fixes

Starting the poll on matchPending raced /stash: the branch is created before the
export task is, so the first poll read the previous task, saw a terminal status
and stopped -- leaving the two remaining remote-sync specs waiting on a second
poll that never came. Keying off matchFulfilled with a task_id present mirrors
what the settings-update listener already does.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.claude/skills/typescript-review/SKILL.md

@@ -13,7 +13,7 @@ allowed-tools: Read, Grep, Bash, Glob, Skill
 
 **Primary standard: the [`typescript-write`](../typescript-write/SKILL.md) skill.** Load it first — it defines the authoring rules this review enforces, alongside `frontend/CLAUDE.md` and `docs/developers-guide/frontend.md`.
 
-Adherence to `typescript-write` is the **highest-priority** review dimension: rank any violation of its provisions above all other findings. Treat its **no-`any` hard rule** (no explicit *or* implicit `any` in new code) as **blocking**, and verify it with the LSP rather than by eye.
+Adherence to `typescript-write` is the **highest-priority** review dimension: rank any violation of its provisions above all other findings. Treat its **no-`any` hard rule** (no explicit *or* implicit `any` in new code) as **blocking**. Use TypeScript LSP tools to inspect inferred types when available; otherwise rely on type-checking and linting.
 
 Review in this priority order:
 

.claude/skills/typescript-write/SKILL.md

@@ -13,7 +13,7 @@ description: Write TypeScript and JavaScript code following Metabase coding stan
 
 - **New code must not introduce `any`, explicit or implicit.** No `any` annotations, no `as any` / `as unknown as`, no untyped parameters or returns that infer `any`, no implicitly-`any` destructures or array/object literals.
 - **Untyped third-party / boundary values** must be typed at the boundary (a declared type, `unknown` + type guard, or a small typed wrapper) — never let `any` propagate inward.
-- **Mandatory LSP verification.** After writing or editing any TS/TSX, inspect the changed symbols with the TypeScript Language Server (hover to read inferred types; `goToDefinition` to confirm sources) and run the project type-check.
+- **Mandatory type verification.** Before finishing a TS/TSX change, run `bun run type-check-pure`. If TypeScript LSP tools are available, also inspect changed symbols with hover and go-to-definition; otherwise skip LSP check.
 
 ## Type tightening
 
@@ -26,6 +26,7 @@ description: Write TypeScript and JavaScript code following Metabase coding stan
 - **Avoid non-null assertions (`!`)**. Prefer a guard, early return, or `?.`. Use `!` only when non-nullness is provably true and localized, with a comment.
 - **No redundant runtime coercion** — don't wrap already-typed values in `Number()` / `String()` / `Boolean()`.
 - **Type guards belong in `frontend/src/metabase-types/guards/`**. Do not redefine them locally.
+- **A cast you can't avoid needs a real justification comment.** The `metabase/no-unjustified-type-casts` rule accepts any preceding comment — state the actual reason the cast is safe. NEVER write the legacy `// Unjustified type cast. FIXME` placeholder; it exists only on casts that predated the rule, and copying it sneaks an unjustified cast past the linter. If you can't articulate why the cast is correct, the cast is wrong — fix the types.
 
 ## Type modeling
 

.clj-kondo/config.edn

@@ -179,6 +179,8 @@
      clojure.core.async/take!
      clojure.core.async/to-chan!
      clojure.core.async/to-chan!!
+     ;; only writes .clj-kondo/ratchets.edn, from a :once fixture that finishes before the parallel tests
+     dev.kondo-ratchet/fix!
      metabase.ai-tracing.core/record!
      metabase.api.macros.defendpoint.tools-manifest/assert-optional-fields-nullable!
      metabase.channel.core/send!
@@ -298,7 +300,10 @@
     metabase.query-processor.util/normalize-token                {:namespaces ["metabase.*"]}}}
 
   :discouraged-var
-  {clojure.core/print                                 {:message "Use metabase.util.log instead of clojure.core/print"}
+  {metabase-enterprise.entity-retrieval.core/search-unfiltered {:message "Permission bypass risk: library-index hits are unfiltered — resolve each entity and drop what the current user can't read"}
+   metabase.entity-retrieval.core/search-unfiltered            {:message "Permission bypass risk: library-index hits are unfiltered — resolve each entity and drop what the current user can't read"}
+   metabase.entity-retrieval.mirror/search-unfiltered          {:message "Permission bypass risk: library-index hits are unfiltered — resolve each entity and drop what the current user can't read"}
+   clojure.core/print                                 {:message "Use metabase.util.log instead of clojure.core/print"}
    clojure.core/println                               {:message "Use metabase.util.log instead of clojure.core/println"}
    clojure.core/printf                                {:message "Use metabase.util.log instead of clojure.core/printf"}
    clojure.core/prn                                   {:message "Use metabase.util.log instead of clojure.core/prn"}
@@ -457,6 +462,7 @@
   metabase-enterprise.mfa.enrollment-flow-test/with-fresh-user-session!                  clojure.core/fn
   metabase-enterprise.mfa.login-flow-test/with-enrolled-rasta!                           clojure.core/fn
   metabase-enterprise.mfa.recovery-codes-test/with-confirmed-enrollment!                 clojure.core/fn
+  metabase-enterprise.remote-sync.worktree-pull-test/with-worktree                       clojure.core/let
   metabase-enterprise.serialization.metadata-file-import.wire-format-test/with-tiny-fixture! clojure.core/fn
   metabase-enterprise.serialization.test-util/with-dbs                                  clojure.core/fn
   metabase-enterprise.serialization.test-util/with-random-dump-dir                      clojure.core/let
@@ -465,6 +471,8 @@
   metabase.actions.test-util/with-actions                                               clojure.core/let
   metabase.transforms.test-util/with-transform-cleanup!                                 clojure.core/let
   metabase.api.common/let-404                                                           clojure.core/let
+  metabase.app-db.connection/with-unshared-connection                                   clojure.core/fn
+  metabase.app-db.core/with-unshared-connection                                         clojure.core/fn
   metabase.app-db.custom-migrations.util/with-temp-scheduler!                           clojure.core/fn
   metabase.app-db.custom-migrations/define-migration                                    clj-kondo.lint-as/def-catch-all
   metabase.app-db.custom-migrations/define-reversible-migration                         clj-kondo.lint-as/def-catch-all
@@ -524,6 +532,7 @@
   metabase.test/with-temp-empty-app-db                                                  clojure.core/let
   metabase.test/with-temp-file                                                          clojure.core/let
   metabase.test/with-user-in-groups                                                     clojure.core/let
+  metabase.transforms-rest.api.transform-runs-test/with-runs-fixture!                   clojure.core/fn
   metabase.upload.impl-test/with-upload-table!                                          clojure.core/let
   metabase.util/for-map                                                                 clojure.core/for
   metabase.util.files/with-open-path-to-resource                                        clojure.core/let
@@ -622,6 +631,7 @@
    metabase.lib.test-util.macros/mbql-query                                                                                  hooks.metabase.test.data/mbql-query
    metabase.lib.test-util.macros/mbql-5-query                                                                                hooks.metabase.test.data/mbql-query
    metabase.lib.test-util.macros/with-testing-against-standard-queries                                                       hooks.metabase.lib.test-util.macros/with-testing-against-standard-queries
+   metabase.metrics.api-dimension-test/with-seeded-metric                                                                    hooks.common/with-one-binding
    metabase.model-persistence.api-test/with-persistence-setup!                                                               hooks.common/with-one-top-level-binding
    metabase.model-persistence.api-test/with-setup!                                                                           hooks.common/with-one-top-level-binding
    metabase.model-persistence.test-util/with-persistence-enabled!                                                            hooks.metabase.model-persistence.test-util/with-persistence-enabled!
@@ -736,6 +746,7 @@
    clojurewerkz.quartzite.schedule.simple/schedule                                              macros.quartz/simple-schedule
    clojurewerkz.quartzite.triggers/build                                                        macros.quartz/build-trigger
    metabase-enterprise.database-routing.e2e-test/with-temp-dbs!                                 macros.metabase-enterprise.database-routing.e2e-test/with-temp-dbs!
+   metabase-enterprise.database-routing.e2e-test/with-routing-setup!                            macros.metabase-enterprise.database-routing.e2e-test/with-routing-setup!
    metabase-enterprise.impersonation.util-test/with-impersonations!                             macros.metabase-enterprise.impersonation.util-test/with-impersonations!
    metabase-enterprise.query-reference-validation.api-test/with-test-setup!                     macros.metabase-enterprise.query-reference-validation.api-test/with-test-setup!
    metabase-enterprise.sandbox.test-util/with-gtaps!                                            macros.metabase-enterprise.sandbox.test-util/with-gtaps!

.clj-kondo/config/modules/config.edn

@@ -55,9 +55,9 @@
 ;; Set of `:model/X` keywords defined by this module that it allows others to reference. By default all are private.
 ;; If you know what you're doing, we support an :any keyword, but let's prefer explicit sets for now.
 ;;
-;;    enterprise/workspaces
+;;    transforms
 ;;    {...
-;;     :model-exports #{:model/Workspace :model/WorkspaceMergeTransform}}
+;;     :model-exports #{:model/Transform :model/TransformRun}}
 ;;
 ;; ## `model-imports`:
 ;;
@@ -106,11 +106,11 @@
            parameters
            queries
            query-processor
+           remote-sync
            search
            settings
            util
-           warehouses
-           workspaces}
+           warehouses}
    :model-exports #{:model/Action}
    :model-imports #{:model/Card
                     :model/Collection
@@ -147,6 +147,7 @@
            config
            events
            models
+           permissions
            util}
    :model-imports #{:model/Card
                     :model/Collection
@@ -157,8 +158,7 @@
 
   agent-api
   {:team    "Metabot"
-   :api     #{metabase.agent-api.api
-              metabase.agent-api.init}
+   :api     #{metabase.agent-api.api metabase.agent-api.init metabase.agent-api.usage}
    :uses    #{ai-tracing
               api
               auth-identity
@@ -170,6 +170,7 @@
               lib-be
               llm
               metabot
+              premium-features
               queries
               query-permissions
               query-processor
@@ -184,7 +185,8 @@
                     :model/DashboardTab
                     :model/Database
                     :model/Table
-                    :model/User}}
+                    :model/User}
+   :model-exports #{:model/AgentApiCallLog}}
 
   agent-lib
   {:team "Metabot"
@@ -632,6 +634,7 @@
            permissions
            premium-features
            queries
+           remote-sync
            request
            revisions
            settings
@@ -723,6 +726,7 @@
            public-sharing
            queries
            query-processor
+           remote-sync
            search
            settings
            staleness
@@ -823,6 +827,7 @@
            queries
            query-permissions
            query-processor
+           remote-sync
            revisions
            search
            util
@@ -851,10 +856,8 @@
            metabase.driver.sql-jdbc.execute
            metabase.driver.sql-jdbc.execute.diagnostic
            metabase.driver.sql-jdbc.sync
-           ;; TODO (lbrdnk 2025/12/17): We should revisit addition of the following line. I've added it to make
-           ;; tests pass as we are using it directly with ee/workspaces module. I believe later, when workspaces
-           ;; are in better state quality wise, it should become part of the driver api and that should be used
-           ;; instead of calling directly into the normalize module.
+           ;; TODO (lbrdnk 2025/12/17): We should revisit addition of the following line. Ideally this would
+           ;; become part of the driver api rather than callers reaching directly into the normalize module.
            metabase.driver.sql.normalize
            metabase.driver.sql.query-processor
            metabase.driver.sql.util
@@ -878,10 +881,7 @@
            tracing
            util
            warehouse-schema
-           warehouses
-           ;; `metabase.driver.sync/include-schema?` skips workspace iso schemas
-           ;; on parent (non-workspace-mode) instances. See GHY-3489.
-           workspaces}
+           warehouses}
    :model-imports #{:model/Database :model/Field :model/Table}}
 
   driver-api
@@ -1048,6 +1048,7 @@
   health-inspector
   {:team "Querying Platform"
    :api #{metabase.health-inspector.api
+          metabase.health-inspector.core
           metabase.health-inspector.init}
    :uses #{api
            lib
@@ -1303,7 +1304,8 @@
               metabase.metabot.core
               metabase.metabot.init
               metabase.metabot.self
-              metabase.metabot.settings}
+              metabase.metabot.settings
+              metabase.metabot.tools.entity-details}
    :friends #{agent-api
               enterprise/metabot
               enterprise/metabot-analytics
@@ -1323,11 +1325,13 @@
               documents
               driver
               entity-retrieval
+              events
               interestingness
               legacy-mbql
               lib
               lib-be
               llm
+              metrics
               models
               native-query-snippets
               notification
@@ -1335,6 +1339,8 @@
               permissions
               premium-features
               pulse
+              queries
+              query-permissions
               query-processor
               request
               search
@@ -1360,6 +1366,7 @@
                     :model/DashboardCard
                     :model/DashboardTab
                     :model/Database
+                    :model/Document
                     :model/Field
                     :model/Glossary
                     :model/Measure
@@ -1376,21 +1383,18 @@
            metabase.metrics.core}
    :uses #{api
            collections
+           events
            lib
            lib-be
            lib-metric
            models
            parameters
            permissions
-           premium-features
            query-processor
            request
            server
            util}
-   :model-imports #{:model/Card
-                    :model/Field
-                    :model/Measure
-                    :model/Table}}
+   :model-imports #{:model/Card :model/Field :model/Measure}}
 
   model-persistence
   {:team "Graphy"
@@ -1413,8 +1417,7 @@
            task
            task-history
            tracing
-           util
-           workspaces}
+           util}
    :model-exports #{:model/PersistedInfo}
    :model-imports #{:model/Card :model/Database}}
 
@@ -1444,6 +1447,7 @@
                     :model/Field
                     :model/Measure
                     :model/NativeQuerySnippet
+                    :model/RemoteSyncWorktreeRemapping
                     :model/Segment
                     :model/Table
                     :model/User}}
@@ -1584,6 +1588,7 @@
   {:team "UX West"
    :api  #{metabase.permissions.core
            metabase.permissions.init
+           metabase.permissions.metric
            metabase.permissions.schema}
    :uses #{api
            app-db
@@ -1608,6 +1613,7 @@
                     :model/PermissionsRevision}
    :model-imports #{:model/Collection
                     :model/Database
+                    :model/Field
                     :model/Table
                     :model/User}}
 
@@ -1622,7 +1628,9 @@
            request
            settings
            util}
-   :model-imports #{:model/DataPermissions
+   :model-imports #{:model/Card
+                    :model/Dashboard
+                    :model/DataPermissions
                     :model/Database
                     :model/PermissionsGroup
                     :model/PermissionsGroupMembership
@@ -1786,6 +1794,7 @@
            pulse
            query-permissions
            query-processor
+           remote-sync
            request
            search
            settings
@@ -1874,7 +1883,6 @@
               metabase.query-processor.interface
               metabase.query-processor.metadata
               metabase.query-processor.middleware.constraints
-              metabase.query-processor.middleware.enterprise
               metabase.query-processor.middleware.permissions
               metabase.query-processor.parameters.dates
               metabase.query-processor.parameters.operators
@@ -1909,6 +1917,7 @@
            legacy-mbql
            lib
            lib-be
+           lib-metric
            model-persistence
            models
            parameters
@@ -1923,8 +1932,7 @@
            system
            tracing
            users
-           util
-           workspaces}
+           util}
    :model-imports #{:model/Card
                     :model/DashboardCardSeries
                     :model/Database
@@ -1938,7 +1946,8 @@
            metabase.remote-sync.init}
    :uses #{api
            models
-           premium-features}
+           premium-features
+           util}
    :model-imports #{:model/Collection}}
 
   request
@@ -2011,6 +2020,7 @@
            metabase.search.core
            metabase.search.engine
            metabase.search.in-place.scoring
+           metabase.search.index-health
            metabase.search.ingestion
            metabase.search.init
            metabase.search.scoring
@@ -2025,6 +2035,7 @@
            collections
            config
            events
+           health-inspector
            lib
            lib-be
            models
@@ -2294,8 +2305,7 @@
            tracing
            util
            warehouse-schema
-           warehouses
-           workspaces}
+           warehouses}
    :model-imports #{:model/Database
                     :model/Field
                     :model/FieldValues
@@ -2392,6 +2402,7 @@
            collections
            events
            models
+           remote-sync
            util}
    :model-exports #{:model/Timeline}
    :model-imports #{:model/Collection :model/User}}
@@ -2442,6 +2453,7 @@
    :friends #{models
               enterprise/transforms-python}
    :model-exports #{:model/Transform
+                    :model/TransformDagRun
                     :model/TransformJob
                     :model/TransformJobRun
                     :model/TransformJobTransformTag
@@ -2477,8 +2489,7 @@
            premium-features
            query-processor
            sync
-           util
-           workspaces}
+           util}
    :friends #{transforms
               enterprise/transforms-python}}
 
@@ -2499,12 +2510,36 @@
            transforms-base
            util}
    :model-imports #{:model/Transform
+                    :model/TransformDagRun
                     :model/TransformJob
                     :model/TransformJobRun
                     :model/TransformJobTransformTag
                     :model/TransformRun
                     :model/TransformTag}}
 
