🤖 backported "Remove old llms.txt superseded by Jekyll plugin on docs site" (#69134 )

Remove old llms.txt superseded by Jekyll plugin on docs site (#69132) remove llms.txt and llms-embedding-full.txt superseded by Jekyll build plugin Co-authored-by: Phoomparin Mano <poom@metabase.com>
🤖 backported "Added MB_MONITOR_PERFORMANCE option" (#69362 )
2026-02-12 03:47:47 +07:00 · 2026-02-10 16:50:28 -06:00 · 2026-02-10 16:20:53 +00:00 · 2026-02-05 20:29:00 +00:00 · 2026-02-04 15:28:54 +00:00 · 2026-02-04 11:29:19 +02:00
2374 changed files with 698066 additions and 569929 deletions
--- a/.claude/skills/add-malli-schemas/SKILL.md
+++ b/.claude/skills/add-malli-schemas/SKILL.md
@@ -0,0 +1,420 @@
+---
+name: add-malli-schemas
+description: Efficiently add Malli schemas to API endpoints in the Metabase codebase with proper patterns, validation timing, and error handling
+---
+
+# Add Malli Schemas to API Endpoints
+
+This skill helps you efficiently and uniformly add Malli schemas to API endpoints in the Metabase codebase.
+
+## Reference Files (Best Examples)
+
+- `src/metabase/warehouses/api.clj` - Most comprehensive schemas, custom error messages
+- `src/metabase/api_keys/api.clj` - Excellent response schemas
+- `src/metabase/collections/api.clj` - Great named schema patterns
+- `src/metabase/timeline/api/timeline.clj` - Clean, simple examples
+
+## Quick Checklist
+
+When adding Malli schemas to an endpoint:
+
+- [ ] Route params have schemas
+- [ ] Query params have schemas with `:optional true` and `:default` where appropriate
+- [ ] Request body has a schema (for POST/PUT)
+- [ ] Response schema is defined (using `:-` after route string)
+- [ ] Use existing schema types from `ms` namespace when possible
+- [ ] Consider creating named schemas for reusable or complex types
+- [ ] Add contextual error messages for validation failures
+
+## Basic Structure
+
+### Complete Endpoint Example
+
+```clojure
+(mr/def ::Color [:enum "red" "blue" "green"])
+
+(mr/def ::ResponseSchema
+  [:map
+   [:id pos-int?]
+   [:name string?]
+   [:color ::Color]
+   [:created_at ms/TemporalString]])
+
+(api.macros/defendpoint :post "/:name" :- ::ResponseSchema
+  "Create a resource with a given name."
+  [;; Route Params:
+   {:keys [name]} :- [:map [:name ms/NonBlankString]]
+   ;; Query Params:
+   {:keys [include archived]} :- [:map
+                                   [:include  {:optional true} [:maybe [:= "details"]]]
+                                   [:archived {:default false} [:maybe ms/BooleanValue]]]
+   ;; Body Params:
+   {:keys [color]} :- [:map [:color ::Color]]
+   ]
+  ;; endpoint implementation, ex:
+  {:id 99
+   :name (str "mr or mrs " name)
+   :color ({"red" "blue" "blue" "green" "green" "red"} color)
+   :created_at (t/format (t/formatter "yyyy-MM-dd'T'HH:mm:ssXXX") (t/zoned-date-time))}
+  )
+```
+
+## Common Schema Patterns
+
+1. Route Params (the 5 in `api/user/id/5`)
+2. Query Params (the sort+asc pair in `api/users?sort=asc`)
+3. Body Params (the contents of a request body. Almost always decoded from json into edn)
+4. The Raw Request map
+
+Of the 4 arguments, deprioritize usage of the raw request unless necessary.
+
+### Route Params
+
+Always required, typically just a map with an ID:
+
+```clojure
+[{:keys [id]} :- [:map [:id ms/PositiveInt]]]
+```
+
+For multiple route params:
+
+```clojure
+[{:keys [id field-id]} :- [:map
+                           [:id ms/PositiveInt]
+                           [:field-id ms/PositiveInt]]]
+```
+
+### Query Params
+
+Add properties for `{:optional true ...}` and `:default` values:
+
+```clojure
+{:keys [archived include limit offset]} :- [:map
+                                            [:archived {:default false} [:maybe ms/BooleanValue]]
+                                            [:include  {:optional true}   [:maybe [:= "tables"]]]
+                                            [:limit    {:optional true} [:maybe ms/PositiveInt]]
+                                            [:offset   {:optional true} [:maybe ms/PositiveInt]]]
+```
+
+### Request Body (POST/PUT)
+
+```clojure
+{:keys [name description parent_id]} :- [:map
+                                         [:name        ms/NonBlankString]
+                                         [:description {:optional true} [:maybe ms/NonBlankString]]
+                                         [:parent_id   {:optional true} [:maybe ms/PositiveInt]]]
+```
+
+### Response Schemas
+
+#### Simple inline response:
+
+```clojure
+(api.macros/defendpoint :get "/:id" :- [:map
+                                        [:id pos-int?]
+                                        [:name string?]]
+  "Get a thing"
+  ...)
+```
+
+#### Named schema for reuse:
+
+```clojure
+(mr/def ::Thing
+  [:map
+   [:id pos-int?]
+   [:name string?]
+   [:description [:maybe string?]]])
+
+(api.macros/defendpoint :get "/:id" :- ::Thing
+  "Get a thing"
+  ...)
+
+(api.macros/defendpoint :get "/" :- [:sequential ::Thing]
+  "Get all things"
+  ...)
+```
+
+## Common Schema Types
+
+### From `metabase.util.malli.schema` (aliased as `ms`)
+
+Prefer the schemas in the ms/* namespace, since they work better with our api infrastructure. 
+
+For example use `ms/PositiveInt` instead of `pos-int?`.
+
+```clojure
+ms/PositiveInt                  ;; Positive integer
+ms/NonBlankString               ;; Non-empty string
+ms/BooleanValue                 ;; String "true"/"false" or boolean
+ms/MaybeBooleanValue            ;; BooleanValue or nil
+ms/TemporalString               ;; ISO-8601 date/time string (for REQUEST params only!)
+ms/Map                          ;; Any map
+ms/JSONString                   ;; JSON-encoded string
+ms/PositiveNum                  ;; Positive number
+ms/IntGreaterThanOrEqualToZero  ;; 0 or positive
+```
+
+**IMPORTANT:** For response schemas, use `:any` for temporal fields, not `ms/TemporalString`!
+Response schemas validate BEFORE JSON serialization, so they see Java Time objects.
+
+### Built-in Malli Types
+
+```clojure
+:string                     ;; Any string
+:boolean                    ;; true/false
+:int                        ;; Any integer
+:keyword                    ;; Clojure keyword
+pos-int?                    ;; Positive integer predicate
+[:maybe X]                  ;; X or nil
+[:enum "a" "b" "c"]         ;; One of these values
+[:or X Y]                   ;; Schema that satisfies X or Y
+[:and X Y]                  ;; Schema that satisfies X and Y
+[:sequential X]             ;; Sequential of Xs
+[:set X]                    ;; Set of Xs
+[:map-of K V]               ;; Map with keys w/ schema K and values w/ schema V
+[:tuple X Y Z]              ;; Fixed-length tuple of schemas X Y Z
+```
+
+Avoid using sequence schemas unless completely necessary.
+
+## Step-by-Step: Adding Schemas to an Endpoint
+
+### Example: Adding return schema to `GET /api/field/:id/related`
+
+**Before:**
+```clojure
+(api.macros/defendpoint :get "/:id/related"
+  "Return related entities."
+  [{:keys [id]} :- [:map [:id ms/PositiveInt]]]
+  (-> (t2/select-one :model/Field :id id) api/read-check xrays/related))
+```
+
+**Step 1:** Check what the function returns (look at `xrays/related`)
+
+**Step 2:** Define response schema based on return type:
+
+```clojure
+(mr/def ::RelatedEntity
+  [:map
+   [:tables [:sequential [:map [:id pos-int?] [:name string?]]]]
+   [:fields [:sequential [:map [:id pos-int?] [:name string?]]]]])
+```
+
+**Step 3:** Add response schema to endpoint:
+
+```clojure
+(api.macros/defendpoint :get "/:id/related" :- ::RelatedEntity
+  "Return related entities."
+  [{:keys [id]} :- [:map [:id ms/PositiveInt]]]
+  (-> (t2/select-one :model/Field :id id) api/read-check xrays/related))
+```
+
+## Advanced Patterns
+
+### Custom Error Messages
+
+```clojure
+(def DBEngineString
+  "Schema for a valid database engine name."
+  (mu/with-api-error-message
+   [:and
+    ms/NonBlankString
+    [:fn
+     {:error/message "Valid database engine"}
+     #(u/ignore-exceptions (driver/the-driver %))]]
+   (deferred-tru "value must be a valid database engine.")))
+```
+
+### Enum with Documentation
+
+```clojure
+(def PinnedState
+  (into [:enum {:error/message "pinned state must be 'all', 'is_pinned', or 'is_not_pinned'"}]
+        #{"all" "is_pinned" "is_not_pinned"}))
+```
+
+### Complex Nested Response
+
+```clojure
+(mr/def ::DashboardQuestionCandidate
+  [:map
+   [:id ms/PositiveInt]
+   [:name ms/NonBlankString]
+   [:description [:maybe string?]]
+   [:sole_dashboard_info
+    [:map
+     [:id ms/PositiveInt]
+     [:name ms/NonBlankString]
+     [:description [:maybe string?]]]]])
+
+(mr/def ::DashboardQuestionCandidatesResponse
+  [:map
+   [:data [:sequential ::DashboardQuestionCandidate]]
+   [:total ms/PositiveInt]])
+```
+
+### Paginated Response Pattern
+
+```clojure
+(mr/def ::PaginatedResponse
+  [:map
+   [:data [:sequential ::Item]]
+   [:total integer?]
+   [:limit {:optional true} [:maybe integer?]]
+   [:offset {:optional true} [:maybe integer?]]])
+```
+
+## Common Pitfalls
+
+### Don't: Forget `:maybe` for nullable fields
+
+```clojure
+[:description ms/NonBlankString]  ;; WRONG - fails if nil
+[:description [:maybe ms/NonBlankString]]  ;; RIGHT - allows nil
+```
+
+### Don't: Forget `:optional true` for optional query params
+
+```clojure
+[:limit ms/PositiveInt]  ;; WRONG - required but shouldn't be
+[:limit {:optional true} [:maybe ms/PositiveInt]]  ;; RIGHT
+```
+
+### Don't: Forget `:default` values for known params
+
+```clojure
+[:limit ms/PositiveInt]  ;; WRONG - required but shouldn't be
+[:limit {:optional true :default 0} [:maybe ms/PositiveInt]]  ;; RIGHT
+```
+
+
+### Don't: Mix up route params, query params, and body
+
+```clojure
+;; WRONG - all in one map
+[{:keys [id name archived]} :- [:map ...]]
+
+;; RIGHT - separate destructuring
+[{:keys [id]} :- [:map [:id ms/PositiveInt]]
+ {:keys [archived]} :- [:map [:archived {:default false} ms/BooleanValue]]
+ {:keys [name]} :- [:map [:name ms/NonBlankString]]]
+```
+
+### Don't: Use `ms/TemporalString` for Java Time objects in response schemas
+
+```clojure
+;; WRONG - Java Time objects aren't strings yet
+[:date_joined ms/TemporalString]
+
+;; RIGHT - schemas validate BEFORE JSON serialization
+[:date_joined :any]  ;; Java Time object, serialized to string by middleware
+[:last_login [:maybe :any]]  ;; Java Time object or nil
+```
+
+**Why:** Response schemas validate the internal Clojure data structures BEFORE they are serialized to JSON. Java Time objects like `OffsetDateTime` get converted to ISO-8601 strings by the JSON middleware, so the schema needs to accept the raw Java objects.
+
+### Don't: Use `[:sequential X]` when the data is actually a set
+
+```clojure
+;; WRONG - group_ids is actually a set
+[:group_ids {:optional true} [:sequential pos-int?]]
+
+;; RIGHT - matches the actual data structure
+[:group_ids {:optional true} [:maybe [:set pos-int?]]]
+```
+
+**Why:** Toucan hydration methods often return sets. The JSON middleware will serialize sets to arrays, but the schema validates before serialization.
+
+### Don't: Create anonymous schemas for reused structures
+
+Use `mr/def` for schemas used in multiple places:
+
+```clojure
+(mr/def ::User
+  [:map
+   [:id pos-int?]
+   [:email string?]
+   [:name string?]])
+```
+
+## Finding Return Types
+
+1. **Look at the function being called**
+
+```clojure
+(api.macros/defendpoint :get "/:id"
+  [{:keys [id]}]
+  (t2/select-one :model/Field :id id))  ;; Returns a Field instance
+```
+
+2. **Check Toucan models for structure**
+
+Look in `src/metabase/*/models/*.clj` for model definitions.
+
+3. **Use clojure-mcp or REPL to inspect**
+
+```bash
+./bin/mage -repl '(require '\''metabase.xrays.core) (doc metabase.xrays.core/related)'
+```
+
+4. **Check tests**
+
+Tests often show the expected response structure.
+
+## Understanding Schema Validation Timing
+
+**CRITICAL CONCEPT:** Schemas validate at different points in the request/response lifecycle:
+
+### Request Parameter Schemas (Query/Body/Route)
+- Validate AFTER JSON parsing
+- Data is already deserialized (strings, numbers, booleans)
+- Use `ms/TemporalString` for date/time inputs
+- Use `ms/BooleanValue` for boolean query params
+
+### Response Schemas
+- Validate BEFORE JSON serialization
+- Data is still in Clojure format (Java Time objects, sets, keywords)
+- Use `:any` for Java Time objects
+- Use `[:set X]` for sets
+- Use `[:enum :keyword]` for keyword enums
+
+### Serialization Flow
+
+```
+Request:  JSON string → Parse → Coerce → Handler
+Response: Handler → Schema Check → Encode → Serialize → JSON string
+```
+
+## Workflow Summary
+
+1. **Read the endpoint** - understand what it does
+2. **Identify params** - route, query, body
+3. **Add parameter schemas** - use existing types from `ms`
+4. **Determine return type** - check the implementation
+5. **Define response schema** - inline or named with `mr/def`
+6. **Test** - ensure the endpoint works and validates correctly
+
+## Testing Your Schemas
+
+After adding schemas, verify:
+
+1. **Valid requests work** - test with correct data
+2. **Invalid requests fail gracefully** - test with wrong types
+3. **Optional params work** - test with/without optional params
+4. **Error messages are clear** - check validation error responses
+
+## Tips
+
+- **Start simple** - begin with basic types, refine later
+- **Reuse schemas** - if you see the same structure twice, make it a named schema
+- **Be specific** - use `ms/PositiveInt` instead of `pos-int?`
+- **Document intent** - add docstrings to named schemas
+- **Follow conventions** - look at similar endpoints in the same namespace
+- **Check the actual data** - use REPL to inspect what's actually returned before serialization
+
+## Additional Resources
+
+- [Malli Documentation](https://github.com/metosin/malli)
+- Metabase Malli utilities: `src/metabase/util/malli/schema.clj`
+- Metabase schema registry: `src/metabase/util/malli/registry.clj`
--- a/.clj-kondo/config.edn
+++ b/.clj-kondo/config.edn
@@ -229,9 +229,6 @@
  {:exclude
   [(build.uberjar/with-duration-ms)
    (cljs.test/is [=? malli=])
-    (clojure.core.logic/fresh)
-    (clojure.core.logic/matcha)
-    (clojure.core.logic/run)
    (clojure.test/is [=? malli= qv=])
    (clojure.tools.macro/macrolet)
    instaparse.core/transform
@@ -410,7 +407,6 @@
 :lint-as
 {cljs.cache/defcache                                                                   clojure.core/deftype
  clojure.core.cache/defcache                                                           clojure.core/deftype
-  clojure.core.logic/defne                                                              clj-kondo.lint-as/def-catch-all
  clojure.test.check.clojure-test/defspec                                               clojure.test/deftest
  clojure.test.check.properties/for-all                                                 clojure.core/let
  clojurewerkz.quartzite.jobs/defjob                                                    clojure.core/defn
@@ -902,16 +898,21 @@
  performance-sensitive
  {:linters
   {:discouraged-var
-    {clojure.core/every?          {:message "Use metabase.util.performance/every?"}
+    {clojure.core/empty?          {:message "Use metabase.util.performance/empty?"}
+     clojure.core/not-empty       {:message "Use metabase.util.performance/not-empty"}
+     clojure.core/every?          {:message "Use metabase.util.performance/every?"}
     clojure.core/mapv            {:message "Use metabase.util.performance/mapv"}
     clojure.core/run!            {:message "Use metabase.util.performance/run!"}
+     clojure.core/get-in          {:message "Use metabase.util.performance/get-in"}
     clojure.core/select-keys     {:message "Use metabase.util.performance/select-keys"}
     clojure.core/some            {:message "Use metabase.util.performance/some"}
     clojure.core/update-keys     {:message "Use metabase.util.performance/update-keys"}
     clojure.walk/keywordize-keys {:message "Use metabase.util.performance/keywordize-keys"}
     clojure.walk/postwalk        {:message "Use metabase.util.performance/postwalk"}
     clojure.walk/prewalk         {:message "Use metabase.util.performance/prewalk"}
-     clojure.walk/walk            {:message "Use metabase.util.performance/walk"}}}}
+     clojure.walk/walk            {:message "Use metabase.util.performance/walk"}
+     clojure.walk/for             {:message "Use metabase.util.performance/for"}
+     clojure.walk/doseq           {:message "Use metabase.util.performance/doseq"}}}}

  qp-and-driver-source-namespaces
  {:linters
--- a/.clj-kondo/config/modules/config.edn
+++ b/.clj-kondo/config/modules/config.edn
@@ -160,7 +160,8 @@

  api-routes
  {:team "UX West"
-   :api  #{metabase.api-routes.core}
+   :api  #{metabase.api-routes.cmd
+           metabase.api-routes.core}
   :uses :any}

  app-db
@@ -330,6 +331,7 @@
  {:team "UX West"
   :api  #{metabase.collections.api
           metabase.collections.core
+           metabase.collections.init
           metabase.collections.models.collection
           metabase.collections.models.collection.root}
   :uses #{api
@@ -349,6 +351,7 @@
           request
           revisions
           search
+           settings
           upload
           util}}

@@ -605,12 +608,15 @@
   :api  #{metabase.lib.binning
           metabase.lib.binning.util
           metabase.lib.card
+           metabase.lib.computed ; temporarily so that `qp.compile` can use it as lib memoization evolves
+           metabase.lib.convert  ; Only so [[metabase.queries.models.card]] can set dynamic vars.
           metabase.lib.core
           metabase.lib.equality
           metabase.lib.field
           metabase.lib.field.resolution
           metabase.lib.filter
           metabase.lib.filter.desugar.jvm ; only so [[metabase.legacy-mbql.jvm-util]] can use defined regexes
+           metabase.lib.hierarchy
           metabase.lib.init
           metabase.lib.join.util
           metabase.lib.metadata
@@ -832,7 +838,8 @@
   :api  #{metabase.premium-features.api
           metabase.premium-features.core
           metabase.premium-features.init}
-   :uses #{api
+   :uses #{analytics
+           api
           app-db
           classloader
           config
@@ -1142,6 +1149,7 @@
           session
           settings
           system
+           users
           util
           enterprise/sso}}

@@ -1238,6 +1246,7 @@
           app-db
           audit-app
           config
+           database-routing
           driver
           events
           lib
@@ -1358,7 +1367,8 @@
           metabase.users.init
           metabase.users.models.user
           metabase.users.models.user-parameter-value
-           metabase.users.schema}
+           metabase.users.schema
+           metabase.users.settings}
   :uses #{analytics
           api
           appearance
@@ -1562,6 +1572,8 @@
   :api  #{metabase-enterprise.ai-sql-fixer.api}
   :uses #{api
           driver
+           lib
+           lib-be
           query-processor
           util
           enterprise/metabot-v3}}
@@ -1608,6 +1620,8 @@
           query-permissions
           query-processor
           settings
+           setup
+           startup
           sync
           users
           util
@@ -1647,6 +1661,7 @@
   :uses #{api
           events
           premium-features
+           store-api
           util
           enterprise/harbormaster}}

@@ -1727,7 +1742,6 @@
   :uses #{analyze
           api
           collections
-           config
           driver
           events
           graph
@@ -1735,6 +1749,7 @@
           lib-be
           models
           native-query-snippets
+           permissions
           premium-features
           queries
           query-processor
@@ -1903,7 +1918,7 @@
           query-processor
           util}}

- enterprise/remote-sync
+  enterprise/remote-sync
  {:team "UX West"
   :api  #{metabase-enterprise.remote-sync.api
           metabase-enterprise.remote-sync.core
@@ -1999,6 +2014,7 @@
           app-db
           appearance
           collections
+           config
           logger
           models
           plugins
@@ -2061,6 +2077,7 @@
   :uses #{analytics
           api
           app-db
+           channel
           driver
           events
           lib
@@ -2070,6 +2087,7 @@
           queries
           query-processor
           request
+           revisions
           search
           settings
           sync
--- a/.clj-kondo/src/hooks/metabase/settings/models/setting.clj
+++ b/.clj-kondo/src/hooks/metabase/settings/models/setting.clj
@@ -119,10 +119,10 @@
     reset-token-ttl-hours
     retired-setting
     retry-initial-interval
-     retry-max-attempts
+     retry-max-retries
     retry-max-interval-millis
     retry-multiplier
-     retry-randomization-factor
+     retry-jitter-factor
     saml-application-name
     saml-attribute-email
     saml-attribute-firstname
--- a/.cljfmt.edn
+++ b/.cljfmt.edn
@@ -43,9 +43,6 @@
  with-meta                                                                            [[:default]]
  ;; library stuff. Libraries that specify their own `:style/indent` specs are included in the section after this
  ;; since it is generated automatically.
-  clojure.core.logic/fresh                                                             [[:block 1]]
-  clojure.core.logic/matcha                                                            [[:block 1]]
-  clojure.core.logic/run                                                               [[:block 2]]
  clojure.core.match/match                                                             [[:block 1]]
  clojure.test.check.properties/for-all                                                [[:block 1]]
  clojure.test.check.properties/for-all*                                               [[:block 1]]
--- a/.codespellignore
+++ b/.codespellignore
@@ -0,0 +1,23 @@
+Brite
+afterAll
+ags
+altho
+cancelation
+cancelations
+datas
+edn
+eduction
+hasTables
+horizontalX
+horizontalY
+juxt
+methodd
+notIn
+pass-thru
+ser
+serieses
+sortings
+trs
+trsn
+tru
+trun
--- a/.codespellrc
+++ b/.codespellrc
@@ -0,0 +1,3 @@
+[codespell]
+skip = *.csv,*.edn,*.geojson,*.json,*.tsv,*.xml,docs/developers-guide/drivers/driver-tests.md,docs/developers-guide/e2e-tests.md,docs/questions/query-builder/expressions-list.md,docs/questions/visualizations/country-codes.md,e2e/test/scenarios/admin/i18n/content-translation/constants.ts,frontend/src/cljs,frontend/src/metabase/querying/expressions/tokenizer/lezer.js,frontend/src/metabase/static-viz/constants/char-sizes.ts,frontend/src/metabase/visualizations/lib/mapping_codes.ts,modules/drivers/mongo/src/metabase/driver/mongo/operators.clj
+ignore-words = .codespellignore
--- a/.eslintrc.js
+++ b/.eslintrc.js
@@ -118,7 +118,6 @@ module.exports = {
          "And",
          "When",
          "Then",
-          "describeWithSnowplow",
        ],
      },
    ],
@@ -348,5 +347,11 @@ module.exports = {
        "import/no-commonjs": "off",
      },
    },
+    {
+      files: ["**/*.stories.tsx", "**/preview.tsx"],
+      rules: {
+        "import/no-default-export": "off",
+      },
+    },
  ],
 };
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,12 +1,12 @@
 # Before changing this file, make sure you have read how we use it:
 # https://www.notion.so/metabase/Pull-Request-Code-Review-Guide-374f05df889748b69d67af753f9bc9b8?pvs=4#36550c04ceab40b5a8b8bee6264b090c

-enterprise/frontend/src/embedding-sdk-package @metabase/embedding
-enterprise/frontend/src/embedding-sdk-bundle @metabase/embedding
-enterprise/frontend/src/embedding-sdk-shared @metabase/embedding
-frontend/src/metabase/embedding-sdk @metabase/embedding
-frontend/src/metabase/public/containers/PublicOrEmbeddedQuestion @metabase/embedding
-frontend/src/metabase/public/containers/PublicOrEmbeddedDashboard @metabase/embedding
+# enterprise/frontend/src/embedding-sdk-package @metabase/embedding
+# enterprise/frontend/src/embedding-sdk-bundle @metabase/embedding
+# enterprise/frontend/src/embedding-sdk-shared @metabase/embedding
+# frontend/src/metabase/embedding-sdk @metabase/embedding
+# frontend/src/metabase/public/containers/PublicOrEmbeddedQuestion @metabase/embedding
+# frontend/src/metabase/public/containers/PublicOrEmbeddedDashboard @metabase/embedding
 frontend/src/metabase/ui @metabase/core-frontend-ux-west
 # snowplow/* @metabase/data
 src/metabase/analytics/prometheus.clj @metabase/cloud-ops
--- a/.github/actions/get-cache-keys/action.yml
+++ b/.github/actions/get-cache-keys/action.yml
@@ -10,6 +10,12 @@ outputs:
  node-cache-key:
    description: "The cache key for the Node.js cache."
    value: ${{ steps.keys-factory.outputs.node-cache-key }}
+  eslint-cache-key:
+    description: "The cache key for Eslint cache"
+    value: ${{ steps.keys-factory.outputs.eslint-cache-key }}
+  cypress-cache-key:
+    description: "The cache key for Cypress cache"
+    value: ${{ steps.keys-factory.outputs.cypress-cache-key }}

 runs:
  using: "composite"
@@ -19,9 +25,13 @@ runs:
      run: |
        M2_CACHE_PREFIX='M2'
        NODE_CACHE_PREFIX='node-modules'
+        ESLINT_CACHE_PREFIX='eslint'
+        CYPRESS_CACHE_PREFIX='cypress'
        WEEK_OF_YEAR=$(/bin/date "+%G-%V")
        CACHE_SUFFIX="${{ runner.os }}-$WEEK_OF_YEAR"

        echo "m2-cache-key=$M2_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
        echo "node-cache-key=$NODE_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
+        echo "eslint-cache-key=$ESLINT_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
+        echo "cypress-cache-key=$CYPRESS_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
      shell: bash
--- a/.github/actions/maximize-disk-space/action.yml
+++ b/.github/actions/maximize-disk-space/action.yml
@@ -0,0 +1,19 @@
+name: Maximize disk space
+description: Removes unused stuff from GH runner
+
+runs:
+  using: "composite"
+  steps:
+    - name: Maximize build space
+      shell: bash
+      run: |
+        echo "-- Dotnet"
+        sudo rm -rf /usr/share/dotnet
+        echo "-- Android"
+        sudo rm -rf /usr/local/lib/android
+        echo "-- Haskell"
+        sudo rm -rf /opt/ghc
+        echo "-- CodeQL"
+        sudo rm -rf /opt/hostedtoolcache/CodeQL
+
+        df -h
--- a/.github/actions/prepare-backend/action.yml
+++ b/.github/actions/prepare-backend/action.yml
@@ -25,11 +25,6 @@ runs:
        curl -O https://download.clojure.org/install/linux-install-${{ inputs.clojure-version }}.sh &&
        sudo bash ./linux-install-${{ inputs.clojure-version }}.sh

-    - name: Fetch CI config
-      shell: bash
-      run: |
-        curl -o ci-test-config.json https://raw.githubusercontent.com/metabase/metabase/refs/heads/master/ci-test-config.json
-
    - name: Get M2 cache key
      uses: ./.github/actions/get-cache-keys
      id: get-cache-keys
--- a/.github/actions/prepare-cypress/action.yml
+++ b/.github/actions/prepare-cypress/action.yml
@@ -22,16 +22,16 @@ runs:
        chrome-version: 1097615
      id: setup-chrome

-    - name: Get current week of year
-      id: get-date
-      run: |
-        echo "week-of-year=$(/bin/date "+%G-%V")" >> $GITHUB_OUTPUT
-      shell: bash
+    - name: Get cache keys
+      uses: ./.github/actions/get-cache-keys
+      id: get-cache-keys
+
    - name: Get Cypress cache
-      uses: actions/cache@v4
+      uses: actions/cache/restore@v4
      with:
        path: ~/.cache/Cypress
-        key: ${{ runner.os }}-Cypress-${{ steps.get-date.outputs.week-of-year }}
+        key: ${{ steps.get-cache-keys.outputs.cypress-cache-key }}
+
    - name: Ensure that Cypress executable is ready
      run: |
        yarn cypress install
--- a/.github/actions/prepare-frontend/action.yml
+++ b/.github/actions/prepare-frontend/action.yml
@@ -6,7 +6,7 @@ inputs:
  apply-patches:
    description: "Whether to patch frontend dependencies with patch-package."
    required: true
-    default: 'true'
+    default: "true"
 runs:
  using: "composite"
  steps:
@@ -28,11 +28,21 @@ runs:
          ~/.gitlibs
        key: ${{ steps.get-cache-keys.outputs.m2-cache-key }}

+    - name: Get yarn cache directory
+      id: yarn-cache-dir
+      run: |
+        YARN_CACHE_DIR=$(yarn cache dir)
+        echo "Yarn cache directory: $YARN_CACHE_DIR"
+        echo "dir=$YARN_CACHE_DIR" >> $GITHUB_OUTPUT
+      shell: bash
+
    - name: Restore node_modules cache
      uses: actions/cache/restore@v4
      id: node-modules-cache
      with:
-        path: node_modules
+        path: |
+          ${{ steps.yarn-cache-dir.outputs.dir }}
+          node_modules
        key: ${{ steps.get-cache-keys.outputs.node-cache-key }}

