/asm-all]}
     lambdaisland/deep-diff2      {:mvn/version "2.12.219"}                  ; way better diffs
+    net.solovyov/hashp           {:mvn/version "0.4.0-1"}                   ; debugging/spying utility
     nrepl/nrepl                  {:mvn/version "1.3.1"}                     ; nREPL server
     peridot/peridot              {:git/url "https://github.com/piranha/peridot.git"
                                   :sha "db627c627db3b527a63caf472f0422e4cbfdf574"} ; mocking Ring requests; waiting for upstream release of commit 0fc7c01 (explicit charset)

docs/developers-guide/driver-changelog.md

@@ -54,7 +54,6 @@ title: Driver interface changelog
   `metabase.driver/upload-type->database-type` or `metabase.driver/allowed-promotions` -- make sure you use
   `:metabase.upload/varchar-255` rather than something like `::upload/varchar-255`.
 
-- Added the multi-method `metabase.driver.sql.parameters.substitution/time-grouping->replacement-snippet-info`.  This is effectively `->replacement-snippet-info` for the new native query time grouping feature, but is its own separate multimethod because it needs an extra parameter.
 - The `metabase.models.secret` namespace has been replaced with `metabase.secrets.core`; if you were using it please
   update your usages.
 

docs/developers-guide/security-token-scanner.md

@@ -0,0 +1,44 @@
+# Security Token Scanner
+
+Security token scanner detects potentially leaked API keys and secrets in the Metabase codebase. Runs automatically as a git precommit hook on staged files.
+
+## Usage
+
+```bash
+# Scan specific files
+./bin/mage -token-scan deps.edn bb.edn
+
+# Scan all files
+./bin/mage -token-scan -a
+
+# Verbose output
+./bin/mage -token-scan -v deps.edn
+```
+
+## Token Types Detected
+
+- Airgap tokens (`airgap_`)
+- Dev tokens (`mb_dev_`, 64-char hex)
+- OpenAI API keys (`sk-`)
+- JWT/JWE tokens
+- GitHub tokens (`gh[pousr]_`)
+- Slack bot tokens (`xoxb-`)
+- AWS access keys (`AKIA`)
+
+The scanner uses `.gitignore` to filter files and will block commits containing detected tokens.
+
+
+## False positives
+
+If the scanner flags a non-token string, you should **exclude the literal token string** by adding it to: `mage/resources/token_scanner/token_whitelist.txt`.
+
+```
+echo 'my-token-string' >> mage/resources/token_scanner/token_whitelist.txt && git add mage/resources/token_scanner/token_whitelist.txt
+```
+
+
+## Bypassing (not recommended)
+
+```bash
+git commit --no-verify -m "commit message"
+```

docs/embedding/sdk/introduction.md

@@ -107,7 +107,7 @@ View the SDK's changelog:
 
 ## Embedded analytics SDK on NPM
 
-Check out the Metabase Embedded analytics SDK on NPM: [metaba.se/sdk](https://metaba.se/sdk).
+Check out the Metabase Embedded analytics SDK on NPM: [metaba.se/sdk-npm](https://metaba.se/sdk-npm).
 
 ## SDK limitations
 

docs/installation-and-operation/running-metabase-on-azure.md

@@ -104,7 +104,7 @@ Now go to the next step where you will select:
 - **Options**: Single container.
 - **Image source**: DockerHub.
 - **Access Type**: Public.
-- **Image and tag**: metabase/metabase:latest (or choose any other docker image tag of your preference, like our Enterprise Edition). To find the latest version, check our [Community Edition Dockerhub repository](https://hub.docker.com/r/metabase/metabase/tags?page=1&ordering=last_updated) and also our [Enterprise Edition Dockerhub Repository](https://hub.docker.com/r/metabase/metabase-enterprise/tags?page=1&ordering=last_updated).
+- **Image and tag**: metabase/metabase:latest (or choose any other docker image tag of your preference, like our Enterprise Edition). To find the latest version, check our [Community Edition Docker Hub repository](https://hub.docker.com/r/metabase/metabase/tags?page=1&ordering=last_updated) and also our [Enterprise Edition Docker Hub Repository](https://hub.docker.com/r/metabase/metabase-enterprise/tags?page=1&ordering=last_updated).
 - **Startup command**: Leave this field empty.
 
 Click **Next** until you get to the last section, then click **Create**, and wait while your application initializes.

docs/installation-and-operation/running-metabase-on-docker.md

@@ -8,7 +8,7 @@ redirect_from:
 
 > To get fast, reliable, and secure deployment with none of the work or hidden costs that come with self-hosting, check out [Metabase Cloud](https://www.metabase.com/cloud/).
 
-Metabase provides an official Docker image via Dockerhub that can be used for deployments on any system that is running Docker.
+Metabase provides an official Docker image via Docker Hub that can be used for deployments on any system that is running Docker.
 
 If you're trying to upgrade your Metabase version on Docker, check out these [upgrading instructions](upgrading-metabase.md).
 

docs/people-and-groups/saml-google.md

@@ -61,7 +61,9 @@ For example, to add the attribute "First name":
 
 ## Setting up synchronize group membership
 
-1. In Google Admin, setup a multi-value [custom user attribute](https://support.google.com/a/answer/6208725?hl=en#zippy=%2Cadd-a-new-custom-attribute) for your users (recommended if you manage multiple SAML app permissions in Google or do not have existing Google Groups that align with your desired Metabase groups) OR [map to existing Google Groups](https://support.google.com/a/answer/11143403?hl=en).
+1. In Google Admin, you can EITHER:
+     - Set up a multi-value [custom user attribute](https://support.google.com/a/answer/6208725?hl=en#zippy=%2Cadd-a-new-custom-attribute) for your users. Recommended if you manage multiple SAML app permissions in Google or if you lack existing Google Groups that align with your desired Metabase groups.
+     - [Map to existing Google Groups](https://support.google.com/a/answer/11143403?hl=en).
 2. Follow the instructions for [Configuring the group schema](./authenticating-with-saml.md#configuring-the-group-schema-in-metabase) using the `App attribute` that you used in Google as the Group attribute name in Metabase.
 
 ## Troubleshooting SAML issues