+  typed-schemas
+  {:team "Embedding"
+   :api  #{metabase.typed-schemas.api}
+   :uses #{actions
+           api
+           collections
+           lib
+           lib-be
+           metabot
+           metrics
+           models
+           permissions
+           system
+           types
+           util}
+   :model-imports #{:model/Action
+                    :model/Card
+                    :model/Collection
+                    :model/Database
+                    :model/Field
+                    :model/Measure
+                    :model/Table}}
+
   types
   {:team "Querying Platform"
    :api  #{metabase.types.core
@@ -2531,8 +2566,7 @@
            settings
            sync
            util
-           warehouse-schema
-           workspaces}
+           warehouse-schema}
    :model-imports #{:model/Card
                     :model/Database
                     :model/Field
@@ -2687,6 +2721,7 @@
            warehouses}
    :model-exports #{:model/Dimension
                     :model/Field
+                    :model/FieldUserSettings
                     :model/FieldValues
                     :model/Table}
    :model-imports #{:model/Card
@@ -2784,13 +2819,6 @@
                     :model/Field
                     :model/Table}}
 
-  workspaces
-  {:team "Graphy"
-   :api #{metabase.workspaces.core
-          metabase.workspaces.table-remapping}
-   :uses #{premium-features
-           util}}
-
   xrays
   {:team "Graphy"
    :api  #{metabase.xrays.api
@@ -2864,8 +2892,7 @@
            setup
            sync
            users
-           util
-           enterprise/workspaces}
+           util}
    :model-imports #{:model/ApiKey :model/Database :model/User}}
 
   enterprise/advanced-permissions
@@ -2892,6 +2919,17 @@
                     :model/Sandbox
                     :model/Table}}
 
+  enterprise/agent-api
+  {:team "Metabot"
+   :api  #{metabase-enterprise.agent-api.init}
+   :uses #{agent-api
+           analytics
+           metabot
+           premium-features
+           task
+           util}
+   :model-imports #{:model/AgentApiCallLog}}
+
   enterprise/analytics
   {:team "UX West"
    :api  #{}
@@ -2902,7 +2940,7 @@
            enterprise/scim
            enterprise/semantic-search
            enterprise/sso}
-   :model-imports #{:model/Database :model/Sandbox :model/Workspace}}
+   :model-imports #{:model/Database :model/Sandbox}}
 
   enterprise/api
   {:team "UX West"
@@ -2991,20 +3029,6 @@
                     :model/QueryCache
                     :model/QueryExecution}}
 
-  enterprise/checker
-  {:team "Graphy"
-   ;; todo: add ability to prevent usage (transitive even) of app db
-   :api  #{}
-   :uses #{classloader
-           lib
-           models
-           plugins
-           query-processor
-           sql-tools
-           util
-           enterprise/dependencies}
-   :model-imports #{:model/Database}}
-
   enterprise/cloud-add-ons
   {:team "Cloud"
    :api  #{metabase-enterprise.cloud-add-ons.api}
@@ -3072,6 +3096,17 @@
    :api  #{}
    :uses #{premium-features}}
 
+  enterprise/data-apps
+  {:team "Gadget"
+   :api  #{metabase-enterprise.data-apps.api
+           metabase-enterprise.data-apps.init
+           metabase-enterprise.data-apps.sync}
+   :uses #{api
+           models
+           premium-features
+           settings
+           util}}
+
   enterprise/data-complexity-score
   {:team "Metabot"
    :api  #{metabase-enterprise.data-complexity-score.api
@@ -3142,15 +3177,13 @@
            settings
            util
            warehouse-schema
-           warehouses
-           workspaces}
+           warehouses}
    :model-exports #{:model/DatabaseRouter}
    :model-imports #{:model/Database :model/Transform}}
 
   enterprise/dependencies
   {:team "Graphy"
-   :api  #{metabase-enterprise.dependencies.analysis
-           metabase-enterprise.dependencies.api
+   :api  #{metabase-enterprise.dependencies.api
            metabase-enterprise.dependencies.core
            metabase-enterprise.dependencies.init
            metabase-enterprise.dependencies.models.dependency}
@@ -3231,9 +3264,12 @@
   {:team "Metabot"
    :api  #{metabase-enterprise.entity-retrieval.init}
    :uses #{analytics-interface
+           app-db
            collections
            entity-retrieval
+           health-inspector
            premium-features
+           search
            task
            util
            enterprise/semantic-search}
@@ -3420,14 +3456,17 @@
            task
            task-history
            util
+           enterprise/data-apps
            enterprise/serialization
            enterprise/transforms-python}
-   :model-exports #{:model/RemoteSyncTask}
-   :model-imports #{:model/Card
+   :model-exports #{:model/RemoteSyncTask :model/RemoteSyncWorktreeRemapping}
+   :model-imports #{:model/Action
+                    :model/Card
                     :model/Collection
                     :model/Dashboard
                     :model/Document
                     :model/Field
+                    :model/FieldUserSettings
                     :model/Measure
                     :model/NativeQuerySnippet
                     :model/PythonLibrary
@@ -3512,8 +3551,7 @@
            settings
            system
            users
-           util
-           enterprise/serialization}
+           util}
    :model-imports #{:model/ApiKey
                     :model/PermissionsGroup
                     :model/PermissionsGroupMembership
@@ -3554,7 +3592,9 @@
            metabase-enterprise.semantic-search.core
            metabase-enterprise.semantic-search.db.datasource
            metabase-enterprise.semantic-search.embedding
-           metabase-enterprise.semantic-search.init}
+           metabase-enterprise.semantic-search.embedding-health
+           metabase-enterprise.semantic-search.init
+           metabase-enterprise.semantic-search.util}
    :uses #{activity-feed
            analytics
            analytics-interface
@@ -3564,6 +3604,7 @@
            config
            connection-pool
            events
+           health-inspector
            lib-be
            llm
            metabot
@@ -3581,12 +3622,7 @@
 
   enterprise/serialization
   {:team "Graphy"
-   :api  #{metabase-enterprise.serialization.api
-           metabase-enterprise.serialization.cmd
-           metabase-enterprise.serialization.core
-           metabase-enterprise.serialization.init
-           metabase-enterprise.serialization.schema
-           metabase-enterprise.serialization.v2.backfill-ids}
+   :api  #{metabase-enterprise.serialization.api metabase-enterprise.serialization.cmd metabase-enterprise.serialization.core}
    :friends #{enterprise/memoize-monitor}
    :uses #{analytics
            api
@@ -3602,9 +3638,7 @@
            search
            server
            setup
-           sync
-           util
-           warehouse-schema}
+           util}
    :model-imports :bypass}
 
   enterprise/snippet-collections
@@ -3669,7 +3703,7 @@
 
   enterprise/tenants
   {:team "Admin Webapp"
-   :api  #{metabase-enterprise.tenants.api}
+   :api  #{metabase-enterprise.tenants.api metabase-enterprise.tenants.init}
    :uses #{api
            audit-app
            auth-identity
@@ -3748,33 +3782,7 @@
            premium-features
            upload
            util}
-   :model-imports #{:model/Database :model/Table}}
-
-  enterprise/workspaces
-  {:team "Graphy"
-   :api  #{metabase-enterprise.workspaces.api
-           metabase-enterprise.workspaces.core
-           metabase-enterprise.workspaces.init}
-   :uses #{api
-           app-db
-           cache
-           driver
-           lib
-           models
-           permissions
-           premium-features
-           query-processor
-           sample-data
-           server
-           settings
-           sql-tools
-           util
-           workspaces
-           enterprise/serialization}
-   :model-exports #{:model/Workspace}
-   :model-imports #{:model/Database
-                    :model/Table
-                    :model/User}}}
+   :model-imports #{:model/Database :model/Table}}}
 
  ;; namespaces matching these patterns (with `re-find`) are excluded from the module linter. Since regex literals
  ;; aren't allowed in EDN just used the `(str <regex>)` version i.e. two slashes instead of one.

.clj-kondo/macros/metabase_enterprise/database_routing/e2e_test.clj

@@ -3,3 +3,8 @@
 (defmacro with-temp-dbs! [bindings & body]
   `(let [~@(interleave bindings (repeat nil))]
      ~@body))
+
+(defmacro with-routing-setup! [[router-binding destinations] & body]
+  `(let [~router-binding nil
+         ~@(interleave (map first destinations) (repeat nil))]
+     ~@body))

.clj-kondo/ratchets.edn

@@ -0,0 +1,47 @@
+;; Per-linter budgets for inline `:clj-kondo/ignore` forms.
+;; metabase.core.kondo-ratchet-test fails when the budgets drift from the actual counts.
+;; `./bin/mage fix-kondo-ratchets` lowers budgets to match the tree; local test runs do it
+;; automatically. Raising a budget, or adding one for a new linter (`--seed`), is a hand edit
+;; to defend in your PR.
+;; :all is the vector-less ignore form, which suppresses every linter on the next form.
+{:ignore-counts {:aliased-namespace-symbol                                            3
+                 :all                                                                 50
+                 :case-symbol-test                                                    1
+                 :clojure-lsp/unused-public-var                                       9
+                 :def-fn                                                              1
+                 :deprecated-namespace                                                95
+                 :deprecated-var                                                      81
+                 :discouraged-java-method                                             3
+                 :discouraged-namespace                                               80
+                 :discouraged-var                                                     106
+                 :equals-true                                                         1
+                 :main-without-gen-class                                              1
+                 :metabase/defsetting-namespace                                       7
+                 :metabase/disallow-hardcoded-driver-names-in-tests                   34
+                 :metabase/discourage-millis-duration                                 1
+                 :metabase/i-like-making-cams-eyes-bleed-with-horrifically-long-tests 13
+                 :metabase/modules                                                    8
+                 :metabase/namespace-name                                             4
+                 :metabase/prefer-with-dynamic-fn-redefs                              27
+                 :metabase/test-helpers-use-non-thread-safe-functions                 17
+                 :metabase/validate-defendpoint-has-response-schema                   441
+                 :metabase/validate-defendpoint-query-params-use-kebab-case           40
+                 :metabase/validate-defendpoint-route-uses-kebab-case                 44
+                 :metabase/validate-deftest                                           8
+                 :missing-docstring                                                   10
+                 :missing-protocol-method                                             3
+                 :non-arg-vec-return-type-hint                                        1
+                 :reduce-without-init                                                 3
+                 :redundant-fn-wrapper                                                1
+                 :syntax                                                              2
+                 :unquote-not-syntax-quoted                                           1
+                 :unresolved-namespace                                                3
+                 :unresolved-require                                                  1
+                 :unresolved-symbol                                                   4
+                 :unsorted-required-namespaces                                        1
+                 :unused-alias                                                        1
+                 :unused-binding                                                      9
+                 :unused-excluded-var                                                 2
+                 :unused-namespace                                                    1
+                 :unused-private-var                                                  8
+                 :unused-value                                                        1}}

.clj-kondo/src/hooks/clojure/test.clj

@@ -153,6 +153,7 @@
          "build."
          "i18n." ; bin/i18n
          "lint-migrations-file-test"
+         "mage."
          "main-test" ; bin/release-list
          "metabase.deps-edn-test"
          "metabase.driver."

.github/CODEOWNERS

@@ -10,6 +10,7 @@ src/metabase/query_processor @metabase/core-backend-querying-platform
 src/metabase/graph @metabase/graphy
 enterprise/backend/src/metabase_enterprise/dependencies @metabase/graphy
 enterprise/frontend/src/metabase-enterprise/dependencies @metabase/graphy
+enterprise/frontend/src/metabase-enterprise/monitor/dependency-diagnostics @metabase/graphy
 
 # @metabase/embedding
 
@@ -49,5 +50,5 @@ docs/installation-and-operation/commands.md # auto-generated
 src/metabase/analytics/prometheus.clj @metabase/cloud-ops
 
 # @metabase/metabot-frontend
-enterprise/frontend/src/metabase-enterprise/metabot @metabase/metabot-frontend 
+enterprise/frontend/src/metabase-enterprise/metabot @metabase/metabot-frontend
 frontend/src/metabase/metabot @metabase/metabot-frontend

.github/actions/bundle-size-check/action.yml

@@ -1,10 +1,11 @@
-name: Embedding SDK Bundle Size Check
+name: Bundle Size Check
 description: |
   Measures app + embedding SDK bundle sizes from the current and base-ref
   uberjars (reusing the builds that already ran) plus their bundle-stats
-  artifacts, and flags changes to the chunked SDK's reachable, gzipped size
-  beyond the threshold. Skips when the base-ref artifacts aren't available
-  rather than rebuilding from source (which would compare across pipelines).
+  artifacts, and flags gzipped size changes beyond the threshold for the main
+  app's initial bundle and the chunked SDK's reachable total. Skips when the
+  base-ref artifacts aren't available rather than rebuilding from source (which
+  would compare across pipelines).
 
 inputs:
   edition:
@@ -18,12 +19,18 @@ inputs:
     required: true
 
 outputs:
-  status:
-    description: "Bundle size status: increased, decreased, or stable"
-    value: ${{ steps.compare.outputs.status }}
-  size_change_percent:
-    description: "size change percent (positive = increase, negative = decrease)"
-    value: ${{ steps.compare.outputs.size_change_percent }}
+  app_status:
+    description: "App initial bundle status: increased, decreased, or stable"
+    value: ${{ steps.compare.outputs.app_initial_status }}
+  app_size_change_percent:
+    description: "App initial bundle size change percent (positive = increase, negative = decrease)"
+    value: ${{ steps.compare.outputs.app_initial_size_change_percent }}
+  sdk_status:
+    description: "Chunked SDK bundle status: increased, decreased, or stable"
+    value: ${{ steps.compare.outputs.embedding_sdk_chunked_total_status }}
+  sdk_size_change_percent:
+    description: "Chunked SDK bundle size change percent (positive = increase, negative = decrease)"
+    value: ${{ steps.compare.outputs.embedding_sdk_chunked_total_size_change_percent }}
 
 runs:
   using: "composite"
@@ -52,13 +59,20 @@ runs:
         BASE_SHA: ${{ inputs.base-ref-commit }}
         THRESHOLD: ${{ inputs.threshold-percent }}
         MEASURE_BUNDLES: app,embedding-sdk-legacy,embedding-sdk-chunked
+        # The gated bundles, as "<bundle>/<kind>". Each one's step outputs are
+        # named after its key (see outputPrefix in compare.js), which is what the
+        # action outputs above read.
+        GATES: app/initial,embedding-sdk-chunked/total
       run: |
         set -uo pipefail
 
         skip() {
-          echo "::notice::Embedding SDK bundle-size check skipped: $1"
-          echo "status=stable" >> "$GITHUB_OUTPUT"
-          echo "size_change_percent=0" >> "$GITHUB_OUTPUT"
+          echo "::notice::Bundle-size check skipped: $1"
+          for gate in ${GATES//,/ }; do
+            prefix=$(printf '%s' "$gate" | tr -c 'a-zA-Z0-9' '_')
+            echo "${prefix}_status=stable" >> "$GITHUB_OUTPUT"
+            echo "${prefix}_size_change_percent=0" >> "$GITHUB_OUTPUT"
+          done
           exit 0
         }
 
@@ -97,4 +111,4 @@ runs:
         MEASURE_ROOT=temp/base node ./.github/scripts/measure-bundle-sizes.js > temp/base-sizes.json \
           || { echo "::error::Failed to measure base bundle sizes"; exit 1; }
 
-        node ./.github/actions/sdk-bundle-size-check/compare.js temp/current-sizes.json temp/base-sizes.json
+        node ./.github/actions/bundle-size-check/compare.js temp/current-sizes.json temp/base-sizes.json

.github/actions/bundle-size-check/compare.js

@@ -2,8 +2,11 @@
 // Diffs the bundle sizes produced by measure-bundle-sizes.js for the current
 // build and the base ref. Every (bundle, kind) is compared strictly against the
 // same (bundle, kind) — never one bundle type against another — using gzipped
-// (served) bytes. The gate is driven by the chunked SDK's reachable total, which
-// is what the SDK actually delivers.
+// (served) bytes.
+//
+// The report covers every measured bundle; the gates are the subset that drives
+// PR comments, named as "<bundle>/<kind>" (e.g. "app/initial",
+// "embedding-sdk-chunked/total").
 //
 // compareBundles is pure (data in, data out) so it can be unit-tested; main()
 // is the thin I/O wrapper that reads the size files, prints the report and sets
@@ -16,14 +19,48 @@ const mb = bytes => (bytes / 1024 / 1024).toFixed(2);
 const percentOf = (currentBytes, baseBytes) =>
   baseBytes ? Math.trunc(((currentBytes - baseBytes) * 100) / baseBytes) : 0;
 