    # postinstall lifecycle hook can be dangerous in CI so we only run it locally (see package.json)
--- a/.github/actions/run-embedding-sdk-storybook/action.yml
+++ b/.github/actions/run-embedding-sdk-storybook/action.yml
@@ -1,31 +0,0 @@
-name: Run Embedding SDK Storybook
-runs:
-  using: "composite"
-  steps:
-    - name: Prepare frontend environment
-      uses: ./.github/actions/prepare-frontend
-
-    - name: Prepare back-end environment
-      uses: ./.github/actions/prepare-backend
-
-    - name: Compile CLJS
-      run: yarn build-pure:cljs
-      shell: bash
-
-    - name: Build Storybook
-      run: yarn build-storybook-embedding-sdk
-      shell: bash
-
-    - name: Serve Storybook
-      run: yarn http-server storybook-static -p 6006 &
-      shell: bash
-
-    - name: Wait for Storybook to become available
-      run: |
-        echo "Waiting for Storybook to be served..."
-        while ! curl --silent --fail http://localhost:6006; do
-          sleep 5
-          echo "Retrying..."
-        done
-        echo "Storybook is being served!"
-      shell: bash
--- a/.github/actions/test-driver/action.yml
+++ b/.github/actions/test-driver/action.yml
@@ -9,33 +9,71 @@ inputs:
  build-static-viz:
    required: true
    default: false
+  logs-artifact-suffix:
+    required: false
+    description: Suffix to append to the test logs artifact name to avoid conflicts in matrix jobs
+
+outputs:
+  quarantine-skipped:
+    description: Whether the driver test was skipped due to quarantine
+    value: ${{ steps.check-driver.outputs.skip }}

 runs:
  using: "composite"
  steps:
+    - name: Check if driver is ignored
+      id: check-driver
+      shell: bash
+      run: |
+        # If DRIVERS env var is not set, proceed with tests
+        if [ -z "$DRIVERS" ]; then
+          echo "No DRIVERS env var set. Proceeding with tests."
+          echo "skip=false" >> $GITHUB_OUTPUT
+          exit 0
+        fi
+
+        # Fetch CI config and check if driver should be skipped
+        curl -sSf -o ci-test-config.json https://raw.githubusercontent.com/metabase/ci-test-config/refs/heads/master/ci-test-config.json || true
+
+        # Check if the driver is in the ignored list (gracefully handle missing/invalid config)
+        IS_IGNORED=$(jq --arg driver "$DRIVERS" '.ignored.drivers // [] | contains([$driver])' ci-test-config.json 2>/dev/null || echo "false")
+
+        if [ "$IS_IGNORED" = "true" ]; then
+          echo "⚠️  Driver '$DRIVERS' is in the ignored list. Skipping tests."
+          echo "View the ignored list here: https://github.com/metabase/ci-test-config/blob/master/ci-test-config.json"
+          echo "skip=true" >> $GITHUB_OUTPUT
+        else
+          echo "Driver '$DRIVERS' is not ignored. Proceeding with tests."
+          echo "skip=false" >> $GITHUB_OUTPUT
+        fi
+
    - name: Prepare back-end environment
+      if: steps.check-driver.outputs.skip != 'true'
      uses: ./.github/actions/prepare-backend
    - name: Prepare front-end environment
+      if: ${{ steps.check-driver.outputs.skip != 'true' && inputs.build-static-viz == 'true' }}
      uses: ./.github/actions/prepare-frontend
-      if: ${{ inputs.build-static-viz == 'true' }}
    - name: Build static viz frontend
+      if: ${{ steps.check-driver.outputs.skip != 'true' && inputs.build-static-viz == 'true' }}
      run: yarn build-static-viz
      shell: bash
-      if: ${{ inputs.build-static-viz == 'true' }}
      env:
        MB_EDITION: ee
    - name: Test database driver
+      if: steps.check-driver.outputs.skip != 'true'
      run: clojure -X:dev:ci:ee:ee-dev:drivers:drivers-dev:test ${{ inputs.test-args }}
      shell: bash
      id: run-test
      # Trunk Quarantine controls the final state of the run in the CI!
-      # Even if this step fails, we let it pass and then `trunk-io/analytics-uploader` determines whether to fail or to
-      # pass the whole job, based on the quarantine list.
-      # We only want to "continue on error" (ignore failures) when the Trunk upload is active - i.e. not on drafts!
-      continue-on-error: ${{ !(github.event_name == 'pull_request' && github.event.pull_request.draft == true) }}
+      # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
+      # whether to fail or to pass the whole job, based on the quarantine list.
+      continue-on-error: true
    - name: Publish Test Report (JUnit)
      uses: dorny/test-reporter@v1
-      if: ${{ steps.run-test.outcome == 'failure' }}
+      # As per the documentation: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#steps-context
+      # test.outcome gives us access to the result before `continue-on-error` overrides it and sets it to 'success'.
+      # We want test reports even if the test step gets cancelled (e.g. times out), hence we match anything that is not a 'success'.
+      if: ${{ steps.run-test.outcome != 'success' && steps.check-driver.outputs.skip != 'true' }}
      with:
        path: "target/junit/**/*_test.xml"
        name: JUnit Test Report ${{ inputs.junit-name }}
@@ -44,10 +82,10 @@ runs:
        list-tests: failed
        fail-on-error: false
    - name: Upload Logs on Failure
-      if: ${{ steps.run-test.outcome == 'failure' }}
+      if: always() && steps.run-test.outcome != 'success' && steps.check-driver.outputs.skip != 'true'
      uses: actions/upload-artifact@v4
      with:
-        name: test-logs-${{ github.job }}
+        name: ${{ format('test-logs-{0}{1}', github.job, (inputs.logs-artifact-suffix == '' || inputs.logs-artifact-suffix == null) && '' || format('-{0}', inputs.logs-artifact-suffix)) }}
        path: logs/test-log.json
        retention-days: 1
      # Failing to upload the artifact should never affect the outcome of the whole test run.
--- a/.github/actions/upload-test-results/action.yml
+++ b/.github/actions/upload-test-results/action.yml
@@ -20,7 +20,7 @@ inputs:
    required: true
  variant:
    required: false
-    default: ''
+    default: ""

 runs:
  using: "composite"
@@ -48,10 +48,12 @@ runs:
        aws s3 cp ${OUTPUT_FILE}.zip s3://$BUCKET/$DATE/$GITHUB_RUN_ID/$GITHUB_RUN_ATTEMPT/

    - name: Upload results to Trunk
-      if: ${{ always() && !(github.event_name == 'pull_request' && github.event.pull_request.draft == true) }}
+      if: always() # Important! This step must always run because it controls job's exit code.
      uses: trunk-io/analytics-uploader@main
      with:
        junit-paths: ${{ inputs.input-path }}
        variant: ${{ inputs.variant || inputs.output-name }}
        org-slug: metabase
+        dry-run: ${{ github.event_name == 'pull_request' && github.event.pull_request.draft == true }} # quarantine, but do not upload results
        token: ${{ inputs.trunk-api-token }}
+        use-cache: true
--- a/.github/codeql/codeql-config.yml
+++ b/.github/codeql/codeql-config.yml
@@ -1,3 +1,5 @@
+version: 1
+
 name: "Metabase CodeQL config"

 paths-ignore:
--- a/.github/file-paths.yaml
+++ b/.github/file-paths.yaml
@@ -11,15 +11,19 @@ shared_specs: &shared_specs
  - "test/**/*.cljc"
  - "test/**/*.cljs"

-frontend_ci: &frontend_ci
+shared_ci: &shared_ci
  - ".github/actions/prepare-frontend/**"
  - ".github/actions/prepare-backend/**"
-  - ".github/workflows/frontend.yml"
+  - ".github/workflows/run-tests.yml"

-frontend_embedding_sdk_ci: &frontend_embedding_sdk_ci
-  - ".github/actions/prepare-frontend/**"
-  - ".github/actions/prepare-backend/**"
-  - ".github/workflows/*embedding-sdk*.yml"
+shared_e2e: &shared_e2e
+  - "e2e/runner/**"
+  - "e2e/snapshot-creators/**"
+  - "e2e/support/**"
+
+frontend_ci: &frontend_ci
+  - *shared_ci
+  - ".github/workflows/frontend.yml"

 frontend_configs: &frontend_configs
  - "yarn.lock"
@@ -41,14 +45,12 @@ frontend_sources: &frontend_sources
  - "enterprise/frontend/!(test)**/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
  - "frontend/!(test)**/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"

+# Used only in .github/workflows/conventional-commit-pr-title-reminder.yml
 frontend_embedding_sources:
  - "enterprise/frontend/src/{embedding,embedding-*}/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
  - "enterprise/frontend/src/metabase-enterprise/{embedding,embedding-*}**/{!(*.spec),}.{js,jsx,ts,tsx,css}"

-frontend_embedding_sdk_sources:
-  - *frontend_configs
-  - "enterprise/frontend/!(test)**/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
-
+# Used only in .github/workflows/embedding-sdk-labels-reminder.yml
 frontend_embedding_sdk_package_sources:
  - "enterprise/frontend/src/embedding-sdk-package/**/!(*.spec).{js,jsx,ts,tsx,css}"

@@ -76,8 +78,7 @@ frontend_loki_ci: &frontend_loki_ci
  - ".storybook/**"

 backend_ci: &backend_ci
-  - ".github/actions/prepare-frontend/**"
-  - ".github/actions/prepare-backend/**"
+  - *shared_ci
  - ".github/actions/test-driver/**"
  - ".github/workflows/backend.yml"
  - ".github/workflows/drivers.yml"
@@ -117,9 +118,9 @@ sources: &sources
  - *backend_sources

 e2e_ci: &e2e_ci
-  - ".github/actions/prepare-frontend/**"
-  - ".github/actions/prepare-backend/**"
+  - *shared_ci
  - ".github/actions/prepare-uberjar-artifact/**"
+  - ".github/actions/fetch-artifact/action.yml"
  - ".github/actions/e2e-prepare-containers/**"
  - ".github/actions/prepare-cypress/**"
  - ".github/workflows/e2e-*"
@@ -127,22 +128,27 @@ e2e_ci: &e2e_ci
 e2e_specs: &e2e_specs
  - e2e/!(test-host-app)**/*.cy.*.{js,ts}

-e2e_cross_version: &e2e_cross_version
-  - ".github/workflows/e2e-cross-version.yml"
-  - "e2e/test/scenarios/cross-version/**"
+embedding_sdk_ci: &embedding_sdk_ci
+  - *shared_ci
+  - ".github/actions/prepare-uberjar-artifact/**"
+  - ".github/actions/fetch-artifact/action.yml"
+  - ".github/actions/prepare-cypress/**"
+  - ".github/workflows/embedding-sdk*.yml"

-e2e_embedding_sdk:
-  - *frontend_embedding_sdk_ci
-  - *sources
-  - "e2e/component/**/*.cy.*.{js,ts}"
-
-e2e_embedding_sdk_compatibility:
+embedding_sdk_components:
  - *default
-  - *frontend_embedding_sdk_ci
+  - *embedding_sdk_ci
+  - *sources
+  - *shared_e2e
+  - "e2e/test-component/**/*.cy.*.{js,jsx,ts,tsx}"
+
+embedding_sdk_host_sample_apps:
+  - *default
+  - *embedding_sdk_ci
  - *frontend_sources
  - *backend_sources
+  - *shared_e2e
  - "e2e/embedding-sdk-host-apps/**"
-  - "e2e/runner/embedding-sdk/**"
  - "e2e/test-host-app/**/*.cy.*.{js,ts}"

 snowplow: &snowplow
@@ -170,6 +176,7 @@ yaml:
  - "**/*.yaml"

 codeql:
+  - ".github/workflows/codeql.yml"
  - "frontend/src/**"
  - "enterprise/frontend/src/**"

--- a/.github/scripts/build-e2e-matrix.js
+++ b/.github/scripts/build-e2e-matrix.js
@@ -3,14 +3,8 @@
 // grouping some specific tests together, other tests are split into chunks

 const DEFAULT_SPEC_PATTERN = "./e2e/test/scenarios/**/*.cy.spec.*";
-const EMBEDDING_SDK_SPEC_PATTERN =
-  "./e2e/test/scenarios/embedding-sdk/**.cy.spec.*";

 const specialTestConfigs = [
-  {
-    name: "embedding-sdk",
-    specs: EMBEDDING_SDK_SPEC_PATTERN,
-  },
  {
    name: "oss-subset",
    edition: "oss",
--- a/.github/scripts/build-e2e-matrix.unit.spec.js
+++ b/.github/scripts/build-e2e-matrix.unit.spec.js
@@ -11,7 +11,7 @@ describe("buildMatrix", () => {
  it("should calculate correct regular chunks with default parameters", () => {
    const result = testBuildMatrix("./e2e/test/scenarios/**/*.cy.spec.*", 30);

-    expect(result.regularChunks).toBe(26);
+    expect(result.regularChunks).toBe(27);
  });

  it("should create correct number of configuration objects", () => {
@@ -23,7 +23,7 @@ describe("buildMatrix", () => {
  it("should apply default specs path when empty entry is provided", () => {
    const result = testBuildMatrix("", 6);

-    expect(result.regularChunks).toBe(2);
+    expect(result.regularChunks).toBe(3);
    expect(result.config.length).toBe(6);
  });

@@ -39,14 +39,13 @@ describe("buildMatrix", () => {
  });

  it("should handle case when input chunks equals special tests count", () => {
-    const result = testBuildMatrix("./e2e/test/scenarios/**/*.cy.spec.*", 4);
+    const result = testBuildMatrix("./e2e/test/scenarios/**/*.cy.spec.*", 3);

    expect(result.regularChunks).toBe(0);
-    expect(result.config.length).toBe(4);
-    expect(result.config[0].name).toBe("embedding-sdk");
-    expect(result.config[1].name).toBe("oss-subset");
-    expect(result.config[2].name).toBe("mongo");
-    expect(result.config[3].name).toBe("python");
+    expect(result.config.length).toBe(3);
+    expect(result.config[0].name).toBe("oss-subset");
+    expect(result.config[1].name).toBe("mongo");
+    expect(result.config[2].name).toBe("python");
  });

  it("should correctly calculate regularChunks for non-default spec pattern", () => {
@@ -84,7 +83,6 @@ describe("buildMatrix", () => {
  it("should return special test configs when default spec pattern is provided", () => {
    const result = testBuildMatrix("./e2e/test/scenarios/**/*.cy.spec.*", 50);

-    expect(result.config[46].name).toBe("embedding-sdk");
    expect(result.config[47].name).toBe("oss-subset");
    expect(result.config[48].name).toBe("mongo");
    expect(result.config[49].name).toBe("python");
--- a/.github/workflows/backend.yml
+++ b/.github/workflows/backend.yml
@@ -48,13 +48,11 @@ jobs:
          - name: Enterprise Tests
            edition: ee
            test-group-name: ee
-            build-static-viz: 'false'
            test-args: >-
              :only '"enterprise/backend/test"'
          - name: EE App DB Tests (Part 1)
            edition: ee
            test-group-name: ee-app-db-1
-            build-static-viz: 'true'
            test-args: >-
              :only '["test" ".clj-kondo/test"]'
              :partition/total 2
@@ -62,7 +60,6 @@ jobs:
          - name: EE App DB Tests (Part 2)
            edition: ee
            test-group-name: ee-app-db-2
-            build-static-viz: 'true'
            test-args: >-
              :only '["test" ".clj-kondo/test"]'
              :partition/total 2
@@ -70,7 +67,6 @@ jobs:
          - name: OSS App DB Tests (Part 1)
            edition: oss
            test-group-name: oss-app-db-1
-            build-static-viz: 'true'
            test-args: >-
              :only '["test" ".clj-kondo/test"]'
              :partition/total 2
@@ -78,7 +74,6 @@ jobs:
          - name: OSS App DB Tests (Part 2)
            edition: oss
            test-group-name: oss-app-db-2
-            build-static-viz: 'true'
            test-args: >-
              :only '["test" ".clj-kondo/test"]'
              :partition/total 2
@@ -103,25 +98,15 @@ jobs:
    steps:
      - uses: actions/checkout@v4
      - name: Prepare front-end environment
-        if: ${{ matrix.job.build-static-viz == 'true' }}
        uses: ./.github/actions/prepare-frontend
      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
        with:
          java-version: "${{ matrix.java-version }}"
-      # Depending on which files changed, we might either have to build static-viz
-      # from scratch or download the previously built artifact
      - name: Build static-viz frontend
-        if: ${{ matrix.job.build-static-viz == 'true' && !inputs.skip }}
        run: yarn build-static-viz
        env:
          MB_EDITION: ${{ matrix.job.edition }}
-      - name: Download Static Viz Bundle Artifact
-        if: ${{ matrix.job.build-static-viz == 'true' && !inputs.skip }}
-        uses: actions/download-artifact@v4
-        with:
-          name: static-viz-bundle-${{ github.sha }}
-          path: resources/frontend_client/app/dist

      - name: "Test Java ${{ matrix.java-version }} ${{ matrix.job.name }}"
        id: run-java-tests
@@ -130,10 +115,9 @@ jobs:
          :exclude-tags '[:mb/driver-tests ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
          ${{ matrix.job.test-args }}
        # Trunk Quarantine controls the final state of the run in the CI!
-        # Even if this step fails, we let it pass and then `trunk-io/analytics-uploader` determines whether to fail or to
-        # pass the whole job, based on the quarantine list.
-        # We only want to "continue on error" (ignore failures) when the Trunk upload is active - i.e. not on drafts!
-        continue-on-error: ${{ !(github.event_name == 'pull_request' && github.event.pull_request.draft == true) }}
+        # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
+        # whether to fail or to pass the whole job, based on the quarantine list.
+        continue-on-error: true

      - name: Upload Test Results
        uses: ./.github/actions/upload-test-results
--- a/.github/workflows/cache-generator.yml
+++ b/.github/workflows/cache-generator.yml
@@ -30,8 +30,8 @@ name: Cache Generator

 on:
  schedule:
-    - cron: '0 3 * * 1'   # Mondays at 03:00 UTC
-  workflow_dispatch:      # manually update the cache
+    - cron: "0 3 * * 1" # Mondays at 03:00 UTC
+  workflow_dispatch: # manually update the cache

 concurrency:
  group: cache-generator
@@ -48,6 +48,8 @@ jobs:
    outputs:
      m2-cache-key: ${{ steps.get-cache-keys.outputs.m2-cache-key }}
      node-cache-key: ${{ steps.get-cache-keys.outputs.node-cache-key }}
+      eslint-cache-key: ${{ steps.get-cache-keys.outputs.eslint-cache-key }}
+      cypress-cache-key: ${{ steps.get-cache-keys.outputs.cypress-cache-key }}

  generate-m2-cache:
    runs-on: ubuntu-22.04
@@ -62,7 +64,7 @@ jobs:

      # Add or remove aliases to affect the cache size and its contents.
      # Adjust to taste, then redeploy this workflow.
-      - name: Pre-resolve dependencies
+      - name: Pre-resolve Clojure dependencies
        run: clojure -A:build:dev:ee:ee-dev:drivers:drivers-dev:cljs -P

      - name: Update M2 cache
@@ -73,12 +75,14 @@ jobs:
            ~/.gitlibs
          key: ${{ env.M2_CACHE_KEY }}

-  generate-node-modules-cache:
+  generate-frontend-caches:
    runs-on: ubuntu-22.04
    timeout-minutes: 15
    needs: get-cache-keys
    env:
      NODE_CACHE_KEY: ${{ needs.get-cache-keys.outputs.node-cache-key }}
+      ESLINT_CACHE_KEY: ${{ needs.get-cache-keys.outputs.eslint-cache-key }}
+      CYPRESS_CACHE_KEY: ${{ needs.get-cache-keys.outputs.cypress-cache-key }}
    steps:
      - uses: actions/checkout@v4
      # `prepare-frontend` action (1) prepares Node.js and (2) fetches the node_modules cache if it exists.
@@ -90,10 +94,39 @@ jobs:
      - name: Install front-end dependencies
        uses: ./.github/actions/prepare-frontend
        with:
-          apply-patches: 'false'
+          apply-patches: "false"
+
+      - name: Get yarn cache directory
+        id: yarn-cache-dir
+        run: |
+          YARN_CACHE_DIR=$(yarn cache dir)
+          echo "Yarn cache directory: $YARN_CACHE_DIR"
+          echo "dir=$YARN_CACHE_DIR" >> $GITHUB_OUTPUT
+
+      - name: Ensure that Cypress executable is ready
+        run: |
+          yarn cypress install
+          yarn cypress cache path
+          yarn cypress cache list
+          yarn cypress verify
+        shell: bash

      - name: Update node_modules cache
        uses: ./.github/actions/update-cache
        with:
-          path: node_modules
+          path: |
+            ${{ steps.yarn-cache-dir.outputs.dir }}
+            node_modules
          key: ${{ env.NODE_CACHE_KEY }}
+
+      - name: Update eslint cache
+        uses: ./.github/actions/update-cache
+        with:
+          path: ${{ github.workspace}}/.eslintcache
+          key: ${{ env.ESLINT_CACHE_KEY }}
+
+      - name: Update Cypress cache
+        uses: ./.github/actions/update-cache
+        with:
+          path: ~/.cache/Cypress
+          key: ${{ env.CYPRESS_CACHE_KEY }}
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -30,9 +30,10 @@ jobs:
    - name: Checkout repository
      uses: actions/checkout@v4
    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v4
      with:
        languages: javascript
        config-file: ./.github/codeql/codeql-config.yml
+        trap-caching: false
    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v4
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -0,0 +1,19 @@
+name: Codespell
+
+on:
+  push:
+    branches:
+      - 'master'
+      - 'release-**'
+  pull_request:
+
+jobs:
+  codespell:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: codespell-project/actions-codespell@v1
+        with:
+          # keep this list in sync with the list in `mage/src/mage/codespell.yml`
+          path: >-
+            docs
--- a/.github/workflows/drivers.yml
+++ b/.github/workflows/drivers.yml
@@ -85,6 +85,7 @@ jobs:
    steps:
    - uses: actions/checkout@v4
    - name: Test Athena driver
+      id: test-driver
      uses: ./.github/actions/test-driver
      with:
        junit-name: 'be-tests-athena-ee'
@@ -93,7 +94,7 @@ jobs:
          :exclude-tags [:mb/transforms-python-test]
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
-      if: always()
+      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
      with:
        input-path: ./target/junit/
        output-name: ${{ github.job }}
@@ -144,9 +145,10 @@ jobs:
      with:
        junit-name: 'be-tests-bigquery-cloud-sdk-ee'
        test-args: ${{ matrix.job.test-args }}
+        logs-artifact-suffix: ${{ matrix.job.name }}
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
-      if: always()
+      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
      with:
        input-path: ./target/junit/
        output-name: ${{ github.job }}
@@ -214,9 +216,10 @@ jobs:
      with:
        junit-name: 'be-tests-clickhouse-ee'
        test-args: ${{ matrix.job.test-args }}
+        logs-artifact-suffix: ${{ matrix.job.name }}
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
-      if: always()
+      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
      with:
        input-path: ./target/junit/
        output-name: ${{ github.job }}
@@ -251,6 +254,7 @@ jobs:
    steps:
    - uses: actions/checkout@v4
    - name: Test Druid driver
+      id: test-driver
      uses: ./.github/actions/test-driver
      with:
        junit-name: 'be-tests-druid-ee'
@@ -259,7 +263,7 @@ jobs:
          :exclude-tags [:mb/transforms-python-test]
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
-      if: always()
+      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
      with:
        input-path: ./target/junit/
        output-name: ${{ github.job }}
@@ -288,6 +292,7 @@ jobs:
    steps:
    - uses: actions/checkout@v4
    - name: Test Druid JDBC driver
+      id: test-driver
      uses: ./.github/actions/test-driver
      with:
        junit-name: 'be-tests-druid-jdbc-ee'
@@ -296,7 +301,7 @@ jobs:
          :exclude-tags [:mb/transforms-python-test]
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
-      if: always()
+      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
      with:
        input-path: ./target/junit/
        output-name: ${{ github.job }}
@@ -325,6 +330,7 @@ jobs:
    steps:
    - uses: actions/checkout@v4
    - name: Test Databricks driver
+      id: test-driver
      uses: ./.github/actions/test-driver
      with:
        junit-name: 'be-tests-databricks-ee'
@@ -333,7 +339,7 @@ jobs:
          :exclude-tags [:mb/transforms-python-test]
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
-      if: always()
+      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
      with:
        input-path: ./target/junit/
        output-name: ${{ github.job }}
@@ -363,6 +369,7 @@ jobs:
    steps:
    - uses: actions/checkout@v4
    - name: Test Databricks driver with multi-catalog
+      id: test-driver
      uses: ./.github/actions/test-driver
      with:
        junit-name: 'be-tests-databricks-multi-catalog-ee'
@@ -371,7 +378,7 @@ jobs:
          :exclude-tags [:mb/transforms-python-test]
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
-      if: always()
+      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
      with:
        input-path: ./target/junit/
        output-name: ${{ github.job }}
@@ -390,10 +397,6 @@ jobs:
    name: H2
    steps:
    - uses: actions/checkout@v4
-    - name: Setup python-runner
-      uses: ./.github/actions/setup-python-runner
-      with:
-        metabase-automation-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
    - name: Test H2 driver
      id: test-driver
      uses: ./.github/actions/test-driver
@@ -404,7 +407,7 @@ jobs:
          :exclude-tags [:mb/transforms-python-test]
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
-      if: always()
+      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
      with:
        input-path: ./target/junit/
        output-name: ${{ github.job }}
@@ -413,12 +416,6 @@ jobs:
        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
        aws-region: ${{ vars.AWS_REGION }}
        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-    - name: Cleanup python-runner
-      if: always()
-      uses: ./.github/actions/cleanup-python-runner
-      with:
-        upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
-        logs-artifact-suffix: ${{ matrix.job.name }} ${{ matrix.version.name }}

  be-tests-mysql-mariadb:
    if: ${{ !inputs.skip }}
@@ -521,12 +518,13 @@ jobs:
        uses: ./.github/actions/test-driver
        with:
          junit-name: ${{ matrix.version.junit-name }}
+          logs-artifact-suffix: ${{ matrix.version.name }}
          test-args: >-
            ${{ matrix.job.test-args }}
            :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
      - name: Upload Test Results
        uses: ./.github/actions/upload-test-results
-        if: always()
+        if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
        with:
          input-path: ./target/junit/
          output-name: ${{ github.job }}
@@ -593,9 +591,10 @@ jobs:
      with:
        junit-name: ${{ matrix.version.junit-name }}
        test-args: ${{ matrix.job.test-args }}
+        logs-artifact-suffix: ${{ matrix.job.name }}
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
-      if: always()
+      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
      with:
        input-path: ./target/junit/
        output-name: ${{ github.job }}
@@ -658,6 +657,7 @@ jobs:
          curl https://raw.githubusercontent.com/metabase/metabase-qa/master/dbs/mongo/certificates/metaca.crt \
          -o ./test_resources/ssl/mongo/metaca.crt
      - name: Test ${{ matrix.version.name }}
+        id: test-driver
        uses: ./.github/actions/test-driver
        with:
          junit-name: ${{ matrix.version.junit-name }}
@@ -666,7 +666,7 @@ jobs:
            :only-tags [:mb/driver-tests]
      - name: Upload Test Results
        uses: ./.github/actions/upload-test-results
-        if: always()
+        if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
        with:
          input-path: ./target/junit/
          output-name: ${{ github.job }}
@@ -693,6 +693,7 @@ jobs:
    steps:
    - uses: actions/checkout@v4
    - name: Test MongoDB driver (Sharded cluster)
+      id: test-driver
      uses: ./.github/actions/test-driver
      with:
        junit-name: 'be-tests-mongo-sharded-cluster-ee'
@@ -700,7 +701,7 @@ jobs:
          :only metabase.driver.mongo.sharded-cluster-test
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
-      if: always()
+      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
      with:
        input-path: ./target/junit/
        output-name: ${{ github.job }}
@@ -765,15 +766,17 @@ jobs:
    steps:
    - uses: actions/checkout@v4
    - name: Test ${{ matrix.version.name }}
+      id: test-driver
      uses: ./.github/actions/test-driver
      with:
        junit-name: ${{ matrix.version.junit-name }}
+        logs-artifact-suffix: ${{ matrix.version.name }}
        test-args: >-
          :only-tags [:mb/driver-tests]
          :exclude-tags [:mb/transforms-python-test]
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
-      if: always()
+      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
      with:
        input-path: ./target/junit/
        output-name: ${{ github.job }}
@@ -866,7 +869,7 @@ jobs:
            :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
      - name: Upload Test Results
        uses: ./.github/actions/upload-test-results
-        if: always()
+        if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
        with:
          input-path: ./target/junit/
          output-name: ${{ github.job }}
@@ -934,6 +937,7 @@ jobs:
        -file /tmp/presto-ssl-ca.der
        -trustcacerts
    - name: Test Presto JDBC driver
+      id: test-driver
      uses: ./.github/actions/test-driver
      with:
        junit-name: 'be-tests-presto-jdbc-ee'
@@ -942,7 +946,7 @@ jobs:
          :exclude-tags [:mb/transforms-python-test]
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
-      if: always()
+      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
      with:
        input-path: ./target/junit/
        output-name: ${{ github.job }}
@@ -965,12 +969,22 @@ jobs:
            test-args: >-
              :only-tags [:mb/upload-tests]
              :fail-fast? true
-          - name: Redshift (Excluding Upload Tests)
+          - name: Redshift (Excluding Upload Tests) Part 1
            skip: false
            test-args: >-
              :only-tags [:mb/driver-tests]
              :exclude-tags '[:mb/upload-tests :mb/transforms-python-test]'
              :fail-fast? true
+              :partition/total 2
+              :partition/index 0
+          - name: Redshift (Excluding Upload Tests) Part 2
+            skip: false
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags '[:mb/upload-tests :mb/transforms-python-test]'
+              :fail-fast? true
+              :partition/total 2
+              :partition/index 1
          - name: Redshift Transforms Python Tests
            skip: false
            test-args: >-
@@ -1002,9 +1016,10 @@ jobs:
        junit-name: 'be-tests-redshift-ee'
        test-args: >-
          ${{ matrix.job.test-args }}
+        logs-artifact-suffix: ${{ matrix.job.name }}
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
-      if: ${{ !matrix.job.skip && !cancelled() }}
+      if: ${{ !matrix.job.skip && !cancelled() && steps.test-driver.outputs.quarantine-skipped != 'true' }}
      with:
        input-path: ./target/junit/
        output-name: ${{ github.job }}
@@ -1020,75 +1035,75 @@ jobs:
        upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
        logs-artifact-suffix: ${{ matrix.job.name }} ${{ matrix.version.name }}

-  # dan sutton 2025-10-23: disable snowflake because of account
-  # issues. https://linear.app/metabase/issue/DEV-997/reenable-snowflake-in-ci. Note that the transforms tests were
-  # disabled previously
-  # be-tests-snowflake-ee:
-  #   if: ${{ !inputs.skip }}
-  #   runs-on: ubuntu-22.04
-  #   timeout-minutes: 60
-  #   strategy:
-  #     fail-fast: false
-  #     matrix:
-  #       job:
-  #         - name: Driver Tests
-  #           test-args: >-
-  #             :only-tags [:mb/driver-tests]
-  #             :exclude-tags [:mb/transforms-python-test]
+  be-tests-snowflake-ee:
+    runs-on: ubuntu-22.04
+    needs: determine-driver-skips
+    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        job:
+          - name: Driver Tests
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags [:mb/transforms-python-test]
 # DS 2025-09-26 temporarily disabled while we diagnose flakes
 #          - name: Transforms Python Tests
 #            test-args: >-
 #              :only-tags [:mb/transforms-python-test]
 #            needs-python-runner: true
-    # env:
-    #   CI: 'true'
-    #   DRIVERS: snowflake
-    #   MB_SNOWFLAKE_TEST_USER: METABASE CI
-    #   MB_SNOWFLAKE_TEST_ACCOUNT: ${{ secrets.MB_SNOWFLAKE_TEST_ACCOUNT }}
-    #   MB_SNOWFLAKE_TEST_PASSWORD: ${{ secrets.MB_SNOWFLAKE_TEST_PASSWORD }}
-    #   MB_SNOWFLAKE_TEST_WAREHOUSE: ${{ secrets.MB_SNOWFLAKE_TEST_WAREHOUSE }}
-    #   MB_SNOWFLAKE_TEST_PK_USER: METABASE PK
-    #   MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY }}
-    #   MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY_2: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY_2 }}
-    #   MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY }}
-    #   MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY_2: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY_2 }}
+    env:
+      CI: 'true'
+      DRIVERS: snowflake
+      MB_SNOWFLAKE_TEST_USER: METABASE CI
+      MB_SNOWFLAKE_TEST_ACCOUNT: ${{ secrets.MB_SNOWFLAKE_TEST_ACCOUNT }}
+      MB_SNOWFLAKE_TEST_PASSWORD: ${{ secrets.MB_SNOWFLAKE_TEST_PASSWORD }}
+      MB_SNOWFLAKE_TEST_PRIVATE_KEY: ${{ secrets.MB_SNOWFLAKE_TEST_PRIVATE_KEY }}
+      MB_SNOWFLAKE_TEST_WAREHOUSE: ${{ secrets.MB_SNOWFLAKE_TEST_WAREHOUSE }}
+      MB_SNOWFLAKE_TEST_PK_USER: METABASE PK
+      MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY }}
+      MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY_2: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY_2 }}
+      MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY }}
+      MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY_2: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY_2 }}