+// Output names are derived from the gate key, so the workflow reads
+// `app_initial_status`, `embedding_sdk_chunked_total_status`, and so on.
+const outputPrefix = gateKey => gateKey.replace(/[^a-zA-Z0-9]+/g, "_");
+
 /**
- * Compare two measurement sets and decide the gate. Returns a human-readable
- * `report` (always), and exactly one of:
- *  - `gate`  { status, percent }: the chunked SDK total moved by `percent`.
- *  - `skip`  reason: the gate is non-actionable (report stable, no comment).
+ * Evaluate one gate. Returns the key plus exactly one of:
+ *  - `status` / `percent`: the bundle moved by `percent`.
+ *  - `skip`  reason: the gate is non-actionable (reported stable, no comment).
  *  - `error` reason: the gate inputs are missing (hard failure).
  */
-function compareBundles({ current, base, threshold }) {
+function evaluateGate({ current, base, threshold, gateKey }) {
+  const [bundle, kind] = gateKey.split("/");
+  const gateCurrent = pick(current, bundle, kind);
+  const gateBase = pick(base, bundle, kind);
+  if (!gateCurrent || !gateBase || !gateBase.gzipBytes) {
+    return { gateKey, error: `Could not find ${bundle} ${kind} (gzip) in both builds` };
+  }
+
+  // Both sides must measure the bundle the same way. A base ref built before the
+  // reachableAssets enrichment collapses its total to the initial set, so
+  // comparing it against the current reachable total reports a phantom jump
+  // (~30%). Skip until the base ref also carries reachable stats.
+  if (Boolean(gateCurrent.reachable) !== Boolean(gateBase.reachable)) {
+    return {
+      gateKey,
+      skip:
+        `"${gateKey}" measured differently on each side ` +
+        `(current reachable=${Boolean(gateCurrent.reachable)}, base reachable=${Boolean(gateBase.reachable)}); ` +
+        `the base ref predates the reachable-chunk stats. Resolves once this change is on the base ref.`,
+    };
+  }
+
+  const percent = percentOf(gateCurrent.gzipBytes, gateBase.gzipBytes);
+  const status = percent > threshold ? "increased" : percent < -threshold ? "decreased" : "stable";
+  return { gateKey, status, percent };
+}
+
+/**
+ * Compare two measurement sets and evaluate every gate. Returns a
+ * human-readable `report` over all measured bundles plus one entry per gate.
+ */
+function compareBundles({ current, base, threshold, gateKeys }) {
   const report = ["=== Bundle sizes (gzipped, current vs base) ==="];
   const keys = [...new Set([...current, ...base].map(keyOf))].sort();
   for (const key of keys) {
@@ -39,34 +76,10 @@ function compareBundles({ current, base, threshold }) {
     report.push(`${key}: ${mb(currentRow.gzipBytes)}MB vs ${mb(baseRow.gzipBytes)}MB (${percent}%, ${diff} bytes)`);
   }
 
-  // Gate on the chunked SDK's reachable total (gzipped) — what the SDK ships.
-  const gateCurrent = pick(current, "embedding-sdk-chunked", "total");
-  const gateBase = pick(base, "embedding-sdk-chunked", "total");
-  if (!gateCurrent || !gateBase || !gateBase.gzipBytes) {
-    return { report, error: "Could not find embedding-sdk-chunked total (gzip) in both builds" };
-  }
-
-  // Both sides must measure "total" the same way. A base ref built before the
-  // reachableAssets enrichment collapses its total to the initial set, so
-  // comparing it against the current reachable total reports a phantom jump
-  // (~30%). Skip until the base ref also carries reachable stats (i.e. once
-  // this change is on the base).
-  if (Boolean(gateCurrent.reachable) !== Boolean(gateBase.reachable)) {
-    return {
-      report,
-      skip:
-        `chunked "total" measured differently on each side ` +
-        `(current reachable=${Boolean(gateCurrent.reachable)}, base reachable=${Boolean(gateBase.reachable)}); ` +
-        `the base ref predates the reachable-chunk stats. Resolves once this change is on the base ref.`,
-    };
-  }
-
-  const percent = percentOf(gateCurrent.gzipBytes, gateBase.gzipBytes);
-  const status = percent > threshold ? "increased" : percent < -threshold ? "decreased" : "stable";
-  return { report, gate: { status, percent } };
+  return { report, gates: gateKeys.map(gateKey => evaluateGate({ current, base, threshold, gateKey })) };
 }
 
-module.exports = { compareBundles };
+module.exports = { compareBundles, outputPrefix };
 
 const setOutput = (name, value) => {
   if (process.env.GITHUB_OUTPUT) {
@@ -77,32 +90,42 @@ const setOutput = (name, value) => {
 function main() {
   const [, , currentPath, basePath] = process.argv;
   const threshold = Number(process.env.THRESHOLD ?? 2);
+  const gateKeys = (process.env.GATES ?? "embedding-sdk-chunked/total").split(",").map(key => key.trim());
 
   const current = JSON.parse(fs.readFileSync(currentPath, "utf8"));
   const base = JSON.parse(fs.readFileSync(basePath, "utf8"));
 
-  const { report, gate, skip, error } = compareBundles({ current, base, threshold });
+  const { report, gates } = compareBundles({ current, base, threshold, gateKeys });
   console.log(report.join("\n"));
+  console.log("");
 
-  if (error) {
-    console.error(`::error::${error}`);
+  for (const gate of gates) {
+    const prefix = outputPrefix(gate.gateKey);
+
+    if (gate.error) {
+      // One broken gate must not hide the others, so report them all and fail
+      // the step at the end.
+      console.error(`::error::${gate.error}`);
+      continue;
+    }
+
+    if (gate.skip) {
+      // Treat the gate as non-actionable: report stable so no regression comment
+      // is posted, mirroring the shell skip() for missing artifacts.
+      console.log(`::notice::Bundle-size gate skipped: ${gate.skip}`);
+      setOutput(`${prefix}_status`, "stable");
+      setOutput(`${prefix}_size_change_percent`, "0");
+      continue;
+    }
+
+    console.log(`Gate: ${gate.gateKey} ${gate.percent}% (threshold ${threshold}%) → ${gate.status}`);
+    setOutput(`${prefix}_status`, gate.status);
+    setOutput(`${prefix}_size_change_percent`, gate.percent);
+  }
+
+  if (gates.some(gate => gate.error)) {
     process.exit(1);
   }
-
-  if (skip) {
-    // Treat the gate as non-actionable: report stable so no regression comment
-    // is posted, mirroring the shell skip() for missing artifacts.
-    console.log(`::notice::Embedding SDK bundle-size gate skipped: ${skip}`);
-    setOutput("status", "stable");
-    setOutput("size_change_percent", "0");
-    process.exit(0);
-  }
-
-  console.log("");
-  console.log(`Gate: embedding-sdk-chunked total ${gate.percent}% (threshold ${threshold}%) → ${gate.status}`);
-
-  setOutput("status", gate.status);
-  setOutput("size_change_percent", gate.percent);
 }
 
 if (require.main === module) {

.github/actions/bundle-size-check/compare.unit.spec.js

@@ -0,0 +1,84 @@
+const { compareBundles, outputPrefix } = require("./compare");
+
+const SDK_GATE = "embedding-sdk-chunked/total";
+const APP_GATE = "app/initial";
+
+const total = (gzipBytes, over = {}) => ({
+  bundle: "embedding-sdk-chunked",
+  kind: "total",
+  gzipBytes,
+  reachable: true,
+  ...over,
+});
+
+const appInitial = gzipBytes => ({ bundle: "app", kind: "initial", gzipBytes });
+
+const compare = ({ current, base, threshold = 2, gateKeys = [SDK_GATE] }) =>
+  compareBundles({ current, base, threshold, gateKeys });
+
+describe("outputPrefix", () => {
+  it("turns a gate key into a step-output prefix", () => {
+    expect(outputPrefix(APP_GATE)).toBe("app_initial");
+    expect(outputPrefix(SDK_GATE)).toBe("embedding_sdk_chunked_total");
+  });
+});
+
+describe("compareBundles", () => {
+  it("gates on the chunked SDK total and flags an increase past the threshold", () => {
+    const { gates, report } = compare({ current: [total(110)], base: [total(100)] });
+
+    expect(gates).toEqual([{ gateKey: SDK_GATE, status: "increased", percent: 10 }]);
+    expect(report[0]).toContain("current vs base");
+  });
+
+  it("flags a decrease and stays stable within the threshold", () => {
+    expect(compare({ current: [total(90)], base: [total(100)] }).gates[0]).toMatchObject({
+      status: "decreased",
+      percent: -10,
+    });
+    expect(compare({ current: [total(101)], base: [total(100)] }).gates[0]).toMatchObject({
+      status: "stable",
+      percent: 1,
+    });
+  });
+
+  it("evaluates each gate against its own bundle", () => {
+    const { gates } = compare({
+      current: [total(100), appInitial(110)],
+      base: [total(100), appInitial(100)],
+      gateKeys: [APP_GATE, SDK_GATE],
+    });
+
+    expect(gates).toEqual([
+      { gateKey: APP_GATE, status: "increased", percent: 10 },
+      { gateKey: SDK_GATE, status: "stable", percent: 0 },
+    ]);
+  });
+
+  it("skips when the two sides measured a gate differently (reachable mismatch)", () => {
+    const { gates } = compare({
+      current: [total(130, { reachable: true })],
+      base: [total(100, { reachable: false })],
+    });
+
+    expect(gates[0].status).toBeUndefined();
+    expect(gates[0].skip).toContain("predates the reachable-chunk stats");
+  });
+
+  it("errors when a gate bundle is missing on either side, without hiding the others", () => {
+    const { gates } = compare({
+      current: [appInitial(100)],
+      base: [appInitial(100)],
+      gateKeys: [APP_GATE, SDK_GATE],
+    });
+
+    expect(gates[0]).toEqual({ gateKey: APP_GATE, status: "stable", percent: 0 });
+    expect(gates[1].error).toContain("embedding-sdk-chunked total");
+  });
+
+  it("reports a bundle/kind present on only one side without erroring", () => {
+    const { report } = compare({ current: [total(100), appInitial(50)], base: [total(100)] });
+
+    expect(report.some(line => line.includes("present only in current build"))).toBe(true);
+  });
+});

.github/actions/create-backport/action.yml

@@ -57,14 +57,12 @@ runs:
           #${ORIGINAL_PULL_REQUEST_NUMBER}
           > [!IMPORTANT]
           > Manual conflict resolution is required.
-          > Checkout the branch and run \`./backport.sh\` script. Force push your changes after cherry-picking. Check the box below when done.
+          > Checkout the branch and run \`./backport.sh\` script. Force push your changes after cherry-picking. Mark the PR as ready for review once conflicts have been addressed.
 
           Conflicts:
           \`\`\`shell
           ${CONFLICT_LIST}
           \`\`\`
-
-          - [ ] Conflicts resolved
         END
           )
         else
@@ -74,7 +72,12 @@ runs:
 
         git push -u origin ${BACKPORT_BRANCH}
 
-        BACKPORT_PR_URL=$(gh pr create --base "${TARGET_BRANCH}" --head "${BACKPORT_BRANCH}" --label "was-backported" --assignee "${{ github.event.pull_request.user.login }}" --title "🤖 backported \"${ORIGINAL_TITLE}\"" --body "${PR_BODY}")
+        PR_ARGS=(--base "${TARGET_BRANCH}" --head "${BACKPORT_BRANCH}" --label "was-backported" --assignee "${{ github.event.pull_request.user.login }}" --title "🤖 backported \"${ORIGINAL_TITLE}\"" --body "${PR_BODY}")
+        if [ "$CONFLICTS" -gt 0 ]; then
+          PR_ARGS+=(--draft)
+        fi
+
+        BACKPORT_PR_URL=$(gh pr create "${PR_ARGS[@]}")
         BACKPORT_PR_NUMBER=${BACKPORT_PR_URL##*/}
 
         echo "backport_pr_number=$BACKPORT_PR_NUMBER" >> $GITHUB_OUTPUT

.github/actions/notify-pull-request/action.yml

@@ -1,12 +1,11 @@
 name: Notify Pull Request
+description: Post a comment on the pull request, optionally replacing the previous one with the same message.
 inputs:
   remove-previous-comment:
     required: false
-    type: boolean
     default: false
   add-new-comment:
     required: false
-    type: boolean
     default: true
   message:
     required: true

.github/actions/sdk-bundle-size-check/compare.unit.spec.js

@@ -1,65 +0,0 @@
-const { compareBundles } = require("./compare");
-
-const total = (gzipBytes, over = {}) => ({
-  bundle: "embedding-sdk-chunked",
-  kind: "total",
-  gzipBytes,
-  reachable: true,
-  ...over,
-});
-
-describe("compareBundles", () => {
-  it("gates on the chunked SDK total and flags an increase past the threshold", () => {
-    const { gate, report } = compareBundles({
-      current: [total(110)],
-      base: [total(100)],
-      threshold: 2,
-    });
-
-    expect(gate).toEqual({ status: "increased", percent: 10 });
-    expect(report[0]).toContain("current vs base");
-  });
-
-  it("flags a decrease and stays stable within the threshold", () => {
-    expect(compareBundles({ current: [total(90)], base: [total(100)], threshold: 2 }).gate).toEqual({
-      status: "decreased",
-      percent: -10,
-    });
-    expect(compareBundles({ current: [total(101)], base: [total(100)], threshold: 2 }).gate).toEqual({
-      status: "stable",
-      percent: 1,
-    });
-  });
-
-  it("skips when the two sides measured total differently (reachable mismatch)", () => {
-    const result = compareBundles({
-      current: [total(130, { reachable: true })],
-      base: [total(100, { reachable: false })],
-      threshold: 2,
-    });
-
-    expect(result.gate).toBeUndefined();
-    expect(result.skip).toContain("predates the reachable-chunk stats");
-  });
-
-  it("errors when the gate bundle is missing on either side", () => {
-    const result = compareBundles({
-      current: [{ bundle: "app", kind: "total", gzipBytes: 1 }],
-      base: [total(100)],
-      threshold: 2,
-    });
-
-    expect(result.gate).toBeUndefined();
-    expect(result.error).toContain("embedding-sdk-chunked total");
-  });
-
-  it("reports a bundle/kind present on only one side without erroring", () => {
-    const { report } = compareBundles({
-      current: [total(100), { bundle: "app", kind: "total", gzipBytes: 50 }],
-      base: [total(100)],
-      threshold: 2,
-    });
-
-    expect(report.some(line => line.includes("present only in current build"))).toBe(true);
-  });
-});

.github/actions/test-driver/action.yml

@@ -99,7 +99,6 @@ runs:
         && steps.run-test.outcome == 'failure'
         && !(inputs.driver-status == 'info'
              && !(github.ref_name == 'master' || startsWith(github.ref_name, 'release-x')))
-      continue-on-error: ${{ inputs.quarantine-engine != 'ci-conductor' }}
       uses: ./.github/actions/quarantine-gate
       with:
         adapter: backend

.github/file-paths.yaml

@@ -8,8 +8,8 @@ default: &default
   - "bin/**/!(*.md)"
 
 actionlint:
-  - ".github/workflows/*.yml"
-  - ".github/workflows/*.yaml"
+  - added|modified: ".github/workflows/*.yml"
+  - added|modified: ".github/workflows/*.yaml"
 
 shared_sources: &shared_sources
   - "src/**/*.cljc"
@@ -54,11 +54,6 @@ frontend_sources: &frontend_sources
   - "enterprise/frontend/!(test)**/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
   - "frontend/!(test)**/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
 
-# Used only in .github/workflows/conventional-commit-pr-title-reminder.yml
-frontend_embedding_sources:
-  - "enterprise/frontend/src/{embedding,embedding-*}/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
-  - "enterprise/frontend/src/metabase-enterprise/{embedding,embedding-*}**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
-
 # Used only in .github/workflows/embedding-sdk-labels-reminder.yml
 frontend_embedding_sdk_package_sources:
   - "enterprise/frontend/src/embedding-sdk-package/**/!(*.spec).{js,jsx,ts,tsx,css}"

.github/scripts/conventional-commit-pr-title-reminder/utils.js

@@ -1,109 +0,0 @@
-const TYPES = new Set([
-  "feat",
-  "fix",
-  "perf",
-  "docs",
-  "style",
-  "refactor",
-  "test",
-  "build",
-  "ci",
-]);
-
-/**
- * @param title {string}
- */
-function isConventionalTitle(title) {
-  const match = /^(?<type>\w+)\((?<rawScopes>[^)]+)\):/.exec(title);
-
-  if (!match) {
-    return false;
-  }
-
-  const [, type, rawScopes] = match;
-  const scopes = rawScopes
-    .split(",")
-    .map((scope) => scope.trim())
-    .filter(Boolean);
-
-  return TYPES.has(type) && scopes.length > 0;
-}
-
-/** @param {import('@types/github-script').AsyncFunctionArguments} AsyncFunctionArguments */
-async function updateCommentForEmbedding({ github, context }) {
-  const githubUsername = context.payload.sender.login;
-
-  const comment = `${CONVENTIONAL_COMMENT_IDENTIFIER}
-@${githubUsername} You have modified embedding code. Please make sure the PR title follows [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) style.
-Here are all the supported types:
-- \`feat\`
-- \`fix\`
-- \`perf\`
-- \`docs\`
-- \`style\`
-- \`refactor\`
-- \`test\`
-- \`build\`
-- \`ci\`
-
-Please also make sure to include a scope.
-
-For example, these are valid PR titles:
-- \`feat(sdk-bundle): Add interactive dashboard component\`
-- \`fix(sdk-package): Fixed MetabaseProviderPropsStore logic\`
-- \`fix(sdk-package, embed-js): Fix API\``;
-
-  return updateComment(comment, { github, context });
-}
-
-/**
- * @param comment {string}
- * @param {import('@types/github-script').AsyncFunctionArguments} AsyncFunctionArguments
- */
-async function updateComment(comment, { github, context }) {
-  const owner = context.repo.owner;
-  const repo = context.repo.repo;
-  const pullRequestNumber = context.issue.number;
-  const comments = await github.rest.issues.listComments({
-    owner,
-    repo,
-    issue_number: pullRequestNumber,
-  });
-
-  const existingComment = getExistingConventionalCommitReminderComment(
-    comments.data,
-  );
-
-  if (existingComment) {
-    return await github.rest.issues.updateComment({
-      owner,
-      repo,
-      comment_id: existingComment.id,
-      body: comment,
-    });
-  } else {
-    return await github.rest.issues.createComment({
-      owner,
-      repo,
-      issue_number: pullRequestNumber,
-      body: comment,
-    });
-  }
-}
-
-const CONVENTIONAL_COMMENT_IDENTIFIER =
-  "<!---conventional comment identifier-->";
-
-/**
- * @param comments {{body: string}[]}
- */
-function getExistingConventionalCommitReminderComment(comments) {
-  for (const comment of comments) {
-    if (comment.body.startsWith(CONVENTIONAL_COMMENT_IDENTIFIER)) {
-      return comment;
-    }
-  }
-}
-
-exports.isConventionalTitle = isConventionalTitle;
-exports.updateCommentForEmbedding = updateCommentForEmbedding;

.github/scripts/conventional-commit-pr-title-reminder/utils.unit.spec.js

@@ -1,45 +0,0 @@
-const { isConventionalTitle } = require("./utils");
-
-describe("isConventionalTitle", () => {
-  it("returns true for a simple conventional commit", () => {
-    expect(isConventionalTitle("feat: add new feature")).toBe(false);
-  });
-
-  it("returns true for a commit with a scope", () => {
-    expect(isConventionalTitle("fix(api): correct API bug")).toBe(true);
-  });
-
-  it("returns true for a commit with multiple scopes, comma separated", () => {
-    expect(isConventionalTitle("feat(build,deps): update dependencies")).toBe(
-      true,
-    );
-  });
-
-  it("returns true for a commit with multiple scopes, comma separated with space", () => {
-    expect(isConventionalTitle("feat(build, deps): update dependencies")).toBe(
-      true,
-    );
-  });
-
-  it("returns false for a commit with round brackets in a message", () => {
-    expect(isConventionalTitle("feat: (something) update dependencies")).toBe(
-      false,
-    );
-  });
-
-  it("returns false for missing colon", () => {
-    expect(isConventionalTitle("feat add feature")).toBe(false);
-  });
-
-  it("returns false for invalid type", () => {
-    expect(isConventionalTitle("invalidType: some message")).toBe(false);
-  });
-
-  it("returns false for empty message", () => {
-    expect(isConventionalTitle("feat:")).toBe(false);
-  });
-
-  it("returns false for empty input", () => {
-    expect(isConventionalTitle("")).toBe(false);
-  });
-});

.github/team.json

@@ -124,6 +124,13 @@
         "losrebellos",
         "tmashara"
       ]
+    },
+    {
+      "name": "Security Engineering",
+      "label": ".Team/SecurityEngineering",
+      "members": [
+        "enthym-aa"
+      ]
     }
   ]
 }

.github/workflows/actionlint.yml

@@ -29,6 +29,7 @@ jobs:
           filters: .github/file-paths.yaml
           list-files: shell
       - name: Setup actionlint
+        if: steps.changes.outputs.actionlint == 'true'
         id: download
         shell: bash
         run: |
@@ -39,4 +40,5 @@ jobs:
             bash <(curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/v1.7.12/scripts/download-actionlint.bash)
           fi
       - name: Run actionlint
+        if: steps.changes.outputs.actionlint == 'true'
         run: ${{ steps.download.outputs.executable }} --color --verbose ${{ steps.changes.outputs.actionlint_files }}

.github/workflows/ai-benchmark.yml

@@ -1,21 +1,172 @@
 name: AI Benchmark
-
-# Runs the ai-benchmark E2E test suite against a Metabase instance.
-#
-# NOTE: This is a stub. The real workflow — which builds the benchmark Docker
-# image, boots Metabase + Postgres with a preloaded data dump, runs the
-# benchmark suite, and uploads results as artifacts — is being developed on a
-# feature branch. This stub exists on master so that the "Run workflow" button
-# is available in the GitHub Actions UI, which lets us dispatch the real
-# workflow against feature branches during development.
+run-name: "dispatch evals · ${{ github.event_name == 'pull_request' && format('smoke PR#{0}', github.event.pull_request.number) || (inputs.pr != '' && format('PR#{0}', inputs.pr) || (inputs.ref != '' && inputs.ref || 'master')) }}"
 
 on:
+  pull_request:
+    types: [labeled]
   workflow_dispatch:
+    inputs:
+      pr:
+        description: "Metabase PR number (sets ref to the PR head)"
+        required: false
+        default: ""
+      ref:
+        description: "Metabase ref"
+        required: false
+        default: ""
+      scope:
+        description: "Scope"
+        required: true
+        type: choice
+        options: [smoke, full, "all (EXPENSIVE)"]
+        default: smoke
+      sample:
+        description: "Sample (0 = full suite)"
+        required: false
+        default: "5"
+      evals_branch:
+        description: "Evals branch"
+        default: main
+
+concurrency:
+  group: evals-dispatch-${{ (github.event.label.name == 'evals/smoke' && github.event.pull_request.number) || github.run_id }}
+  cancel-in-progress: true
 
 jobs:
-  placeholder:
-    name: Placeholder
-    runs-on: ubuntu-latest
+  unsupported:
+    if: >-
+      github.event_name == 'pull_request'
+      && github.event.label.name == 'evals/smoke'
+      && github.event.pull_request.head.repo.full_name != github.repository
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
     steps:
-      - name: Stub
-        run: echo "ai-benchmark workflow stub — real implementation pending"
+      - run: |
+          echo "::error::evals/smoke only runs on same-repo PRs; this PR's head is on a fork"
+          exit 1
+
+  announce:
+    if: >-
+      github.event_name == 'pull_request'
+      && github.event.label.name == 'evals/smoke'
+      && github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    outputs:
+      comment_id: ${{ steps.post.outputs.comment_id }}
+    steps:
+      - name: Comment (building)
+        id: post
+        uses: actions/github-script@v9
+        with:
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          script: |
+            const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
+            const body = `🤖 **Evals smoke** — ⏳ building the image… ([logs](${runUrl}))`;
+            const { owner, repo } = context.repo;
+            const issue_number = context.payload.pull_request.number;
+            // Drop earlier verdicts first: they describe shas that are no longer head, and a stale
+            // green one reads as this PR passing. The prefix survives eval-run's rewrites.
+            const existing = await github.paginate(github.rest.issues.listComments, { owner, repo, issue_number });
+            for (const c of existing.filter(c => c.body.startsWith('🤖 **Evals'))) {
+              await github.rest.issues.deleteComment({ owner, repo, comment_id: c.id }).catch(() => {});
+            }
+            const { data } = await github.rest.issues.createComment({ owner, repo, issue_number, body });
+            core.setOutput('comment_id', String(data.id));
+
+  uberjar:
+    needs: [announce]
+    if: >-
+      github.event_name == 'pull_request'
+      && github.event.label.name == 'evals/smoke'
+      && github.event.pull_request.head.repo.full_name == github.repository
+    uses: ./.github/workflows/uberjar.yml
+    secrets: inherit
+
+  smoke:
+    needs: [announce, uberjar]
+    if: >-
+      github.event_name == 'pull_request'
+      && github.event.label.name == 'evals/smoke'
+      && github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    env:
+      COMMENT_ID: ${{ needs.announce.outputs.comment_id }}
+    steps:
+      - name: Dispatch smoke eval-run
+        env:
+          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          PR: ${{ github.event.pull_request.number }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          EVALS_BRANCH: main
+        run: |
+          gh api repos/metabase/evals/actions/workflows/eval-run.yml/dispatches \
+            -f ref="$EVALS_BRANCH" \
+            -f "inputs[pr]=$PR" \
+            -f "inputs[ref]=$HEAD_SHA" \
+            -f "inputs[scope]=smoke" \
+            -f "inputs[surfaces]=all" \
+            -f "inputs[sample]=5" \
+            -f "inputs[evals_branch]=$EVALS_BRANCH" \
+            -f "inputs[comment_id]=$COMMENT_ID"
+
+  finalize:
+    # If the build or dispatch fell over, eval-run never took over the comment — leave a
+    # failure verdict instead of a comment stuck at "building the image…".
+    needs: [announce, uberjar, smoke]
+    if: always() && needs.announce.result == 'success' && needs.smoke.result != 'success'
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    env:
+      COMMENT_ID: ${{ needs.announce.outputs.comment_id }}
+      SMOKE_RESULT: ${{ needs.smoke.result }}
+      UBERJAR_RESULT: ${{ needs.uberjar.result }}
+    steps:
+      - name: Comment (build/dispatch failed)
+        uses: actions/github-script@v9
+        with:
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          script: |
+            const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
+            // A concurrency-cancelled retrigger lands here too; don't stamp it as an infra failure.
+            const cancelled = [process.env.SMOKE_RESULT, process.env.UBERJAR_RESULT].includes('cancelled');
+            const body = cancelled
+              ? `🤖 **Evals smoke** — ⚪ cancelled before evals started ([logs](${runUrl}))`
+              : `🤖 **Evals smoke** — ❌ build or dispatch failed before evals started ([logs](${runUrl}))`;
+            // The replacement run deletes this comment on its way in, so a concurrency cancel can
+            // land here with nothing to patch. Losing the stamp is fine; failing the job isn't.
+            await github.rest.issues.updateComment({
+              owner: context.repo.owner, repo: context.repo.repo,
+              comment_id: Number(process.env.COMMENT_ID), body })
+              .catch(e => core.warning(`could not update comment (deleted?): ${e.message}`));
+            // eval-run only consumes the label once it has taken the run over, so anything failing
+            // before the dispatch leaves it applied — and `labeled` only fires on a transition, which
+            // makes re-applying it to retry a no-op. Hand it back.
+            await github.rest.issues.removeLabel({
+              owner: context.repo.owner, repo: context.repo.repo,
+              issue_number: context.payload.pull_request.number,
+              name: 'evals/smoke',
+            }).catch(() => {});
+
+  dispatch:
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    steps:
+      - name: Dispatch eval-run
+        env:
+          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          EVALS_BRANCH: ${{ github.event.inputs.evals_branch }}
+          PR: ${{ inputs.pr }}
+          REF: ${{ inputs.ref }}
+          SCOPE: ${{ inputs.scope }}
+          SAMPLE: ${{ inputs.sample }}
+        run: |
+          gh api repos/metabase/evals/actions/workflows/eval-run.yml/dispatches \
+            -f ref="$EVALS_BRANCH" \
+            -f "inputs[pr]=$PR" \
+            -f "inputs[ref]=$REF" \
+            -f "inputs[scope]=$SCOPE" \
+            -f "inputs[sample]=${SAMPLE:-5}" \
+            -f "inputs[evals_branch]=$EVALS_BRANCH"

.github/workflows/app-db.yml

@@ -148,12 +148,21 @@ jobs:
             env:
               enable-ssl-tests: 'false'
               enable-aws-iam-tests: 'false'
-          - name: MySQL Latest
-            junit-name: be-tests-mysql-latest-ee
-            image: mysql:latest
+          - name: MySQL 9
+            junit-name: be-tests-mysql-9-ee
+            image: mysql:9
             env:
               enable-ssl-tests: 'true'
               enable-aws-iam-tests: 'true'
+          # `mysql:latest` now resolves to MySQL 26.x, which fails in a way that floods the log
+          # until the runner cancels the job. A cancelled job can't be soft-failed with
+          # continue-on-error, so the leg is disabled until 26.x is supported.
+          # - name: MySQL Latest
+          #   junit-name: be-tests-mysql-latest-ee
+          #   image: mysql:latest
+          #   env:
+          #     enable-ssl-tests: 'false'
+          #     enable-aws-iam-tests: 'false'
         job:
           - name: Enterprise Tests
             build-static-viz: false

.github/workflows/bundle-size.yml

@@ -0,0 +1,88 @@
+name: Bundle Size
+
+# Warns on PRs that move a shipped bundle's gzipped size past the threshold,
+# comparing the PR's uberjar against the base ref's. Both gates are measured in
+# a single job: downloading and extracting two uberjars is the expensive part,
+# so adding a bundle costs a comment step, not another job.
+
+on:
+  workflow_call:
+    inputs:
+      skip:
+        description: Whether to skip the check (e.g. no front-end sources changed, or the uberjar failed to build).
+        required: true
+        type: boolean
+
+concurrency:
+  group: bundle-size-${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  bundle-size-check:
+    name: "Bundle size check"
+    if: ${{ !inputs.skip }}
+    continue-on-error: true
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 20
+    env:
+      BUNDLE_SIZE_THRESHOLD_PERCENT: 2
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/bundle-size-check
+        id: compare
+        with:
+          edition: ee
+          base-ref-commit: ${{ github.event.pull_request.base.sha }}
+          threshold-percent: ${{ env.BUNDLE_SIZE_THRESHOLD_PERCENT }}
+
+      - name: Comment on PR if app bundle size has increased
+        uses: ./.github/actions/notify-pull-request
+        if: success() && steps.compare.outputs.app_status == 'increased'
+        with:
+          remove-previous-comment: true
+          add-new-comment: true
+          message: "⚠️ Main app initial bundle size (gzipped) increased by ${{ steps.compare.outputs.app_size_change_percent }}% compared to the ${{ github.base_ref }} branch (threshold: ${{ env.BUNDLE_SIZE_THRESHOLD_PERCENT }}%). This is the JavaScript every user downloads before the app renders, so check whether the new code can be loaded lazily instead."
+          include-log: false
+
+      - name: Comment on PR if app bundle size has decreased
+        uses: ./.github/actions/notify-pull-request
+        if: success() && steps.compare.outputs.app_status == 'decreased'
+        with:
+          remove-previous-comment: true
+          add-new-comment: true
+          message: "🎉 Main app initial bundle size (gzipped) decreased by ${{ steps.compare.outputs.app_size_change_percent }}% compared to the ${{ github.base_ref }} branch. Nice work!"
+          include-log: false
+
+      - name: Comment on PR if SDK bundle size has increased
+        uses: ./.github/actions/notify-pull-request
+        if: success() && steps.compare.outputs.sdk_status == 'increased'
+        with:
+          remove-previous-comment: true
+          add-new-comment: true
+          message: "⚠️ Embedding SDK chunked bundle size (gzipped) increased by ${{ steps.compare.outputs.sdk_size_change_percent }}% compared to the ${{ github.base_ref }} branch (threshold: ${{ env.BUNDLE_SIZE_THRESHOLD_PERCENT }}%). Please contact Embedding team."
+          include-log: false
+
+      - name: Send notification to Slack via Zapier
+        if: success() && steps.compare.outputs.sdk_status == 'increased'
+        shell: bash
+        env:
+          ZAPIER_WEBHOOK_URL: ${{ secrets.EMBEDDING_ZAPIER_WEBHOOK_URL }}
+          SIZE_CHANGE_PERCENT: ${{ steps.compare.outputs.sdk_size_change_percent }}
+          BUNDLE_SIZE_THRESHOLD_PERCENT: ${{ env.BUNDLE_SIZE_THRESHOLD_PERCENT }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: |
+          curl -s -X POST "$ZAPIER_WEBHOOK_URL" \
+            -d "⚠️ Embedding SDK chunked bundle size (gzipped) increased by ${SIZE_CHANGE_PERCENT}% (threshold: ${BUNDLE_SIZE_THRESHOLD_PERCENT}%)
+
+          PR #${PR_NUMBER} ${PR_TITLE} (${PR_URL})"
+
+      - name: Comment on PR if SDK bundle size has decreased
+        uses: ./.github/actions/notify-pull-request
+        if: success() && steps.compare.outputs.sdk_status == 'decreased'
+        with:
+          remove-previous-comment: true
+          add-new-comment: true
+          message: "🎉 Embedding SDK chunked bundle size (gzipped) decreased by ${{ steps.compare.outputs.sdk_size_change_percent }}% compared to the ${{ github.base_ref }} branch. Nice work!"
+          include-log: false