-    #   # RSA Role testing:
-    #   MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_DEFAULT_USER: RSA_ROLE_TEST_DEFAULT_USER
-    #   MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_CUSTOM_USER: RSA_ROLE_TEST_CUSTOM_USER
-    #   MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_ROLE: RSA_ROLE_TEST_ROLE
-    #   MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_DB: RSA_ROLE_TEST_DB
-    # name: Snowflake ${{ matrix.job.name }}
-    # steps:
-    # - uses: actions/checkout@v4
-    # - name: Setup python-runner
-    #   if: ${{ matrix.job.needs-python-runner == true }}
-    #   uses: ./.github/actions/setup-python-runner
-    #   with:
-    #     metabase-automation-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-    # - name: Test Snowflake driver
-    #   id: test-driver
-    #   uses: ./.github/actions/test-driver
-    #   with:
-    #     junit-name: 'be-tests-snowflake-ee'
-    #     test-args: ${{ matrix.job.test-args }}
-    # - name: Upload Test Results
-    #   uses: ./.github/actions/upload-test-results
-    #   if: always()
-    #   with:
-    #     input-path: ./target/junit/
-    #     output-name: ${{ github.job }}
-    #     bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-    #     aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-    #     aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
-    #     aws-region: ${{ vars.AWS_REGION }}
-    #     trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-    # - name: Cleanup python-runner
-    #   if: ${{ always() && matrix.job.needs-python-runner == true }}
-    #   uses: ./.github/actions/cleanup-python-runner
-    #   with:
-    #     upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
-    #     logs-artifact-suffix: ${{ matrix.job.name }} ${{ matrix.version.name }}
+      # RSA Role testing:
+      MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_DEFAULT_USER: RSA_ROLE_TEST_DEFAULT_USER
+      MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_CUSTOM_USER: RSA_ROLE_TEST_CUSTOM_USER
+      MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_ROLE: RSA_ROLE_TEST_ROLE
+      MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_DB: RSA_ROLE_TEST_DB
+    name: Snowflake ${{ matrix.job.name }}
+    steps:
+    - uses: actions/checkout@v4
+    - name: Setup python-runner
+      if: ${{ matrix.job.needs-python-runner == true }}
+      uses: ./.github/actions/setup-python-runner
+      with:
+        metabase-automation-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+    - name: Test Snowflake driver
+      id: test-driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-snowflake-ee'
+        test-args: ${{ matrix.job.test-args }}
+        logs-artifact-suffix: ${{ matrix.job.name }}
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+    - name: Cleanup python-runner
+      if: ${{ always() && matrix.job.needs-python-runner == true }}
+      uses: ./.github/actions/cleanup-python-runner
+      with:
+        upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
+        logs-artifact-suffix: ${{ matrix.job.name }} ${{ matrix.version.name }}

  be-tests-sparksql-ee:
    needs: determine-driver-skips
@@ -1107,6 +1122,7 @@ jobs:
    steps:
    - uses: actions/checkout@v4
    - name: Test Spark driver
+      id: test-driver
      uses: ./.github/actions/test-driver
      with:
        junit-name: 'be-tests-sparksql-ee'
@@ -1115,7 +1131,7 @@ jobs:
          :exclude-tags [:mb/transforms-python-test]
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
-      if: always()
+      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
      with:
        input-path: ./target/junit/
        output-name: ${{ github.job }}
@@ -1137,6 +1153,7 @@ jobs:
    steps:
    - uses: actions/checkout@v4
    - name: Test SQLite driver
+      id: test-driver
      uses: ./.github/actions/test-driver
      with:
        junit-name: 'be-tests-sqlite-ee'
@@ -1145,7 +1162,7 @@ jobs:
          :exclude-tags [:mb/transforms-python-test]
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
-      if: always()
+      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
      with:
        input-path: ./target/junit/
        output-name: ${{ github.job }}
@@ -1208,9 +1225,10 @@ jobs:
      with:
        junit-name: ${{ matrix.version.junit-name }}
        test-args: ${{ matrix.job.test-args }}
+        logs-artifact-suffix: ${{ matrix.version.name }}
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
-      if: always()
+      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
      with:
        input-path: ./target/junit/
        output-name: ${{ github.job }}
@@ -1317,6 +1335,7 @@ jobs:
    - name: Make plugins directory
      run: mkdir plugins
    - name: Test Vertica driver
+      id: test-driver
      uses: ./.github/actions/test-driver
      with:
        junit-name: 'be-tests-vertica-ee'
@@ -1325,7 +1344,7 @@ jobs:
          :exclude-tags [:mb/transforms-python-test]
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
-      if: always()
+      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
      with:
        input-path: ./target/junit/
        output-name: ${{ github.job }}
@@ -1352,8 +1371,7 @@ jobs:
      - be-tests-postgres
      - be-tests-presto-jdbc-ee
      - be-tests-redshift-ee
-      # dan: disabled for account reasons. https://linear.app/metabase/issue/DEV-997/reenable-snowflake-in-ci
-      # - be-tests-snowflake-ee
+      - be-tests-snowflake-ee
      - be-tests-sparksql-ee
      - be-tests-sqlite-ee
      - be-tests-sqlserver
--- a/.github/workflows/e2e-component-tests-embedding-sdk-backward-compatibility.yml
+++ b/.github/workflows/e2e-component-tests-embedding-sdk-backward-compatibility.yml
@@ -1,185 +0,0 @@
-# This workflow does the backward compatibility tests
-# between the Embedding SDK package of version N and Embedding SDK Bundle of version N - 1
-# N - 1 is a target of a PR
-name: Embedding SDK backward-compatibility E2E Component Tests
-
-on:
-  workflow_call:
-    inputs:
-      cached-embedding-sdk-dist-artifact-name:
-        required: true
-        type: string
-
-jobs:
-  files-changed:
-    name: "SDK backward-compatibility E2E > Check which files changed"
-    runs-on: ubuntu-22.04
-    timeout-minutes: 3
-    outputs:
-      e2e_embedding_sdk: ${{ steps.changes.outputs.e2e_embedding_sdk }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Test which files changed
-        uses: dorny/paths-filter@v3.0.0
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
-  decide-target-ref:
-    runs-on: ubuntu-latest
-    outputs:
-      target-ref: ${{ steps.get-target-ref.outputs.value }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 2
-
-      - name: Decide ref to checkout
-        id: get-target-ref
-        run: |
-          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-            echo "value=${{ github.base_ref }}" >> "$GITHUB_OUTPUT"
-          else
-            echo "value=$(git rev-parse HEAD^1)" >> "$GITHUB_OUTPUT"
-          fi
-
-  # if this is a test on a release branch, we need to check the build requirements
-  get-build-requirements:
-    name: "SDK backward-compatibility E2E > [Backport only] Get build requirements"
-    needs: [decide-target-ref]
-    if: |
-      !cancelled() &&
-      contains(github.base_ref || github.ref, 'release-x')
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    outputs:
-      java_version: ${{ fromJson(steps.dependencies.outputs.result).java_version }}
-      node_version: ${{ fromJson(steps.dependencies.outputs.result).node_version }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ needs.decide-target-ref.outputs.target-ref }}
-          sparse-checkout: release
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
-      - name: Get build dependencies
-        uses: actions/github-script@v7
-        id: dependencies
-        with:
-          script: | # js
-            const {
-              getBuildRequirements,
-              getVersionFromReleaseBranch,
-            } = require('${{ github.workspace }}/release/dist/index.cjs');
-            const targetBranchName = '${{ github.base_ref || github.ref }}';
-
-            const version = getVersionFromReleaseBranch(targetBranchName);
-            const requirements = getBuildRequirements(version);
-
-            return {
-              java_version: requirements.java,
-              node_version: requirements.node,
-            };
-
-  e2e-tests:
-    name: "SDK backward-compatibility E2E > Run e2e tests"
-    needs: [files-changed, decide-target-ref, get-build-requirements]
-    if: |
-      !cancelled() &&
-      needs.files-changed.outputs.e2e_embedding_sdk == 'true'
-    runs-on: ubuntu-22.04
-    timeout-minutes: 45
-    env:
-      MB_EDITION: ee
-      DISPLAY: ""
-      MB_RUN_MODE: "e2e"
-      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
-      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
-      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
-      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
-      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
-      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
-      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
-      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
-      TZ: US/Pacific # to make node match the instance tz
-      CYPRESS_CI: true
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ needs.decide-target-ref.outputs.target-ref }}
-
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-        with:
-          java-version: "${{ needs.get-build-requirements.outputs.java_version || 21 }}"
-
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-        with:
-          node-version: "${{ needs.get-build-requirements.outputs.node_version }}"
-
-      - name: Build uberjar with ./bin/build.sh
-        run: ./bin/build.sh
-
-      - name: Retrieve Embedding SDK dist artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: ${{ inputs.cached-embedding-sdk-dist-artifact-name }}
-          path: ${{ github.workspace }}/resources/embedding-sdk
-
-      - name: Prepare Cypress environment
-        id: cypress-prep
-        uses: ./.github/actions/prepare-cypress
-
-      - name: Run Metabase
-        run: node e2e/runner/run_cypress_ci.js start
-
-      - name: Make app db snapshot
-        run: node e2e/runner/run_cypress_ci.js snapshot --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-
-      - name: Run component tests for Embedding SDK
-        run: |
-          node e2e/runner/run_cypress_ci.js component \
-            --browser ${{ steps.cypress-prep.outputs.chrome-path }} \
-            --env grepTags="-@skip-backward-compatibility",grepOmitFiltered=true
-
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit
-          output-name: e2e-embedding-sdk
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-
-      - name: Upload Cypress Artifacts upon failure
-        uses: actions/upload-artifact@v4
-        if: failure()
-        with:
-          name: cypress-recording-embedding-sdk-cross-version
-          path: |
-            ./cypress
-            ./logs/test.log
-          if-no-files-found: ignore
-
-      - name: Publish Summary
-        if: failure()
-        uses: actions/github-script@v7
-        with:
-          script: | #js
-            const {
-               generateReport,
-               parseReport,
-               formatSummary
-             } = require("./.github/scripts/handle-mochawesome-report.js");
-
-             const report = await generateReport();
-             const results = parseReport(report);
-             const summary = formatSummary(results);
-
-             await core.summary.addRaw(summary).write();
--- a/.github/workflows/e2e-component-tests-embedding-sdk.yml
+++ b/.github/workflows/e2e-component-tests-embedding-sdk.yml
@@ -1,204 +0,0 @@
-name: E2E Component Tests for Embedding SDK
-
-on:
-  workflow_call:
-    inputs:
-      cached-embedding-sdk-dist-artifact-name:
-        required: true
-        type: string
-
-jobs:
-  files-changed:
-    name: "SDK e2e > Check which files changed"
-    runs-on: ubuntu-22.04
-    timeout-minutes: 3
-    outputs:
-      e2e_embedding_sdk: ${{ steps.changes.outputs.e2e_embedding_sdk }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Test which files changed
-        uses: dorny/paths-filter@v3.0.0
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
-  # if this is a test on a release branch, we need to check the build requirements
-  get-build-requirements:
-    name: "SDK e2e > [Backport only] Get build requirements"
-    if: |
-      !cancelled() &&
-      contains(github.base_ref || github.ref, 'release-x')
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    outputs:
-      java_version: ${{ fromJson(steps.dependencies.outputs.result).java_version }}
-      node_version: ${{ fromJson(steps.dependencies.outputs.result).node_version }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          sparse-checkout: release
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
-      - name: Get build dependencies
-        uses: actions/github-script@v7
-        id: dependencies
-        with:
-          script: | # js
-            const {
-              getBuildRequirements,
-              getVersionFromReleaseBranch,
-            } = require('${{ github.workspace }}/release/dist/index.cjs');
-            const targetBranchName = '${{ github.base_ref || github.ref }}';
-
-            const version = getVersionFromReleaseBranch(targetBranchName);
-            const requirements = getBuildRequirements(version);
-
-            return {
-              java_version: requirements.java,
-              node_version: requirements.node,
-            };
-
-  build-uberjar:
-    name: "SDK e2e > Build uberjar"
-    needs: [files-changed, get-build-requirements]
-    if: |
-      !cancelled() &&
-      needs.files-changed.outputs.e2e_embedding_sdk == 'true'
-    runs-on: ubuntu-22.04
-    timeout-minutes: 25
-    env:
-      MB_EDITION: ee
-      INTERACTIVE: false
-      # make sure that builds on release branches get licenses, because we use them for releases
-      SKIP_LICENSES: ${{ github.event_name == 'pull_request' }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-        with:
-          node-version: "${{ needs.get-build-requirements.outputs.node_version }}"
-
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-        with:
-          java-version: "${{ needs.get-build-requirements.outputs.java_version || 21 }}"
-
-      - name: Build uberjar with ./bin/build.sh
-        run: ./bin/build.sh
-
-      - name: Prepare uberjar artifact
-        uses: ./.github/actions/prepare-uberjar-artifact
-        with:
-          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar-sdk-tests
-
-  e2e-tests:
-    name: "SDK e2e > Run e2e tests (React ${{ matrix.react-version }})"
-    needs: [get-build-requirements, build-uberjar]
-    if: |
-      !cancelled() &&
-      needs.build-uberjar.result == 'success'
-    runs-on: ubuntu-22.04
-    timeout-minutes: 45
-    strategy:
-      matrix:
-        react-version: [18, 19]
-      fail-fast: false
-    env:
-      MB_EDITION: ee
-      DISPLAY: ""
-      MB_RUN_MODE: "e2e"
-      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
-      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
-      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
-      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
-      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
-      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
-      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
-      CYPRESS_IS_EMBEDDING_SDK: "true"
-      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
-      TZ: US/Pacific # to make node match the instance tz
-      CYPRESS_CI: true
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Retrieve uberjar artifact for ee
-        uses: actions/download-artifact@v4
-        with:
-          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar-sdk-tests
-
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-
-      - name: Prepare JDK ${{ needs.get-build-requirements.outputs.java_version || 21 }}
-        uses: actions/setup-java@v4
-        with:
-          java-version: ${{ needs.get-build-requirements.outputs.java_version || 21 }}
-          distribution: "temurin"
-
-      - name: Prepare Cypress environment
-        id: cypress-prep
-        uses: ./.github/actions/prepare-cypress
-
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-
-      - name: Retrieve Embedding SDK dist artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: ${{ inputs.cached-embedding-sdk-dist-artifact-name }}
-          path: ${{ github.workspace }}/resources/embedding-sdk
-
-      - name: Run Metabase
-        run: node e2e/runner/run_cypress_ci.js start
-
-      - name: Make app db snapshot
-        run: node e2e/runner/run_cypress_ci.js snapshot --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-
-      # Has to be run after the app db snapshot is made, as it is not compatible with React 19
-      - name: Change React version to ${{ matrix.react-version }}
-        run: ./bin/embedding-sdk/change-react-version.bash ${{ matrix.react-version }}
-
-      - name: Run component tests for Embedding SDK
-        run: node e2e/runner/run_cypress_ci.js component --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit
-          output-name: e2e-embedding-sdk-react-${{ matrix.react-version }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-
-      - name: "SDK e2e > Upload Cypress Artifacts upon failure"
-        uses: actions/upload-artifact@v4
-        if: failure()
-        with:
-          name: cypress-recording-embedding-sdk-react-${{ matrix.react-version }}
-          path: |
-            ./cypress
-            ./logs/test.log
-          if-no-files-found: ignore
-
-      - name: "SDK e2e > Publish Summary"
-        if: failure()
-        uses: actions/github-script@v7
-        with:
-          script: | #js
-            const {
-               generateReport,
-               parseReport,
-               formatSummary
-             } = require("./.github/scripts/handle-mochawesome-report.js");
-
-             const report = await generateReport();
-             const results = parseReport(report);
-             const summary = formatSummary(results);
-
-             await core.summary.addRaw(summary).write();
--- a/.github/workflows/e2e-cross-version.yml
+++ b/.github/workflows/e2e-cross-version.yml
@@ -1,175 +0,0 @@
-name: E2E Cross-version Tests
-
-on:
-  schedule:
-    - cron: '0 9 * * 1-5'
-  pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
-
-jobs:
-  files-changed:
-    name: Check which files changed
-    # don't run this workflow on a cron for forks
-    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
-    runs-on: ubuntu-22.04
-    timeout-minutes: 3
-    outputs:
-      e2e_cross_version: ${{ steps.changes.outputs.e2e_cross_version }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Test which files changed
-        uses: dorny/paths-filter@v3.0.0
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
-  cross-version-testing:
-    needs: files-changed
-    if: ${{ needs.files-changed.outputs.e2e_cross_version == 'true' || github.event_name == 'schedule'}}
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    strategy:
-      matrix:
-        version: [
-          # Major OSS upgrade
-          { source: v0.42.2, target: v0.48.7 },
-          # OSS upgrade
-          { source: v0.41.3.1, target: v0.42.2 },
-          # EE upgrade
-          { source: v1.43.4, target: v1.44.0 },
-          # EE downgrade
-          { source: v1.42.0, target: v1.41.3.1 },
-          # Cross-edition upgrade
-          { source: v0.41.3.1, target: v1.42.2 }
-        ]
-      fail-fast: false
-    env:
-      CROSS_VERSION_SOURCE: ${{ matrix.version.source }}
-      CROSS_VERSION_TARGET: ${{ matrix.version.target }}
-
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-    - name: Set source Docker image to OSS
-      run: |
-        echo "DOCKER_SOURCE_IMAGE=metabase/metabase:${{ matrix.version.source }}" >> $GITHUB_ENV
-      if: startsWith(matrix.version.source, 'v0')
-    - name: Set source Docker image to EE
-      run: |
-        echo "DOCKER_SOURCE_IMAGE=metabase/metabase-enterprise:${{ matrix.version.source }}" >> $GITHUB_ENV
-      if: startsWith(matrix.version.source, 'v1')
-    - name: Prepare front-end environment
-      uses: ./.github/actions/prepare-frontend
-    - name: Start Metabase ${{ matrix.version.source }}
-      run: |
-        docker run -d \
-        -v $PWD/my-metabase:/metabase.db \
-        -p 3000:3000 \
-        -e MB_RUN_MODE=e2e \
-        -e METASTORE_DEV_SERVER_URL=${{ secrets.METASTORE_DEV_SERVER_URL }} \
-        -e CYPRESS_MB_ALL_FEATURES_TOKEN=${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }} \
-        -e CYPRESS_MB_STARTER_CLOUD_TOKEN=${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }} \
-        -e CYPRESS_MB_PRO_CLOUD_TOKEN=${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }} \
-        -e CYPRESS_MB_PRO_SELF_HOSTED_TOKEN=${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }} \
-        --name metabase-${{ matrix.version.source }} \
-        ${{ env.DOCKER_SOURCE_IMAGE }}
-    - name: Wait for Metabase to start on port 3000
-      run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
-    - name: Prepare Cypress environment
-      id: cypress-prep
-      uses: ./.github/actions/prepare-cypress
-    - name: Run Cypress on the source
-      run: |
-        yarn cypress run \
-          --browser ${{ steps.cypress-prep.outputs.chrome-path }} \
-          --config-file e2e/test/scenarios/cross-version/source/shared/cross-version-source.config.js \
-          --spec e2e/test/scenarios/cross-version/source/**/*.cy.spec.js
-    - name: Stop Metabase ${{ matrix.version.source }}
-      run: docker stop metabase-${{ matrix.version.source }}
-
-    - name: Set target Docker image to OSS
-      run: |
-        echo "DOCKER_TARGET_IMAGE=metabase/metabase:${{ matrix.version.source }}" >> $GITHUB_ENV
-      if: startsWith(matrix.version.source, 'v0')
-    - name: Set target Docker image to EE
-      run: |
-        echo "DOCKER_TARGET_IMAGE=metabase/metabase-enterprise:${{ matrix.version.source }}" >> $GITHUB_ENV
-      if: startsWith(matrix.version.source, 'v1')
-    - name: Start Metabase ${{ matrix.version.target }}
-      run: |
-        docker run -d \
-          -v $PWD/my-metabase:/metabase.db \
-          -p 3001:3000 \
-          -e MB_RUN_MODE=e2e \
-          -e METASTORE_DEV_SERVER_URL=${{ secrets.METASTORE_DEV_SERVER_URL }} \
-          -e CYPRESS_MB_ALL_FEATURES_TOKEN=${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }} \
-          -e CYPRESS_MB_STARTER_CLOUD_TOKEN=${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }} \
-          -e CYPRESS_MB_PRO_CLOUD_TOKEN=${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }} \
-          -e CYPRESS_MB_PRO_SELF_HOSTED_TOKEN=${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }} \
-          --name metabase-${{ matrix.version.target }} \
-          ${{ env.DOCKER_TARGET_IMAGE }}
-    - name: Wait for Metabase to start on port 3001
-      run: while ! curl -s 'http://localhost:3001/api/health' | grep '{"status":"ok"}'; do sleep 1; done
-    - name: Run Cypress on the target
-      run: |
-        yarn cypress run \
-          --browser ${{ steps.cypress-prep.outputs.chrome-path }} \
-          --config-file e2e/test/scenarios/cross-version/target/shared/cross-version-target.config.js \
-          --spec e2e/test/scenarios/cross-version/target/**/*.cy.spec.js
-    - name: Upload Cypress Artifacts upon failure
-      uses: actions/upload-artifact@v4
-      if: failure()
-      with:
-        name: cypress-artifacts-${{ matrix.version.source}}-to-${{ matrix.version.target }}
-        path: |
-          ./cypress
-        if-no-files-found: ignore
-  notify-on-failure:
-    needs: cross-version-testing
-    if: ${{ always() && contains(needs.*.result, 'failure') && github.event_name == 'schedule' }}
-    name: Cross-version test failure
-    runs-on: ubuntu-22.04
-    timeout-minutes: 5
-    steps:
-      - uses: actions/setup-node@v4
-        with:
-          node-version: lts/Jod # 22.x.x
-      - run: npm install @slack/web-api
-      - name: notify slack of failure
-        uses: actions/github-script@v7
-        with:
-          script: | # js
-            const FAILED_RUN_URL = "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}";
-            const REF_NAME = "${{ github.ref_name }}";
-
-            // notify slack of failure
-            const { WebClient } = require('@slack/web-api');
-            const slack = new WebClient('${{ secrets.SLACK_BOT_TOKEN }}');
-
-            await slack.chat.postMessage({
-              channel: 'engineering-ci',
-              text: 'Cross-version Tests Have Failed',
-              blocks: [
-                {
-                  "type": "header",
-                  "text": {
-                    "type": "plain_text",
-                    "text": `:broken_heart:   Cross-version tests are failing on ${REF_NAME}`,
-                    "emoji": true,
-                  }
-                },
-              ],
-              attachments: [{
-                color: "#BF40BF",
-                blocks: [
-                  {
-                    "type": "section",
-                    "text": {
-                      "type": "mrkdwn",
-                      "text": `See <${FAILED_RUN_URL}|failing run details>.`
-                    }
-                  },
-                ]
-              }]
-            });
--- a/.github/workflows/e2e-stress-test-flake-fix.yml
+++ b/.github/workflows/e2e-stress-test-flake-fix.yml
@@ -37,8 +37,26 @@ on:
        default: true

 jobs:
+  determine-test-type:
+    name: Determine test type
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    outputs:
+      type: ${{ steps.detect.outputs.type }}
+    steps:
+      - name: Detect test type from spec path
+        id: detect
+        run: |
+          SPEC='${{ inputs.spec }}'
+          if [[ "$SPEC" == e2e/test-component/scenarios/embedding-sdk/* ]]; then
+            echo "type=component" >> $GITHUB_OUTPUT
+          else
+            echo "type=e2e" >> $GITHUB_OUTPUT
+          fi
+
  workflow-summary:
    name: Stress test inputs
+    needs: [determine-test-type]
    runs-on: ubuntu-22.04
    timeout-minutes: 5
    steps:
@@ -48,6 +66,7 @@ jobs:
          echo '' >> $GITHUB_STEP_SUMMARY
          echo '- `branch`: ${{ github.ref_name }}' >> $GITHUB_STEP_SUMMARY
          echo '- `spec`: ${{ inputs.spec }}' >> $GITHUB_STEP_SUMMARY
+          echo '- `test_type` (inferred): ${{ needs.determine-test-type.outputs.type }}' >> $GITHUB_STEP_SUMMARY
          echo '- `burn_in`: ${{ inputs.burn_in }}' >> $GITHUB_STEP_SUMMARY
          echo '- `grep`: "${{ inputs.grep }}"' >> $GITHUB_STEP_SUMMARY
          echo '- `qa_db`: "${{ inputs.qa_db }}"' >> $GITHUB_STEP_SUMMARY
@@ -56,6 +75,7 @@ jobs:
          echo 'triggered by: @${{ github.event.sender.login }}' >> $GITHUB_STEP_SUMMARY

  stress-test-flake-fix:
+    needs: [determine-test-type]
    runs-on: ubuntu-22.04
    timeout-minutes: 60
    name: Stress test E2E flake fix
@@ -100,6 +120,16 @@ jobs:

      - name: Prepare front-end environment
        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare back-end environment
+        if: ${{ needs.determine-test-type.outputs.type == 'component' }}
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
+      - name: Build Embedding SDK package
+        if: ${{ needs.determine-test-type.outputs.type == 'component' }}
+        run: yarn build-embedding-sdk-package
+
      - name: Prepare JDK 21
        uses: actions/setup-java@v4
        with:
@@ -118,12 +148,12 @@ jobs:
      - name: Stress-test ${{ github.event.inputs.spec }} ${{ github.event.inputs.burn_in }} times
        env:
          GREP: ${{ github.event.inputs.grep }}
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
        run: |
-          node e2e/runner/run_cypress_ci.js e2e \
+          node e2e/runner/run_cypress_ci.js ${{ needs.determine-test-type.outputs.type }} \
          --spec '${{ github.event.inputs.spec }}' \
          --env burn=${{ github.event.inputs.burn_in }} \
-          --config-file e2e/support/cypress-stress-test.config.js \
-          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+          --config-file e2e/support/cypress-stress-test.config.js

      - name: Upload Cypress Artifacts upon failure
        uses: actions/upload-artifact@v4
--- a/.github/workflows/e2e-test.yml
+++ b/.github/workflows/e2e-test.yml
@@ -59,7 +59,6 @@ jobs:
      TZ: US/Pacific # to make node match the instance tz
      CYPRESS_CI: true
      CYPRESS_QA_DB_MONGO: ${{ inputs.name == 'mongo' }}
-      CYPRESS_IS_EMBEDDING_SDK: "${{ inputs.name == 'embedding-sdk' }}"
    steps:
      - uses: actions/checkout@v4
        with:
@@ -85,10 +84,6 @@ jobs:
          mysql: ${{ inputs.name != 'mongo' }}
          mongo: ${{ inputs.name == 'mongo' }}

-      - name: Run Embedding SDK Storybook
-        if: inputs.name == 'embedding-sdk'
-        uses: ./.github/actions/run-embedding-sdk-storybook
-
      - name: Retrieve uberjar artifact for ${{ inputs.edition }}
        uses: ./.github/actions/fetch-artifact
        with:
@@ -125,9 +120,12 @@ jobs:
        run: node e2e/runner/run_cypress_ci.js start

      - name: Generate database snapshots
+        env:
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
        run: node e2e/runner/run_cypress_ci.js snapshot

      - name: Run auto-split Cypress tests on ${{ inputs.name }}
+        id: split-e2e
        if: ${{ !inputs.specs }}
        env:
          SPLIT: ${{ inputs.total_chunks }}
@@ -138,35 +136,34 @@ jobs:
          # do not write cypress-split summary to github
          SPLIT_SUMMARY: false
          SPEC_PATH: ${{ env.specs || inputs.specs }}
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
        shell: bash
        run: |
          echo "Running tests with specs: $SPEC_PATH"
          node e2e/runner/run_cypress_ci.js e2e \
-            --env grepTags="-@mongo+-@python+-@flaky+-@OSS+-@skip",grepOmitFiltered=true \
-            --spec "$SPEC_PATH" \
-            --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+            --env grepTags="-@mongo+-@python+-@OSS+-@skip" \
+            --spec "$SPEC_PATH"
        # Trunk Quarantine controls the final state of the run in the CI!
-        # Even if this step fails, we let it pass and then `trunk-io/analytics-uploader` determines whether to fail or to
-        # pass the whole job, based on the quarantine list.
-        # We only want to "continue on error" (ignore failures) when the Trunk upload is active - i.e. not on drafts!
-        continue-on-error: ${{ !(github.event_name == 'pull_request' && github.event.pull_request.draft == true) }}
+        # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
+        # whether to fail or to pass the whole job, based on the quarantine list.
+        continue-on-error: true

      - name: Run Tagged EE Cypress tests on ${{ inputs.name }}
+        id: tagged-e2e
        if: ${{ inputs.specs }}
        shell: bash
        env:
          SPEC_PATH: ${{ env.specs || inputs.specs }}
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
        run: |
          echo "Running tests with specs: $SPEC_PATH"
          node e2e/runner/run_cypress_ci.js e2e \
-          --env grepTags="${{inputs.tags && format('{0}+-@skip', inputs.tags) || '-@skip'}}",grepOmitFiltered=true \
-          --spec "$SPEC_PATH" \
-          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+          --env grepTags="${{inputs.tags && format('{0}+-@skip', inputs.tags) || '-@skip'}}" \
+          --spec "$SPEC_PATH"
        # Trunk Quarantine controls the final state of the run in the CI!
-        # Even if this step fails, we let it pass and then `trunk-io/analytics-uploader` determines whether to fail or to
-        # pass the whole job, based on the quarantine list.
-        # We only want to "continue on error" (ignore failures) when the Trunk upload is active - i.e. not on drafts!
-        continue-on-error: ${{ !(github.event_name == 'pull_request' && github.event.pull_request.draft == true) }}
+        # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
+        # whether to fail or to pass the whole job, based on the quarantine list.
+        continue-on-error: true

      - name: Upload Test Results
        uses: ./.github/actions/upload-test-results
@@ -185,7 +182,8 @@ jobs:

      - name: Upload Cypress Artifacts upon failure
        uses: actions/upload-artifact@v4
-        if: failure()
+        if: |
+          !cancelled() && (steps.split-e2e.outcome == 'failure' || steps.tagged-e2e.outcome == 'failure')
        with:
          name: cypress-recording-${{ inputs.name }}-${{ inputs.edition }}
          path: |
@@ -195,10 +193,12 @@ jobs:

      - name: Upload Failed Tests
        uses: actions/upload-artifact@v4
-        if: failure()
+        if: |
+          !cancelled() && (steps.split-e2e.outcome == 'failure' || steps.tagged-e2e.outcome == 'failure')
        with:
          name: failed-tests-${{ inputs.name }}-${{ inputs.edition }}
          path: ./cypress/test-results
+          if-no-files-found: ignore

      - name: Extract chunk-specific changed timings
        id: extract-timings
--- a/.github/workflows/e2e-tests.yml
+++ b/.github/workflows/e2e-tests.yml
@@ -73,20 +73,6 @@ jobs:
      tags: ${{ matrix.tags }}
      runner: ${{ matrix.runner }}