.github/workflows/cache-cleanup-codeql.yml

@@ -0,0 +1,83 @@
+# CodeQL's overlay analysis saves a ~400MB "base database" cache on every master run, keyed by commit SHA.
+#
+# Only the newest entry is ever restored: CodeQL looks its cache up by key *prefix* and takes the most recent match,
+# so everything behind it is dead weight. This job keeps the newest few and deletes the rest.
+name: CodeQL Cache Cleanup
+
+on:
+  schedule:
+    - cron: "0 4 * * *" # daily at 04:00 UTC
+  workflow_dispatch:
+    inputs:
+      keep:
+        description: "How many of the newest CodeQL caches to keep"
+        required: false
+        default: "2"
+      dry-run:
+        description: "List what would be deleted without deleting it"
+        type: boolean
+        required: false
+        default: false
+
+concurrency:
+  group: cache-cleanup-codeql
+  cancel-in-progress: false
+
+permissions:
+  actions: write # required to delete cache entries
+  contents: read
+
+jobs:
+  cleanup:
+    # don't run the schedule on forks
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 10
+    env:
+      GH_TOKEN: ${{ github.token }}
+      KEEP: ${{ github.event.inputs.keep || '2' }}
+      DRY_RUN: ${{ github.event.inputs.dry-run || 'false' }}
+      PREFIX: codeql-overlay-base-database-
+    steps:
+      - name: Delete superseded CodeQL caches
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          # created_at is ISO-8601, so a reverse lexicographic sort is newest-first.
+          gh api --paginate "/repos/${GITHUB_REPOSITORY}/actions/caches?per_page=100" \
+            --jq ".actions_caches[] | select(.key | startswith(\"${PREFIX}\")) | \"\(.created_at)\t\(.id)\t\(.size_in_bytes)\t\(.key)\"" \
+            | sort -r > all.tsv || true
+
+          found=$(wc -l < all.tsv | tr -d ' ')
+          echo "Found $found cache(s) matching '${PREFIX}'; keeping the newest $KEEP."
+          if [ "$found" -eq 0 ]; then
+            echo "Nothing to do." >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+
+          tail -n +$((KEEP + 1)) all.tsv > doomed.tsv || true
+          doomed=$(wc -l < doomed.tsv | tr -d ' ')
+
+          freed=0
+          while IFS=$'\t' read -r created id size key; do
+            [ -z "${id:-}" ] && continue
+            echo "  deleting $key ($((size / 1000000))MB, created $created)"
+            if [ "$DRY_RUN" = "true" ]; then
+              echo "    (dry run — not deleted)"
+            else
+              # A cache can vanish between listing and deleting (concurrent eviction); don't fail the job over it.
+              gh api --method DELETE "/repos/${GITHUB_REPOSITORY}/actions/caches/${id}" >/dev/null \
+                || echo "    (already gone, skipping)"
+            fi
+            freed=$((freed + size))
+          done < doomed.tsv
+
+          {
+            echo "### CodeQL cache cleanup"
+            echo ""
+            echo "- matched: **$found**"
+            echo "- kept (newest): **$KEEP**"
+            echo "- deleted: **$doomed**"
+            echo "- reclaimed: **$((freed / 1000000)) MB**${DRY_RUN:+ (dry run: $DRY_RUN)}"
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/conventional-commit-pr-title-reminder.yml

@@ -1,56 +0,0 @@
-name: Conventional commit PR Title Reminder
-
-on:
-  pull_request:
-    branches:
-      - master
-
-jobs:
-  files-changed:
-    name: Check which files changed
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 3
-    outputs:
-      frontend_embedding_sources: ${{ steps.changes.outputs.frontend_embedding_sources }}
-    steps:
-      - uses: actions/checkout@v6
-      - name: Test which files changed
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
-  pr-title-reminder:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 5
-    permissions:
-      pull-requests: write
-    needs: [ files-changed ]
-    if: |
-      !cancelled() &&
-      needs.files-changed.outputs.frontend_embedding_sources == 'true'
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          ref: ${{ github.head_ref }}
-
-      - name: Check if the PR title is already following Conventional Commits style
-        uses: actions/github-script@v9
-        id: is-conventional-commit
-        with:
-          result-encoding: string
-          script: | # js
-            const { isConventionalTitle } = require(".github/scripts/conventional-commit-pr-title-reminder/utils.js")
-            const pullRequestTitle = context.payload.pull_request.title
-
-            return isConventionalTitle(pullRequestTitle)
-
-      - name: Remind PR authors to use conventional commit in the title
-        if: ${{ steps.is-conventional-commit.outputs.result != 'true' }}
-        uses: actions/github-script@v9
-        with:
-          script: | #js
-            const { updateCommentForEmbedding } = require(".github/scripts/conventional-commit-pr-title-reminder/utils.js")
-
-            await updateCommentForEmbedding({github, context})

.github/workflows/cross-branch-migrations.yml

@@ -115,7 +115,7 @@ jobs:
           base-ref: ${{ env.BASE_REF }}
           head-ref: ${{ env.HEAD_REF }}
 
-  migrations-mysql-latest-ee:
+  migrations-mysql-9-ee:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 15
     env:
@@ -128,7 +128,7 @@ jobs:
       MB_MYSQL_TEST_USER: root
     services:
       mysql:
-        image: mysql:latest
+        image: mysql:9
         env:
           MYSQL_ALLOW_EMPTY_PASSWORD: true
           MYSQL_DATABASE: mb_test
@@ -141,6 +141,35 @@ jobs:
           base-ref: ${{ env.BASE_REF }}
           head-ref: ${{ env.HEAD_REF }}
 
+  # `mysql:latest` now resolves to MySQL 26.x, which fails in a way that floods the log until the
+  # runner cancels the job. A cancelled job can't be soft-failed with continue-on-error, so this
+  # job is disabled until 26.x is supported.
+  # migrations-mysql-latest-ee:
+  #   runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+  #   timeout-minutes: 15
+  #   env:
+  #     CI: 'true'
+  #     MB_DB_TYPE: mysql
+  #     MB_DB_HOST: localhost
+  #     MB_DB_PORT: 3306
+  #     MB_DB_DBNAME: mb_test
+  #     MB_DB_USER: root
+  #     MB_MYSQL_TEST_USER: root
+  #   services:
+  #     mysql:
+  #       image: mysql:latest
+  #       env:
+  #         MYSQL_ALLOW_EMPTY_PASSWORD: true
+  #         MYSQL_DATABASE: mb_test
+  #       ports:
+  #         - "3306:3306"
+  #   steps:
+  #     - uses: actions/checkout@v6
+  #     - uses: ./.github/actions/cross-branch-migration-test
+  #       with:
+  #         base-ref: ${{ env.BASE_REF }}
+  #         head-ref: ${{ env.HEAD_REF }}
+
   migrations-mariadb-10-6-ee:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 15

.github/workflows/cross-version.yml

@@ -12,15 +12,16 @@ on:
         required: true
         type: string
 
-  pull_request:
-    paths:
-      - "cross-version/**"
-      - ".github/workflows/cross-version.yml"
-      - ".github/scripts/build-cross-version-matrix.js"
+  # NOTE: this workflow is temporarily disabled until the cross version tests are fixed.
+  # pull_request:
+  #   paths:
+  #     - "cross-version/**"
+  #     - ".github/workflows/cross-version.yml"
+  #     - ".github/scripts/build-cross-version-matrix.js"
 
-  schedule:
-    # Run nightly at 3 AM UTC
-    - cron: "0 3 * * *"
+  # schedule:
+  #   # Run nightly at 3 AM UTC
+  #   - cron: "0 3 * * *"
 
 jobs:
   # Generate matrix for scheduled/PR runs

.github/workflows/cut-release-branch.yml

@@ -250,8 +250,7 @@ jobs:
 
             const message = [
               `:announcement-animated: ${eng} The v${next} release branch has been cut.`,
-              `- \`backport\`s will go to v${next} now`,
-              `- If you want to go back to v${current}, you'll need to add the double-backport tag`,
+              `Add the \`backport\` label to backport changes to all supported release branches.`,
             ].join('\n');
 
             await sendSlackMessage({

.github/workflows/docs-generate-63.yml

@@ -1,22 +0,0 @@
-name: Auto-update documentation (release)
-
-on:
-  schedule:
-    - cron: "0 23 * * 1-5" # Every Monday through Friday at 11 PM UTC
-  workflow_dispatch:
-    inputs:
-      target_branch:
-        description: "Target branch for documentation update"
-        required: false
-        default: "release-x.63.x"
-        type: string
-
-jobs:
-  update-release-docs:
-    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
-    name: Call documentation update for release branch
-    uses: ./.github/workflows/docs-generate-base.yml
-    with:
-      target_branch: ${{ inputs.target_branch || 'release-x.63.x' }}
-    secrets:
-      automation_token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}

.github/workflows/docs-release-generate.yml

@@ -8,7 +8,7 @@ on:
       target_branch:
         description: "Target branch for documentation update"
         required: false
-        default: "release-x.62.x"
+        default: "release-x.63.x"
         type: string
 
 jobs:
@@ -17,6 +17,6 @@ jobs:
     name: Call documentation update for release branch
     uses: ./.github/workflows/docs-generate-base.yml
     with:
-      target_branch: ${{ inputs.target_branch || 'release-x.62.x' }}
+      target_branch: ${{ inputs.target_branch || 'release-x.63.x' }}
     secrets:
       automation_token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}

.github/workflows/drivers-stress-test.yml

@@ -34,6 +34,7 @@ on:
           - Mongo 5 (SSL)
           - Mongo (latest)
           - MySQL
+          - MySQL 9
           - MySQL (latest)
           - Oracle 18
           - Oracle 21
@@ -338,6 +339,35 @@ jobs:
         junit-name: 'be-tests-mysql-8-0-ee'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
+  be-tests-mysql-9-ee:
+    if: inputs.driver == 'MySQL 9'
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: mysql
+      MB_DB_TYPE: mysql
+      MB_DB_HOST: localhost
+      MB_DB_PORT: 3306
+      MB_DB_DBNAME: mb_test
+      MB_DB_USER: root
+      MB_MYSQL_TEST_USER: root
+    services:
+      mysql:
+        image: mysql:9
+        ports:
+          - "3306:3306"
+        env:
+          MYSQL_ALLOW_EMPTY_PASSWORD: true
+          MYSQL_DATABASE: mb_test
+    steps:
+    - uses: actions/checkout@v6
+    - name: Test MySQL driver (9)
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-mysql-9-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
   be-tests-mysql-latest-ee:
     if: inputs.driver == 'MySQL (latest)'
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}

.github/workflows/drivers.yml

@@ -127,7 +127,7 @@ jobs:
             --skip="${{ inputs.skip }}"
           )
           echo "Running:"
-          echo "./bin/mage -driver-decisions ${MAGE_ARGS[@]}"
+          echo "./bin/mage -driver-decisions ${MAGE_ARGS[*]}"
           echo ""
           # First call: show human-readable output for debugging
           ./bin/mage -driver-decisions "${MAGE_ARGS[@]}"
@@ -135,7 +135,7 @@ jobs:
           echo "Want to force-run a specific driver? Add a ci:run-<driver> or ci:run-all-drivers label to your PR."
           echo "Run './bin/mage -driver-decisions -h' locally for the full list of drivers and labels."
           # Second call: output only key=value lines for GITHUB_OUTPUT
-          ./bin/mage -driver-decisions "${MAGE_ARGS[@]}" --github-output-only >> $GITHUB_OUTPUT
+          ./bin/mage -driver-decisions "${MAGE_ARGS[@]}" --github-output-only >> "$GITHUB_OUTPUT"
         env:
           BASE_REF: ${{ github.event.pull_request.base.ref || github.ref_name }}
           IS_MASTER_OR_RELEASE: ${{ github.ref_name == 'master' || startsWith(github.ref_name, 'release-x') }}
@@ -193,14 +193,13 @@ jobs:
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
         driver-status: ${{ needs.determine-driver-skips.outputs.athena-status }}
-        report-variant: ${{ matrix.job.name }}
         run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-bigquery-cloud-sdk-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.bigquery-should-run == 'true' || needs.determine-driver-skips.outputs.bigquery-quarantine-conflict == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 60
+    timeout-minutes: 70
     strategy:
       fail-fast: false
       matrix:
@@ -279,7 +278,7 @@ jobs:
       uses: ./.github/actions/cleanup-python-runner
       with:
         upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
-        logs-artifact-suffix: ${{ matrix.job.name }} ${{ matrix.version.name }}
+        logs-artifact-suffix: ${{ matrix.job.name }}
 
   be-tests-clickhouse-ee:
     needs: determine-driver-skips
@@ -366,7 +365,7 @@ jobs:
       uses: ./.github/actions/cleanup-python-runner
       with:
         upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
-        logs-artifact-suffix: ${{ matrix.job.name }} ${{ matrix.version.name }}
+        logs-artifact-suffix: ${{ matrix.job.name }}
 
   be-tests-druid-jdbc-ee:
     needs: determine-driver-skips
@@ -424,7 +423,7 @@ jobs:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' || needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 40
+    timeout-minutes: 50
     strategy:
       fail-fast: false
       matrix:
@@ -500,7 +499,7 @@ jobs:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' || needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 40
+    timeout-minutes: 50
     strategy:
       fail-fast: false
       matrix:
@@ -669,12 +668,21 @@ jobs:
             env:
               enable-ssl-tests: 'false'
               enable-aws-iam-tests: 'false'
-          - name: MySQL Latest
-            junit-name: be-tests-mysql-latest-ee
-            image: mysql:latest
+          - name: MySQL 9
+            junit-name: be-tests-mysql-9-ee
+            image: mysql:9
             env:
               enable-ssl-tests: 'true'
               enable-aws-iam-tests: 'true'
+          # `mysql:latest` now resolves to MySQL 26.x, which fails in a way that floods the log
+          # until the runner cancels the job. A cancelled job can't be soft-failed with
+          # continue-on-error, so the leg is disabled until 26.x is supported.
+          # - name: MySQL Latest
+          #   junit-name: be-tests-mysql-latest-ee
+          #   image: mysql:latest
+          #   env:
+          #     enable-ssl-tests: 'false'
+          #     enable-aws-iam-tests: 'false'
         job:
           - name: Driver Tests
             test-args: >-
@@ -1088,7 +1096,7 @@ jobs:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.postgres-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 40
+    timeout-minutes: 50
     strategy:
       fail-fast: false
       matrix:
@@ -1240,7 +1248,7 @@ jobs:
          port: ${{ env.MB_PRESTO_JDBC_TEST_PORT }}
       timeout-minutes: 5
     - name: Create temp cacerts file based on bundled JDK one
-      run: cp $JAVA_HOME/lib/security/cacerts /tmp/cacerts-with-presto-ssl.jks
+      run: cp "$JAVA_HOME/lib/security/cacerts" /tmp/cacerts-with-presto-ssl.jks
     - name: Capture Presto server self signed CA
       run: |
           while [[ ! -s /tmp/presto-ssl-ca.pem ]]; do
@@ -1288,7 +1296,7 @@ jobs:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.redshift-should-run == 'true' || needs.determine-driver-skips.outputs.redshift-quarantine-conflict == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 40
+    timeout-minutes: 50
     strategy:
       fail-fast: false
       matrix:
@@ -1377,13 +1385,13 @@ jobs:
       uses: ./.github/actions/cleanup-python-runner
       with:
         upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
-        logs-artifact-suffix: ${{ matrix.job.name }} ${{ matrix.version.name }}
+        logs-artifact-suffix: ${{ matrix.job.name }}
 
   be-tests-snowflake-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.snowflake-should-run == 'true' || needs.determine-driver-skips.outputs.snowflake-quarantine-conflict == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 60
+    timeout-minutes: 70
     strategy:
       fail-fast: false
       matrix:
@@ -1465,7 +1473,7 @@ jobs:
       uses: ./.github/actions/cleanup-python-runner
       with:
         upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
-        logs-artifact-suffix: ${{ matrix.job.name }} ${{ matrix.version.name }}
+        logs-artifact-suffix: ${{ matrix.job.name }}
 
   be-tests-sparksql-ee:
     needs: determine-driver-skips
@@ -1708,9 +1716,11 @@ jobs:
 
         REGISTRY="$(aws sts get-caller-identity --query Account --output text).dkr.ecr.us-east-1.amazonaws.com"
 
-        echo "docker_username=AWS" >> $GITHUB_OUTPUT
-        echo "docker_password=$PASSWORD" >> $GITHUB_OUTPUT
-        echo "registry=$REGISTRY" >> $GITHUB_OUTPUT
+        {
+          echo "docker_username=AWS"
+          echo "docker_password=$PASSWORD"
+          echo "registry=$REGISTRY"
+        } >> "$GITHUB_OUTPUT"
     outputs:
       registry: ${{ steps.login-ecr.outputs.registry }}
       docker_username: ${{ steps.login-ecr.outputs.docker_username }}

.github/workflows/e2e-test.yml

@@ -64,6 +64,11 @@ jobs:
       # workspace where the gate step runs; an absolute path anchored to the
       # workspace makes both agree regardless of cwd.
       QUARANTINE_FAILURES_FILE: ${{ github.workspace }}/target/quarantine-failures.jsonl
+      # Cypress records video for every spec but the passing specs' videos are
+      # deleted in after:spec so recording is ~5-10% slowdown per shard and almost
+      # never yields an artifact. Failure screenshots are unaffected, and the
+      # stress-test workflows have their own config and keep video.
+      CYPRESS_VIDEO: "false"
       # Sensitive env vars (tokens, secrets) starting with `CYPRESS_` are accessed via async `cy.env()`
       # Example: `cy.env(["FOO"]).then(({ FOO }) => ...)`
       # For non-sensitive config, use `Cypress.expose()` in cypress config instead (synchronous)
@@ -123,9 +128,20 @@ jobs:
 
       - name: Get failed specs
         if: github.run_attempt != '1'
-        run: echo "specs=$(cat failed-specs)" >> $GITHUB_ENV
+        run: echo "specs=$(cat failed-specs)" >> "$GITHUB_ENV"
+
+      # run-tests.yml compiles this in parallel with the uberjar build. Downloading it is ~10x faster than compiling it here.
+      # Callers without that job (stress tests, coverage shards, cross-run re-runs) fall through to compiling as before.
+      - name: Download pre-built CLJS
+        id: prebuilt-cljs
+        uses: actions/download-artifact@v8
+        continue-on-error: true
+        with:
+          name: e2e-cljs-${{ github.event.pull_request.head.sha || github.sha }}
+          path: target/cljs_dev
 