-  # run this separately to make it non-blocking
-  flaky-e2e-tests:
-    name: Flaky e2e Tests
-    uses: ./.github/workflows/e2e-test.yml
-    needs:
-      - e2e-matrix-builder
-    # skip flaky test run if only e2e specs changed as an optimization
-    if: |
-      !cancelled() && !inputs.skip && needs.e2e-matrix-builder.outputs.isDefaultSpecPattern == 'true'
-    secrets: inherit
-    with:
-      name: Flaky
-      tags: "@flaky"
-
  collect-timings:
    name: Collect E2E Timings
    runs-on: ubuntu-22.04
@@ -152,14 +138,12 @@ jobs:
  e2e-tests-result:
    needs:
      - e2e-tests
-      - flaky-e2e-tests
    runs-on: ubuntu-latest
    timeout-minutes: 5
    name: e2e-tests-result
    if: always() && !cancelled()
    env:
      E2E_TESTS_RESULT: ${{ needs.e2e-tests.result }}
-      FLAKY_E2E_TESTS_RESULT: ${{ needs.flaky-e2e-tests.result }}
    steps:
      - name: Stub
        if: ${{ needs.e2e-tests.result == 'skipped' }}
@@ -169,7 +153,6 @@ jobs:
        if: ${{ needs.e2e-tests.result != 'skipped' }}
        run: | # sh
          echo "E2E Tests: ${{ needs.e2e-tests.result }}"
-          echo "Flaky E2E Tests: ${{ needs.flaky-e2e-tests.result }}"

          if [ "${{ needs.e2e-tests.result }}" != "success" ]; then
            echo "E2E Tests failed"
--- a/.github/workflows/embedding-sdk-component-tests.yml
+++ b/.github/workflows/embedding-sdk-component-tests.yml
@@ -0,0 +1,250 @@
+name: Embedding SDK Component Tests
+
+on:
+  workflow_call:
+
+jobs:
+  sdk-component-tests:
+    name: "SDK component tests (React ${{ matrix.react-version }})"
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    strategy:
+      matrix:
+        react-version: [18, 19]
+      fail-fast: false
+    env:
+      MB_EDITION: ee
+      DISPLAY: ""
+      MB_RUN_MODE: "e2e"
+      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
+      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
+      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
+      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
+      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
+      TZ: US/Pacific # to make node match the instance tz
+      CYPRESS_CI: true
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Retrieve uberjar artifact for ee
+        uses: ./.github/actions/fetch-artifact
+        with:
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          extract-path: "target/uberjar"
+          output-name: "metabase.jar"
+
+      - name: Retrieve Embedding SDK dist artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
+          path: ${{ github.workspace }}/resources/embedding-sdk
+
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare JDK 21
+        uses: actions/setup-java@v4
+        with:
+          java-version: 21
+          distribution: "temurin"
+
+      - name: Prepare Cypress environment
+        id: cypress-prep
+        uses: ./.github/actions/prepare-cypress
+
+      - name: Run Metabase
+        run: node e2e/runner/run_cypress_ci.js start
+
+      - name: Make app db snapshot
+        env:
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
+        run: node e2e/runner/run_cypress_ci.js snapshot
+
+      # Has to be run after the app db snapshot is made, as it is not compatible with React 19
+      - name: Change React version to ${{ matrix.react-version }}
+        run: ./bin/embedding-sdk/change-react-version.bash ${{ matrix.react-version }}
+
+      - name: Run component tests for Embedding SDK
+        env:
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
+        run: node e2e/runner/run_cypress_ci.js component
+
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always()
+        with:
+          input-path: ./target/junit
+          output-name: e2e-embedding-sdk-react-${{ matrix.react-version }}
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+      - name: "SDK component tests > Upload Cypress Artifacts upon failure"
+        uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: cypress-recording-embedding-sdk-react-${{ matrix.react-version }}
+          path: |
+            ./cypress
+            ./logs/test.log
+          if-no-files-found: ignore
+
+      - name: "SDK component tests > Publish Summary"
+        if: failure()
+        uses: actions/github-script@v7
+        with:
+          script: | #js
+            const {
+               generateReport,
+               parseReport,
+               formatSummary
+             } = require("./.github/scripts/handle-mochawesome-report.js");
+
+             const report = await generateReport();
+             const results = parseReport(report);
+             const summary = formatSummary(results);
+
+             await core.summary.addRaw(summary).write();
+
+  decide-target-ref:
+    runs-on: ubuntu-latest
+    outputs:
+      target-ref: ${{ steps.get-target-ref.outputs.value }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+
+      - name: Decide ref to checkout
+        id: get-target-ref
+        run: |
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            echo "value=${{ github.base_ref }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "value=$(git rev-parse HEAD^1)" >> "$GITHUB_OUTPUT"
+          fi
+
+  # This job ensures that the Embedding SDK package from the current commit (N) works with the
+  # Embedding SDK Bundle (Metabase JAR) from the previous commit (N-1).
+  # N - 1 is a target of a pull request, or a literal previous commit when this job is run on push in a branch.
+  sdk-component-tests-backward-compatibility:
+    name: "SDK component tests (Backward compatibility)"
+    needs: [decide-target-ref]
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    env:
+      MB_EDITION: ee
+      DISPLAY: ""
+      MB_RUN_MODE: "e2e"
+      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
+      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
+      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
+      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
+      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
+      TZ: US/Pacific # to make node match the instance tz
+      CYPRESS_CI: true
+
+    steps:
+      - name: Check out the code from the previous commit
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.decide-target-ref.outputs.target-ref }}
+
+      - name: Get the actual commit SHA from the checked out branch
+        id: get-commit-sha
+        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Attempt to retrieve the ee uberjar artifact from the previous commit
+        id: download-uberjar
+        uses: ./.github/actions/fetch-artifact
+        with:
+          name: metabase-ee-${{ steps.get-commit-sha.outputs.sha }}-uberjar
+          extract-path: "target/uberjar"
+          output-name: "metabase.jar"
+        continue-on-error: true # do not break the whole job if this step doesn't succeed
+
+      # Build the uberjar from the previous commit only if we couldn't fetch it.
+      # `step.foo.OUTCOME` is important because it looks at the step status *before* continue-on-error is applied.
+      # Do not confuse it with the `step.foo.conclusion`.
+      - name: Build MB uberjar from the commit N-1
+        if: steps.download-uberjar.outcome != 'success'
+        run: ./bin/build.sh
+
+      - name: Retrieve Embedding SDK dist artifact built from the current commit N
+        uses: actions/download-artifact@v4
+        with:
+          name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
+          path: ${{ github.workspace }}/resources/embedding-sdk
+
+      - name: Prepare Cypress environment
+        id: cypress-prep
+        uses: ./.github/actions/prepare-cypress
+
+      - name: Run Metabase
+        run: node e2e/runner/run_cypress_ci.js start
+
+      - name: Make app db snapshot
+        env:
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
+        run: node e2e/runner/run_cypress_ci.js snapshot
+
+      - name: Run component tests for Embedding SDK
+        env:
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
+        run: |
+          node e2e/runner/run_cypress_ci.js component \
+            --env grepTags="-@skip-backward-compatibility"
+
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always()
+        with:
+          input-path: ./target/junit
+          output-name: e2e-embedding-sdk
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+      - name: Upload Cypress Artifacts upon failure
+        uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: cypress-recording-embedding-sdk-cross-version
+          path: |
+            ./cypress
+            ./logs/test.log
+          if-no-files-found: ignore
+
+      - name: Publish Summary
+        if: failure()
+        uses: actions/github-script@v7
+        with:
+          script: | #js
+            const {
+               generateReport,
+               parseReport,
+               formatSummary
+             } = require("./.github/scripts/handle-mochawesome-report.js");
+
+             const report = await generateReport();
+             const results = parseReport(report);
+             const summary = formatSummary(results);
+
+             await core.summary.addRaw(summary).write();
--- a/.github/workflows/e2e-embedding-sdk-compatibility-tests.yml
+++ b/.github/workflows/e2e-embedding-sdk-compatibility-tests.yml
@@ -1,78 +1,14 @@
 name: "[NOT REQUIRED] SDK Compatibility tests"

 on:
-  push:
-    branches:
-      - "master"
-      - "release-**"
-  pull_request:
-    types: [opened, synchronize, reopened]
-    branches:
-      - "master"
-      - "release-**"
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
-  cancel-in-progress: true
+  workflow_call:

 jobs:
-  files-changed:
-    name: Check which files changed
-    runs-on: ubuntu-22.04
-    timeout-minutes: 3
-    outputs:
-      e2e_embedding_sdk_compatibility: ${{ steps.changes.outputs.e2e_embedding_sdk_compatibility }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Test which files changed
-        uses: dorny/paths-filter@v3.0.0
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
-  # if this is a test on a release branch, we need to check the build requirements
-  get-build-requirements:
-    if: |
-      !cancelled() &&
-      contains(github.base_ref || github.ref, 'release-x')
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    outputs:
-      java_version: ${{ fromJson(steps.dependencies.outputs.result).java_version }}
-      node_version: ${{ fromJson(steps.dependencies.outputs.result).node_version }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          sparse-checkout: release
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
-      - name: Get build dependencies
-        uses: actions/github-script@v7
-        id: dependencies
-        with:
-          script: | # js
-            const {
-              getBuildRequirements,
-              getVersionFromReleaseBranch,
-            } = require('${{ github.workspace }}/release/dist/index.cjs');
-            const targetBranchName = '${{ github.base_ref || github.ref }}';
-
-            const version = getVersionFromReleaseBranch(targetBranchName);
-            const requirements = getBuildRequirements(version);
-
-            return {
-              java_version: requirements.java,
-              node_version: requirements.node,
-            };
-
  get-sample-apps-data:
-    if: |
-      !cancelled()
    runs-on: ubuntu-22.04
    timeout-minutes: 10
    env:
-      # we must support last two stable releases
+      # we must support the last two stable releases
      SUPPORTED_RELEASES_COUNT: 2
      TEST_SUITES: |
        [
@@ -145,51 +81,6 @@ jobs:
              matrix: []
            };

-  build:
-    needs: [files-changed, get-build-requirements, get-sample-apps-data]
-    if: |
-      !cancelled() &&
-      needs.files-changed.outputs.e2e_embedding_sdk_compatibility == 'true' &&
-      fromJSON(needs.get-sample-apps-data.outputs.matrix)[0] != null
-    runs-on: ubuntu-22.04
-    timeout-minutes: 25
-    env:
-      MB_EDITION: ee
-      INTERACTIVE: false
-      # make sure that builds on release branches get licenses, because we use them for releases
-      SKIP_LICENSES: ${{ github.event_name == 'pull_request' }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-        with:
-          node-version: "${{ needs.get-build-requirements.outputs.node_version }}"
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-        with:
-          java-version: "${{ needs.get-build-requirements.outputs.java_version || 21 }}"
-
-      - name: Build uberjar with ./bin/build.sh
-        run: ./bin/build.sh
-
-      - name: Prepare uberjar artifact
-        uses: ./.github/actions/prepare-uberjar-artifact
-        with:
-          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
-
-      - name: Build Embedding SDK package
-        run: |
-          # Remove the matchers to not report false positives on every PR
-          # unrelated to embedding (EMB-765)
-          echo "::remove-matcher owner=tsc::"
-          yarn build-embedding-sdk-package
-
-      - name: Prepare Embedding SDK artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
-          path: resources/embedding-sdk
-
  # In order to check compatibility between Sample Apps and Embedding SDK, the job for each sample app:
  # - pulls a Sample App
  # - starts it
@@ -197,13 +88,13 @@ jobs:
  # The job is not required, though if it's failing better to be sure that it's not caused by a breaking change.
  # For more details see `Sample Apps compatibility with Embedding SDK tests` in `enterprise/frontend/src/embedding-sdk-package/dev.md`
  e2e-sample-apps-tests:
-    needs: [get-build-requirements, get-sample-apps-data, build]
+    needs: [get-sample-apps-data]
    strategy:
      matrix:
        test_suite: ${{ fromJSON(needs.get-sample-apps-data.outputs.matrix) }}
        environment: ["production", "development"]
    if: |
-      !cancelled() && needs.build.result == 'success'
+      !cancelled() && needs.get-sample-apps-data.result == 'success'
    runs-on: ubuntu-22.04
    timeout-minutes: 45
    name: e2e-sample-app-${{ matrix.test_suite }}-tests-${{ matrix.environment }}-bundle
@@ -216,7 +107,6 @@ jobs:
      MB_RUN_MODE: e2e
      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
-      CYPRESS_IS_EMBEDDING_SDK: "true"
      TZ: US/Pacific # to make node match the instance tz
      CYPRESS_CI: true
      SAMPLE_APP_BRANCH_NAME: ${{ needs.get-sample-apps-data.outputs.branch_name }}
@@ -227,6 +117,8 @@ jobs:
    steps:
      - uses: actions/checkout@v4

+      - uses: ./.github/actions/maximize-disk-space
+
      # We have to use the latest version that does not have this issue https://github.com/docker/compose/pull/12752
      - name: Set up Docker Compose
        uses: docker/setup-compose-action@v1
@@ -241,9 +133,11 @@ jobs:
          echo "sample_app_name=${test_suite%-e2e}" >> "$GITHUB_OUTPUT"

      - name: Retrieve uberjar artifact for ee
-        uses: actions/download-artifact@v4
+        uses: ./.github/actions/fetch-artifact
        with:
          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          extract-path: "target/uberjar"
+          output-name: "metabase.jar"

      - name: Retrieve Embedding SDK dist artifact
        uses: actions/download-artifact@v4
@@ -295,11 +189,19 @@ jobs:
        if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' && matrix.test_suite != 'shoppy-e2e' }}
        run: npx tsx ./e2e/runner/embedding-sdk/sample-apps/start-ci.ts ${{ matrix.test_suite }}

+      - name: Prune build cache
+        run: docker builder prune -af
+
+      - name: Log free disk space
+        run: df -h /
+
      - name: Run e2e tests for Sample App
        id: run-e2e-tests
        if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' }}
        continue-on-error: true
-        run: node e2e/runner/run_cypress_ci.js ${{ matrix.test_suite }} --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+        env:
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
+        run: node e2e/runner/run_cypress_ci.js ${{ matrix.test_suite }}

      - name: Upload Cypress Artifacts upon failure
        uses: actions/upload-artifact@v4
@@ -323,7 +225,6 @@ jobs:
  # The job is not required, though if it's failing better to be sure that it's not caused by a breaking change.
  # For more details see `Embedding SDK integration tests with Host Apps` in `enterprise/frontend/src/embedding-sdk-package/dev.md`
  e2e-host-apps-tests:
-    needs: [get-build-requirements, build]
    strategy:
      matrix:
        test_suite:
@@ -334,8 +235,6 @@ jobs:
            "angular-20-host-app-e2e",
          ]
        environment: ["production", "development"]
-    if: |
-      !cancelled() && needs.build.result == 'success'
    runs-on: ubuntu-22.04
    timeout-minutes: 45
    name: e2e-host-app-${{ matrix.test_suite }}-tests-${{ matrix.environment }}-bundle
@@ -348,7 +247,6 @@ jobs:
      MB_RUN_MODE: e2e
      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
-      CYPRESS_IS_EMBEDDING_SDK: "true"
      TZ: US/Pacific # to make node match the instance tz
      CYPRESS_CI: true
      HOST_APP_ENVIRONMENT: ${{ matrix.environment }}
@@ -359,9 +257,11 @@ jobs:
      - uses: actions/checkout@v4

      - name: Retrieve uberjar artifact for ee
-        uses: actions/download-artifact@v4
+        uses: ./.github/actions/fetch-artifact
        with:
          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          extract-path: "target/uberjar"
+          output-name: "metabase.jar"

      - name: Retrieve Embedding SDK dist artifact
        uses: actions/download-artifact@v4
@@ -394,7 +294,9 @@ jobs:
      - name: Run e2e tests for Host App
        id: run-e2e-tests
        continue-on-error: true
-        run: node e2e/runner/run_cypress_ci.js ${{ matrix.test_suite }} --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+        env:
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
+        run: node e2e/runner/run_cypress_ci.js ${{ matrix.test_suite }}

      - name: Upload Cypress Artifacts upon failure
        uses: actions/upload-artifact@v4
--- a/.github/workflows/embedding-sdk-package-build.yml
+++ b/.github/workflows/embedding-sdk-package-build.yml
@@ -0,0 +1,31 @@
+name: Embedding SDK Package Build
+
+on:
+  workflow_call:
+  workflow_dispatch:
+
+concurrency:
+  group: embedding-sdk-package-${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  build-sdk-package:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      - name: Build Embedding SDK package
+        run: |
+          # Remove the matchers to not report false positives on every PR
+          # unrelated to embedding (EMB-765)
+          echo "::remove-matcher owner=tsc::"
+          yarn build-embedding-sdk-package
+      - name: Prepare Embedding SDK artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
+          path: resources/embedding-sdk
--- a/.github/workflows/embedding-sdk.yml
+++ b/.github/workflows/embedding-sdk.yml
@@ -2,61 +2,39 @@ name: SDK

 on:
  workflow_call:
+    inputs:
+      cli-snippets-type-check:
+        description: "Whether to run cli snippets type check."
+        required: true
+        type: boolean
+      docs-snippets-type-check:
+        description: "Whether to run docs snippets type check."
+        required: true
+        type: boolean
+      documentation-validation:
+        description: "Whether to run documentation generation validation check."
+        required: true
+        type: boolean
+      component-tests:
+        description: "Whether to run component tests."
+        required: true
+        type: boolean
+      host-sample-apps-tests:
+        description: "Whether to run host and sample apps compatibility tests."
+        required: true
+        type: boolean
+      skip:
+        description: Whether to skip running tests due to one of the artifacts failing to build.
+        required: true
+        type: boolean

 concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
  cancel-in-progress: true

 jobs:
-  files-changed:
-    name: Check which files changed
-    runs-on: ubuntu-22.04
-    timeout-minutes: 3
-    outputs:
-      e2e_embedding_sdk: ${{ steps.changes.outputs.e2e_embedding_sdk }}
-      frontend_embedding_sdk_sources: ${{ steps.changes.outputs.frontend_embedding_sdk_sources }}
-      embedding_documentation: ${{ steps.changes.outputs.embedding_documentation }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Test which files changed
-        uses: dorny/paths-filter@v3.0.0
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
-  build:
-    needs: [files-changed]
-    if: |
-      !cancelled() &&
-      (needs.files-changed.outputs.e2e_embedding_sdk == 'true' ||
-      needs.files-changed.outputs.frontend_embedding_sdk_sources == 'true' ||
-      needs.files-changed.outputs.embedding_documentation == 'true')
-    runs-on: ubuntu-22.04
-    timeout-minutes: 25
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-      - name: Build Embedding SDK package
-        run: |
-          # Remove the matchers to not report false positives on every PR
-          # unrelated to embedding (EMB-765)
-          echo "::remove-matcher owner=tsc::"
-          yarn build-embedding-sdk-package
-      - name: Prepare Embedding SDK artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
-          path: resources/embedding-sdk
-
  embedding-sdk-cli-snippets-type-check:
-    needs: [files-changed, build]
-    if: |
-      needs.files-changed.outputs.frontend_embedding_sdk_sources == 'true' &&
-      needs.build.result == 'success'
+    if: inputs.cli-snippets-type-check && !inputs.skip
    runs-on: ubuntu-22.04
    timeout-minutes: 20
    steps:
@@ -72,10 +50,7 @@ jobs:
        run: yarn run embedding-sdk:cli-snippets:type-check

  embedding-sdk-docs-snippets-type-check:
-    needs: [files-changed, build]
-    if: |
-      needs.files-changed.outputs.embedding_documentation == 'true' &&
-      needs.build.result == 'success'
+    if: inputs.docs-snippets-type-check && !inputs.skip
    runs-on: ubuntu-22.04
    timeout-minutes: 20
    steps:
@@ -91,10 +66,7 @@ jobs:
        run: yarn run embedding-sdk:docs-snippets:type-check

  embedding-sdk-api-documentation-generation-validation:
-    needs: [files-changed, build]
-    if: |
-      needs.files-changed.outputs.frontend_embedding_sdk_sources == 'true' &&
-      needs.build.result == 'success'
+    if: inputs.documentation-validation && !inputs.skip
    runs-on: ubuntu-22.04
    timeout-minutes: 20
    steps:
@@ -140,29 +112,24 @@ jobs:
        run: exit 1

  # See `Component e2e tests` in `enterprise/frontend/src/embedding-sdk-package/dev.md`
-  sdk-e2e-tests:
-    name: "SDK e2e tests"
-    uses: ./.github/workflows/e2e-component-tests-embedding-sdk.yml
-    needs: [build]
+  embedding-sdk-component-tests:
+    name: "SDK component tests"
+    if: inputs.component-tests && !inputs.skip
+    uses: ./.github/workflows/embedding-sdk-component-tests.yml
    secrets: inherit
-    with:
-      cached-embedding-sdk-dist-artifact-name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}

-  e2e-component-tests-embedding-sdk-backward-compatibility:
-    name: "SDK e2e backward compatibility tests"
-    uses: ./.github/workflows/e2e-component-tests-embedding-sdk-backward-compatibility.yml
-    needs: [build]
+  not-required-embedding-sdk-apps-compatibility-tests:
+    name: "SDK e2e tests for compatibility with (host/sample) apps"
+    if: inputs.host-sample-apps-tests && !inputs.skip
+    uses: ./.github/workflows/embedding-sdk-host-sample-apps-tests.yml
    secrets: inherit
-    with:
-      cached-embedding-sdk-dist-artifact-name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}

  embedding-sdk-tests-result:
    needs:
      - embedding-sdk-cli-snippets-type-check
      - embedding-sdk-docs-snippets-type-check
      - embedding-sdk-api-documentation-generation-validation
-      - sdk-e2e-tests
-      - e2e-component-tests-embedding-sdk-backward-compatibility
+      - embedding-sdk-component-tests
    if: always() && !cancelled()
    runs-on: ubuntu-latest
    timeout-minutes: 5
--- a/.github/workflows/frontend.yml
+++ b/.github/workflows/frontend.yml
@@ -35,13 +35,16 @@ jobs:
        uses: ./.github/actions/prepare-frontend
      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
+
+      - name: Get Eslint cache key
+        uses: ./.github/actions/get-cache-keys
+        id: get-cache-keys
      - name: Restore ESLint cache
-        uses: actions/cache@v4
+        uses: actions/cache/restore@v4
        with:
-          path: .eslintcache
-          key: eslintcache-${{ hashFiles('yarn.lock', '.eslintrc.js') }}
-          restore-keys: |
-            eslintcache-
+          path: ${{ github.workspace}}/.eslintcache
+          key: ${{ steps.get-cache-keys.outputs.eslint-cache-key }}
+
      - name: Compile CLJS
        run: yarn build-pure:cljs
      - name: Find CSS variables that are used but never defined
@@ -88,8 +91,9 @@ jobs:
        uses: ./.github/actions/prepare-backend
      - name: Run frontend unit tests
        run: yarn run test-unit --silent --shard=${{ matrix.shard }}/${{ env.SHARDS }}
-        # We want Trunk to still receive test reports even if this job fails.
-        # It will filter out the quarantined tests, and will control the job exit code based on the analysis.
+        # Trunk Quarantine controls the final state of the run in the CI!
+        # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
+        # whether to fail or to pass the whole job, based on the quarantine list.
        continue-on-error: true
      - name: Upload Test Results
        uses: ./.github/actions/upload-test-results
--- a/.github/workflows/fuzzing.yml
+++ b/.github/workflows/fuzzing.yml
@@ -1,56 +0,0 @@
-name: Fuzzing
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - "master"
-      - "release-**"
-    paths:
-      - "frontend/src/metabase/querying/expressions/**"
-  pull_request:
-    paths:
-      - "frontend/src/metabase/querying/expressions/**"
-
-jobs:
-  fe-fuzz-lexifier:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-      - run: yarn test-unit frontend/src/metabase/querying/expressions/pratt/fuzz.lexifier.unit.spec.ts
-        env:
-          MB_FUZZ: 1
-        name: Run fuzz testing on the lexifier
-
-  fe-fuzz-compiler:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-      - run: yarn test-unit frontend/src/metabase/querying/expressions/fuzz.compiler.unit.spec.ts
-        env:
-          MB_FUZZ: 1
-        name: Run fuzz testing on the custom expression compiler
-
-  fe-fuzz-string-quoting:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-      - run: yarn test-unit frontend/src/metabase/querying/expressions/fuzz.string.unit.spec.ts
-        env:
-          MB_FUZZ: 1
-        name: Run fuzz testing on the custom expression string quoter
--- a/.github/workflows/minimal-tests.yml
+++ b/.github/workflows/minimal-tests.yml
@@ -0,0 +1,227 @@
+name: Minimal Tests
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  # Only run if the PR has the minimal-tests label
+  check-label:
+    runs-on: ubuntu-latest
+    timeout-minutes: 1
+    outputs:
+      should-run: ${{ steps.check.outputs.result }}
+    steps:
+      - name: Check for minimal-tests label
+        id: check
+        run: |
+          if [[ "${{ contains(github.event.pull_request.labels.*.name, 'minimal-tests') }}" == "true" ]]; then
+            echo "result=true" >> $GITHUB_OUTPUT
+          else
+            echo "result=false" >> $GITHUB_OUTPUT
+          fi
+
+  # Postgres app-db tests - single version, single job
+  postgres-app-db-test:
+    needs: check-label
+    if: needs.check-label.outputs.should-run == 'true'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 60
+    env:
+      CI: 'true'
+      DRIVERS: postgres
+      MB_DB_TYPE: postgres
+      MB_DB_PORT: 5432
+      MB_DB_HOST: localhost
+      MB_DB_DBNAME: mb_test
+      MB_DB_USER: mb_test
+      MB_POSTGRESQL_TEST_USER: mb_test
+    services:
+      postgres:
+        image: postgres:latest
+        ports:
+          - "5432:5432"
+        env:
+          POSTGRES_USER: mb_test
+          POSTGRES_DB: mb_test
+          POSTGRES_HOST_AUTH_METHOD: trust
+    name: Postgres Latest EE App DB Tests (Part 1)
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test Postgres App DB
+        uses: ./.github/actions/test-driver
+        with:
+          build-static-viz: true
+          junit-name: 'minimal-be-tests-postgres-ee'
+          test-args: >-
+            :only '["test" "enterprise/backend/test"]'
+            :exclude-tags '[:mb/driver-tests :mb/transforms-python-test]'
+            :partition/total 2
+            :partition/index 0
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always()
+        with:
+          input-path: ./target/junit/
+          output-name: ${{ github.job }}
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+  # Postgres driver tests
+  postgres-driver-test:
+    needs: check-label
+    if: needs.check-label.outputs.should-run == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    env:
+      CI: 'true'
+      DRIVERS: postgres
+      MB_DB_TYPE: postgres
+      MB_DB_PORT: 5432
+      MB_DB_HOST: localhost
+      MB_DB_DBNAME: mb_test
+      MB_DB_USER: mb_test
+      MB_POSTGRESQL_TEST_USER: mb_test
+    services:
+      postgres:
+        image: postgres:latest
+        ports:
+          - "5432:5432"
+        env:
+          POSTGRES_USER: mb_test
+          POSTGRES_DB: mb_test
+          POSTGRES_HOST_AUTH_METHOD: trust
+    name: Postgres Latest Driver Tests
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test Postgres Driver
+        uses: ./.github/actions/test-driver
+        with:
+          junit-name: 'minimal-be-tests-postgres-driver-ee'
+          test-args: >-
+            :only-tags [:mb/driver-tests]
+            :exclude-tags [:mb/transforms-python-test]
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always()
+        with:
+          input-path: ./target/junit/
+          output-name: ${{ github.job }}
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+  # Frontend unit tests
+  frontend-unit-tests:
+    needs: check-label
+    if: needs.check-label.outputs.should-run == 'true'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    env:
+      JEST_JUNIT_OUTPUT_DIR: ./target/junit
+      JEST_JUNIT_OUTPUT_NAME: test-report-frontend-unit.xml
+    name: Frontend Unit Tests
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      - name: Run frontend unit tests
+        run: yarn run test-unit --silent
+        continue-on-error: true
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always()
+        with:
+          input-path: ./target/junit
+          output-name: frontend-unit
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+  # Summary job
+  minimal-tests-result:
+    needs:
+      - postgres-app-db-test
+      - postgres-driver-test
+      - frontend-unit-tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    name: minimal-tests-result
+    if: always() && !cancelled()
+    steps:
+      - name: Check job status
+        uses: actions/github-script@v7
+        env:
+          needs: ${{ toJson(needs) }}
+        with:
+          script: | # js
+            const needs = JSON.parse(process.env.needs);
+
+            const jobs = Object.entries(needs).map(
+              ([jobName, jobValues]) => ({
+                name: jobName,
+                result: jobValues.result
+              }));
+
+            // Check if all jobs either succeeded or were skipped
+            // Skipped jobs are acceptable (they were intentionally skipped when the label is absent)
+            const allPassedOrSkipped = jobs.every(job =>
+              job.result === 'success' || job.result === 'skipped'
+            );
+
+            // Check if any jobs actually failed (not skipped, not cancelled)
+            const anyFailed = jobs.some(job =>
+              job.result === 'failure'
+            );
+
+            if (allPassedOrSkipped && !anyFailed) {
+              console.log("");
+              console.log("        _------.        ");
+              console.log("       /  ,     \_      ");
+              console.log("     /   /  /{}\ |o\_   ");
+              console.log("    /    \  `--' /-' \  ");
+              console.log("   |      \      \    | ");
+              console.log("  |              |`-, | ");
+              console.log("  /              /__/)/ ");
+              console.log(" |              |       ");
+              console.log("");
+              console.log("All minimal tests have passed. Fast feedback achieved!");
+              process.exit(0);
+            }
+
+            // otherwise, something failed
+            console.log("");
+            console.log("       .::::::::::.                          .::::::::::.       ");
+            console.log("     .::::''''''::::.                      .::::''''''::::.     ");
+            console.log("   .:::'          `::::....          ....::::'          `:::.   ");
+            console.log("  .::'             `:::::::|        |:::::::'             `::.  ");
+            console.log(" .::|               |::::::|_ ___ __|::::::|               |::. ");
+            console.log(" `--'               |::::::|_()__()_|::::::|               `--' ");
+            console.log("  :::               |::-o::|        |::o-::|               :::  ");
+            console.log("  `::.             .|::::::|        |::::::|.             .::'  ");
+            console.log("   `:::.          .::\-----'        `-----/::.          .:::'   ");
+            console.log("     `::::......::::'                      `::::......::::'     ");
+            console.log("       `::::::::::'                          `::::::::::'       ");
+            console.log("");
+            console.log("Minimal tests have failed.");
+
+            jobs.forEach((job) => {
+              if (job.result !== 'success' && job.result !== 'skipped') {
+                console.log(`${job.name} - ${job.result}`);
+              }
+            });
+
+            process.exit(1);
--- a/.github/workflows/openapi-check.yml
+++ b/.github/workflows/openapi-check.yml
@@ -0,0 +1,44 @@
+name: OpenAPI Check
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  check-openapi-specs:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    if: contains(github.event.pull_request.labels.*.name, 'openapi-self-healing')
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # we're intentionally using METABASE_AUTOMATION_USER_TOKEN to trigger the whole CI pipeline again
+          #  after the self-healing commit is created
+          #  if we used GITHUB_TOKEN, the self-healing commit would not trigger the CI pipeline again
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          # fetch full git history to allow fetching the latest base branch commit and comparing changes
+          fetch-depth: 0
+      - name: Setup Node.js 22
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22.x
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      - name: Generate version.properties
+        run: ./bin/build.sh :steps [:version]
+      - name: Get latest base branch commit
+        run: |
+          git fetch origin ${{ github.event.pull_request.base.ref }}
+          echo "LATEST_BASE_SHA=$(git rev-parse origin/${{ github.event.pull_request.base.ref }})" >> $GITHUB_ENV
+      - name: Check OpenAPI specs are up to date
+        env:
+          AUTO_COMMIT: "true"
+          PR_BRANCH: ${{ github.event.pull_request.head.ref }}
+          BASE_SHA: ${{ env.LATEST_BASE_SHA }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          GITHUB_SHA: ${{ github.sha }}
+        run: ./bin/openapi-check.sh
--- a/.github/workflows/pr-env-close-unlabel.yml
+++ b/.github/workflows/pr-env-close-unlabel.yml
@@ -10,6 +10,15 @@ concurrency:

 jobs:
  pr-env:
-    if: ${{ github.event.action == 'closed' && contains(github.event.pull_request.labels.*.name, 'PR-Env') || github.event.label.name == 'PR-Env' }}
+    if: ${{ (github.event.action == 'closed' && contains(github.event.pull_request.labels.*.name, 'PR-Env') && !contains(github.event.pull_request.labels.*.name, 'PR-Env-analytics-dev')) || github.event.label.name == 'PR-Env' }}
    uses: ./.github/workflows/pr-env-destroy.yml
    secrets: inherit
+    with:
+      analytics_dev_mode: false
+
+  pr-env-analytics-dev:
+    if: ${{ (github.event.action == 'closed' && contains(github.event.pull_request.labels.*.name, 'PR-Env-analytics-dev')) || github.event.label.name == 'PR-Env-analytics-dev' }}
+    uses: ./.github/workflows/pr-env-destroy.yml
+    secrets: inherit
+    with:
+      analytics_dev_mode: false
--- a/.github/workflows/pr-env-labeled.yml
+++ b/.github/workflows/pr-env-labeled.yml
@@ -10,7 +10,7 @@ concurrency:

 jobs:
  uberjar:
-    if: ${{ github.event.label.name == 'PR-Env' }}
+    if: ${{ github.event.label.name == 'PR-Env' || github.event.label.name == 'PR-Env-analytics-dev' }}
    uses: ./.github/workflows/uberjar.yml
    secrets: inherit

@@ -19,3 +19,13 @@ jobs:
    if: ${{ github.event.label.name == 'PR-Env' }}
    uses: ./.github/workflows/pr-env.yml
    secrets: inherit
+    with:
+      analytics_dev_mode: false
+
+  pr-env-analytics-dev:
+    needs: [uberjar]
+    if: ${{ github.event.label.name == 'PR-Env-analytics-dev' }}
+    uses: ./.github/workflows/pr-env.yml
+    secrets: inherit
+    with:
+      analytics_dev_mode: true
--- a/.github/workflows/pr-env.yml
+++ b/.github/workflows/pr-env.yml
@@ -3,6 +3,12 @@ run-name: Building Dynamic PR Environment for ${{ github.ref_name }} by @${{ git

 on:
  workflow_call:
+    inputs:
+      analytics_dev_mode:
+        description: 'Enable analytics development mode'
+        required: false
+        type: boolean
+        default: false
 jobs:
  build:
    runs-on: ubuntu-latest
@@ -124,6 +130,7 @@ jobs:
          PR_NUMBER: ${{ github.event.number }}
          MB_PREMIUM_EMBEDDING_TOKEN: ${{ secrets.PR_ENV_MB_PREMIUM_EMBEDDING_TOKEN }}
          SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          MB_ANALYTICS_DEV_MODE: ${{ inputs.analytics_dev_mode && 'true' || 'false' }}
      - name: Deploy PR Review ENV
        run: |
          kubectl apply -f ./metabase.yml
@@ -139,3 +146,4 @@ jobs:
            ✅ Preview:
                https://pr${{ github.event.number }}.coredev.metabase.com
            🗒️ [login instructions](https://www.notion.so/metabase/Ephemeral-PR-Environments-c74a3710c87a460dbf4fc0007a001458)
+            📦 Deployment type: ${{ inputs.analytics_dev_mode && 'PR-Env-analytics-dev' || 'PR-Env' }}
--- a/.github/workflows/pre-release.yml
+++ b/.github/workflows/pre-release.yml
@@ -161,19 +161,21 @@ jobs:

      - name: Run a few important OSS Cypress tests as sanity check
        if: ${{ matrix.edition == 'oss' }}
+        env:
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
        run: |
          node e2e/runner/run_cypress_ci.js e2e \
-            --env grepTags="@smoke+-@EE",grepOmitFiltered=true \
-            --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)' \
-            --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+            --env grepTags="@smoke+-@EE" \
+            --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)'

      - name: Run a few important EE Cypress tests as sanity check
        if: ${{ matrix.edition == 'ee' }}
+        env:
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
        run: |
          node e2e/runner/run_cypress_ci.js e2e \
-            --env grepTags="@smoke+-@OSS",grepOmitFiltered=true \
-            --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)' \
-            --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+            --env grepTags="@smoke+-@OSS" \
+            --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)'

      - name: Upload Cypress Artifacts upon failure
        uses: actions/upload-artifact@v4
--- a/.github/workflows/release-embedding-sdk.yml
+++ b/.github/workflows/release-embedding-sdk.yml
@@ -8,9 +8,9 @@ on:
        description: "Branch we want to release the SDK from (to release from other branches use the workflow from those branches)"
        type: choice
        required: true
-        default: "master"
+        default: release-x.57.x
        options:
-          - master
+          - release-x.57.x

 concurrency:
  # We want to ensure only one job is running at a time per branch because
@@ -345,8 +345,9 @@ jobs:
          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}

      - name: Edit PR adding useful information (using Metabase bot app)
+        # metabase/embedding team is added automatically as code owner of updated `package.template.json` file
        run: |
-          gh pr edit --add-reviewer @metabase/embedding,albertoperdomo --add-label no-backport
+          gh pr edit --add-reviewer albertoperdomo --add-label no-backport
        env:
          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}

@@ -368,42 +369,16 @@ jobs:
          name: metabase-sdk
          path: sdk

-      - name: Compute master tag
-        id: compute-tag
-        run: |
-          if [ -n "${{ needs.determine-sdk-version.outputs.pre_release_label }}" ]; then
-            echo "masterTag=${{ needs.determine-sdk-version.outputs.pre_release_label }}" >> $GITHUB_OUTPUT
-          else
-            echo "masterTag=nightly" >> $GITHUB_OUTPUT
-          fi
-
      - name: Publish to NPM
        working-directory: sdk
        run: |
          echo //registry.npmjs.org/:_authToken=${{ secrets.NPM_RELEASE_TOKEN }} > .npmrc
+          npm publish --tag 57-stable

-          TAG=$(jq -r --null-input \
-            --arg branch "${{ inputs.branch }}" \
-            --arg masterTag "${{ steps.compute-tag.outputs.masterTag }}" '
-            {
-              "master": $masterTag,
-              "release-x.51.x": "51-stable",
-              "release-x.52.x": "52-stable",
-              "release-x.53.x": "53-stable",
-              "release-x.54.x": "54-stable",
-              "release-x.55.x": "55-stable",
-              "release-x.56.x": "56-stable"
-            }[$branch]'
-          )
-
-          echo "Resolved npm tag: $TAG"
-          npm publish --tag "$TAG"
-
-      - name: Add `latest` tag to the latest release branch (`release-x.55.x`) deployment
-        if: ${{ inputs.branch == 'release-x.56.x' }}
-        working-directory: sdk
-        run: |
-          npm dist-tag add @metabase/embedding-sdk-react@${{ env.sdk_version }} latest
+      # - name: Add `latest` tag to the latest release branch deployment
+      #   working-directory: sdk
+      #   run: |
+      #     npm dist-tag add @metabase/embedding-sdk-react@${{ env.sdk_version }} latest

  git-tag:
    needs: [publish-npm, determine-sdk-version]
--- a/.github/workflows/release-log.yml
+++ b/.github/workflows/release-log.yml
@@ -47,7 +47,7 @@ jobs:
        with:
          script: | # js
            const {
-              getVersionFromReleaseBranch,
+              getMajorVersionFromRef,
              getMajorVersion,
            } = require('${{ github.workspace }}/release/dist/index.cjs');

@@ -60,11 +60,10 @@ jobs:
            }

            // otherwise, get the version from the release branch name
-            const branch = context.payload.ref;
-            const version = getVersionFromReleaseBranch(branch);
-            const majorVersion = getMajorVersion(version);
+            const ref = context.payload.ref;
+            const majorVersion = getMajorVersionFromRef(ref);

-            console.log({ branch, version, majorVersion });
+            console.log({ ref, majorVersion });
            core.exportVariable('VERSION', majorVersion);

      - name: generate release Log
--- a/.github/workflows/run-tests.yml
+++ b/.github/workflows/run-tests.yml
@@ -12,7 +12,7 @@ on:

 jobs:
  files-changed:
-    if: ${{ !contains(github.event.pull_request.labels.*.name,'ci skip') }}
+    if: ${{ !contains(github.event.pull_request.labels.*.name,'ci skip') && !contains(github.event.pull_request.labels.*.name,'minimal-tests') }}
    name: Check which files changed
    runs-on: ubuntu-22.04
    timeout-minutes: 5
@@ -25,6 +25,10 @@ jobs:
      frontend_all: ${{ steps.changes.outputs.frontend_all }}
      frontend_sources: ${{ steps.changes.outputs.frontend_sources }}
      documentation: ${{ steps.changes.outputs.documentation }}
+      embedding_documentation: ${{ steps.changes.outputs.embedding_documentation }}
+      embedding_sdk_components: ${{ steps.changes.outputs.embedding_sdk_components }}
+      embedding_sdk_host_sample_apps: ${{ steps.changes.outputs.embedding_sdk_host_sample_apps }}
+      embedding_sdk_ci: ${{ steps.changes.outputs.embedding_sdk_ci }}
    steps:
      - uses: actions/checkout@v4
      - name: Test which files changed
@@ -36,49 +40,19 @@ jobs:
          list-files: csv
          filters: .github/file-paths.yaml

-  static-viz-files-changed:
-    name: Check whether static-viz files changed
-    if: ${{ !contains(github.event.pull_request.labels.*.name,'ci skip') }}
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    outputs:
-      static_viz: ${{ steps.static_viz.outputs.static_viz }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-      - name: Build static-viz frontend
-        run: yarn build-static-viz
-        env:
-          MB_EDITION: ee
-      - name: Upload Static Viz Bundle Artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: static-viz-bundle-${{ github.sha }}
-          path: resources/frontend_client/app/dist
-
-      - name: Check for static viz changes
-        uses: dorny/paths-filter@v3.0.0
-        id: static_viz
-        with:
-          token: ${{ github.token }}
-          filters: .github/static-viz-sources.yaml
-
  uberjar:
-    needs: [files-changed, static-viz-files-changed]
+    needs: [files-changed]
    if: ${{ !cancelled() && !(needs.files-changed.outputs.documentation == 'true' && needs.files-changed.outputs.backend_all == 'false' && needs.files-changed.outputs.frontend_all == 'false' && needs.files-changed.outputs.e2e_all == 'false') }}
    uses: ./.github/workflows/uberjar.yml
    secrets: inherit

  backend-tests:
    if: ${{ !cancelled() && needs.files-changed.result == 'success' }}
-    needs: [files-changed, static-viz-files-changed]
+    needs: [files-changed]
    uses: ./.github/workflows/backend.yml
    secrets: inherit
    with:
-      skip: ${{ needs.files-changed.outputs.backend_all != 'true' && needs.static-viz-files-changed.outputs.static_viz != 'true' }}
+      skip: ${{ needs.files-changed.outputs.backend_all != 'true' }}

  semantic-search-tests:
    needs: files-changed
@@ -122,18 +96,50 @@ jobs:
      # list of changed specs files, then only specs are changed and we can run only those specs
      specs: ${{ needs.files-changed.outputs.e2e_all_files == needs.files-changed.outputs.e2e_specs_files && needs.files-changed.outputs.e2e_specs_files || '' }}

+  embedding-sdk-package:
+    needs: [files-changed]
+    if: |
+      !cancelled() &&
+      (needs.files-changed.outputs.embedding_sdk_components == 'true' ||
+      needs.files-changed.outputs.frontend_sources == 'true' ||
+      needs.files-changed.outputs.embedding_documentation == 'true' ||
+      needs.files-changed.outputs.embedding_sdk_ci == 'true')
+    uses: ./.github/workflows/embedding-sdk-package-build.yml
+    secrets: inherit
+
  sdk-tests:
-    needs: files-changed
+    needs: [uberjar, embedding-sdk-package, files-changed]
+    if: always()
    uses: ./.github/workflows/embedding-sdk.yml
    secrets: inherit
+    with:
+      cli-snippets-type-check: ${{ needs.files-changed.outputs.frontend_sources == 'true' }}
+      docs-snippets-type-check: ${{ needs.files-changed.outputs.embedding_documentation == 'true' }}
+      documentation-validation: ${{ needs.files-changed.outputs.frontend_sources == 'true' }}
+      component-tests: ${{ needs.files-changed.outputs.embedding_sdk_components == 'true' }}
+      host-sample-apps-tests: ${{ needs.files-changed.outputs.embedding_sdk_host_sample_apps == 'true' }}
+      skip: ${{ needs.embedding-sdk-package.result != 'success' || needs.uberjar.result != 'success' }}

  pr-env:
    needs: [uberjar]
    if: |
      !cancelled() &&
-      contains(github.event.pull_request.labels.*.name, 'PR-Env')
+      contains(github.event.pull_request.labels.*.name, 'PR-Env') &&
+      !contains(github.event.pull_request.labels.*.name, 'PR-Env-analytics-dev')
    uses: ./.github/workflows/pr-env.yml
    secrets: inherit
+    with:
+      analytics_dev_mode: false
+
+  pr-env-analytics-dev:
+    needs: [uberjar]
+    if: |
+      !cancelled() &&
+      contains(github.event.pull_request.labels.*.name, 'PR-Env-analytics-dev')
+    uses: ./.github/workflows/pr-env.yml
+    secrets: inherit
+    with:
+      analytics_dev_mode: true

  containerize:
    needs: [uberjar]
--- a/.github/workflows/uberjar.yml
+++ b/.github/workflows/uberjar.yml
@@ -146,7 +146,13 @@ jobs:
    runs-on: ubuntu-22.04
    name: Is ${{ matrix.edition }} (java ${{ matrix.java-version }}) healthy?
    needs: [build, check-existing-artifacts]
-    if: always() && !cancelled() && (needs.build.result == 'success' || (needs.check-existing-artifacts.outputs.should_build == 'false' && needs.check-existing-artifacts.outputs.ee_exists == 'true' && needs.check-existing-artifacts.outputs.oss_exists == 'true'))
+    # We only care about the explicit JAR health check on push to `master` and the `release-` branches.
+    # JARs created in random branches on PRs are 99% of the time treated as ephemeral, and used only in e2e tests.
+    # E2E tests already have a step where they wait for the instance health check.
+    if: |
+      always() && !cancelled() &&
+      (github.ref_name == 'master' || startsWith(github.ref_name, 'release-')) &&
+      (needs.build.result == 'success' || (needs.check-existing-artifacts.outputs.should_build == 'false' && needs.check-existing-artifacts.outputs.ee_exists == 'true' && needs.check-existing-artifacts.outputs.oss_exists == 'true'))
    timeout-minutes: 10
    strategy:
      matrix:
--- a/.gitignore
+++ b/.gitignore
@@ -104,6 +104,7 @@ dev/serialization_deltas/
 *.tsbuildinfo
 /trace-output/
 /temp-types/
+/frontend/src/metabase-types/openapi

 **/cypress_sample_database.json
 **/cypress_sample_instance_data.json
--- a/.loki/reference/chrome_laptop_App_Embed_PublicOrEmbeddedDashboardView_Light_Theme_No_Results.png
+++ b/.loki/reference/chrome_laptop_App_Embed_PublicOrEmbeddedDashboardView_Light_Theme_No_Results.png
--- a/.loki/reference/chrome_laptop_App_Embed_PublicOrEmbeddedDashboardView_Narrow_With_Many_Tabs.png
+++ b/.loki/reference/chrome_laptop_App_Embed_PublicOrEmbeddedDashboardView_Narrow_With_Many_Tabs.png
--- a/.loki/reference/chrome_laptop_App_Embed_PublicOrEmbeddedDashboardView_filters_Dark_Theme_Date_Filter_Range.png
+++ b/.loki/reference/chrome_laptop_App_Embed_PublicOrEmbeddedDashboardView_filters_Dark_Theme_Date_Filter_Range.png
--- a/.loki/reference/chrome_laptop_App_Embed_PublicOrEmbeddedDashboardView_filters_Dark_Theme_Number.png
+++ b/.loki/reference/chrome_laptop_App_Embed_PublicOrEmbeddedDashboardView_filters_Dark_Theme_Number.png
--- a/.loki/reference/chrome_laptop_App_Embed_PublicOrEmbeddedDashboardView_filters_Dark_Theme_Parameter_List.png
+++ b/.loki/reference/chrome_laptop_App_Embed_PublicOrEmbeddedDashboardView_filters_Dark_Theme_Parameter_List.png
--- a/.loki/reference/chrome_laptop_App_Embed_PublicOrEmbeddedDashboardView_filters_Dark_Theme_Parameter_List_With_Value.png
+++ b/.loki/reference/chrome_laptop_App_Embed_PublicOrEmbeddedDashboardView_filters_Dark_Theme_Parameter_List_With_Value.png
--- a/.loki/reference/chrome_laptop_App_Embed_PublicOrEmbeddedDashboardView_filters_Dark_Theme_Parameter_Search.png
+++ b/.loki/reference/chrome_laptop_App_Embed_PublicOrEmbeddedDashboardView_filters_Dark_Theme_Parameter_Search.png
--- a/.loki/reference/chrome_laptop_App_Embed_PublicOrEmbeddedDashboardView_filters_Dark_Theme_Parameter_Search_With_Value.png
+++ b/.loki/reference/chrome_laptop_App_Embed_PublicOrEmbeddedDashboardView_filters_Dark_Theme_Parameter_Search_With_Value.png
--- a/.loki/reference/chrome_laptop_App_Embed_PublicOrEmbeddedDashboardView_filters_Dark_Theme_Text.png
+++ b/.loki/reference/chrome_laptop_App_Embed_PublicOrEmbeddedDashboardView_filters_Dark_Theme_Text.png
--- a/.loki/reference/chrome_laptop_App_Embed_PublicOrEmbeddedDashboardView_filters_Dark_Theme_Text_With_Value.png
+++ b/.loki/reference/chrome_laptop_App_Embed_PublicOrEmbeddedDashboardView_filters_Dark_Theme_Text_With_Value.png
--- a/.loki/reference/chrome_laptop_App_Embed_PublicOrEmbeddedQuestionView_Table_Light_Theme.png
+++ b/.loki/reference/chrome_laptop_App_Embed_PublicOrEmbeddedQuestionView_Table_Light_Theme.png
--- a/.loki/reference/chrome_laptop_App_MetabotLogo_Customized_Brand_Color.png
+++ b/.loki/reference/chrome_laptop_App_MetabotLogo_Customized_Brand_Color.png
--- a/.loki/reference/chrome_laptop_App_MetabotLogo_Default.png
+++ b/.loki/reference/chrome_laptop_App_MetabotLogo_Default.png
--- a/.loki/reference/chrome_laptop_App_Palette_Recents.png
+++ b/.loki/reference/chrome_laptop_App_Palette_Recents.png
--- a/.loki/reference/chrome_laptop_App_Palette_Search.png
+++ b/.loki/reference/chrome_laptop_App_Palette_Search.png
--- a/.loki/reference/chrome_laptop_Patterns_Upsells_BigCard_Default.png
+++ b/.loki/reference/chrome_laptop_Patterns_Upsells_BigCard_Default.png
--- a/.loki/reference/chrome_laptop_Patterns_Upsells_BigCard_Modal_Story.png
+++ b/.loki/reference/chrome_laptop_Patterns_Upsells_BigCard_Modal_Story.png
--- a/.loki/reference/chrome_laptop_Patterns_Upsells_BigCard_Secondary.png
+++ b/.loki/reference/chrome_laptop_Patterns_Upsells_BigCard_Secondary.png
--- a/.loki/reference/chrome_laptop_Viz_Static_Viz_ComboChart_Area_Stack_Linear_X_Axis.png
+++ b/.loki/reference/chrome_laptop_Viz_Static_Viz_ComboChart_Area_Stack_Linear_X_Axis.png
--- a/.loki/reference/chrome_laptop_Viz_Static_Viz_ComboChart_Bar_Stack_Linear_X_Axis.png
+++ b/.loki/reference/chrome_laptop_Viz_Static_Viz_ComboChart_Bar_Stack_Linear_X_Axis.png
--- a/.loki/reference/chrome_laptop_Viz_Static_Viz_ScatterPlot_Log_X_Scale.png
+++ b/.loki/reference/chrome_laptop_Viz_Static_Viz_ScatterPlot_Log_X_Scale.png
--- a/.loki/reference/chrome_laptop_Viz_Static_Viz_ScatterPlot_Pin_To_Zero.png
+++ b/.loki/reference/chrome_laptop_Viz_Static_Viz_ScatterPlot_Pin_To_Zero.png
--- a/.loki/reference/chrome_laptop_viz_PieChart_Dark_Theme.png
+++ b/.loki/reference/chrome_laptop_viz_PieChart_Dark_Theme.png
--- a/.loki/reference/chrome_laptop_viz_PieChart_Embedded_Dashcard.png
+++ b/.loki/reference/chrome_laptop_viz_PieChart_Embedded_Dashcard.png
--- a/.loki/reference/chrome_laptop_viz_PieChart_Embedded_Question.png
+++ b/.loki/reference/chrome_laptop_viz_PieChart_Embedded_Question.png
--- a/.loki/reference/chrome_laptop_viz_SankeyChart_Sankey_Node_Align_Justify.png
+++ b/.loki/reference/chrome_laptop_viz_SankeyChart_Sankey_Node_Align_Justify.png
--- a/.loki/reference/chrome_laptop_viz_Table_Conditional_Fomatting_Dark.png
+++ b/.loki/reference/chrome_laptop_viz_Table_Conditional_Fomatting_Dark.png
--- a/.loki/reference/chrome_laptop_viz_Table_Conditional_Fomatting_Light.png
+++ b/.loki/reference/chrome_laptop_viz_Table_Conditional_Fomatting_Light.png
--- a/.prettierignore
+++ b/.prettierignore
@@ -2,4 +2,4 @@ frontend/src/cljs
 docs/configuring-metabase/environment-variables.md
 docs/api/*
 docs/api-documentation.md
-enterprise/frontend/src/embedding-sdk-shared/.storybook/msw-public/mockServiceWorker.js
+frontend/src/embedding-sdk-shared/.storybook/msw-public/mockServiceWorker.js
--- a/LICENSE-AGPL.txt
+++ b/LICENSE-AGPL.txt
@@ -676,14 +676,11 @@ If you modify this Program, or any covered work, by linking or combining it with
 * environ
 * hiccup
 * junit
-* korma
 * medley
 * org.clojure/clojure
 * org.clojure/clojurescript
 * org.clojure/core.async
 * org.clojure/core.cache
-* org.clojure/core.incubator
-* org.clojure/core.logic
 * org.clojure/core.match
 * org.clojure/core.memoize
 * org.clojure/data.csv
@@ -702,10 +699,8 @@ If you modify this Program, or any covered work, by linking or combining it with
 * org.tcrawley/dynapath
 * quoin
 * refactor-nrepl
-* robert/hooke
 * scout
 * slingshot
 * stencil
-* swiss-arrows
 * tigris
 * instaparse
--- a/bb.edn
+++ b/bb.edn
@@ -2,7 +2,8 @@
 ;; we put path as bin, and everything is in the ./mage subdirectory,
 ;; so the namespaces are mage.cli, mage.format, etc.
 :paths          ["mage/src" "mage/test" "bin/lint-migrations-file/src"]
- :deps           {org.babashka/json {:mvn/version "0.1.6"}
+ :deps           {dev.weavejester/cljfmt {:mvn/version "0.15.3"}
+                  org.babashka/json {:mvn/version "0.1.6"}
                  metosin/malli     {:mvn/version "0.17.0"}
                  table/table       {:mvn/version "0.5.0"}
                  mvxcvi/puget      {:mvn/version "1.3.4"}}
@@ -82,6 +83,18 @@
   :requires [[mage.check]]
   :task     (task! (mage.check/check (:arguments parsed)))}

+  codespell
+  {:doc      "Check for misspellings in the source code."
+   :examples [["./bin/mage codespell"]]
+   :requires [[mage.codespell]]
+   :task     (task! (mage.codespell/codespell (:arguments parsed)))}
+
+  codespell-interactive
+  {:doc      "Check for misspellings in the source code, and interactively prompt to fix them."
+   :examples [["./bin/mage codespell-interactive"]]
+   :requires [[mage.codespell]]
+   :task     (task! (mage.codespell/codespell-interactive (:arguments parsed)))}
+
  start-maildev
  {:doc      "Start Maildev"
   :examples [["./bin/mage start-maildev -h" "print help for start-maildev"]]
@@ -196,6 +209,38 @@
      :requires [[mage.util :as u]]
      :task     (task! (u/print-tasks parsed))}

+  analytics:setup
+  {:doc "Set up usage analytics development mode"
+   :examples [["./bin/mage analytics:setup" "Enable usage analytics dev mode and import content"]]
+   :requires [[mage.analytics :as analytics]]
+   :task (task! (analytics/setup!))}
+
+  analytics:export
+  {:doc "Export usage analytics content to YAML files"
+   :examples [["./bin/mage analytics:export" "Export to default location (resources/instance_analytics)"]
+              ["./bin/mage analytics:export my-custom-dir" "Export to custom directory"]]
+   :arg-schema [:or
+                [:tuple]
+                [:tuple [:string {:description "Target directory for export"}]]]
+   :requires [[mage.analytics :as analytics]]
+   :task (task! (if-let [target-dir (first (:arguments parsed))]
+                  (analytics/export! target-dir)
+                  (analytics/export!)))}
+
+  analytics:teardown
+  {:doc "Tear down usage analytics development mode"
+   :examples [["./bin/mage analytics:teardown" "Remove usage analytics dev database and disable dev mode"]]
+   :requires [[mage.analytics :as analytics]]
+   :task (task! (analytics/teardown!))}
+
+  analytics:finalize
+  {:doc "Export usage analytics content and tear down development mode"
+   :examples [["./bin/mage analytics:finalize" "Export to default location and tear down"]]
+   :requires [[mage.analytics :as analytics]]
+   :task (task! (do
+                  (analytics/export!)
+                  (analytics/teardown!)))}
+
  ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
  ;; Private Tasks:
  ;; These tasks are more for internal tooling, e.g. for use from git hooks etc.
--- a/bin/build/resources/overrides.edn
+++ b/bin/build/resources/overrides.edn
@@ -13,6 +13,7 @@
  "org.apache.hadoop"                {:resource "apache2_0.txt"}
  "org.clojure"                      {:resource "EPL.txt"}
  "org.eclipse.jetty"                {:resource "apache2_0.txt"}
+  "org.eclipse.jetty.ee"             {:resource "apache2_0.txt"}
  "org.opensaml"                     {:resource "apache2_0.txt"}
  "org.ow2.asm"                      {:resource "BSD.txt"}
  "xalan"                            {:resource "apache2_0.txt"}}
--- a/bin/build/test/build/licenses_test.clj
+++ b/bin/build/test/build/licenses_test.clj
@@ -159,7 +159,7 @@
                     (catch Exception _ false))]
      (cond success? ::done
            (and (not success?) (< n max)) (recur (inc n))
-            :else (throw (ex-info (str "Could not succeed " step-name) {:max-attempts max}))))))
+            :else (throw (ex-info (str "Could not succeed " step-name) {:max-retries max}))))))

 (deftest all-deps-have-licenses
  (testing "All deps on the classpath have licenses"
--- a/bin/cleanup-instance-analytics.sh
+++ b/bin/cleanup-instance-analytics.sh
@@ -1,63 +0,0 @@
-#!/usr/bin/env bash
-
-set -eE -o errexit -o functrace
-
-### Utility
-
-failure() {
-  local lineno=$1
-  local msg=$2
-  echo "Failed at $lineno: $msg"
-}
-
-trap 'failure ${LINENO} "$BASH_COMMAND"' ERR
-
-err() {
-    echo "Error: $1"
-    exit 1
-}
-
-rename() {
-    dirname=$(dirname "$1")
-    basename=$(basename "$1")
-
-    target="${basename//$2/$3}"
-    mv "$1" "${dirname}/${target}"
-}
-
-### Main
-
-main() {
-    target="${1}"
-    if [ -z "${target}" ]; then
-        echo "Usage: $0 path/to/export"
-        exit 0
-    fi
-
-
-    if [ ! -d "${target}/collections" ]; then
-        err "No 'collections' directory in '${target}'"
-    fi
-
-    find "${target}"/databases -maxdepth 1 -mindepth 1 \
-         -name audit_development_app_db -prune \
-         -o -exec rm -rf "{}" \;
-
-    find "${target}"/databases/audit_development_app_db/schemas/public/tables -maxdepth 1 -mindepth 1 \
-         -name "v_*" -prune \
-         -o -exec rm -rf "{}" \;
-
-    old_db="audit_development_app_db"
-    new_db="Internal Metabase Database"
-
-    old_coll="audit_internal_col_id"
-    new_coll="vG58R8k-QddHWA7_47umn"
-
-    # Replace database_name and collection_id
-    find "${target}" -depth -name "*${old_db}*" | while IFS= read -r path; do rename "${path}" "${old_db}" "${new_db}"; done
-    find "${target}" -depth -name "*${old_coll}*" | while IFS= read -r path; do rename "${path}" "${old_coll}" "${new_coll}"; done
-    find "${target}" -name '*.yaml' -exec sed -i '' "s/${old_db}/${new_db}/g" {} \;
-    find "${target}" -name '*.yaml' -exec sed -i '' "s/${old_coll}/${new_coll}/g" {} \;
-}
-
-main "$@"
--- a/bin/embedding-sdk/fixup-types-after-compilation.js
+++ b/bin/embedding-sdk/fixup-types-after-compilation.js
@@ -20,8 +20,9 @@ const REPLACES_MAP = {
  "metabase-types": "frontend/src/metabase-types",
  metabase: "frontend/src/metabase",
  "embedding-sdk-package": "enterprise/frontend/src/embedding-sdk-package",
-  "embedding-sdk-bundle": "enterprise/frontend/src/embedding-sdk-bundle",
-  "embedding-sdk-shared": "enterprise/frontend/src/embedding-sdk-shared",
+  "embedding-sdk-bundle": "frontend/src/embedding-sdk-bundle",
+  "embedding-sdk-shared": "frontend/src/embedding-sdk-shared",
+  "embedding-sdk-ee": "enterprise/frontend/src/embedding-sdk-ee",
  cljs: "target/cljs_release",
 };

@@ -31,13 +32,15 @@ const API_EXTRACTOR_CONFIG_PATH = path.join(
 );

 const getLogger = (prefix) => {
+  const verbose = process.env.SDK_FIXUP_VERBOSE_LOGS === "true";
  return {
+    verbose: (message) => verbose && console.log(`[${prefix}] ${message}`),
    log: (message) => console.log(`[${prefix}] ${message}`),
    error: (message) => console.error(`[${prefix}] ${message}`),
  };
 };

-const { log } = getLogger("dts fixup");
+const { log, verbose } = getLogger("dts fixup");

 const getRelativePath = (fromPath, toPath) => {
  const relativePath = path.relative(path.dirname(fromPath), toPath);
@@ -67,7 +70,7 @@ const replaceAliasedImports = (filePath) => {
  });

  fs.writeFileSync(filePath, fileContent, { encoding: "utf-8" });
-  log(`Edited file: ${filePath}`);
+  verbose(`Edited file: ${filePath}`);
 };

 const removeUnresolvedReexports = (filePath) => {
@@ -94,7 +97,7 @@ const removeUnresolvedReexports = (filePath) => {
        !fs.existsSync(`${path.resolve(dirPath, target)}.d.ts`);

      if (isUnresolved) {
-        log(`Removing unresolved re-export: ${line}`);
+        verbose(`Removing unresolved re-export: ${line}`);
        isModified = true;
      }

@@ -117,7 +120,7 @@ const fixupTypesAfterCompilation = ({ isWatchMode }) => {
    removeUnresolvedReexports(filePath);
  });

-  log("Done!");
+  console.log("[dts fixup] Done!");

  if (!isWatchMode) {
    generateDtsRollup();
@@ -176,7 +179,7 @@ const generateDtsRollup = () => {
    });
  });

-  log("Dts rollup done!");
+  console.log("[dts rollup] Dts rollup done!");
 };

 const watchFilesAndFixThem = () => {
--- a/bin/embedding-sdk/templates/package.json
+++ b/bin/embedding-sdk/templates/package.json
@@ -9,6 +9,6 @@
    "express": "^5.0.1",
    "express-session": "^1.18.1",
    "jsonwebtoken": "^9.0.2",
-    "next": "^15.2.3"
+    "next": "^15.2.6"
  }
 }
--- a/bin/embedding-sdk/templates/yarn.lock
+++ b/bin/embedding-sdk/templates/yarn.lock
@@ -2,185 +2,204 @@
 # yarn lockfile v1


-"@emnapi/runtime@^1.4.3":
-  version "1.4.3"
-  resolved "https://registry.yarnpkg.com/@emnapi/runtime/-/runtime-1.4.3.tgz#c0564665c80dc81c448adac23f9dfbed6c838f7d"
-  integrity sha512-pBPWdu6MLKROBX05wSNKcNb++m5Er+KQ9QkB+WVM+pW2Kx9hoSrVTnu3BdkI5eBLZoKu/J6mW/B6i6bJB2ytXQ==
+"@emnapi/runtime@^1.7.0":
+  version "1.7.1"
+  resolved "https://registry.yarnpkg.com/@emnapi/runtime/-/runtime-1.7.1.tgz#a73784e23f5d57287369c808197288b52276b791"
+  integrity sha512-PVtJr5CmLwYAU9PZDMITZoR5iAOShYREoR45EyyLrbntV50mdePTgUn4AmOw90Ifcj+x2kRjdzr1HP3RrNiHGA==
  dependencies:
    tslib "^2.4.0"

-"@img/sharp-darwin-arm64@0.34.2":
-  version "0.34.2"
-  resolved "https://registry.yarnpkg.com/@img/sharp-darwin-arm64/-/sharp-darwin-arm64-0.34.2.tgz#65049ef7c6be7857da742cd028f97602ce209635"
-  integrity sha512-OfXHZPppddivUJnqyKoi5YVeHRkkNE2zUFT2gbpKxp/JZCFYEYubnMg+gOp6lWfasPrTS+KPosKqdI+ELYVDtg==
+"@img/colour@^1.0.0":
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/@img/colour/-/colour-1.0.0.tgz#d2fabb223455a793bf3bf9c70de3d28526aa8311"
+  integrity sha512-A5P/LfWGFSl6nsckYtjw9da+19jB8hkJ6ACTGcDfEJ0aE+l2n2El7dsVM7UVHZQ9s2lmYMWlrS21YLy2IR1LUw==
+
+"@img/sharp-darwin-arm64@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-darwin-arm64/-/sharp-darwin-arm64-0.34.5.tgz#6e0732dcade126b6670af7aa17060b926835ea86"
+  integrity sha512-imtQ3WMJXbMY4fxb/Ndp6HBTNVtWCUI0WdobyheGf5+ad6xX8VIDO8u2xE4qc/fr08CKG/7dDseFtn6M6g/r3w==
  optionalDependencies:
-    "@img/sharp-libvips-darwin-arm64" "1.1.0"
+    "@img/sharp-libvips-darwin-arm64" "1.2.4"