       - name: Compile CLJS
+        if: steps.prebuilt-cljs.outcome != 'success'
         run: bun run build-pure:cljs
 
       - name: Run Metabase

.github/workflows/embedding-sdk-host-sample-apps-tests.yml

@@ -156,9 +156,9 @@ jobs:
           REPO_URL="https://github.com/metabase/${REPO_NAME}.git"
           echo "Checking if branch '${SAMPLE_APP_BRANCH_NAME}' exists in ${REPO_URL}..."
           if git ls-remote --exit-code --heads "$REPO_URL" "${SAMPLE_APP_BRANCH_NAME}"; then
-            echo "sample_app_branch_exists=true" >> $GITHUB_OUTPUT
+            echo "sample_app_branch_exists=true" >> "$GITHUB_OUTPUT"
           else
-            echo "sample_app_branch_exists=false" >> $GITHUB_OUTPUT
+            echo "sample_app_branch_exists=false" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Prepare and launch Sample Apps
@@ -360,6 +360,7 @@ jobs:
         test_suite:
           [
             "vite-6-host-app-e2e",
+            "vite-6-data-app-host-app-e2e",
             "next-15-app-router-host-app-e2e",
             "next-15-pages-router-host-app-e2e",
             "angular-20-host-app-e2e",

.github/workflows/embedding-sdk.yml

@@ -23,10 +23,6 @@ on:
         description: "Whether to run host and sample apps compatibility tests."
         required: true
         type: boolean
-      bundle-size-check:
-        description: "Whether to run bundle size check."
-        required: true
-        type: boolean
       skip:
         description: Whether to skip running tests due to one of the artifacts failing to build.
         required: true
@@ -90,13 +86,15 @@ jobs:
         shell: bash
         run: |
           set -o pipefail
+          # SC2016: the '$a' and '$aEOF' are sed commands, not shell variables.
+          # shellcheck disable=SC2016
           bun run embedding-sdk:docs:generate:pure --emit none 2>&1 \
           | tee /dev/stdout \
           | tee >( tail -n 10 \
           | sed '1s/^/output<<EOF\n/' \
                    | sed '$aEOF' \
                    >> "$GITHUB_OUTPUT" )
-          exit ${PIPESTATUS[0]}
+          exit "${PIPESTATUS[0]}"
       - name: Comment on PR if 'not included in the documentation' error happens
         uses: ./.github/actions/notify-pull-request
         with:
@@ -128,59 +126,8 @@ jobs:
     uses: ./.github/workflows/embedding-sdk-host-sample-apps-tests.yml
     secrets: inherit
 
-  embedding-sdk-bundle-size-check:
-    if: inputs.bundle-size-check
-    continue-on-error: true
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 20
-    env:
-      BUNDLE_SIZE_THRESHOLD_PERCENT: 2
-    steps:
-      - uses: actions/checkout@v6
-      - uses: ./.github/actions/sdk-bundle-size-check
-        id: compare
-        with:
-          edition: ee
-          base-ref-commit: ${{ github.event.pull_request.base.sha }}
-          threshold-percent: ${{ env.BUNDLE_SIZE_THRESHOLD_PERCENT }}
-
-      - name: Comment on PR if bundle size has increased
-        uses: ./.github/actions/notify-pull-request
-        if: success() && steps.compare.outputs.status == 'increased'
-        with:
-          remove-previous-comment: true
-          add-new-comment: true
-          message: "⚠️ Embedding SDK chunked bundle size (gzipped) increased by ${{ steps.compare.outputs.size_change_percent }}% compared to the ${{ github.base_ref }} branch (threshold: ${{ env.BUNDLE_SIZE_THRESHOLD_PERCENT }}%). Please contact Embedding team."
-          include-log: false
-
-      - name: Send notification to Slack via Zapier
-        if: success() && steps.compare.outputs.status == 'increased'
-        shell: bash
-        env:
-          ZAPIER_WEBHOOK_URL: ${{ secrets.EMBEDDING_ZAPIER_WEBHOOK_URL }}
-          SIZE_CHANGE_PERCENT: ${{ steps.compare.outputs.size_change_percent }}
-          BUNDLE_SIZE_THRESHOLD_PERCENT: ${{ env.BUNDLE_SIZE_THRESHOLD_PERCENT }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          PR_TITLE: ${{ github.event.pull_request.title }}
-          PR_URL: ${{ github.event.pull_request.html_url }}
-        run: |
-          curl -s -X POST "$ZAPIER_WEBHOOK_URL" \
-            -d "⚠️ Embedding SDK chunked bundle size (gzipped) increased by ${SIZE_CHANGE_PERCENT}% (threshold: ${BUNDLE_SIZE_THRESHOLD_PERCENT}%)
-
-          PR #${PR_NUMBER} ${PR_TITLE} (${PR_URL})"
-
-      - name: Comment on PR if bundle size has decreased
-        uses: ./.github/actions/notify-pull-request
-        if: success() && steps.compare.outputs.status == 'decreased'
-        with:
-          remove-previous-comment: true
-          add-new-comment: true
-          message: "🎉 Embedding SDK chunked bundle size (gzipped) decreased by ${{ steps.compare.outputs.size_change_percent }}% compared to the ${{ github.base_ref }} branch. Nice work!"
-          include-log: false
-
   embedding-sdk-tests-result:
     needs:
-      - embedding-sdk-bundle-size-check
       - embedding-sdk-cli-snippets-type-check
       - embedding-sdk-docs-snippets-type-check
       - embedding-sdk-api-documentation-generation-validation

.github/workflows/kondo-ratchets-self-heal.yml

@@ -0,0 +1,85 @@
+name: Kondo Ratchets Self-Heal
+
+# Stale budgets in .clj-kondo/ratchets.edn (above the actual ignore counts) fail CI. On PRs
+# labelled kondo-ratchets-self-healing, this commits the lowered budgets to the branch;
+# unlabelled PRs rely on local test runs to tighten the file.
+#
+# Two jobs so the automation token never shares an environment with PR-controlled code: the
+# ratchet-down job runs ./bin/mage from the PR branch and only exports the fixed file as an
+# artifact; the push job starts from a clean runner, executes nothing from the PR, and pushes.
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+    paths:
+      - "**.clj"
+      - "**.cljc"
+      - "**.cljs"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  ratchet-down:
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 10
+    # fork PRs don't get the automation token, so we couldn't push to them anyway
+    if: >-
+      contains(github.event.pull_request.labels.*.name, 'kondo-ratchets-self-healing')
+      && github.event.pull_request.head.repo.full_name == github.repository
+    outputs:
+      changed: ${{ steps.diff.outputs.changed }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+          persist-credentials: false
+      - name: Lower ignore budgets to match the source tree
+        run: ./bin/mage fix-kondo-ratchets
+      - name: Check for changes
+        id: diff
+        run: |
+          if git diff --quiet .clj-kondo/ratchets.edn; then
+            echo "budgets already tight"
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+      - uses: actions/upload-artifact@v7
+        if: steps.diff.outputs.changed == 'true'
+        with:
+          name: ratchets-edn
+          path: .clj-kondo/ratchets.edn
+          # dot-directories are excluded by default, which would ship an empty artifact
+          include-hidden-files: true
+
+  push:
+    needs: ratchet-down
+    if: needs.ratchet-down.outputs.changed == 'true'
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+          persist-credentials: false
+      - uses: actions/download-artifact@v8
+        with:
+          name: ratchets-edn
+          path: .clj-kondo/
+      - name: Commit to the PR branch
+        env:
+          PR_BRANCH: ${{ github.event.pull_request.head.ref }}
+          REPO: ${{ github.repository }}
+          # METABASE_AUTOMATION_USER_TOKEN so the self-healing commit triggers CI
+          # (a GITHUB_TOKEN push would not)
+          AUTOMATION_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+        run: |
+          git config --global user.name "Metabase Automation"
+          git config --global user.email "github-automation@metabase.com"
+          git add .clj-kondo/ratchets.edn
+          git commit -m "Ratchet down kondo ignore budgets" --no-verify
+          git push "https://x-access-token:${AUTOMATION_TOKEN}@github.com/${REPO}.git" "HEAD:$PR_BRANCH"

.github/workflows/migrations.yml

@@ -24,15 +24,42 @@ jobs:
   check-migration-versions:
     if: github.event_name == 'pull_request'
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 5
+    timeout-minutes: 10 # the `backport`-label path builds the release scripts
     steps:
       - uses: actions/checkout@v6
         with:
           filter: blob:none
           fetch-depth: 0
+      # The `backport` label backports to every supported release line (see auto-backport.yml),
+      # so migrations on such a PR must sit in the oldest supported line's directory. Resolve
+      # that floor with the same getSupportedMajors the backport workflow uses; skip the
+      # release-script build entirely for PRs without the label.
+      - name: Prepare release scripts
+        if: contains(github.event.pull_request.labels.*.name, 'backport')
+        uses: ./.github/actions/prepare-release-scripts
+      - name: Compute oldest supported backport target
+        id: oldest-supported
+        if: contains(github.event.pull_request.labels.*.name, 'backport')
+        uses: actions/github-script@v9
+        env:
+          AWS_S3_STATIC_BUCKET: ${{ vars.AWS_S3_STATIC_BUCKET }}
+          AWS_REGION: ${{ vars.AWS_REGION }}
+        with:
+          script: | # js
+            const { getSupportedMajors } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            const targets = await getSupportedMajors();
+            console.log('supported backport targets', targets);
+
+            if (!targets.length || !targets.every(Number.isInteger)) {
+              throw new Error(`getSupportedMajors() returned no usable majors: ${JSON.stringify(targets)}`);
+            }
+
+            return Math.min(...targets);
       - name: Check migration versions
         env:
           BASE_REF: ${{ github.base_ref }}
           CURRENT_VERSION: ${{ vars.CURRENT_VERSION }}
           PR_LABELS: ${{ join(github.event.pull_request.labels.*.name, ',') }}
+          OLDEST_SUPPORTED_VERSION: ${{ steps.oldest-supported.outputs.result }}
         run: bin/check-migration-versions

.github/workflows/module-boundaries-stats.yml

@@ -19,40 +19,7 @@ jobs:
         run: bun install --frozen-lockfile
       - name: get module boundary stats
         id: get-stats
-        run: |
-          NAMED_MODULES=$(node --input-type=module -e "
-            import { elements } from './frontend/lint/module-boundaries.mjs';
-            const named = elements.filter(e => !['shared/other', 'app/misc', 'other'].includes(e.type));
-            console.log(named.length);
-          ")
-
-          ENFORCED_MODULES=$(node --input-type=module -e "
-            import { elements } from './frontend/lint/module-boundaries.mjs';
-            const enforced = new Set(elements.filter(e => e.enforceOutgoing).map(e => e.type));
-            console.log(enforced.size);
-          ")
-
-          NAMED_DIRS=$(node --input-type=module -e "
-            import { elements } from './frontend/lint/module-boundaries.mjs';
-            const dirs = new Set();
-            for (const el of elements) {
-              const m = el.pattern.match(/^frontend\/src\/metabase\/(\w[\w-]*)\//)
-              if (m) dirs.add(m[1]);
-            }
-            for (const d of dirs) console.log(d);
-          ")
-          TOTAL_DIRS=$(ls -d frontend/src/metabase/*/ | xargs -I{} basename {} | wc -l | tr -d ' ')
-          NAMED_COUNT=$(echo "$NAMED_DIRS" | grep -c . || true)
-          UNMODULED=$(($TOTAL_DIRS - $NAMED_COUNT))
-
-          VIOLATIONS=$(bun run module-boundaries 2>&1 | grep -o '✖ [0-9]* problems' | grep -o '[0-9]*' || echo "0")
-
-          echo "$NAMED_MODULES modules, $ENFORCED_MODULES enforced, $UNMODULED unmoduled folders, $VIOLATIONS violations"
-
-          echo "NAMED_MODULES=$NAMED_MODULES" >> $GITHUB_OUTPUT
-          echo "ENFORCED_MODULES=$ENFORCED_MODULES" >> $GITHUB_OUTPUT
-          echo "UNMODULED=$UNMODULED" >> $GITHUB_OUTPUT
-          echo "VIOLATIONS=$VIOLATIONS" >> $GITHUB_OUTPUT
+        run: node frontend/lint/module-boundaries-stats.mjs | tee -a "$GITHUB_OUTPUT"
       - name: Upload stats
         uses: actions/github-script@v9
         env:

.github/workflows/release-auto.yml

@@ -34,6 +34,12 @@ jobs:
       commit: ${{ steps.compute.outputs.commit }}
       should_release: ${{ steps.compute.outputs.should_release }}
     steps:
+      - name: Check if running on a fork
+        run: |
+          if [ "${{ github.repository }}" != "metabase/metabase" ]; then
+            echo "This workflow should not run on forks."
+            exit 1
+          fi
       - uses: actions/checkout@v6
         with:
           sparse-checkout: |
@@ -125,7 +131,7 @@ jobs:
 
             core.setOutput('should_release', 'false');
       - name: Write job summary
-        if: always()
+        if: always() && github.repository == 'metabase/metabase'
         shell: bash
         run: |
           {
@@ -157,3 +163,12 @@ jobs:
     with:
       version: ${{ needs.prepare.outputs.version }}
       commit: ${{ needs.prepare.outputs.commit }}
+
+  auto-publish-release:
+    name: Auto-publish release ${{ inputs.version }}
+    needs: [prepare, trigger-release]
+    uses: ./.github/workflows/release.yml
+    secrets: inherit
+    with:
+      version: ${{ needs.prepare.outputs.version }}
+      commit: ${{ needs.prepare.outputs.commit }}

.github/workflows/release-embedding-sdk.yml

@@ -1,46 +1,103 @@
+# Step 2 of the SDK release process: merging a version-bump PR (opened by
+# sdk-version-bump-pr.yml, labeled `sdk-release-trigger`) publishes the version
+# and dist-tag committed in package.template.json's `sdkRelease` block.
+#
+# workflow_dispatch publishes the same way, from the branch chosen in the ref
+# picker, without a PR. It reads the same committed sdkRelease block and never
+# bumps the version - so it is not how you cut a release. Use it only to publish
+# a version that is already committed, when the bump PR cannot do it.
+#
+# To retry a failed run, re-run the failed jobs on that run rather than
+# dispatching a fresh one: if publish-npm already succeeded, a fresh run would
+# stop at check-git-tag on the existing tag.
 name: Release Metabase Embedding SDK for React
-run-name: Release SDK from ${{ inputs.branch }}
+run-name: Release SDK from ${{ github.event_name == 'workflow_dispatch' && github.ref_name || github.event.pull_request.base.ref }}
 
 on:
   workflow_dispatch:
     inputs:
-      branch:
-        description: "Branch we want to release the SDK from (to release from other branches use the workflow from those branches)"
+      read_first:
+        description: |
+          ⚠️ To cut a release, use the "SDK Version Bump PR" workflow instead — it bumps the version and opens a PR; merging that PR publishes.
+          This publishes the version already committed in package.template.json. It never bumps. Pick the branch in "Use workflow from" above.
+          Use it only when neither the bump PR nor re-running the failed jobs will do.
         type: choice
-        required: true
-        default: "master"
+        required: false
         options:
-          - master
+          - Publish the committed version from the branch picked in "Use workflow from" above
+  # Step 2 of the new release process: merging a version-bump PR (opened by
+  # sdk-version-bump-pr.yml, labeled `sdk-release-trigger`) triggers a release
+  # of whatever branch that PR targeted. See `prepare-release` below.
+  #
+  # The `paths` filter keeps this from creating a run for every PR closed
+  # anywhere in the repo - version-bump PRs always touch package.template.json,
+  # so this is a reliable pre-filter ahead of the label/merge check below.
+  pull_request:
+    types: [closed]
+    paths:
+      - enterprise/frontend/src/embedding-sdk-package/package.template.json
 
 concurrency:
-  # We want to ensure only one job is running at a time per branch because
-  # there could be a conflict when updating the readme file.
-  group: ${{ github.workflow }}-${{ inputs.branch }}
-  cancel-in-progress: true
+  # One release at a time per branch; base.ref is empty on workflow_dispatch, so
+  # it falls back to the ref picker's branch. Never cancel in progress - a queued
+  # release that turns out stale fails loudly at check-git-tag.
+  #
+  # Non-release closed PRs queue here too and skip in seconds. GitHub keeps only
+  # one pending run per group and cancels any earlier one, so one could in theory
+  # evict a release waiting to start; that needs two same-branch releases at once.
+  # `queue: max` would fix it, but actionlint cannot parse it (rhysd/actionlint#654).
+  group: sdk-release-${{ github.event.pull_request.base.ref || github.ref_name }}
+  cancel-in-progress: false
 
 jobs:
+  # Gates the whole workflow: either a manual workflow_dispatch, or a merged
+  # PR carrying the sdk-release-trigger label. Every other job depends
+  # (directly or transitively) on this one, so if it's skipped the rest of
+  # the run is skipped too - no separate `if:` needed on downstream jobs.
+  prepare-release:
+    name: Prepare release trigger
+    if: |
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'sdk-release-trigger'))
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    outputs:
+      branch: ${{ steps.resolve.outputs.branch }}
+    steps:
+      # base.ref is only set on a pull_request event; on a dispatch it is empty,
+      # so this falls through to the branch picked in the ref picker.
+      - name: Resolve target branch
+        id: resolve
+        run: echo "branch=${{ github.event.pull_request.base.ref || github.ref_name }}" >> "$GITHUB_OUTPUT"
+
   workflow-summary:
     name: Log inputs
+    needs: prepare-release
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
       - name: Generate workflow summary
+        env:
+          BRANCH: ${{ needs.prepare-release.outputs.branch }}
         run: |
-          tee -a $GITHUB_STEP_SUMMARY << EOF
+          tee -a "$GITHUB_STEP_SUMMARY" << EOF
           **Inputs:**
 