-"@img/sharp-darwin-x64@0.34.2":
-  version "0.34.2"
-  resolved "https://registry.yarnpkg.com/@img/sharp-darwin-x64/-/sharp-darwin-x64-0.34.2.tgz#d37ff7c75c46d5a68a3756e3f1924ef7ca7b285e"
-  integrity sha512-dYvWqmjU9VxqXmjEtjmvHnGqF8GrVjM2Epj9rJ6BUIXvk8slvNDJbhGFvIoXzkDhrJC2jUxNLz/GUjjvSzfw+g==
+"@img/sharp-darwin-x64@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-darwin-x64/-/sharp-darwin-x64-0.34.5.tgz#19bc1dd6eba6d5a96283498b9c9f401180ee9c7b"
+  integrity sha512-YNEFAF/4KQ/PeW0N+r+aVVsoIY0/qxxikF2SWdp+NRkmMB7y9LBZAVqQ4yhGCm/H3H270OSykqmQMKLBhBJDEw==
  optionalDependencies:
-    "@img/sharp-libvips-darwin-x64" "1.1.0"
+    "@img/sharp-libvips-darwin-x64" "1.2.4"

-"@img/sharp-libvips-darwin-arm64@1.1.0":
-  version "1.1.0"
-  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-darwin-arm64/-/sharp-libvips-darwin-arm64-1.1.0.tgz#843f7c09c7245dc0d3cfec2b3c83bb08799a704f"
-  integrity sha512-HZ/JUmPwrJSoM4DIQPv/BfNh9yrOA8tlBbqbLz4JZ5uew2+o22Ik+tHQJcih7QJuSa0zo5coHTfD5J8inqj9DA==
+"@img/sharp-libvips-darwin-arm64@1.2.4":
+  version "1.2.4"
+  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-darwin-arm64/-/sharp-libvips-darwin-arm64-1.2.4.tgz#2894c0cb87d42276c3889942e8e2db517a492c43"
+  integrity sha512-zqjjo7RatFfFoP0MkQ51jfuFZBnVE2pRiaydKJ1G/rHZvnsrHAOcQALIi9sA5co5xenQdTugCvtb1cuf78Vf4g==

-"@img/sharp-libvips-darwin-x64@1.1.0":
-  version "1.1.0"
-  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-darwin-x64/-/sharp-libvips-darwin-x64-1.1.0.tgz#1239c24426c06a8e833815562f78047a3bfbaaf8"
-  integrity sha512-Xzc2ToEmHN+hfvsl9wja0RlnXEgpKNmftriQp6XzY/RaSfwD9th+MSh0WQKzUreLKKINb3afirxW7A0fz2YWuQ==
+"@img/sharp-libvips-darwin-x64@1.2.4":
+  version "1.2.4"
+  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-darwin-x64/-/sharp-libvips-darwin-x64-1.2.4.tgz#e63681f4539a94af9cd17246ed8881734386f8cc"
+  integrity sha512-1IOd5xfVhlGwX+zXv2N93k0yMONvUlANylbJw1eTah8K/Jtpi15KC+WSiaX/nBmbm2HxRM1gZ0nSdjSsrZbGKg==

-"@img/sharp-libvips-linux-arm64@1.1.0":
-  version "1.1.0"
-  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.1.0.tgz#20d276cefd903ee483f0441ba35961679c286315"
-  integrity sha512-IVfGJa7gjChDET1dK9SekxFFdflarnUB8PwW8aGwEoF3oAsSDuNUTYS+SKDOyOJxQyDC1aPFMuRYLoDInyV9Ew==
+"@img/sharp-libvips-linux-arm64@1.2.4":
+  version "1.2.4"
+  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.2.4.tgz#b1b288b36864b3bce545ad91fa6dadcf1a4ad318"
+  integrity sha512-excjX8DfsIcJ10x1Kzr4RcWe1edC9PquDRRPx3YVCvQv+U5p7Yin2s32ftzikXojb1PIFc/9Mt28/y+iRklkrw==

-"@img/sharp-libvips-linux-arm@1.1.0":
-  version "1.1.0"
-  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linux-arm/-/sharp-libvips-linux-arm-1.1.0.tgz#067c0b566eae8063738cf1b1db8f8a8573b5465c"
-  integrity sha512-s8BAd0lwUIvYCJyRdFqvsj+BJIpDBSxs6ivrOPm/R7piTs5UIwY5OjXrP2bqXC9/moGsyRa37eYWYCOGVXxVrA==
+"@img/sharp-libvips-linux-arm@1.2.4":
+  version "1.2.4"
+  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linux-arm/-/sharp-libvips-linux-arm-1.2.4.tgz#b9260dd1ebe6f9e3bdbcbdcac9d2ac125f35852d"
+  integrity sha512-bFI7xcKFELdiNCVov8e44Ia4u2byA+l3XtsAj+Q8tfCwO6BQ8iDojYdvoPMqsKDkuoOo+X6HZA0s0q11ANMQ8A==

-"@img/sharp-libvips-linux-ppc64@1.1.0":
-  version "1.1.0"
-  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linux-ppc64/-/sharp-libvips-linux-ppc64-1.1.0.tgz#682334595f2ca00e0a07a675ba170af165162802"
-  integrity sha512-tiXxFZFbhnkWE2LA8oQj7KYR+bWBkiV2nilRldT7bqoEZ4HiDOcePr9wVDAZPi/Id5fT1oY9iGnDq20cwUz8lQ==
+"@img/sharp-libvips-linux-ppc64@1.2.4":
+  version "1.2.4"
+  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linux-ppc64/-/sharp-libvips-linux-ppc64-1.2.4.tgz#4b83ecf2a829057222b38848c7b022e7b4d07aa7"
+  integrity sha512-FMuvGijLDYG6lW+b/UvyilUWu5Ayu+3r2d1S8notiGCIyYU/76eig1UfMmkZ7vwgOrzKzlQbFSuQfgm7GYUPpA==

-"@img/sharp-libvips-linux-s390x@1.1.0":
-  version "1.1.0"
-  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linux-s390x/-/sharp-libvips-linux-s390x-1.1.0.tgz#82fcd68444b3666384235279c145c2b28d8ee302"
-  integrity sha512-xukSwvhguw7COyzvmjydRb3x/09+21HykyapcZchiCUkTThEQEOMtBj9UhkaBRLuBrgLFzQ2wbxdeCCJW/jgJA==
+"@img/sharp-libvips-linux-riscv64@1.2.4":
+  version "1.2.4"
+  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linux-riscv64/-/sharp-libvips-linux-riscv64-1.2.4.tgz#880b4678009e5a2080af192332b00b0aaf8a48de"
+  integrity sha512-oVDbcR4zUC0ce82teubSm+x6ETixtKZBh/qbREIOcI3cULzDyb18Sr/Wcyx7NRQeQzOiHTNbZFF1UwPS2scyGA==

-"@img/sharp-libvips-linux-x64@1.1.0":
-  version "1.1.0"
-  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linux-x64/-/sharp-libvips-linux-x64-1.1.0.tgz#65b2b908bf47156b0724fde9095676c83a18cf5a"
-  integrity sha512-yRj2+reB8iMg9W5sULM3S74jVS7zqSzHG3Ol/twnAAkAhnGQnpjj6e4ayUz7V+FpKypwgs82xbRdYtchTTUB+Q==
+"@img/sharp-libvips-linux-s390x@1.2.4":
+  version "1.2.4"
+  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linux-s390x/-/sharp-libvips-linux-s390x-1.2.4.tgz#74f343c8e10fad821b38f75ced30488939dc59ec"
+  integrity sha512-qmp9VrzgPgMoGZyPvrQHqk02uyjA0/QrTO26Tqk6l4ZV0MPWIW6LTkqOIov+J1yEu7MbFQaDpwdwJKhbJvuRxQ==

-"@img/sharp-libvips-linuxmusl-arm64@1.1.0":
-  version "1.1.0"
-  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linuxmusl-arm64/-/sharp-libvips-linuxmusl-arm64-1.1.0.tgz#72accf924e80b081c8db83b900b444a67c203f01"
-  integrity sha512-jYZdG+whg0MDK+q2COKbYidaqW/WTz0cc1E+tMAusiDygrM4ypmSCjOJPmFTvHHJ8j/6cAGyeDWZOsK06tP33w==
+"@img/sharp-libvips-linux-x64@1.2.4":
+  version "1.2.4"
+  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linux-x64/-/sharp-libvips-linux-x64-1.2.4.tgz#df4183e8bd8410f7d61b66859a35edeab0a531ce"
+  integrity sha512-tJxiiLsmHc9Ax1bz3oaOYBURTXGIRDODBqhveVHonrHJ9/+k89qbLl0bcJns+e4t4rvaNBxaEZsFtSfAdquPrw==

-"@img/sharp-libvips-linuxmusl-x64@1.1.0":
-  version "1.1.0"
-  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linuxmusl-x64/-/sharp-libvips-linuxmusl-x64-1.1.0.tgz#1fa052737e203f46bf44192acd01f9faf11522d7"
-  integrity sha512-wK7SBdwrAiycjXdkPnGCPLjYb9lD4l6Ze2gSdAGVZrEL05AOUJESWU2lhlC+Ffn5/G+VKuSm6zzbQSzFX/P65A==
+"@img/sharp-libvips-linuxmusl-arm64@1.2.4":
+  version "1.2.4"
+  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linuxmusl-arm64/-/sharp-libvips-linuxmusl-arm64-1.2.4.tgz#c8d6b48211df67137541007ee8d1b7b1f8ca8e06"
+  integrity sha512-FVQHuwx1IIuNow9QAbYUzJ+En8KcVm9Lk5+uGUQJHaZmMECZmOlix9HnH7n1TRkXMS0pGxIJokIVB9SuqZGGXw==

-"@img/sharp-linux-arm64@0.34.2":
-  version "0.34.2"
-  resolved "https://registry.yarnpkg.com/@img/sharp-linux-arm64/-/sharp-linux-arm64-0.34.2.tgz#c9690fac5f3137eaab3f7ad6065390d10f66f1fa"
-  integrity sha512-D8n8wgWmPDakc83LORcfJepdOSN6MvWNzzz2ux0MnIbOqdieRZwVYY32zxVx+IFUT8er5KPcyU3XXsn+GzG/0Q==
+"@img/sharp-libvips-linuxmusl-x64@1.2.4":
+  version "1.2.4"
+  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linuxmusl-x64/-/sharp-libvips-linuxmusl-x64-1.2.4.tgz#be11c75bee5b080cbee31a153a8779448f919f75"
+  integrity sha512-+LpyBk7L44ZIXwz/VYfglaX/okxezESc6UxDSoyo2Ks6Jxc4Y7sGjpgU9s4PMgqgjj1gZCylTieNamqA1MF7Dg==
+
+"@img/sharp-linux-arm64@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-linux-arm64/-/sharp-linux-arm64-0.34.5.tgz#7aa7764ef9c001f15e610546d42fce56911790cc"
+  integrity sha512-bKQzaJRY/bkPOXyKx5EVup7qkaojECG6NLYswgktOZjaXecSAeCWiZwwiFf3/Y+O1HrauiE3FVsGxFg8c24rZg==
  optionalDependencies:
-    "@img/sharp-libvips-linux-arm64" "1.1.0"
+    "@img/sharp-libvips-linux-arm64" "1.2.4"

-"@img/sharp-linux-arm@0.34.2":
-  version "0.34.2"
-  resolved "https://registry.yarnpkg.com/@img/sharp-linux-arm/-/sharp-linux-arm-0.34.2.tgz#771dd2ec645f85f98441359bfc118afaf38cbd8b"
-  integrity sha512-0DZzkvuEOqQUP9mo2kjjKNok5AmnOr1jB2XYjkaoNRwpAYMDzRmAqUIa1nRi58S2WswqSfPOWLNOr0FDT3H5RQ==
+"@img/sharp-linux-arm@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-linux-arm/-/sharp-linux-arm-0.34.5.tgz#5fb0c3695dd12522d39c3ff7a6bc816461780a0d"
+  integrity sha512-9dLqsvwtg1uuXBGZKsxem9595+ujv0sJ6Vi8wcTANSFpwV/GONat5eCkzQo/1O6zRIkh0m/8+5BjrRr7jDUSZw==
  optionalDependencies:
-    "@img/sharp-libvips-linux-arm" "1.1.0"
+    "@img/sharp-libvips-linux-arm" "1.2.4"

-"@img/sharp-linux-s390x@0.34.2":
-  version "0.34.2"
-  resolved "https://registry.yarnpkg.com/@img/sharp-linux-s390x/-/sharp-linux-s390x-0.34.2.tgz#82132d158abff57bd90b53574f2865f72f94e6c8"
-  integrity sha512-EGZ1xwhBI7dNISwxjChqBGELCWMGDvmxZXKjQRuqMrakhO8QoMgqCrdjnAqJq/CScxfRn+Bb7suXBElKQpPDiw==
+"@img/sharp-linux-ppc64@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-linux-ppc64/-/sharp-linux-ppc64-0.34.5.tgz#9c213a81520a20caf66978f3d4c07456ff2e0813"
+  integrity sha512-7zznwNaqW6YtsfrGGDA6BRkISKAAE1Jo0QdpNYXNMHu2+0dTrPflTLNkpc8l7MUP5M16ZJcUvysVWWrMefZquA==
  optionalDependencies:
-    "@img/sharp-libvips-linux-s390x" "1.1.0"
+    "@img/sharp-libvips-linux-ppc64" "1.2.4"

-"@img/sharp-linux-x64@0.34.2":
-  version "0.34.2"
-  resolved "https://registry.yarnpkg.com/@img/sharp-linux-x64/-/sharp-linux-x64-0.34.2.tgz#d815fb87899d462b28b62a9252ad127f02fe0740"
-  integrity sha512-sD7J+h5nFLMMmOXYH4DD9UtSNBD05tWSSdWAcEyzqW8Cn5UxXvsHAxmxSesYUsTOBmUnjtxghKDl15EvfqLFbQ==
+"@img/sharp-linux-riscv64@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-linux-riscv64/-/sharp-linux-riscv64-0.34.5.tgz#cdd28182774eadbe04f62675a16aabbccb833f60"
+  integrity sha512-51gJuLPTKa7piYPaVs8GmByo7/U7/7TZOq+cnXJIHZKavIRHAP77e3N2HEl3dgiqdD/w0yUfiJnII77PuDDFdw==
  optionalDependencies:
-    "@img/sharp-libvips-linux-x64" "1.1.0"
+    "@img/sharp-libvips-linux-riscv64" "1.2.4"

-"@img/sharp-linuxmusl-arm64@0.34.2":
-  version "0.34.2"
-  resolved "https://registry.yarnpkg.com/@img/sharp-linuxmusl-arm64/-/sharp-linuxmusl-arm64-0.34.2.tgz#cfac45b2abbc04628f676e123bfe3aeb300266c7"
-  integrity sha512-NEE2vQ6wcxYav1/A22OOxoSOGiKnNmDzCYFOZ949xFmrWZOVII1Bp3NqVVpvj+3UeHMFyN5eP/V5hzViQ5CZNA==
+"@img/sharp-linux-s390x@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-linux-s390x/-/sharp-linux-s390x-0.34.5.tgz#93eac601b9f329bb27917e0e19098c722d630df7"
+  integrity sha512-nQtCk0PdKfho3eC5MrbQoigJ2gd1CgddUMkabUj+rBevs8tZ2cULOx46E7oyX+04WGfABgIwmMC0VqieTiR4jg==
  optionalDependencies:
-    "@img/sharp-libvips-linuxmusl-arm64" "1.1.0"
+    "@img/sharp-libvips-linux-s390x" "1.2.4"

-"@img/sharp-linuxmusl-x64@0.34.2":
-  version "0.34.2"
-  resolved "https://registry.yarnpkg.com/@img/sharp-linuxmusl-x64/-/sharp-linuxmusl-x64-0.34.2.tgz#b876c23ff51d0fb6d9f3b0a07e2f4d1436c203ad"
-  integrity sha512-DOYMrDm5E6/8bm/yQLCWyuDJwUnlevR8xtF8bs+gjZ7cyUNYXiSf/E8Kp0Ss5xasIaXSHzb888V1BE4i1hFhAA==
+"@img/sharp-linux-x64@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-linux-x64/-/sharp-linux-x64-0.34.5.tgz#55abc7cd754ffca5002b6c2b719abdfc846819a8"
+  integrity sha512-MEzd8HPKxVxVenwAa+JRPwEC7QFjoPWuS5NZnBt6B3pu7EG2Ge0id1oLHZpPJdn3OQK+BQDiw9zStiHBTJQQQQ==
  optionalDependencies:
-    "@img/sharp-libvips-linuxmusl-x64" "1.1.0"
+    "@img/sharp-libvips-linux-x64" "1.2.4"

-"@img/sharp-wasm32@0.34.2":
-  version "0.34.2"
-  resolved "https://registry.yarnpkg.com/@img/sharp-wasm32/-/sharp-wasm32-0.34.2.tgz#b1dd0bab547dccf517586eb1fa5852160bba3b82"
-  integrity sha512-/VI4mdlJ9zkaq53MbIG6rZY+QRN3MLbR6usYlgITEzi4Rpx5S6LFKsycOQjkOGmqTNmkIdLjEvooFKwww6OpdQ==
+"@img/sharp-linuxmusl-arm64@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-linuxmusl-arm64/-/sharp-linuxmusl-arm64-0.34.5.tgz#d6515ee971bb62f73001a4829b9d865a11b77086"
+  integrity sha512-fprJR6GtRsMt6Kyfq44IsChVZeGN97gTD331weR1ex1c1rypDEABN6Tm2xa1wE6lYb5DdEnk03NZPqA7Id21yg==
+  optionalDependencies:
+    "@img/sharp-libvips-linuxmusl-arm64" "1.2.4"
+
+"@img/sharp-linuxmusl-x64@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-linuxmusl-x64/-/sharp-linuxmusl-x64-0.34.5.tgz#d97978aec7c5212f999714f2f5b736457e12ee9f"
+  integrity sha512-Jg8wNT1MUzIvhBFxViqrEhWDGzqymo3sV7z7ZsaWbZNDLXRJZoRGrjulp60YYtV4wfY8VIKcWidjojlLcWrd8Q==
+  optionalDependencies:
+    "@img/sharp-libvips-linuxmusl-x64" "1.2.4"
+
+"@img/sharp-wasm32@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-wasm32/-/sharp-wasm32-0.34.5.tgz#2f15803aa626f8c59dd7c9d0bbc766f1ab52cfa0"
+  integrity sha512-OdWTEiVkY2PHwqkbBI8frFxQQFekHaSSkUIJkwzclWZe64O1X4UlUjqqqLaPbUpMOQk6FBu/HtlGXNblIs0huw==
  dependencies:
-    "@emnapi/runtime" "^1.4.3"
+    "@emnapi/runtime" "^1.7.0"

-"@img/sharp-win32-arm64@0.34.2":
-  version "0.34.2"
-  resolved "https://registry.yarnpkg.com/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.34.2.tgz#f37bee0f60c167f825a09d2b8de6849b823e8b30"
-  integrity sha512-cfP/r9FdS63VA5k0xiqaNaEoGxBg9k7uE+RQGzuK9fHt7jib4zAVVseR9LsE4gJcNWgT6APKMNnCcnyOtmSEUQ==
+"@img/sharp-win32-arm64@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.34.5.tgz#3706e9e3ac35fddfc1c87f94e849f1b75307ce0a"
+  integrity sha512-WQ3AgWCWYSb2yt+IG8mnC6Jdk9Whs7O0gxphblsLvdhSpSTtmu69ZG1Gkb6NuvxsNACwiPV6cNSZNzt0KPsw7g==

-"@img/sharp-win32-ia32@0.34.2":
-  version "0.34.2"
-  resolved "https://registry.yarnpkg.com/@img/sharp-win32-ia32/-/sharp-win32-ia32-0.34.2.tgz#8fc30b6655bc6ff8910344a2020d334aa6361672"
-  integrity sha512-QLjGGvAbj0X/FXl8n1WbtQ6iVBpWU7JO94u/P2M4a8CFYsvQi4GW2mRy/JqkRx0qpBzaOdKJKw8uc930EX2AHw==
+"@img/sharp-win32-ia32@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-win32-ia32/-/sharp-win32-ia32-0.34.5.tgz#0b71166599b049e032f085fb9263e02f4e4788de"
+  integrity sha512-FV9m/7NmeCmSHDD5j4+4pNI8Cp3aW+JvLoXcTUo0IqyjSfAZJ8dIUmijx1qaJsIiU+Hosw6xM5KijAWRJCSgNg==

-"@img/sharp-win32-x64@0.34.2":
-  version "0.34.2"
-  resolved "https://registry.yarnpkg.com/@img/sharp-win32-x64/-/sharp-win32-x64-0.34.2.tgz#ecf19250f8fe35de684aa2b0ec6f773b3447247b"
-  integrity sha512-aUdT6zEYtDKCaxkofmmJDJYGCf0+pJg3eU9/oBuqvEeoB9dKI6ZLc/1iLJCTuJQDO4ptntAlkUmHgGjyuobZbw==
+"@img/sharp-win32-x64@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-win32-x64/-/sharp-win32-x64-0.34.5.tgz#a81ffb00e69267cd0a1d626eaedb8a8430b2b2f8"
+  integrity sha512-+29YMsqY2/9eFEiW93eqWnuLcWcufowXewwSNIT6UwZdUUCrM3oFjMWH/Z6/TMmb4hlFenmfAVbpWeup2jryCw==

-"@next/env@15.3.2":
-  version "15.3.2"
-  resolved "https://registry.yarnpkg.com/@next/env/-/env-15.3.2.tgz#7143eafa9b11cfdf3d3c7318b0facb9dfdb2948f"
-  integrity sha512-xURk++7P7qR9JG1jJtLzPzf0qEvqCN0A/T3DXf8IPMKo9/6FfjxtEffRJIIew/bIL4T3C2jLLqBor8B/zVlx6g==
+"@next/env@15.5.7":
+  version "15.5.7"
+  resolved "https://registry.yarnpkg.com/@next/env/-/env-15.5.7.tgz#4168db34ae3bc9fd9ad3b951d327f4cfc38d4362"
+  integrity sha512-4h6Y2NyEkIEN7Z8YxkA27pq6zTkS09bUSYC0xjd0NpwFxjnIKeZEeH591o5WECSmjpUhLn3H2QLJcDye3Uzcvg==

-"@next/swc-darwin-arm64@15.3.2":
-  version "15.3.2"
-  resolved "https://registry.yarnpkg.com/@next/swc-darwin-arm64/-/swc-darwin-arm64-15.3.2.tgz#1a7b36bf3c439f899065c878a580bc57a3630ec7"
-  integrity sha512-2DR6kY/OGcokbnCsjHpNeQblqCZ85/1j6njYSkzRdpLn5At7OkSdmk7WyAmB9G0k25+VgqVZ/u356OSoQZ3z0g==
+"@next/swc-darwin-arm64@15.5.7":
+  version "15.5.7"
+  resolved "https://registry.yarnpkg.com/@next/swc-darwin-arm64/-/swc-darwin-arm64-15.5.7.tgz#f0c9ccfec2cd87cbd4b241ce4c779a7017aed958"
+  integrity sha512-IZwtxCEpI91HVU/rAUOOobWSZv4P2DeTtNaCdHqLcTJU4wdNXgAySvKa/qJCgR5m6KI8UsKDXtO2B31jcaw1Yw==

-"@next/swc-darwin-x64@15.3.2":
-  version "15.3.2"
-  resolved "https://registry.yarnpkg.com/@next/swc-darwin-x64/-/swc-darwin-x64-15.3.2.tgz#3742026344f49128cf1b0f43814c67e880db7361"
-  integrity sha512-ro/fdqaZWL6k1S/5CLv1I0DaZfDVJkWNaUU3un8Lg6m0YENWlDulmIWzV96Iou2wEYyEsZq51mwV8+XQXqMp3w==
+"@next/swc-darwin-x64@15.5.7":
+  version "15.5.7"
+  resolved "https://registry.yarnpkg.com/@next/swc-darwin-x64/-/swc-darwin-x64-15.5.7.tgz#18009e9fcffc5c0687cc9db24182ddeac56280d9"
+  integrity sha512-UP6CaDBcqaCBuiq/gfCEJw7sPEoX1aIjZHnBWN9v9qYHQdMKvCKcAVs4OX1vIjeE+tC5EIuwDTVIoXpUes29lg==

-"@next/swc-linux-arm64-gnu@15.3.2":
-  version "15.3.2"
-  resolved "https://registry.yarnpkg.com/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-15.3.2.tgz#fb29d45c034e3d2eef89b0e2801d62eb86155823"
-  integrity sha512-covwwtZYhlbRWK2HlYX9835qXum4xYZ3E2Mra1mdQ+0ICGoMiw1+nVAn4d9Bo7R3JqSmK1grMq/va+0cdh7bJA==
+"@next/swc-linux-arm64-gnu@15.5.7":
+  version "15.5.7"
+  resolved "https://registry.yarnpkg.com/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-15.5.7.tgz#fe7c7e08264cf522d4e524299f6d3e63d68d579a"
+  integrity sha512-NCslw3GrNIw7OgmRBxHtdWFQYhexoUCq+0oS2ccjyYLtcn1SzGzeM54jpTFonIMUjNbHmpKpziXnpxhSWLcmBA==

-"@next/swc-linux-arm64-musl@15.3.2":
-  version "15.3.2"
-  resolved "https://registry.yarnpkg.com/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-15.3.2.tgz#396784ef312666600ab1ae481e34cb1f6e3ae730"
-  integrity sha512-KQkMEillvlW5Qk5mtGA/3Yz0/tzpNlSw6/3/ttsV1lNtMuOHcGii3zVeXZyi4EJmmLDKYcTcByV2wVsOhDt/zg==
+"@next/swc-linux-arm64-musl@15.5.7":
+  version "15.5.7"
+  resolved "https://registry.yarnpkg.com/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-15.5.7.tgz#94228fe293475ec34a5a54284e1056876f43a3cf"
+  integrity sha512-nfymt+SE5cvtTrG9u1wdoxBr9bVB7mtKTcj0ltRn6gkP/2Nu1zM5ei8rwP9qKQP0Y//umK+TtkKgNtfboBxRrw==

-"@next/swc-linux-x64-gnu@15.3.2":
-  version "15.3.2"
-  resolved "https://registry.yarnpkg.com/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-15.3.2.tgz#ac01fda376878e02bc6b57d1e88ab8ceae9f868e"
-  integrity sha512-uRBo6THWei0chz+Y5j37qzx+BtoDRFIkDzZjlpCItBRXyMPIg079eIkOCl3aqr2tkxL4HFyJ4GHDes7W8HuAUg==
+"@next/swc-linux-x64-gnu@15.5.7":
+  version "15.5.7"
+  resolved "https://registry.yarnpkg.com/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-15.5.7.tgz#078c71201dfe7fcfb8fa6dc92aae6c94bc011cdc"
+  integrity sha512-hvXcZvCaaEbCZcVzcY7E1uXN9xWZfFvkNHwbe/n4OkRhFWrs1J1QV+4U1BN06tXLdaS4DazEGXwgqnu/VMcmqw==

-"@next/swc-linux-x64-musl@15.3.2":
-  version "15.3.2"
-  resolved "https://registry.yarnpkg.com/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-15.3.2.tgz#327a5023003bcb3ca436efc08733f091bba2b1e8"
-  integrity sha512-+uxFlPuCNx/T9PdMClOqeE8USKzj8tVz37KflT3Kdbx/LOlZBRI2yxuIcmx1mPNK8DwSOMNCr4ureSet7eyC0w==
+"@next/swc-linux-x64-musl@15.5.7":
+  version "15.5.7"
+  resolved "https://registry.yarnpkg.com/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-15.5.7.tgz#72947f5357f9226292353e0bb775643da3c7a182"
+  integrity sha512-4IUO539b8FmF0odY6/SqANJdgwn1xs1GkPO5doZugwZ3ETF6JUdckk7RGmsfSf7ws8Qb2YB5It33mvNL/0acqA==

-"@next/swc-win32-arm64-msvc@15.3.2":
-  version "15.3.2"
-  resolved "https://registry.yarnpkg.com/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-15.3.2.tgz#ce3a6588bd9c020960704011ab20bd0440026965"
-  integrity sha512-LLTKmaI5cfD8dVzh5Vt7+OMo+AIOClEdIU/TSKbXXT2iScUTSxOGoBhfuv+FU8R9MLmrkIL1e2fBMkEEjYAtPQ==
+"@next/swc-win32-arm64-msvc@15.5.7":
+  version "15.5.7"
+  resolved "https://registry.yarnpkg.com/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-15.5.7.tgz#397b912cd51c6a80e32b9c0507ecd82514353941"
+  integrity sha512-CpJVTkYI3ZajQkC5vajM7/ApKJUOlm6uP4BknM3XKvJ7VXAvCqSjSLmM0LKdYzn6nBJVSjdclx8nYJSa3xlTgQ==

-"@next/swc-win32-x64-msvc@15.3.2":
-  version "15.3.2"
-  resolved "https://registry.yarnpkg.com/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-15.3.2.tgz#43cc36097ac27639e9024a5ceaa6e7727fa968c8"
-  integrity sha512-aW5B8wOPioJ4mBdMDXkt5f3j8pUr9W8AnlX0Df35uRWNT1Y6RIybxjnSUe+PhM+M1bwgyY8PHLmXZC6zT1o5tA==
-
-"@swc/counter@0.1.3":
-  version "0.1.3"
-  resolved "https://registry.yarnpkg.com/@swc/counter/-/counter-0.1.3.tgz#cc7463bd02949611c6329596fccd2b0ec782b0e9"
-  integrity sha512-e2BR4lsJkkRlKZ/qCHPw9ZaSxc0MVUd7gtbtaB7aMvHeJVYe8sOB8DBZkP2DtISHGSku9sCK6T6cnY0CtXrOCQ==
+"@next/swc-win32-x64-msvc@15.5.7":
+  version "15.5.7"
+  resolved "https://registry.yarnpkg.com/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-15.5.7.tgz#e02b543d9dc6c1631d4ac239cb1177245dfedfe4"
+  integrity sha512-gMzgBX164I6DN+9/PGA+9dQiwmTkE4TloBNx8Kv9UiGARsr9Nba7IpcBRA1iTV9vwlYnrE3Uy6I7Aj6qLjQuqw==

 "@swc/helpers@0.5.15":
  version "0.5.15"
@@ -310,13 +329,6 @@ buffer-equal-constant-time@1.0.1:
  resolved "https://registry.yarnpkg.com/buffer-equal-constant-time/-/buffer-equal-constant-time-1.0.1.tgz#f8e71132f7ffe6e01a5c9697a4c6f3e48d5cc819"
  integrity sha512-zRpUiDwd/xk6ADqPMATG8vc9VPrkck7T07OIx0gnjmJAnHnTVXNQG3vfvWNuiZIkwu9KrKdA1iJKfsfTVxE6NA==

-busboy@1.6.0:
-  version "1.6.0"
-  resolved "https://registry.yarnpkg.com/busboy/-/busboy-1.6.0.tgz#966ea36a9502e43cdb9146962523b92f531f6893"
-  integrity sha512-8SFQbg/0hQ9xy3UNTB0YEnsNBbWfhf7RtnzpL7TkBiTBRfrQ9Fxcnz7VJsleJpyp6rVLvXiuORqjlHi5q+PYuA==
-  dependencies:
-    streamsearch "^1.1.0"
-
 bytes@3.1.2, bytes@^3.1.2:
  version "3.1.2"
  resolved "https://registry.yarnpkg.com/bytes/-/bytes-3.1.2.tgz#8b0beeb98605adf1b128fa4386403c009e0221a5"
@@ -348,34 +360,6 @@ client-only@0.0.1:
  resolved "https://registry.yarnpkg.com/client-only/-/client-only-0.0.1.tgz#38bba5d403c41ab150bff64a95c85013cf73bca1"
  integrity sha512-IV3Ou0jSMzZrd3pZ48nLkT9DA7Ag1pnPzaiQhpW7c3RbcqqzvzzVu+L8gfqMp/8IM2MQtSiqaCxrrcfu8I8rMA==

-color-convert@^2.0.1:
-  version "2.0.1"
-  resolved "https://registry.yarnpkg.com/color-convert/-/color-convert-2.0.1.tgz#72d3a68d598c9bdb3af2ad1e84f21d896abd4de3"
-  integrity sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==
-  dependencies:
-    color-name "~1.1.4"
-
-color-name@^1.0.0, color-name@~1.1.4:
-  version "1.1.4"
-  resolved "https://registry.yarnpkg.com/color-name/-/color-name-1.1.4.tgz#c2a09a87acbde69543de6f63fa3995c826c536a2"
-  integrity sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==
-
-color-string@^1.9.0:
-  version "1.9.1"
-  resolved "https://registry.yarnpkg.com/color-string/-/color-string-1.9.1.tgz#4467f9146f036f855b764dfb5bf8582bf342c7a4"
-  integrity sha512-shrVawQFojnZv6xM40anx4CkoDP+fZsw/ZerEMsW/pyzsRbElpsL/DBVW7q3ExxwusdNXI3lXpuhEZkzs8p5Eg==
-  dependencies:
-    color-name "^1.0.0"
-    simple-swizzle "^0.2.2"
-
-color@^4.2.3:
-  version "4.2.3"
-  resolved "https://registry.yarnpkg.com/color/-/color-4.2.3.tgz#d781ecb5e57224ee43ea9627560107c0e0c6463a"
-  integrity sha512-1rXeuUUiGGrykh+CeBdu5Ie7OJwinCgQY0bc7GCRxy5xVHy+moaqkpL/jqQq0MtQOeYcrqEz4abc5f0KtU7W4A==
-  dependencies:
-    color-convert "^2.0.1"
-    color-string "^1.9.0"
-
 content-disposition@^1.0.0:
  version "1.0.0"
  resolved "https://registry.yarnpkg.com/content-disposition/-/content-disposition-1.0.0.tgz#844426cb398f934caefcbb172200126bc7ceace2"
@@ -447,10 +431,10 @@ destroy@^1.2.0:
  resolved "https://registry.yarnpkg.com/destroy/-/destroy-1.2.0.tgz#4803735509ad8be552934c67df614f94e66fa015"
  integrity sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg==

-detect-libc@^2.0.4:
-  version "2.0.4"
-  resolved "https://registry.yarnpkg.com/detect-libc/-/detect-libc-2.0.4.tgz#f04715b8ba815e53b4d8109655b6508a6865a7e8"
-  integrity sha512-3UDv+G9CsCKO1WKMGw9fwq/SWJYbI0c5Y7LU1AXYoDdbhE2AHQ6N6Nb34sG8Fj7T5APy8qXDCKuuIHd1BR0tVA==
+detect-libc@^2.1.2:
+  version "2.1.2"
+  resolved "https://registry.yarnpkg.com/detect-libc/-/detect-libc-2.1.2.tgz#689c5dcdc1900ef5583a4cb9f6d7b473742074ad"
+  integrity sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==

 dunder-proto@^1.0.1:
  version "1.0.1"
@@ -665,11 +649,6 @@ ipaddr.js@1.9.1:
  resolved "https://registry.yarnpkg.com/ipaddr.js/-/ipaddr.js-1.9.1.tgz#bff38543eeb8984825079ff3a2a8e6cbd46781b3"
  integrity sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==

-is-arrayish@^0.3.1:
-  version "0.3.2"
-  resolved "https://registry.yarnpkg.com/is-arrayish/-/is-arrayish-0.3.2.tgz#4574a2ae56f7ab206896fb431eaeed066fdf8f03"
-  integrity sha512-eVRqCvVlZbuw3GrM63ovNSNAeA1K16kaR/LRY/92w0zxQ5/1YzwblUX652i4Xs9RwAGjW9d9y6X88t8OaAJfWQ==
-
 is-promise@^4.0.0:
  version "4.0.0"
  resolved "https://registry.yarnpkg.com/is-promise/-/is-promise-4.0.0.tgz#42ff9f84206c1991d26debf520dd5c01042dd2f3"
@@ -812,28 +791,26 @@ negotiator@^1.0.0:
  resolved "https://registry.yarnpkg.com/negotiator/-/negotiator-1.0.0.tgz#b6c91bb47172d69f93cfd7c357bbb529019b5f6a"
  integrity sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==

-next@^15.2.3:
-  version "15.3.2"
-  resolved "https://registry.yarnpkg.com/next/-/next-15.3.2.tgz#97510629e38a058dd154782a5c2ec9c9ab94d0d8"
-  integrity sha512-CA3BatMyHkxZ48sgOCLdVHjFU36N7TF1HhqAHLFOkV6buwZnvMI84Cug8xD56B9mCuKrqXnLn94417GrZ/jjCQ==
+next@^15.2.6:
+  version "15.5.7"
+  resolved "https://registry.yarnpkg.com/next/-/next-15.5.7.tgz#4507700b2bbcaf2c9fb7a9ad25c0dac2ba4a9a75"
+  integrity sha512-+t2/0jIJ48kUpGKkdlhgkv+zPTEOoXyr60qXe68eB/pl3CMJaLeIGjzp5D6Oqt25hCBiBTt8wEeeAzfJvUKnPQ==
  dependencies:
-    "@next/env" "15.3.2"
-    "@swc/counter" "0.1.3"
+    "@next/env" "15.5.7"
    "@swc/helpers" "0.5.15"
-    busboy "1.6.0"
    caniuse-lite "^1.0.30001579"
    postcss "8.4.31"
    styled-jsx "5.1.6"
  optionalDependencies:
-    "@next/swc-darwin-arm64" "15.3.2"
-    "@next/swc-darwin-x64" "15.3.2"
-    "@next/swc-linux-arm64-gnu" "15.3.2"
-    "@next/swc-linux-arm64-musl" "15.3.2"
-    "@next/swc-linux-x64-gnu" "15.3.2"
-    "@next/swc-linux-x64-musl" "15.3.2"
-    "@next/swc-win32-arm64-msvc" "15.3.2"
-    "@next/swc-win32-x64-msvc" "15.3.2"
-    sharp "^0.34.1"
+    "@next/swc-darwin-arm64" "15.5.7"
+    "@next/swc-darwin-x64" "15.5.7"
+    "@next/swc-linux-arm64-gnu" "15.5.7"
+    "@next/swc-linux-arm64-musl" "15.5.7"
+    "@next/swc-linux-x64-gnu" "15.5.7"
+    "@next/swc-linux-x64-musl" "15.5.7"
+    "@next/swc-win32-arm64-msvc" "15.5.7"
+    "@next/swc-win32-x64-msvc" "15.5.7"
+    sharp "^0.34.3"

 object-assign@^4:
  version "4.1.1"
@@ -954,10 +931,10 @@ semver@^7.5.4:
  resolved "https://registry.yarnpkg.com/semver/-/semver-7.7.1.tgz#abd5098d82b18c6c81f6074ff2647fd3e7220c9f"
  integrity sha512-hlq8tAfn0m/61p4BVRcPzIGr6LKiMwo4VM6dGi6pt4qcRkmNzTcWq6eCEjEh+qXjkMDvPlOFFSGwQjoEa6gyMA==

-semver@^7.7.2:
-  version "7.7.2"
-  resolved "https://registry.yarnpkg.com/semver/-/semver-7.7.2.tgz#67d99fdcd35cec21e6f8b87a7fd515a33f982b58"
-  integrity sha512-RF0Fw+rO5AMf9MAyaRXI4AV0Ulj5lMHqVxxdSgiVbixSCXoEmmX/jk0CuJw4+3SqroYO9VoUh+HcuJivvtJemA==
+semver@^7.7.3:
+  version "7.7.3"
+  resolved "https://registry.yarnpkg.com/semver/-/semver-7.7.3.tgz#4b5f4143d007633a8dc671cd0a6ef9147b8bb946"
+  integrity sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==

 send@^1.0.0, send@^1.1.0:
  version "1.1.0"
@@ -992,36 +969,39 @@ setprototypeof@1.2.0:
  resolved "https://registry.yarnpkg.com/setprototypeof/-/setprototypeof-1.2.0.tgz#66c9a24a73f9fc28cbe66b09fed3d33dcaf1b424"
  integrity sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==

-sharp@^0.34.1:
-  version "0.34.2"
-  resolved "https://registry.yarnpkg.com/sharp/-/sharp-0.34.2.tgz#648bd639854dbe48047b0b420213c186d036b32d"
-  integrity sha512-lszvBmB9QURERtyKT2bNmsgxXK0ShJrL/fvqlonCo7e6xBF8nT8xU6pW+PMIbLsz0RxQk3rgH9kd8UmvOzlMJg==
+sharp@^0.34.3:
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/sharp/-/sharp-0.34.5.tgz#b6f148e4b8c61f1797bde11a9d1cfebbae2c57b0"
+  integrity sha512-Ou9I5Ft9WNcCbXrU9cMgPBcCK8LiwLqcbywW3t4oDV37n1pzpuNLsYiAV8eODnjbtQlSDwZ2cUEeQz4E54Hltg==
  dependencies:
-    color "^4.2.3"
-    detect-libc "^2.0.4"
-    semver "^7.7.2"
+    "@img/colour" "^1.0.0"
+    detect-libc "^2.1.2"
+    semver "^7.7.3"
  optionalDependencies:
-    "@img/sharp-darwin-arm64" "0.34.2"
-    "@img/sharp-darwin-x64" "0.34.2"
-    "@img/sharp-libvips-darwin-arm64" "1.1.0"
-    "@img/sharp-libvips-darwin-x64" "1.1.0"
-    "@img/sharp-libvips-linux-arm" "1.1.0"
-    "@img/sharp-libvips-linux-arm64" "1.1.0"
-    "@img/sharp-libvips-linux-ppc64" "1.1.0"
-    "@img/sharp-libvips-linux-s390x" "1.1.0"
-    "@img/sharp-libvips-linux-x64" "1.1.0"
-    "@img/sharp-libvips-linuxmusl-arm64" "1.1.0"
-    "@img/sharp-libvips-linuxmusl-x64" "1.1.0"
-    "@img/sharp-linux-arm" "0.34.2"
-    "@img/sharp-linux-arm64" "0.34.2"
-    "@img/sharp-linux-s390x" "0.34.2"
-    "@img/sharp-linux-x64" "0.34.2"
-    "@img/sharp-linuxmusl-arm64" "0.34.2"
-    "@img/sharp-linuxmusl-x64" "0.34.2"
-    "@img/sharp-wasm32" "0.34.2"
-    "@img/sharp-win32-arm64" "0.34.2"
-    "@img/sharp-win32-ia32" "0.34.2"
-    "@img/sharp-win32-x64" "0.34.2"
+    "@img/sharp-darwin-arm64" "0.34.5"
+    "@img/sharp-darwin-x64" "0.34.5"
+    "@img/sharp-libvips-darwin-arm64" "1.2.4"
+    "@img/sharp-libvips-darwin-x64" "1.2.4"
+    "@img/sharp-libvips-linux-arm" "1.2.4"
+    "@img/sharp-libvips-linux-arm64" "1.2.4"
+    "@img/sharp-libvips-linux-ppc64" "1.2.4"
+    "@img/sharp-libvips-linux-riscv64" "1.2.4"
+    "@img/sharp-libvips-linux-s390x" "1.2.4"
+    "@img/sharp-libvips-linux-x64" "1.2.4"
+    "@img/sharp-libvips-linuxmusl-arm64" "1.2.4"
+    "@img/sharp-libvips-linuxmusl-x64" "1.2.4"
+    "@img/sharp-linux-arm" "0.34.5"
+    "@img/sharp-linux-arm64" "0.34.5"
+    "@img/sharp-linux-ppc64" "0.34.5"
+    "@img/sharp-linux-riscv64" "0.34.5"
+    "@img/sharp-linux-s390x" "0.34.5"
+    "@img/sharp-linux-x64" "0.34.5"
+    "@img/sharp-linuxmusl-arm64" "0.34.5"
+    "@img/sharp-linuxmusl-x64" "0.34.5"
+    "@img/sharp-wasm32" "0.34.5"
+    "@img/sharp-win32-arm64" "0.34.5"
+    "@img/sharp-win32-ia32" "0.34.5"
+    "@img/sharp-win32-x64" "0.34.5"

 side-channel-list@^1.0.0:
  version "1.0.0"
@@ -1063,13 +1043,6 @@ side-channel@^1.0.6, side-channel@^1.1.0:
    side-channel-map "^1.0.1"
    side-channel-weakmap "^1.0.2"

-simple-swizzle@^0.2.2:
-  version "0.2.2"
-  resolved "https://registry.yarnpkg.com/simple-swizzle/-/simple-swizzle-0.2.2.tgz#a4da6b635ffcccca33f70d17cb92592de95e557a"
-  integrity sha512-JA//kQgZtbuY83m+xT+tXJkmJncGMTFT+C+g2h2R9uxkYIrE2yy9sgmcLhCnw57/WSD+Eh3J97FPEDFnbXnDUg==
-  dependencies:
-    is-arrayish "^0.3.1"
-
 source-map-js@^1.0.2:
  version "1.2.1"
  resolved "https://registry.yarnpkg.com/source-map-js/-/source-map-js-1.2.1.tgz#1ce5650fddd87abc099eda37dcff024c2667ae46"
@@ -1080,11 +1053,6 @@ statuses@2.0.1, statuses@^2.0.1:
  resolved "https://registry.yarnpkg.com/statuses/-/statuses-2.0.1.tgz#55cb000ccf1d48728bd23c685a063998cf1a1b63"
  integrity sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ==

-streamsearch@^1.1.0:
-  version "1.1.0"
-  resolved "https://registry.yarnpkg.com/streamsearch/-/streamsearch-1.1.0.tgz#404dd1e2247ca94af554e841a8ef0eaa238da764"
-  integrity sha512-Mcc5wHehp9aXz1ax6bZUyY5afg9u2rv5cqQI3mRrYkGC8rW2hM02jWuwjtL++LS5qinSyhj2QfLyNsuc+VsExg==
-
 styled-jsx@5.1.6:
  version "5.1.6"
  resolved "https://registry.yarnpkg.com/styled-jsx/-/styled-jsx-5.1.6.tgz#83b90c077e6c6a80f7f5e8781d0f311b2fe41499"
--- a/bin/openapi-check.sh
+++ b/bin/openapi-check.sh
@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+OPENAPI_SPEC="resources/openapi/openapi.json"
+AUTO_COMMIT="${AUTO_COMMIT:-false}"
+
+# Check that $OPENAPI_SPEC matches the current Malli schema definitions
+
+if [[ -n "${GITHUB_SHA:-}" ]]; then
+        echo "Running OpenAPI check on commit: $GITHUB_SHA"
+fi
+
+# Generate the current OpenAPI spec from Malli schemas using write-openapi-spec-to-file!
+# This creates $OPENAPI_SPEC directly
+# Using the generate-openapi-spec command from metabase.cmd.core
+yarn generate-openapi
+ret=$?
+
+if [[ $ret -ne 0 ]]; then
+        exit $ret
+fi
+
+if [[ ! -f "$OPENAPI_SPEC" ]]; then
+        echo "Error: $OPENAPI_SPEC does not exist!"
+        exit 1
+fi
+
+# Check if there are any differences between generated and committed versions
+if ! git diff --exit-code "$OPENAPI_SPEC" >/dev/null 2>&1; then
+        echo "OpenAPI schema changes detected:"
+        git diff "$OPENAPI_SPEC"
+
+        if [[ "$AUTO_COMMIT" == "true" ]]; then
+                echo ""
+                echo "Auto-committing changes..."
+
+                # Require PR_BRANCH to be set for auto-commit
+                if [[ -z "${PR_BRANCH:-}" ]]; then
+                        echo "Error: PR_BRANCH environment variable must be set for auto-commit"
+                        exit 1
+                fi
+
+                # Stash the generated spec from the merge commit
+                echo "Stashing generated OpenAPI spec from merge commit..."
+                cp "$OPENAPI_SPEC" "${OPENAPI_SPEC}.tmp"
+
+                # Checkout the actual PR branch (in case we're on a merge commit)
+                echo "Checking out branch: $PR_BRANCH"
+                git checkout -f "$PR_BRANCH"
+
+                # Restore the generated spec from the merge commit
+                mv -f "${OPENAPI_SPEC}.tmp" "$OPENAPI_SPEC"
+
+                git config user.name "github-actions[bot]"
+                git config user.email "github-actions[bot]@users.noreply.github.com"
+                git add "$OPENAPI_SPEC"
+
+                # Build commit message with SHAs if available
+                COMMIT_MSG="Update OpenAPI schema"
+                if [[ -n "${BASE_SHA:-}" ]] && [[ -n "${HEAD_SHA:-}" ]]; then
+                        BASE_SHORT="${BASE_SHA:0:7}"
+                        HEAD_SHORT="${HEAD_SHA:0:7}"
+                        COMMIT_MSG="Update OpenAPI schema (${BASE_SHORT}...${HEAD_SHORT})"
+                fi
+
+                git commit -m "$COMMIT_MSG"
+                if ! git push origin "$PR_BRANCH"; then
+                        echo "Error: Failed to push OpenAPI schema update to $PR_BRANCH."
+                        exit 1
+                fi
+                echo "OpenAPI schema updated and pushed to $PR_BRANCH."
+                exit 0
+        fi
+
+        echo "Error: OpenAPI specs are out of date!"
+        echo "The schema in $OPENAPI_SPEC does not match the current Malli schema definitions."
+        echo ""
+        echo "This can happen when:"
+        echo "  1. You added/modified API endpoints but didn't regenerate the OpenAPI spec"
+        echo "  2. Your branch is behind master, which has new API endpoints"
+        echo ""
+        echo "To fix this:"
+        echo "  1. Pull the latest changes from master: git pull origin master"
+        echo "  2. Run 'yarn generate-openapi' to update $OPENAPI_SPEC"
+        echo "  3. Commit the updated openapi.json file"
+        echo ""
+        echo "Differences:"
+        git diff "$OPENAPI_SPEC" || true
+        exit 1
+fi
+echo "OpenAPI specs are up to date."
+
+exit 0
--- a/deps.edn
+++ b/deps.edn
@@ -47,8 +47,6 @@
  com.github.jknack/handlebars              ^:antq/exclude                      ; 4.4.0 requires java 17+
                                            {:mvn/version "4.3.1"}              ; templating engine
  com.github.oliyh/martian-clj-http         {:mvn/version "0.1.31"}             ; openapi client
-  com.github.pangloss/transducers           {:git/sha "c91d39046c8c64dc31b84ebb27154a8084fcda4c" ; like medley for transducers
-                                             :git/url "https://github.com/pangloss/transducers"}
  com.github.seancorfield/honeysql          {:mvn/version "2.7.1340"}           ; Honey SQL 2. SQL generation from Clojure data maps
  com.github.seancorfield/next.jdbc         {:mvn/version "1.3.1070"}           ; Talk to JDBC DBs
  com.github.steffan-westcott/clj-otel-api  {:mvn/version "0.2.8"}              ; Telemetry library
@@ -76,7 +74,6 @@
                                                           commons-logging/commons-logging]}
  compojure/compojure                       {:mvn/version "1.7.1"               ; HTTP Routing library built on Ring
                                             :exclusions  [ring/ring-codec]}
-  crypto-random/crypto-random               {:mvn/version "1.2.1"}              ; library for generating cryptographically secure random bytes and strings
  diehard/diehard                           {:mvn/version "0.12.0"}
  dk.ative/docjure                          {:mvn/version "1.21.0"              ; excel export
                                             :exclusions  [org.apache.poi/poi
@@ -85,14 +82,12 @@
  hiccup/hiccup                             {:mvn/version "2.0.0"}              ; HTML templating
  inflections/inflections                   {:mvn/version "0.15.0"}             ; Clojure/Script library used for prularizing words
  instaparse/instaparse                     {:mvn/version "1.5.0"}              ; Make your own parser
-  io.github.camsaul/toucan2                 {:mvn/version "1.0.568"}
+  io.github.camsaul/toucan2                 {:mvn/version "1.0.570"}
  io.github.eerohele/pp                     {#_#_:git/tag "2024-11-13.77"       ; super fast pretty-printing library
                                             :git/sha "4998a1fdd9d3713d7034d04509e9212204773bf2"
                                             :git/url "https://github.com/eerohele/pp"}
-  ;; TODO: replace back to normal artifact
-  io.github.metabase/macaw                  {:mvn/version "0.2.29"}             ; Parse native SQL queries
-  io.github.resilience4j/resilience4j-retry ^:antq/exclude                      ; 2.x do not support Java 8
-                                            {:mvn/version "1.7.1"}              ; Support for retrying operations
+  io.github.metabase/macaw                  {:mvn/version "0.2.30"}             ; Parse native SQL queries
+  io.netty/netty-codec-http                 {:mvn/version "4.2.9.Final"}        ; override of transitive dep from aws s3
  io.prometheus/simpleclient_hotspot        {:mvn/version "0.16.0"}             ; prometheus jvm collector
  junegunn/grouper                          {:mvn/version "0.1.1"}              ; Batch processing helper
  kixi/stats                                {:mvn/version "0.5.7"               ; Various statistic measures implemented as transducers
@@ -108,7 +103,8 @@
                                                          org.bouncycastle/bcprov-jdk18on]}
  metabase/throttle                         {:mvn/version "1.0.2"}              ; Tools for throttling access to API endpoints and other code pathways
  methodical/methodical                     {:mvn/version "1.0.127"}            ; drop-in replacements for Clojure multimethods and adds several advanced features
-  metosin/malli                             {:mvn/version "0.19.2"}             ; Data-driven Schemas for Clojure/Script and babashka
+  metosin/malli                             {:git/url "https://github.com/metabase/malli" ; Data-driven Schemas for Clojure/Script and babashka
+                                             :git/sha "b4a2d78647a049870b316753d7aae7fb4ade3ae5"} ; patched to resolve an issue causing OOM
  nano-id/nano-id                           {:mvn/version "1.1.0"}              ; NanoID generator for generating entity_ids
  net.cgrand/macrovich                      {:mvn/version "0.2.2"}              ; utils for writing macros for both Clojure & ClojureScript
  net.clojars.wkok/openai-clojure           {:mvn/version "0.23.0"
@@ -120,12 +116,12 @@
                                                           junit/junit]}
  net.thisptr/jackson-jq                    {:mvn/version "1.6.0"}              ; Java implementation of the JQ json query language
  org.apache.commons/commons-compress       {:mvn/version "1.28.0"}             ; compression utils
-  org.apache.commons/commons-lang3          {:mvn/version "3.18.0"}             ; helper methods for working with java.lang stuff
-  org.apache.logging.log4j/log4j-1.2-api    {:mvn/version "2.25.1"}             ; apache logging framework
-  org.apache.logging.log4j/log4j-api        {:mvn/version "2.25.1"}             ; add compatibility with log4j 1.2
-  org.apache.logging.log4j/log4j-core       {:mvn/version "2.25.1"}             ; apache logging framework
-  org.apache.logging.log4j/log4j-jcl        {:mvn/version "2.25.1"}             ; allows the commons-logging API to work with log4j 2
-  org.apache.logging.log4j/log4j-jul        {:mvn/version "2.25.1"}             ; java.util.logging (JUL) -> Log4j2 adapter
+  org.apache.commons/commons-lang3          {:mvn/version "3.19.0"}             ; helper methods for working with java.lang stuff
+  org.apache.logging.log4j/log4j-1.2-api    {:mvn/version "2.25.3"}             ; apache logging framework
+  org.apache.logging.log4j/log4j-api        {:mvn/version "2.25.3"}             ; add compatibility with log4j 1.2
+  org.apache.logging.log4j/log4j-core       {:mvn/version "2.25.3"}             ; apache logging framework
+  org.apache.logging.log4j/log4j-jcl        {:mvn/version "2.25.3"}             ; allows the commons-logging API to work with log4j 2
+  org.apache.logging.log4j/log4j-jul        {:mvn/version "2.25.3"}             ; java.util.logging (JUL) -> Log4j2 adapter
  org.apache.logging.log4j/log4j-layout-template-json
  {:mvn/version "2.25.1"}             ; allows the custom json logging format
  org.apache.logging.log4j/log4j-slf4j2-impl
@@ -138,7 +134,7 @@
  org.apache.sshd/sshd-core                 {:mvn/version "2.16.0"              ; ssh tunneling and test server
                                             :exclusions  [org.slf4j/slf4j-api
                                                           org.slf4j/jcl-over-slf4j]}
-  org.apache.tika/tika-core                 {:mvn/version "3.2.2"}
+  org.apache.tika/tika-core                 {:mvn/version "3.2.3"}
  org.apache.xmlgraphics/batik-all          {:mvn/version "1.19"}               ; SVG -> image
  org.bouncycastle/bcpkix-jdk18on           {:mvn/version "1.81"}               ; Bouncy Castle crypto library -- explicit version of BC specified to resolve illegal reflective access errors
  org.bouncycastle/bcprov-jdk18on           {:mvn/version "1.81"}
@@ -150,11 +146,9 @@
  org.clojure/clojure                       {:mvn/version "1.12.2"}
  org.clojure/core.async                    {:mvn/version "1.7.701"
                                             :exclusions  [org.clojure/tools.reader]}
-  org.clojure/core.logic                    {:mvn/version "1.1.0"}              ; optimized pattern matching library for Clojure
  org.clojure/core.match                    {:mvn/version "1.1.0"}
  org.clojure/core.memoize                  {:mvn/version "1.1.266"}            ; useful FIFO, LRU, etc. caching mechanisms
  org.clojure/data.csv                      {:mvn/version "1.1.0"}              ; CSV parsing / generation
-  org.clojure/data.xml                      {:mvn/version "0.2.0-alpha9"}       ; XML parsing / generation
  org.clojure/java.classpath                {:mvn/version "1.1.0"}              ; examine the Java classpath from Clojure programs
  org.clojure/java.jdbc                     {:mvn/version "0.7.12"}             ; basic JDBC access from Clojure
  org.clojure/java.jmx                      {:mvn/version "1.1.0"}              ; JMX bean library, for exporting diagnostic info
@@ -199,8 +193,8 @@
                                                           org.eclipse.jetty.ee9/jetty-ee9-servlet
                                                           org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-server]}
  slingshot/slingshot                       {:mvn/version "0.12.2"}             ; enhanced throw/catch, used by other deps
-  software.amazon.awssdk/s3                 {:mvn/version "2.33.0"}             ; AWS SDK v2 for S3
-  software.amazon.awssdk/sts                {:mvn/version "2.33.0"}             ; Required for S3 client to use service account
+  software.amazon.awssdk/s3                 {:mvn/version "2.40.13"}             ; AWS SDK v2 for S3
+  software.amazon.awssdk/sts                {:mvn/version "2.36.2"}             ; Required for S3 client to use service account
  stencil/stencil                           {:mvn/version "0.5.0"}              ; Mustache templates for Clojure
  user-agent/user-agent                     {:mvn/version "0.1.1"}              ; User-Agent string parser, for Login History page & elsewhere
  weavejester/dependency                    {:mvn/version "1.0.0"}              ; Dependency graphs and topological sorting
@@ -691,7 +685,7 @@
  ;;
  ;; ./bin/mage cljfmt-all -h for more info
  :cljfmt
-  {:deps       {io.github.weavejester/cljfmt {:git/sha "7de286008766127128a156275b9add3bf443d7e5"}}
+  {:deps       {io.github.weavejester/cljfmt {:mvn/version "0.15.3"}}
   :ns-default cljfmt.tool
   :exec-fn    cljfmt.tool/fix}

--- a/dev/src/dev/deps_graph.clj
+++ b/dev/src/dev/deps_graph.clj
@@ -355,8 +355,8 @@