-          - \`branch\`: ${{ inputs.branch }}
+          - \`branch\`: $BRANCH
+          - \`trigger\`: ${{ github.event_name }}
 
           triggered by: @${{ github.event.sender.login }}
           EOF
 
-  send-slack-notification-start:
-    name: "Send Slack notification: SDK release started"
-    needs: determine-sdk-version
+  # Builds release/dist/index.cjs once, for every Slack job to download. It hangs
+  # off prepare-release only - not off the metadata read or anything downstream -
+  # so the artifact exists even when the release fails at its very first step,
+  # which is exactly when send-slack-notification-failure needs it.
+  build-release-scripts:
+    name: Build release scripts
+    needs: prepare-release
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
-    outputs:
-      slackMessageId: ${{ steps.send-slack-message-start.outputs.result }}
     steps:
       - uses: actions/checkout@v6
         with:
@@ -51,12 +108,28 @@ jobs:
       - name: Prepare release scripts
         uses: ./.github/actions/prepare-release-scripts
 
-      - name: Cache build scripts
+      - name: Upload release scripts
         uses: actions/upload-artifact@v7
         with:
           name: build-scripts
           path: release/dist/index.cjs
 
+  send-slack-notification-start:
+    name: "Send Slack notification: SDK release started"
+    needs:
+      - build-release-scripts
+      - read-sdk-release-metadata
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    outputs:
+      slackMessageId: ${{ steps.send-slack-message-start.outputs.result }}
+    steps:
+      - name: Retrieve release scripts
+        uses: actions/download-artifact@v8
+        with:
+          name: build-scripts
+          path: release/dist/
+
       - name: Send build start message
         id: send-slack-message-start
         uses: actions/github-script@v9
@@ -66,7 +139,7 @@ jobs:
           result-encoding: string
           script: | # js
             const { mentionUserByGithubLogin, sendSlackMessage, githubRunLink } = require('${{ github.workspace }}/release/dist/index.cjs');
-            const sdkVersion = "${{ needs.determine-sdk-version.outputs.sdk_version }}";
+            const sdkVersion = "${{ needs.read-sdk-release-metadata.outputs.sdk_version }}";
 
             const title = `:rocket: *SDK release: ${sdkVersion}* :rocket:`
             const runLink = githubRunLink(
@@ -87,23 +160,22 @@ jobs:
   send-slack-notification-failure:
     name: "Send Slack notification: SDK release failed"
     needs:
-      [
-        "determine-sdk-version",
-        "send-slack-notification-start",
-        "check-git-tag",
-        "test",
-        "build-sdk",
-        "publish-npm",
-        "tag-latest",
-        "git-tag",
-      ]
+      - build-release-scripts
+      - read-sdk-release-metadata
+      - send-slack-notification-start
+      - check-git-tag
+      - test
+      - build-sdk
+      - publish-npm
+      - tag-latest
+      - git-tag
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     env:
       slackMessageId: ${{ needs.send-slack-notification-start.outputs.slackMessageId }}
     if: ${{ always() && contains(needs.*.result, 'failure') }}
     steps:
-      - name: Retrieve build scripts
+      - name: Retrieve release scripts
         uses: actions/download-artifact@v8
         with:
           name: build-scripts
@@ -115,8 +187,9 @@ jobs:
           SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
         with:
           script: | # js
-            const { githubRunLink, sendSlackReply } = require('${{ github.workspace }}/release/dist/index.cjs');
-            const sdkVersion = "${{ needs.determine-sdk-version.outputs.sdk_version }}";
+            const { githubRunLink, sendSlackReply, sendSlackMessage } = require('${{ github.workspace }}/release/dist/index.cjs');
+            const sdkVersion = "${{ needs.read-sdk-release-metadata.outputs.sdk_version }}";
+            const messageId = "${{ env.slackMessageId }}";
 
             const runLink = githubRunLink(
               `:x: ${sdkVersion} Release has failed`,
@@ -124,23 +197,34 @@ jobs:
               context.repo.owner,
               context.repo.repo,
             );
-            sendSlackReply({
-              channelName: 'team-embedding-releases',
-              message: runLink,
-              messageId: ${{ env.slackMessageId}},
-              broadcast: true
-            });
+
+            if (messageId) {
+              sendSlackReply({
+                channelName: 'team-embedding-releases',
+                message: runLink,
+                messageId,
+                broadcast: true,
+              });
+            } else {
+              sendSlackMessage({
+                channelName: 'team-embedding-releases',
+                message: runLink,
+              });
+            }
 
   send-slack-notification-successful:
     name: "Send Slack notification: SDK release successful"
     needs:
-      ["determine-sdk-version", "send-slack-notification-start", "publish-npm"]
+      - build-release-scripts
+      - read-sdk-release-metadata
+      - send-slack-notification-start
+      - publish-npm
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     env:
       slackMessageId: ${{ needs.send-slack-notification-start.outputs.slackMessageId }}
     steps:
-      - name: Retrieve build scripts
+      - name: Retrieve release scripts
         uses: actions/download-artifact@v8
         with:
           name: build-scripts
@@ -153,7 +237,7 @@ jobs:
         with:
           script: | # js
             const { githubRunLink, sendSlackReply } = require('${{ github.workspace }}/release/dist/index.cjs');
-            const sdkVersion = "${{ needs.determine-sdk-version.outputs.sdk_version }}";
+            const sdkVersion = "${{ needs.read-sdk-release-metadata.outputs.sdk_version }}";
 
             const runLink = githubRunLink(
               `:partydeploy: ${sdkVersion} Release is complete :partydeploy:`,
@@ -164,93 +248,104 @@ jobs:
             sendSlackReply({
               channelName: 'team-embedding-releases',
               message: runLink,
-              messageId: ${{ env.slackMessageId}},
+              messageId: "${{ env.slackMessageId }}",
               broadcast: true
             });
 
-  determine-sdk-version:
+  # Reads the version + release metadata straight from package.template.json
+  # instead of computing them (the version and sdkRelease.distTag/tagAsLatest
+  # are already correct on this branch, because sdk-version-bump-pr.yml wrote
+  # them there and a human reviewed them before merging).
+  read-sdk-release-metadata:
+    name: Read SDK release metadata
+    needs: prepare-release
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 20
+    timeout-minutes: 5
     outputs:
-      sdk_version: ${{ fromJson(steps.new-sdk-version.outputs.result).version }}
-      major_version: ${{ fromJson(steps.new-sdk-version.outputs.result).majorVersion }}
-      pre_release_label: ${{ fromJson(steps.new-sdk-version.outputs.result).preReleaseLabel }}
+      sdk_version: ${{ steps.metadata.outputs.sdk_version }}
+      major_version: ${{ steps.metadata.outputs.major_version }}
+      dist_tag: ${{ steps.metadata.outputs.dist_tag }}
+      tag_as_latest: ${{ steps.metadata.outputs.tag_as_latest }}
     steps:
       - name: Check out the code using the provided branch
         uses: actions/checkout@v6
         with:
-          ref: ${{ inputs.branch }}
+          ref: ${{ needs.prepare-release.outputs.branch }}
 
       - name: Prepare release scripts
         uses: ./.github/actions/prepare-release-scripts
 
-      - name: Get current SDK version
-        id: current-sdk-version
-        run: |
-          VERSION=$(jq -r .version ./enterprise/frontend/src/embedding-sdk-package/package.template.json)
-          echo "sdk_current_version=$VERSION" >> $GITHUB_OUTPUT
-
-      - name: Get next SDK patch or pre-release version
-        id: new-sdk-version
+      - name: Read version and sdkRelease metadata
+        id: metadata
         uses: actions/github-script@v9
         with:
-          script: | #js
-            const { getNextSdkVersion } = require('${{ github.workspace }}/release/dist/index.cjs');
+          script: | # js
+            const { readSdkReleaseMetadata } = require('${{ github.workspace }}/release/dist/index.cjs');
 
-            const branch = "${{ inputs.branch }}";
-            const currentVersion = "${{ steps.current-sdk-version.outputs.sdk_current_version }}";
+            let metadata;
+            try {
+              metadata = readSdkReleaseMetadata({
+                packageTemplatePath:
+                  'enterprise/frontend/src/embedding-sdk-package/package.template.json',
+              });
+            } catch (error) {
+              core.setFailed(error.message);
+              return;
+            }
 
-            const result = getNextSdkVersion(branch, currentVersion);
-
-            return {
-              version: result.version,
-              preReleaseLabel: result.preReleaseLabel,
-              majorVersion: result.majorVersion
-            };
+            core.setOutput('sdk_version', metadata.version);
+            core.setOutput('major_version', metadata.majorVersion);
+            core.setOutput('dist_tag', metadata.distTag);
+            core.setOutput('tag_as_latest', String(metadata.tagAsLatest));
 
       - name: Append workflow summary
         run: |
-          tee -a $GITHUB_STEP_SUMMARY << EOF
-          **Derived inputs:**
+          tee -a "$GITHUB_STEP_SUMMARY" << EOF
+          **SDK release metadata (from package.template.json):**
 
-          - \`current_version\`: "${{ steps.current-sdk-version.outputs.sdk_current_version }}"
-          - \`next_version\`: "${{ fromJson(steps.new-sdk-version.outputs.result).version }}"
-          - \`major_version\`: "${{ fromJson(steps.new-sdk-version.outputs.result).majorVersion }}"
+          - \`version\`: "${{ steps.metadata.outputs.sdk_version }}"
+          - \`major_version\`: "${{ steps.metadata.outputs.major_version }}"
+          - \`distTag\`: "${{ steps.metadata.outputs.dist_tag }}"
+          - \`tagAsLatest\`: "${{ steps.metadata.outputs.tag_as_latest }}"
           EOF
 
   check-git-tag:
-    needs: determine-sdk-version
+    needs:
+      - prepare-release
+      - read-sdk-release-metadata
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     env:
-      tag: embedding-sdk-${{ needs.determine-sdk-version.outputs.sdk_version }}
+      tag: embedding-sdk-${{ needs.read-sdk-release-metadata.outputs.sdk_version }}
     steps:
       - name: Check out the code using the provided branch
         uses: actions/checkout@v6
         with:
-          ref: ${{ inputs.branch }}
+          ref: ${{ needs.prepare-release.outputs.branch }}
           fetch-depth: 0
           fetch-tags: true
 
       - name: check tags
         run: |
-          if [ $(git tag -l | grep $tag$) ]
+          if git tag -l | grep -q "${tag}$"
           then
-            echo "::error::Tag '${{ env.tag }}' already exists. If you expect to run this workflow with the same tag, please remove the tag first and rerun this workflow again."
+            echo "::error::Tag '${{ env.tag }}' already exists. If you expect to run this workflow with the same tag, please remove the tag first and rerun this workflow."
             exit 1
           else
             exit 0
           fi
 
   test:
-    needs: check-git-tag
+    needs:
+      - prepare-release
+      - check-git-tag
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     steps:
       - name: Check out the code using the provided branch
         uses: actions/checkout@v6
         with:
-          ref: ${{ inputs.branch }}
+          ref: ${{ needs.prepare-release.outputs.branch }}
 
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
@@ -262,14 +357,16 @@ jobs:
         run: bun run embedding-sdk:test-unit
 
   build-sdk:
-    needs: [test, determine-sdk-version]
+    needs:
+      - prepare-release
+      - test
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     steps:
       - name: Check out the code using the provided branch
         uses: actions/checkout@v6
         with:
-          ref: ${{ inputs.branch }}
+          ref: ${{ needs.prepare-release.outputs.branch }}
           fetch-depth: 0
           fetch-tags: true
 
@@ -279,11 +376,9 @@ jobs:
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
 
-      - name: Bump published npm package version
-        # NOTE: this should happen before "Build SDK bundle" as we inject SDK version into the code during build step
-        run: |
-          ./bin/embedding-sdk/release_utils.bash update_package_json_template ${{ needs.determine-sdk-version.outputs.sdk_version }}
-
+      # No version bump here anymore: package.template.json's version is
+      # already correct on this branch (bumped by sdk-version-bump-pr.yml
+      # before merge), so we build with it as-is.
       - name: Build SDK package
         run: bun run build-embedding-sdk-package
 
@@ -297,94 +392,22 @@ jobs:
           path: ./resources/embedding-sdk
 
   publish-npm:
-    needs: [build-sdk, determine-sdk-version]
+    needs:
+      - prepare-release
+      - build-sdk
+      - read-sdk-release-metadata
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     permissions:
       id-token: write # OIDC handshake for npm trusted publishing
       actions: read # actions/download-artifact reads the Actions API via GITHUB_TOKEN
-      pull-requests: write # gh pr review --approve step uses GITHUB_TOKEN
-    env:
-      sdk_version: ${{ needs.determine-sdk-version.outputs.sdk_version }}
     steps:
-      - name: Check out branch to prepare for a SDK version bump PR
-        uses: actions/checkout@v6
-        with:
-          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          # when we created version update PR, it would only have diff from 2 files SDK readme and SDK package.json template
-          ref: ${{ inputs.branch}}
-
-      - name: Setup git user
-        run: |
-          git config --global user.email "github-automation@metabase.com"
-          git config --global user.name "Metabase Automation"
-
-      - name: Update readme
-        if: inputs.branch != 'master'
-        run: |
-          bash ./bin/embedding-sdk/release_utils.bash update_readme ${{ env.sdk_version }}
-
-      - name: Bump published npm package version
-        run: |
-          bash ./bin/embedding-sdk/release_utils.bash update_package_json_template ${{ env.sdk_version }}
-
-      - name: Create a PR updating readme + published version (using GitHub Metabase Automation account)
-        run: |
-          git checkout -b update-sdk-version-${{ env.sdk_version }}
-
-          if [ "${{ inputs.branch }}" = "master" ]; then
-            COMMIT_MSG="chore(sdk): Update published npm version to ${{ env.sdk_version }}"
-            PR_TITLE="chore(sdk): Update SDK version to ${{ env.sdk_version }}"
-            PR_BODY="Update published npm package version to ${{ env.sdk_version }}"
-          else
-            COMMIT_MSG="docs(sdk): Update Readme version references and published npm version to ${{ env.sdk_version }}"
-            PR_TITLE="docs(sdk): Update SDK version to ${{ env.sdk_version }}"
-            PR_BODY="Update Readme version references and published npm package version to ${{ env.sdk_version }}"
-          fi
-
-          git commit -a -m "$COMMIT_MSG"
-          git push origin HEAD
-          gh pr create --base "${{ inputs.branch }}" \
-                       --assignee "${GITHUB_ACTOR}" \
-                       --title "$PR_TITLE" \
-                       --body "$PR_BODY"
-        env:
-          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-
-      - name: Edit PR adding useful information (using Metabase bot app)
-        # metabase/embedding team is added automatically as code owner of updated `package.template.json` file
-        run: |
-          gh pr edit --add-reviewer albertoperdomo --add-label no-backport
-        env:
-          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-
-      - name: Auto approve PR (using GitHub Actions account)
-        run: |
-          gh pr review --approve
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Enable Pull request auto-merge (using GitHub Metabase Automation account)
-        run: |
-          gh pr merge --auto --squash
-        env:
-          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-
       - name: Retrieve build SDK package artifact
         uses: actions/download-artifact@v8
         with:
           name: metabase-sdk
           path: sdk
 
-      - name: Compute master tag
-        id: compute-tag
-        run: |
-          if [ -n "${{ needs.determine-sdk-version.outputs.pre_release_label }}" ]; then
-            echo "masterTag=${{ needs.determine-sdk-version.outputs.pre_release_label }}" >> $GITHUB_OUTPUT
-          else
-            echo "masterTag=nightly" >> $GITHUB_OUTPUT
-          fi
-
       # Trusted publishing requires npm >= 11.5.1 and Node >= 22.14.0.
       # Node 22.x line bundles npm 10.x, so pin Node 24.x which ships npm 11.x.
       - name: Setup Node.js for npm publish with trusted publishing
@@ -396,34 +419,41 @@ jobs:
       - name: Publish to NPM
         working-directory: sdk
         run: |
-          TAG="${{ steps.compute-tag.outputs.masterTag }}"
+          TAG="${{ needs.read-sdk-release-metadata.outputs.dist_tag }}"
           echo "Resolved npm tag: $TAG"
           npm publish --tag "$TAG"
 