  ([deps module-x module-y]
   (let [module-x-ns->module-y-ns (->> (external-usages deps module-y)
-                                         (filter #(= (:module %) module-x))
-                                         (map (juxt :namespace :depends-on-namespace)))]
+                                       (filter #(= (:module %) module-x))
+                                       (map (juxt :namespace :depends-on-namespace)))]
     (reduce
      (fn [m [module-x-ns module-y-ns]]
        (update m module-x-ns (fn [deps]
--- a/dev/src/dev/search_perf.clj
+++ b/dev/src/dev/search_perf.clj
@@ -0,0 +1,511 @@
+(ns dev.search-perf
+  "Performance testing utilities for search with large numbers of tables,
+   users, and permission groups.
+
+  Example usage:
+    ;; Run full benchmark with default settings (10000 tables, 10 groups, 100 users)
+    (run-full-benchmark!)
+
+    ;; Run with custom settings
+    (run-full-benchmark! {:num-tables 10000
+                          :num-groups 10
+                          :num-users 100
+                          :iterations 5})
+
+    ;; Manual setup for interactive testing
+    (def test-env (create-test-environment! {:num-tables 1000
+                                             :num-groups 5
+                                             :num-users 50}))
+    (timed-search! \"table\" :user-id (:user-id test-env))
+    (cleanup-test-environment! test-env)"
+  (:require
+   [clojure.string :as str]
+   [dev.add-load :as add-load]
+   [metabase.api.common :as api]
+   [metabase.permissions.core :as perms]
+   [metabase.permissions.util :as perms-util]
+   [metabase.request.core :as request]
+   [metabase.search.config :as search.config]
+   [metabase.search.engine :as search.engine]
+   [metabase.search.impl :as search.impl]
+   [metabase.search.ingestion :as search.ingestion]
+   [metabase.util :as u]
+   [metabase.util.random :as u.random]
+   [toucan2.core :as t2]))
+
+(set! *warn-on-reflection* true)
+
+;;; -------------------------------------------- Setup Utilities: Database & Tables ------------------------------------
+
+(defn- generate-table-name
+  "Generate a table name with a prefix and index for identification."
+  [prefix idx]
+  (format "%s_table_%05d" prefix idx))
+
+(defn create-test-database!
+  "Create a test database for performance testing.
+   Returns the database ID."
+  []
+  (let [{:keys [db-id]} (add-load/from-script
+                         [[:model/Database {:?/db-id :id}
+                           {:name (str "Search Perf Test DB " (u.random/random-name))
+                            :engine :h2
+                            :details {}}]])]
+    (perms/set-database-permission! (perms/all-users-group) db-id :perms/view-data :blocked)
+    (perms/set-database-permission! (perms/all-users-group) db-id :perms/create-queries :no)
+    db-id))
+
+(defn create-tables-batch!
+  "Create a batch of tables for the given database.
+   Returns the number of tables created."
+  [db-id prefix start-idx cnt]
+  (let [script (vec
+                (for [i (range start-idx (+ start-idx cnt))]
+                  [:model/Table {}
+                   {:db_id       db-id
+                    :name        (generate-table-name prefix i)
+                    :description (format "Performance test table %d for search benchmarking" i)
+                    :active      true}]))]
+    (add-load/from-script script)
+    cnt))
+
+(defn create-test-database-with-tables!
+  "Create a test database with the specified number of tables.
+   Tables are created in batches for better performance.
+
+   Options:
+     :batch-size - Number of tables per batch (default 500)
+     :prefix - Prefix for table names (default \"perf_test\")
+
+   Returns a map with :db-id and :table-ids."
+  ([num-tables]
+   (create-test-database-with-tables! num-tables {}))
+  ([num-tables {:keys [batch-size prefix]
+                :or   {batch-size 500
+                       prefix     "perf_test"}}]
+   (let [db-id       (create-test-database!)
+         num-batches (Math/ceil (/ num-tables batch-size))]
+     (println (format "Creating %d tables in %d batches of %d..."
+                      num-tables (int num-batches) batch-size))
+     (let [timer (u/start-timer)]
+       (doseq [batch-num (range (int num-batches))]
+         (let [start-idx   (* batch-num batch-size)
+               batch-count (min batch-size (- num-tables start-idx))]
+           (create-tables-batch! db-id prefix start-idx batch-count)
+           (when (zero? (mod (inc batch-num) 10))
+             (println (format "  Created %d/%d tables..." (+ start-idx batch-count) num-tables)))))
+       (let [elapsed-ms (u/since-ms timer)
+             ;; Get all table IDs for this database
+             table-ids  (t2/select-pks-vec :model/Table :db_id db-id)]
+         (println (format "Created %d tables in %.2f seconds (%.1f tables/sec)"
+                          num-tables
+                          (/ elapsed-ms 1000.0)
+                          (/ (* num-tables 1000.0) elapsed-ms)))
+         {:db-id     db-id
+          :table-ids table-ids})))))
+
+;;; -------------------------------------------- Setup Utilities: Groups & Users ---------------------------------------
+
+(defn create-permission-groups!
+  "Create n permission groups for testing.
+   Returns a vector of group IDs."
+  [n run-id]
+  (println (format "Creating %d permission groups..." n))
+  (let [timer  (u/start-timer)
+        prefix (str "Search Perf Group " run-id " ")
+        script (vec
+                (for [i (range n)]
+                  [:model/PermissionsGroup {}
+                   {:name (str prefix i)}]))
+        _          (add-load/from-script script)
+        ;; Query for groups with our name pattern
+        group-ids  (t2/select-pks-vec :model/PermissionsGroup :name [:like (str prefix "%")])
+        elapsed-ms (u/since-ms timer)]
+    (println (format "Created %d groups in %.2f seconds" n (/ elapsed-ms 1000.0)))
+    group-ids))
+
+(defn create-users-with-memberships!
+  "Create n users and assign them to permission groups.
+   Each user is assigned to a subset of groups based on their index.
+   Users are also added to the All Users group automatically by the model.
+
+   Returns a vector of user IDs."
+  [n group-ids run-id]
+  (println (format "Creating %d users with group memberships..." n))
+  (let [timer      (u/start-timer)
+        num-groups (count group-ids)
+        email-domain (str "perftest" run-id ".example.com")
+        ;; Create users first
+        user-script (vec
+                     (for [i (range n)]
+                       [:model/User {}
+                        {:first_name (format "PerfUser%d" i)
+                         :last_name  "Test"
+                         :email      (format "user%d@%s" i email-domain)
+                         :password   "password123"}]))
+        _        (add-load/from-script user-script)
+        ;; Query for users by email pattern
+        user-ids (t2/select-pks-vec :model/User :email [:like (str "%@" email-domain)])]
+
+    ;; Create group memberships - assign each user to some groups
+    ;; User i gets assigned to groups where (mod i num-groups) matches certain patterns
+    (println "  Assigning users to groups...")
+    (let [membership-script
+          (vec
+           (for [user-idx (range n)
+                 group-idx (range num-groups)
+                 ;; Assign user to ~30% of groups based on a deterministic pattern
+                 :when (zero? (mod (+ user-idx group-idx) 3))]
+             [:model/PermissionsGroupMembership {}
+              {:user_id  (nth user-ids user-idx)
+               :group_id (nth group-ids group-idx)}]))]
+      (when (seq membership-script)
+        (add-load/from-script membership-script)))
+
+    (let [elapsed-ms (u/since-ms timer)]
+      (println (format "Created %d users with memberships in %.2f seconds" n (/ elapsed-ms 1000.0))))
+    user-ids))
+
+(defn grant-table-permissions-to-groups!
+  "Grant table-level permissions to groups.
+   Each group gets permissions to a subset of tables based on deterministic assignment.
+   This creates a realistic permission scenario where different groups have access
+   to different tables.
+
+   Assignment strategy:
+   - Each group gets access to ~5% of tables
+   - Tables are assigned based on (mod table-idx 20) pattern with group offset
+   - This ensures overlapping but distinct permission sets"
+  [table-ids group-ids]
+  (println (format "Granting table-level permissions to %d groups for %d tables..."
+                   (count group-ids) (count table-ids)))
+  (let [timer      (u/start-timer)
+        num-groups (count group-ids)
+        ;; Build permission assignments
+        ;; Each group gets ~5% of tables (1 in 20) with offset based on group index
+        assignments (for [group-idx (range num-groups)
+                          :let [group-id (nth group-ids group-idx)
+                                ;; Each group gets ~5% of tables with some overlap
+                                ;; Using mod 20 gives 5%, offset by group-idx for variation
+                                assigned-tables (filterv
+                                                 (fn [table-idx]
+                                                   ;; Deterministic pattern: group gets every 20th table
+                                                   ;; offset by group index to create variation between groups
+                                                   (zero? (mod (+ table-idx group-idx) 20)))
+                                                 (range (count table-ids)))]]
+                      {:group-id        group-id
+                       :group-idx       group-idx
+                       :table-indices   assigned-tables
+                       :num-tables      (count assigned-tables)})]
+
+    ;; Grant permissions - batch by group for efficiency
+    (doseq [{:keys [group-id table-indices]} assignments]
+      (let [table-perms-view  (into {} (for [tidx table-indices]
+                                         [(nth table-ids tidx) :unrestricted]))
+            table-perms-query (into {} (for [tidx table-indices]
+                                         [(nth table-ids tidx) :query-builder]))]
+        ;; Use batch permission setting
+        (when (seq table-perms-view)
+          (perms/set-table-permissions! group-id :perms/view-data table-perms-view)
+          (perms/set-table-permissions! group-id :perms/create-queries table-perms-query))))
+
+    (let [elapsed-ms (u/since-ms timer)]
+      (println (format "Granted table permissions in %.2f seconds" (/ elapsed-ms 1000.0))))))
+
+;;; -------------------------------------------- Test Environment Management -------------------------------------------
+
+(defn create-test-environment!
+  "Create a complete test environment with database, tables, groups, users, and permissions.
+
+   Options:
+     :num-tables - Number of tables to create (default 10000)
+     :num-groups - Number of permission groups (default 10)
+     :num-users - Number of users (default 100)
+     :prefix - Table name prefix (default \"perf_test\")
+
+   Returns a map containing:
+     :db-id - Database ID
+     :table-ids - Vector of table IDs
+     :group-ids - Vector of group IDs
+     :user-ids - Vector of user IDs
+     :user-id - ID of a sample non-admin user for testing
+     :run-id - Unique identifier for this test run"
+  ([]
+   (create-test-environment! {}))
+  ([{:keys [num-tables num-groups num-users prefix]
+     :or   {num-tables 10000
+            num-groups 10
+            num-users  100
+            prefix     "perf_test"}}]
+   (println "\n=== Creating Test Environment ===")
+   (let [timer  (u/start-timer)
+         run-id (u.random/random-name)
+         ;; Create database and tables
+         {:keys [db-id table-ids]} (create-test-database-with-tables! num-tables {:prefix prefix})
+         ;; Create permission groups
+         group-ids (create-permission-groups! num-groups run-id)
+         ;; Grant table-level permissions to groups
+         _ (grant-table-permissions-to-groups! table-ids group-ids)
+         ;; Create users with group memberships
+         user-ids (create-users-with-memberships! num-users group-ids run-id)
+         ;; Pick a user in the middle for testing
+         test-user-id (nth user-ids (quot num-users 2))
+         elapsed-ms (u/since-ms timer)]
+     (println (format "Test environment created in %.2f seconds" (/ elapsed-ms 1000.0)))
+     (println (format "  Run ID: %s" run-id))
+     (println (format "  Database: %d" db-id))
+     (println (format "  Tables: %d" num-tables))
+     (println (format "  Groups: %d" num-groups))
+     (println (format "  Users: %d" num-users))
+     (println (format "  Test user ID: %d" test-user-id))
+     {:db-id      db-id
+      :table-ids  table-ids
+      :group-ids  group-ids
+      :user-ids   user-ids
+      :user-id    test-user-id
+      :run-id     run-id
+      :num-tables num-tables})))
+
+(defn cleanup-test-environment!
+  "Delete all resources created by create-test-environment!"
+  [{:keys [db-id group-ids user-ids]}]
+  (println "\n=== Cleaning Up Test Environment ===")
+  (let [timer (u/start-timer)]
+    ;; Delete group memberships first (foreign key constraints)
+    (when (seq user-ids)
+      (println (format "Deleting memberships for %d users..." (count user-ids)))
+      (t2/delete! :model/PermissionsGroupMembership :user_id [:in user-ids] :group_id [:<> 1]))
+    ;; Delete users
+    (when (seq user-ids)
+      (println (format "Deleting %d users..." (count user-ids)))
+      (t2/delete! :model/User :id [:in user-ids]))
+    ;; Delete data permissions for groups
+    (when (seq group-ids)
+      (println (format "Deleting permissions for %d groups..." (count group-ids)))
+      (t2/delete! :model/DataPermissions :group_id [:in group-ids]))
+    ;; Delete groups
+    (when (seq group-ids)
+      (println (format "Deleting %d groups..." (count group-ids)))
+      (t2/delete! :model/PermissionsGroup :id [:in group-ids]))
+    ;; Delete tables and database
+    (when db-id
+      (let [table-count (t2/count :model/Table :db_id db-id)]
+        (println (format "Deleting database %d and %d tables..." db-id table-count))
+        (t2/delete! :model/Table :db_id db-id)
+        (t2/delete! :model/Database :id db-id)))
+    (let [elapsed-ms (u/since-ms timer)]
+      (println (format "Cleanup completed in %.2f seconds" (/ elapsed-ms 1000.0))))))
+
+;;; ------------------------------------------------ Search Utilities -----------------------------------------------
+
+(defn- search-context-for-user
+  "Build a search context for a specific user."
+  [user-id search-string models]
+  (request/with-current-user user-id
+    (search.impl/search-context
+     {:current-user-id       api/*current-user-id*
+      :current-user-perms    @api/*current-user-permissions-set*
+      :is-superuser?         api/*is-superuser?*
+      :is-impersonated-user? (perms-util/impersonated-user?)
+      :is-sandboxed-user?    (perms-util/impersonated-user?)
+      :archived              false
+      :context               :default
+      :search-string         search-string
+      :models                models
+      :model-ancestors?      false})))
+
+(defn search!
+  "Execute a search and return the results.
+
+   Options:
+     :user-id - User ID to run search as (required)
+     :models - Models to search (default all models)"
+  [search-string & {:keys [user-id models]
+                    :or   {models search.config/all-models}}]
+  (assert user-id "user-id is required for search!")
+  (let [ctx (search-context-for-user user-id search-string models)]
+    (search.engine/results ctx)))
+
+(defn timed-search!
+  "Execute a search and return timing information along with result count.
+
+   Options:
+     :user-id - User ID to run search as (required)
+     :models - Models to search (default all models)
+
+   Returns {:elapsed-ms <time> :result-count <count>}"
+  [search-string & {:keys [user-id models]
+                    :or   {models search.config/all-models}}]
+  (assert user-id "user-id is required for timed-search!")
+  (let [timer   (u/start-timer)
+        results (search! search-string :user-id user-id :models models)
+        elapsed (u/since-ms timer)]
+    {:elapsed-ms   elapsed
+     :result-count (count results)}))
+
+;;; ------------------------------------------------ Benchmark Functions --------------------------------------------
+
+(defn run-search-benchmark!
+  "Run a search benchmark with the given search string.
+
+   Options:
+     :user-id - User ID to run search as (required)
+     :iterations - Number of search iterations (default 5)
+     :models - Models to search (default all models)
+     :warmup - Number of warmup iterations (default 2)
+
+   Returns a map with benchmark statistics."
+  ([search-string opts]
+   (let [{:keys [user-id iterations warmup models]
+          :or   {iterations 5
+                 warmup     2
+                 models     search.config/all-models}} opts]
+     (assert user-id "user-id is required for benchmark!")
+     (println (format "\nRunning search benchmark for: \"%s\" (user-id: %d)" search-string user-id))
+     (println (format "  Warmup iterations: %d" warmup))
+     (println (format "  Benchmark iterations: %d" iterations))
+
+     ;; Warmup
+     (when (pos? warmup)
+       (println "  Warming up...")
+       (dotimes [_ warmup]
+         (search! search-string :user-id user-id :models models)))
+
+     ;; Benchmark
+     (println "  Running benchmark...")
+     (let [results (vec (for [i (range iterations)]
+                          (let [result (timed-search! search-string :user-id user-id :models models)]
+                            (println (format "    Iteration %d: %.2fms (%d results)"
+                                             (inc i)
+                                             (:elapsed-ms result)
+                                             (:result-count result)))
+                            result)))
+           times   (mapv :elapsed-ms results)
+           avg     (/ (reduce + times) (count times))
+           min-t   (apply min times)
+           max-t   (apply max times)
+           sorted  (sort times)
+           p50     (nth sorted (int (* 0.5 (count sorted))))
+           p95     (nth sorted (int (* 0.95 (dec (count sorted)))))]
+       (println "\n  Results:")
+       (println (format "    Average: %.2fms" avg))
+       (println (format "    Min: %.2fms" min-t))
+       (println (format "    Max: %.2fms" max-t))
+       (println (format "    P50: %.2fms" p50))
+       (println (format "    P95: %.2fms" p95))
+       {:search-string search-string
+        :user-id       user-id
+        :iterations    iterations
+        :result-count  (:result-count (first results))
+        :avg-ms        avg
+        :min-ms        min-t
+        :max-ms        max-t
+        :p50-ms        p50
+        :p95-ms        p95
+        :all-times-ms  times}))))
+
+(defn run-full-benchmark!
+  "Run a full benchmark suite with multiple search queries.
+
+   Creates a test environment with database, tables, groups, and users,
+   runs benchmarks with various search patterns using a non-admin user,
+   and optionally cleans up the test data.
+
+   Options:
+     :num-tables - Number of tables to create (default 10000)
+     :num-groups - Number of permission groups (default 10)
+     :num-users - Number of users (default 100)
+     :iterations - Benchmark iterations per query (default 5)
+     :cleanup? - Whether to cleanup after (default true)
+     :prefix - Table name prefix (default \"perf_test\")
+
+   Returns benchmark results for all queries."
+  ([]
+   (run-full-benchmark! {}))
+  ([{:keys [num-tables num-groups num-users iterations cleanup? prefix]
+     :or   {num-tables 10000
+            num-groups 10
+            num-users  100
+            iterations 5
+            cleanup?   true
+            prefix     "perf_test"}}]
+   (println (format "\n%s" (str/join (repeat 60 "="))))
+   (println "SEARCH PERFORMANCE BENCHMARK (Non-Admin User)")
+   (println (str/join (repeat 60 "=")))
+   (println "\nConfiguration:")
+   (println (format "  Tables: %d" num-tables))
+   (println (format "  Permission Groups: %d" num-groups))
+   (println (format "  Users: %d" num-users))
+   (println (format "  Iterations per query: %d" iterations))
+
+   (let [test-env (create-test-environment! {:num-tables num-tables
+                                             :num-groups num-groups
+                                             :num-users  num-users
+                                             :prefix     prefix})
+         user-id (:user-id test-env)
+         ;; Wait for search index to update if using async indexing
+         _ (binding [search.ingestion/*force-sync* true]
+             (Thread/sleep 1000))
+         queries [;; Exact prefix match
+                  (str prefix "_table_00001")
+                  ;; Partial prefix match
+                  (str prefix "_table")
+                  ;; Generic term that should match descriptions
+                  "performance test"
+                  ;; Broad search
+                  "table"
+                  ;; Very specific search
+                  (str prefix "_table_05000")]]
+     (try
+       (let [results (vec (for [query queries]
+                            (run-search-benchmark! query {:user-id    user-id
+                                                          :iterations iterations})))]
+         (println (format "\n%s" (str/join (repeat 60 "="))))
+         (println "SUMMARY")
+         (println (str/join (repeat 60 "=")))
+         (doseq [{:keys [search-string avg-ms result-count]} results]
+           (println (format "  \"%s\": %.2fms avg, %d results"
+                            search-string avg-ms result-count)))
+         {:results  results
+          :test-env test-env})
+       (finally
+         (when cleanup?
+           (cleanup-test-environment! test-env)))))))
+
+(comment
+  ;; Example usage:
+
+  ;; Quick test with fewer tables/users
+  (run-full-benchmark! {:num-tables 1
+                        :num-groups 5
+                        :num-users  4
+                        :iterations 1})
+
+  ;; Full benchmark with 10,000 tables
+  (run-full-benchmark! {:num-tables 10000
+                        :num-groups 25
+                        :num-users  100
+                        :iterations 10})
+
+ ;; {:p95-ms 539.613833, :result-count 10000, :avg-ms 536.6528708, :min-ms 529.310541, :all-times-ms [548.471834 534.8465 538.846875 536.401583 535.707 ...], ...}
+ ;; {:p95-ms 366.195458, :result-count 10000, :avg-ms 360.5523999, :min-ms 352.951208, :all-times-ms [355.839542 366.195458 352.951208 356.9155 362.09225 ...], ...}
+ ;; {:p95-ms 110.475333, :result-count 4000, :avg-ms 108.0612666, :min-ms 105.713041, :all-times-ms [112.747333 108.450292 107.548208 105.93625 108.159375 ...], ...}
+
+  ;; Manual setup for interactive testing
+  (def test-env (create-test-environment! {:num-tables 1000
+                                           :num-groups 35
+                                           :num-users  200}))
+
+  ;; Run individual searches with the non-admin user
+  (e/explain
+   (timed-search! "perf_test_table" :user-id (:user-id test-env)))
+  (timed-search! "table" :user-id (:user-id test-env) :models #{"table"})
+
+  (require '[dev.explain-analyze :as e])
+  ;; Try with different users
+  (e/explain
+   (timed-search! "table" :user-id (first (:user-ids test-env))))
+  (timed-search! "table" :user-id (last (:user-ids test-env)))
+
+  ;; Cleanup
+  (cleanup-test-environment! test-env))
--- a/docs/CONTRIBUTING.md
+++ b/docs/CONTRIBUTING.md
@@ -37,7 +37,7 @@ The core team runs a pretty well defined product process. It is actively being t

 ### A) Identify product needs from the community

-We actively look for new feature ideas from our community, user base and our own use of Metabase internally. We concentrate on the underlying _problem_ or _need_ as opposed to requests for specific features. While sometimes suggested features are built as requested, often we find that they involve changes to existing features, and perhaps an entirely different solution to the underlying problem. These will typically be collected in a number of issues, and tagged [Proposal](https://github.com/metabase/metabase/labels/.Proposal)
+We actively look for new feature ideas from our community, user base and our own use of Metabase internally. We concentrate on the underlying _problem_ or _need_ as opposed to requests for specific features. While sometimes suggested features are built as requested, often we find that they involve changes to existing features, and potentially an entirely different solution to the underlying problem. These will typically be collected in a number of issues, and tagged [Proposal](https://github.com/metabase/metabase/labels/.Proposal)

 ### B) Synthesize these needs into a concrete feature

@@ -107,4 +107,4 @@ Generally speaking, any issue in [Help Wanted](https://github.com/metabase/metab

 ### #YOLO JUST SUBMIT A PR

-If you come up with something really cool, and want to share it with us, just submit a PR. If it hasn't gone through the above process, we probably won't merge it as is, but if it's compelling, we're more than willing to help you via code review, design review and generally OCD nitpicking so that it fits into the rest of our codebase.
+If you come up with something cool, and want to share it with us, just submit a PR. If it hasn't gone through the above process, we probably won't merge it as is, but if it's compelling, we're more than willing to help you via code review, design review and generally OCD nitpicking so that it fits into the rest of our codebase.
--- a/docs/actions/introduction.md
+++ b/docs/actions/introduction.md
@@ -55,7 +55,7 @@ There are multiple ways to run actions:

 Just something to clarify here: actions, even though they are added to models, make their changes to the underlying table that a model queries. Which means that anyone who has access to the underlying table, or to questions or other models based on that table, will be able to see the effects of an action. Tools other than Metabase that are connected to that database will also pick up these changes.

-In this sense, models are containers for actions; models are a way to organize actions. In fact, you could (in theory) add a [custom action](./custom.md) to a model that performs some update unrelated to its model's data. For example, you could write a custom action that updates the `Accounts` table, and add that action to a model that only queries an unrelated table (e.g., the `Orders` table). But, you know, maybe don't do that (unless you have a really good reason). [Basic actions](./basic.md), however, are only be available for models that wrap a single raw table.
+In this sense, models are containers for actions; models are a way to organize actions. In fact, you could (in theory) add a [custom action](./custom.md) to a model that performs some update unrelated to its model's data. For example, you could write a custom action that updates the `Accounts` table, and add that action to a model that only queries an unrelated table (e.g., the `Orders` table). But, you know, maybe don't do that (unless you have a good reason). [Basic actions](./basic.md), however, are only be available for models that wrap a single raw table.

 Before using actions in production, consider playing around with actions on some sample data (like the Sample Database included with Metabase) to get a feel for how they work.

--- a/docs/ai/images/inline-sql.png
+++ b/docs/ai/images/inline-sql.png
--- a/docs/ai/metabot.md
+++ b/docs/ai/metabot.md
@@ -5,14 +5,14 @@ summary: Metabot is Metabase's AI assistant that helps you analyze data, create

 # Metabot - Metabase's AI assistant

-{% include beta-blockquote.html
-   message="For now, <a href='https://www.metabase.com/features/metabot-ai'>Metabot</a> is only available as an add-on for Pro and Enterprise plans on Metabase Cloud."
-%}
+> Metabot is only available as an add-on on Metabase Cloud.

 ![Meet Metabot](./images/metabot.png)

 Metabot helps you analyze your data by creating charts from natural language, generating SQL queries, fixing query errors, and analyzing existing visualizations.

+## Set up Metabot
+
 To set up Metabot, see [Metabot settings](./settings.md).

 ## What Metabot can do
@@ -21,6 +21,7 @@ Metabot can help you to:

 - [Create a chart using the query builder](#how-metabot-uses-the-query-builder) from a natural language query.
 - [Generate SQL in the native editor](../questions/native-editor/writing-sql.md) from natural language. (Currently, only SQL is supported.)
+- [Edit SQL directly in the native editor](#inline-sql-editing).
 - [Analyze a chart](#analyze-charts-with-metabot).
 - [Fix errors in SQL code](#have-metabot-fix-sql-queries).
 - Answer questions from our documentation (as in, the literature you're reading right now).
@@ -46,6 +47,7 @@ Some tips:
 - Whenever you want Metabot to do something completely different, you should reset the conversation, as Metabot might find that irrelevant historical context to be confusing.
 - Once Metabot creates a question for you, you can follow up with more questions or take over yourself. You can drill through the chart or step into the editor to tweak the query (both in the query builder and the SQL editor).
 - Metabot works best with English prompts. While it might understand other languages, you'll get the most reliable results by asking your questions in English.
+- Define domain-specific terms in the [glossary](../exploration-and-organization/data-model-reference.md#glossary) to help Metabot understand your organization's terminology.

 ### Metabot response menu

@@ -92,6 +94,17 @@ If you don't specify a specific table in a natural language question, Metabot wi

 When you get an error in a SQL query, you can click the **Have Metabot fix it** button, and Metabot will try to correct the query. You can also ask Metabot to fix your SQL in the chat.

+## Inline SQL editing
+
+![Using inline SQL editing](./images/inline-sql.png)
+
+You can ask Metabot to generate or edit code in the SQL editor, without using the [chat sidebar](#the-metabot-chat-sidebar):
+
+1. Open the [SQL editor](../questions/native-editor/writing-sql.md).
+2. Press Cmd+; on Mac or Ctrl+; on Windows.
+3. Describe the SQL you want to generate or modify.
+4. Review the generated code and accept or reject it.
+
 ## Navigating after Metabot creates a chart

 If Metabot creates a query or takes you to a new item but you want to return to the previous screen, you can navigate using your browser's back button.
--- a/docs/ai/settings.md
+++ b/docs/ai/settings.md
@@ -5,9 +5,7 @@ summary: Configure Metabot settings, including which collections Metabot can acc

 # Metabot AI settings

-{% include beta-blockquote.html
-   message="For now, <a href='https://www.metabase.com/features/metabot-ai'>Metabot</a> is only available as an add-on for Pro and Enterprise plans on Metabase Cloud."
-%}
+> Metabot is only available as an add-on on Metabase Cloud.

 _Settings > Admin settings > AI_

@@ -15,17 +13,33 @@ This page covers admin settings for Metabase's AI assistant, [Metabot](./metabot

 ![Admin settings for AI Metabot](./images/ai-settings.png)

+Before using Metabot in your Metabase, you'll need to add the Metabot add-on to your instance in Metabase Store.
+
+## Add Metabot from the Metabase Store
+
+For now, Metabot is only available for Metabase Cloud. Before you can set up Metabot in your Metabase, you'll need to add Metabot to your subscription from the Metabase Store.
+
+1. Go to [store.metabase.com](https://store.metabase.com).
+2. Log in with your **Metabase Store account** (distinct from the account you use to log into your Metabase).
+3. In the **Instances** tab, find the instance you'd like to add Metabot to, and click "Add Metabot AI".
+4. Pick the plan based on the number of requests you expect you'll need.
+
+   A "request" is any message anyone in your Metabase sends to Metabot. Several messages sent within the same chat session are counted as separate requests. Requests are added across the entire instance.
+
+5. Read through the [terms of service](https://www.metabase.com/license/hosting) and click **Add Metabot AI**.
+
+Once you've added Metabot AI in the Metabase store, you can log into your Metabase and configure it in _Admin settings > AI_.
+
 ## Verified content

 Admins on Pro and Enterprise plans can tell Metabot to only work with [models](../data-modeling/models.md) and [metrics](../data-modeling/metrics.md) that have been [verified](../exploration-and-organization/content-verification.md).

-Restricting Metabot to verified models and metrics (and only models and metrics) can help Metabot produce more reliable answers, since you know someone has at least vetted the data Metabot can use.
+Restricting Metabot to verified models and metrics (and only models and metrics) helps Metabot produce more reliable answers, since you know someone has at least vetted the data Metabot can use.

 ## When embedding Metabot, you can pick a collection for Metabot to have access to

 When embedding Metabot in your app, you can select a collection for Metabot:

-1. Go to **Settings** > **Admin settings** > **AI**.
 2. Click **Embedded Metabot**.
 3. In the **Collection Embedded Metabot can use** section, click **Pick a collection**.
 4. Select the collection that contains the models and metrics you want Metabot to use.
@@ -38,17 +52,11 @@ Alternatively (or additionally), you can restrict Metabot to [verified content](

 The best thing you can do to improve Metabot's performance is to prep your data like you would for onboarding a new (human) hire to your data. In practice, this means you should:

- [Add models and metrics to your Metabot collection](#add-models-and-metrics-to-your-metabot-collection)
 - [Add descriptions for your data and content](#add-descriptions-for-your-data-and-content)
 - [Make sure the semantic types for each field are correct](#make-sure-the-semantic-types-for-each-field-are-correct)
+- [Define domain-specific terms in the glossary](#define-domain-specific-terms-in-the-glossary)
 - [Curate prompt suggestions](#curate-prompt-suggestions)

-### Add models and metrics to your Metabot collection
-
-Create models that make it easy for Metabot to find answers to the kinds of questions you expect people to ask about your data. Create metrics that capture key business calculations that people frequently need to reference. Add these models and metrics to the collection you've designated for Metabot to learn from.
-
-For example, if people often ask questions about customer lifetime value (LTV), create a model that joins customer data with order history and calculates LTV. Or if people frequently need to know monthly active users (MAU), create a metric that defines exactly how MAU should be calculated.
-
 ### Add descriptions for your data and content

 Add descriptions to your [models](../data-modeling/models.md#add-metadata-to-columns-in-a-model), [metrics](../data-modeling/metrics.md), [dashboards](../dashboards/introduction.md), and [questions](../questions/introduction.md). Write descriptions to provide context, define terms, and explain business logic.
@@ -69,6 +77,12 @@ Make sure the semantic types for each field accurately describe the field's "mea

 Metabase will try to set semantic types automatically, but you should confirm that each field has the relevant semantic type. See [Data types and semantic types](../data-modeling/semantic-types.md). You can also set semantic types for [models](../data-modeling/models.md#add-metadata-to-columns-in-a-model).

+### Define domain-specific terms in the glossary
+
+Add your organization's terminology, acronyms, and business-specific terms to the [glossary](../exploration-and-organization/data-model-reference.md#glossary). When Metabot receives a prompt, it can look up terms in the glossary to better understand your request.
+
+For example, if you define "MRR" as "Monthly Recurring Revenue" in your glossary, Metabot will know what you mean when you ask "What's our MRR for Q4?" This is especially helpful for industry-specific jargon, internal product names, or abbreviations unique to your organization.
+
 ### Curate prompt suggestions

 When you select a collection for Metabot to "learn", Metabot will suggest a series of prompts based on the content it finds in that collection. These prompts just give people a feel for the kinds of things people can ask Metabot to do.
@@ -81,9 +95,17 @@ Metabot inherits the permissions of the current user, so you don't need to set p

 In other words, to restrict what data Metabot can see for each person, simply apply [data](../permissions/data.md) and [collection](../permissions/collections.md) permissions to their groups as you would normally, and those permissions will apply to their use of Metabot as well.

-## Metabot is only available instance-wide, not per person
+## Viewing Metabot usage

-Currently, Metabot will be available to everyone who uses your Metabase.
+You can see how many Metabot requests people have made this month by going to **Admin settings > Settings > License**.
+
+If you aren't logged into the [Metabase Store](../cloud/accounts-and-billing.md).(, you'll need to log in to the store before you can view the usage. Once logged in to the store, go back to your Metabase and view the license page.
+
+The **Metabot AI requests used, this month (updated daily)** field shows how many requests your Metabase has used this month. Each message sent to Metabot counts as a request.
+
+## Metabot can't be enabled per person
+
+Currently, Metabot is available to everyone who uses your Metabase.

 ## Metabot uses a variety of generative AI models to answer your questions

@@ -99,7 +121,7 @@ We've intentionally limited what Metabot can do. Metabot lacks access to API key

 Metabot has access to your Metabase metadata and some data values to help answer your questions:

- **Table, Question, Model, Dashboard, and Metric metadata**: Metabot can see the structure and configuration of your content
+- **Table, Question, Model, Dashboard, and Metric metadata**: Metabot can see the structure and configuration of your content.
 - **Sample field values**: When you ask questions like "Filter everyone from Wisconsin," Metabot might check the values in the state field to understand how the data is stored (like "WI" vs "Wisconsin"). See [syncs](../databases/sync-scan.md).
 - **Timeseries data**: For chart analysis, Metabot might see the timeseries data used to draw certain visualizations, depending on the chart type.

--- a/docs/ai/start.md
+++ b/docs/ai/start.md
@@ -4,9 +4,7 @@ title: "AI in Metabase"

 # AI in Metabase

-{% include beta-blockquote.html %}
-
-> For now, [Metabot](https://www.metabase.com/features/metabot-ai) is only available as an add-on for Pro and Enterprise plans on Metabase Cloud.
+> Metabot is only available as an add-on for Metabase Cloud.

 ## [Metabot](./metabot.md)

--- a/docs/api.html
+++ b/docs/api.html
--- a/docs/api.json
+++ b/docs/api.json
--- a/docs/cloud/change-region.md
+++ b/docs/cloud/change-region.md
@@ -30,6 +30,7 @@ To change regions, go to your [Metabase Store page](https://store.metabase.com/)
 - US East (North Virginia)
 - Europe (Frankfurt)
 - Asia Pacific (Singapore)
+- Asia Pacific (Sydney)
 - South America (São Paulo)

 ## Add the relevant IP addresses to your whitelist
--- a/docs/cloud/google-sheets.md
+++ b/docs/cloud/google-sheets.md
@@ -34,7 +34,7 @@ Here's how to set it up:
 5. Give the service account **Viewer** permissions. Metabase will only have access to this folder or sheet; it won't have access to any other files in your Google Drive. If you select folder, Metabase will also sync any sheets it finds in any subfolders.
 6. Click **Send** to share the folder with the Metabase service account.
 7. Copy the sharing link for the folder or sheet.
-8. Return to Metabase and paste the sharing link into the field that asks for "the sharing link for this folder/file".
+8. Return to Metabase and paste the sharing link into "the sharing link for this folder/file" field.

 **If you synced a Google Drive folder**, Metabase will sync with the Google Drive folder (and its subfolders) and import all Google Sheets, creating a new table in your Metabase Cloud Storage database for each sheet. For sheets with multiple tabs, Metabase will create a table for each tab. Metabase will only sync Google Sheets; it'll ignore other file types in the folder. After the initial sync, Metabase will sync every 15 minutes.

--- a/Show More
+++ b/Show More