-  # When a newer release branch goes gold, remove this entire job from this branch.
   tag-latest:
     name: Tag npm release as latest
-    # Pre-gold: remove `if: false` once this branch becomes gold.
-    if: false
-    needs: [publish-npm, determine-sdk-version]
+    # Driven by package.template.json's sdkRelease.tagAsLatest instead of a
+    # hardcoded `if: false` that had to be hand-edited (uncommented) once a
+    # branch went gold - see sdk-version-bump-pr.yml, which is where a human
+    # sets this to true when appropriate.
+    if: ${{ needs.read-sdk-release-metadata.outputs.tag_as_latest == 'true' }}
+    needs:
+      - publish-npm
+      - read-sdk-release-metadata
     uses: ./.github/workflows/embedding-sdk-tag-latest.yml
     with:
-      version: ${{ needs.determine-sdk-version.outputs.sdk_version }}
+      version: ${{ needs.read-sdk-release-metadata.outputs.sdk_version }}
     secrets: inherit
 
   git-tag:
-    needs: [publish-npm, determine-sdk-version]
+    needs:
+      - prepare-release
+      - publish-npm
+      - read-sdk-release-metadata
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     env:
-      tag: embedding-sdk-${{ needs.determine-sdk-version.outputs.sdk_version }}
-      stable_tag: embedding-sdk-${{ needs.determine-sdk-version.outputs.major_version }}-stable
+      tag: embedding-sdk-${{ needs.read-sdk-release-metadata.outputs.sdk_version }}
+      stable_tag: embedding-sdk-${{ needs.read-sdk-release-metadata.outputs.major_version }}-stable
     steps:
       - name: Check out the code using the provided branch
         uses: actions/checkout@v6
         with:
           token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          ref: ${{ inputs.branch }}
+          ref: ${{ needs.prepare-release.outputs.branch }}
 
       - name: Setup git user
         run: |
@@ -436,7 +466,7 @@ jobs:
           git push origin ${{ env.tag }}
 
       - name: Create and push SDK stable version tag
-        if: ${{ startsWith(inputs.branch, 'release-x.') }}
+        if: ${{ startsWith(needs.prepare-release.outputs.branch, 'release-x.') }}
         run: |
           git tag -a -f ${{ env.stable_tag }} -m "Tagging SDK stable version ${{ env.stable_tag }}"
           git push origin -f ${{ env.stable_tag }}

.github/workflows/release-notes-preview.yml

@@ -36,6 +36,8 @@ jobs:
     - name: Get Release Version
       uses: actions/github-script@v9
       env:
+        # required by getMilestoneIssues to configure GraphQL client
+        GITHUB_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
         DOCKERHUB_OWNER: test_owner
         DOCKERHUB_REPO: test_repo
         AWS_S3_DOWNLOADS_BUCKET: test_bucket

.github/workflows/release.yml

@@ -138,19 +138,45 @@ jobs:
     - name: Check JAR version properties
       run: |
         # ensure actual jar checksum matches checksum file
-        grep -q $(sha256sum ./metabase.jar) SHA256.sum && echo "checksums match" || (echo "checksum mismatch" && exit 1)
+        jar_checksum=$(sha256sum ./metabase.jar | cut -d ' ' -f 1)
+        if grep -q "$jar_checksum" SHA256.sum; then
+          echo "checksums match"
+        else
+          echo "checksum mismatch"
+          exit 1
+        fi
 
         # ensure stored commit-id file matches input commit
-        grep -q ${{ inputs.commit }} COMMIT-ID && echo "commit ids match" || (echo "commit-id mismatch" && exit 1)
+        if grep -q "${{ inputs.commit }}" COMMIT-ID; then
+          echo "commit ids match"
+        else
+          echo "commit-id mismatch"
+          exit 1
+        fi
 
         # ensure version.properties partial commit matches commit input
-        grep -q $(cut -c 1-7 <<< ${{ inputs.commit }}) version.properties && echo "version.properties commit matches" || (echo "version.properties commit mismatch" && exit 1)
+        if grep -q "$(cut -c 1-7 <<< '${{ inputs.commit }}')" version.properties; then
+          echo "version.properties commit matches"
+        else
+          echo "version.properties commit mismatch"
+          exit 1
+        fi
 
         # ensure version.properties version number matches input version (without v0/v1 to make it ee/oss agnostic)
-        grep -q $(cut -c 3-99 <<< ${{ inputs.version }}) version.properties && echo "version.properties version number matches" || (echo "version.properties version number mismatch" && exit 1)
+        if grep -q "$(cut -c 3-99 <<< '${{ inputs.version }}')" version.properties; then
+          echo "version.properties version number matches"
+        else
+          echo "version.properties version number mismatch"
+          exit 1
+        fi
 
         # ensure the build is not a snapshot build
-        grep -q "SNAPSHOT" version.properties && (echo "jar is a snapshot" && exit 1) || echo "jar is not a snapshot build"
+        if grep -q "SNAPSHOT" version.properties; then
+          echo "jar is a snapshot"
+          exit 1
+        else
+          echo "jar is not a snapshot build"
+        fi
     - name: Upload Uberjar as artifact
       uses: actions/upload-artifact@v7
       with:
@@ -244,7 +270,7 @@ jobs:
       run:
         curl -L http://${{ vars.AWS_S3_DOWNLOADS_BUCKET }}.s3.${{ vars.AWS_REGION }}.amazonaws.com/${{ steps.version_path.outputs.result }}/metabase.jar -o metabase-downloaded.jar
     - name: Verify Checksum
-      run: grep -q $(sha256sum ./metabase-downloaded.jar) SHA256.sum && echo "checksums match" || exit 1
+      run: grep -q "$(sha256sum ./metabase-downloaded.jar | cut -d ' ' -f 1)" SHA256.sum && echo "checksums match" || exit 1
 
   containerize-oss:
     needs: check-version
@@ -255,7 +281,7 @@ jobs:
       commit: ${{ inputs.commit }}
       repo: ${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_REPO }}
       tag: ${{ needs.check-version.outputs.oss }}
-      release: "true"
+      release: ${{ 'true' }}
 
   containerize-ee:
     needs: check-version
@@ -266,7 +292,7 @@ jobs:
       commit: ${{ inputs.commit }}
       repo: ${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_REPO }}-enterprise
       tag: ${{ needs.check-version.outputs.ee }}
-      release: "true"
+      release: ${{ 'true' }}
 
   push-tags:
     needs: [verify-s3-download, containerize-oss, containerize-ee, check-version]
@@ -317,6 +343,9 @@ jobs:
       - name: Get extra tags
         id: taglist
         uses: actions/github-script@v9
+        env:
+          AWS_S3_STATIC_BUCKET: ${{ vars.AWS_S3_STATIC_BUCKET }}
+          AWS_REGION: ${{ vars.AWS_REGION }}
         with:
           result-encoding: string
           script: | # js
@@ -325,7 +354,7 @@ jobs:
             const version = '${{ inputs.version }}';
             const latestMajorVersion = '${{ vars.LATEST_MAJOR_VERSION }}';
 
-            const extra_tags = getExtraTagsForVersion({ version, latestMajorVersion });
+            const extra_tags = await getExtraTagsForVersion({ version, latestMajorVersion });
 
             console.log({ extra_tags, latestMajorVersion });
             core.setOutput('extra_tags', JSON.stringify(extra_tags));
@@ -445,6 +474,9 @@ jobs:
         uses: ./.github/actions/prepare-release-scripts
       - name: Publish draft release notes to github
         uses: actions/github-script@v9
+        env:
+          # required by getMilestoneIssues to configure GraphQL client
+          GITHUB_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
         with:
           github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
           result-encoding: string

.github/workflows/rerun-workflows.yml

@@ -15,20 +15,30 @@ jobs:
     env:
       BRANCH_NAME: ${{ github.event.workflow_run.head_branch }}
       AUTHOR_NAME: ${{ github.event.workflow_run.head_commit.author.name }}
+      AUTHOR_LOGIN: ${{ github.event.workflow_run.head_commit.author.username }}
     steps:
       - name: Generate job summary
         run: |
-          echo "# ${{ github.event.workflow_run.name }} workflow failed! :x:" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "View the failed run attempt (#${{ github.event.workflow_run.run_attempt }}) using the following link:" >> $GITHUB_STEP_SUMMARY
-          echo "${{ github.event.workflow_run.html_url }}" >> $GITHUB_STEP_SUMMARY
+          {
+            echo "# ${{ github.event.workflow_run.name }} workflow failed! :x:"
+            echo ""
+            echo "View the failed run attempt (#${{ github.event.workflow_run.run_attempt }}) using the following link:"
+            echo "${{ github.event.workflow_run.html_url }}"
+          } >> "$GITHUB_STEP_SUMMARY"
 
-      - uses: actions/setup-node@v6.4.0
+      - uses: actions/checkout@v6
         with:
-          node-version: lts/Jod # 22.x.x
-      - run: npm install @slack/web-api
+          sparse-checkout: |
+            .github
+            release
+
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
+
       - name: Trigger a re-run
         uses: actions/github-script@v9
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
         with:
           script: | # js
             const MAX_ATTEMPTS = 1;
@@ -36,7 +46,8 @@ jobs:
             const FAILED_RUN_URL = "${{ github.event.workflow_run.html_url }}";
             const FAILED_RUN_NAME = "${{ github.event.workflow_run.name }}";
             const BREAKING_COMMIT = "${{ github.event.workflow_run.head_sha }}";
-            const AUTHOR = process.env.AUTHOR_NAME;
+            let AUTHOR = process.env.AUTHOR_NAME;
+            let AUTHOR_LOGIN = process.env.AUTHOR_LOGIN;
             const BRANCH = process.env.BRANCH_NAME;
 
             if (ATTEMPT <= MAX_ATTEMPTS) {
@@ -55,8 +66,7 @@ jobs:
               }
             } else if (!BRANCH.includes('backport-')) {
               // notify slack of repeated failure
-              const { WebClient } = require('@slack/web-api');
-              const slack = new WebClient('${{ secrets.SLACK_BOT_TOKEN }}');
+              const { mentionUserByGithubLogin, sendSlackMessage } = require('${{ github.workspace }}/release/dist/index.cjs');
 
               // find out which jobs failed
               const { owner, repo } = context.repo;
@@ -76,6 +86,24 @@ jobs:
                 return;
               }
 
+              // the workflow_run payload omits the github login when the commit
+              // author isn't matched to a github account, so look it up from
+              // the commit itself
+              if (!AUTHOR_LOGIN) {
+                try {
+                  const { data: commit } = await github.rest.repos.getCommit({
+                    owner,
+                    repo,
+                    ref: BREAKING_COMMIT,
+                  });
+
+                  AUTHOR_LOGIN = commit.author?.login ?? '';
+                  AUTHOR = AUTHOR || commit.commit?.author?.name || '';
+                } catch (error) {
+                  console.log(`Could not look up the author of ${BREAKING_COMMIT}: ${error.message}`);
+                }
+              }
+
               const failedJobsList = failedJobs.map(job => ({
                 "type": "rich_text_section",
                 "elements": [
@@ -87,9 +115,9 @@ jobs:
                 ]
               }));
 
-              await slack.chat.postMessage({
-                channel: 'engineering-ci',
-                text: 'Failing tests',
+              await sendSlackMessage({
+                channelName: 'engineering-ci',
+                message: 'Failing tests',
                 blocks: [
                   {
                     "type": "header",
@@ -107,7 +135,7 @@ jobs:
                       "type": "section",
                       "text": {
                         "type": "mrkdwn",
-                        "text": `Commit <https://github.com/metabase/metabase/commit/${BREAKING_COMMIT}|${BREAKING_COMMIT.slice(0,7)}> by ${AUTHOR} has failing <${FAILED_RUN_URL}|${FAILED_RUN_NAME}> tests on <https://github.com/${owner}/${repo}/commits/${BRANCH}|\`${BRANCH}\`>`
+                        "text": `Commit <https://github.com/metabase/metabase/commit/${BREAKING_COMMIT}|${BREAKING_COMMIT.slice(0,7)}> by ${AUTHOR} (${mentionUserByGithubLogin(AUTHOR_LOGIN)}) has failing <${FAILED_RUN_URL}|${FAILED_RUN_NAME}> tests on <https://github.com/${owner}/${repo}/commits/${BRANCH}|\`${BRANCH}\`>`
                       },
                     },
                     {

.github/workflows/run-tests.yml

@@ -93,13 +93,63 @@ jobs:
     uses: ./.github/workflows/uberjar.yml
     secrets: inherit
 
+  # Compile CLJS in parallel with the uberjar and pass it to each e2e group.
+  # The compile is doesn't depend on MB_EDITION
+  e2e-cljs:
+    name: Compile CLJS for e2e
+    needs: [create-test-plan]
+    if: ${{ !cancelled() && needs.create-test-plan.result == 'success' && needs.create-test-plan.outputs.e2e_all == 'true' }}
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      - name: Compile CLJS
+        run: bun run build-pure:cljs
+      - name: Upload compiled CLJS
+        uses: actions/upload-artifact@v7
+        with:
+          name: e2e-cljs-${{ github.event.pull_request.head.sha || github.sha }}
+          path: target/cljs_dev
+          if-no-files-found: error
+          # Uploads fail when an artifact of this name already exists in the run
+          # replace it rather than fail on a re-run.
+          overwrite: true
+
+  static-viz-files-changed:
+    name: Check whether static-viz files changed
+    if: ${{ !contains(github.event.pull_request.labels.*.name,'ci skip') && !contains(github.event.pull_request.labels.*.name,'minimal-tests') }}
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 10
+    outputs:
+      static_viz: ${{ steps.static_viz.outputs.static_viz }}
+    steps:
+      - uses: actions/checkout@v6
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      - name: Build static-viz frontend
+        run: bun run build-static-viz
+        env:
+          MB_EDITION: ee
+      - name: Check for static viz changes
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        id: static_viz
+        with:
+          token: ${{ github.token }}
+          filters: .github/static-viz-sources.yaml
+
   backend-tests:
     if: ${{ !cancelled() && needs.create-test-plan.result == 'success' }}
-    needs: [create-test-plan]
+    needs: [create-test-plan, static-viz-files-changed]
     uses: ./.github/workflows/backend.yml
     secrets: inherit
     with:
-      skip: ${{ needs.create-test-plan.outputs.backend_all != 'true' }}
+      skip: ${{ needs.create-test-plan.outputs.backend_all != 'true' && needs.static-viz-files-changed.outputs.static_viz != 'true' }}
 
   semantic-search-tests:
     needs: create-test-plan
@@ -178,7 +228,6 @@ jobs:
     uses: ./.github/workflows/embedding-sdk.yml
     secrets: inherit
     with:
-      bundle-size-check: ${{ github.event_name == 'pull_request' && needs.uberjar.result == 'success' && needs.create-test-plan.outputs.frontend_sources == 'true' }}
       cli-snippets-type-check: ${{ needs.create-test-plan.outputs.frontend_sources == 'true' }}
       docs-snippets-type-check: ${{ needs.create-test-plan.outputs.embedding_documentation == 'true' }}
       documentation-validation: ${{ needs.create-test-plan.outputs.frontend_sources == 'true' }}
@@ -186,6 +235,14 @@ jobs:
       host-sample-apps-tests: ${{ needs.create-test-plan.outputs.embedding_sdk_host_sample_apps == 'true' }}
       skip: ${{ needs.embedding-sdk-package.result != 'success' || needs.uberjar.result != 'success' }}
 
+  bundle-size:
+    needs: [uberjar, create-test-plan]
+    if: always() && !cancelled()
+    uses: ./.github/workflows/bundle-size.yml
+    secrets: inherit
+    with:
+      skip: ${{ github.event_name != 'pull_request' || needs.uberjar.result != 'success' || needs.create-test-plan.outputs.frontend_sources != 'true' }}
+
   pr-env:
     needs: [uberjar]
     if: |

.github/workflows/sdk-version-bump-pr.yml

@@ -0,0 +1,180 @@
+# Step 1 of the SDK release process: bump the version (and the sdkRelease
+# metadata that controls the npm dist-tag / `latest` promotion) in
+# package.template.json, then open a PR labeled `sdk-release-trigger`.
+# Merging that PR is what actually triggers a release, via the
+# `pull_request` trigger on release-embedding-sdk.yml.
+name: SDK Version Bump PR
+run-name: Bump Embedding SDK version (${{ inputs.release_type }}) on ${{ github.ref_name }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      read_first:
+        description: "Bumps the version on the branch chosen in 'Use workflow from' above."
+        type: choice
+        required: false
+        options:
+          - Pick the branch in "Use workflow from" above
+      release_type:
+        description: |
+          Before gold:
+          • beta — release branch: publish a beta
+
+          At gold:
+          • patch — release branch: graduate the beta to 0.N.0
+          • preminor — master: move master to the next major
+
+          After gold:
+          • patch — release branch: ship a patch (0.N.1, 0.N.2, ...)
+
+          Any time:
+          • alpha — master: bump the development version
+          • custom — one-off branch (esbuild, data-apps): publish under its own prerelease id
+        type: choice
+        required: true
+        options:
+          - alpha
+          - beta
+          - preminor
+          - patch
+          - custom
+      prerelease_id:
+        description: "release_type=custom only, and only on the FIRST cut of a one-off branch (e.g. data-apps). Becomes the prerelease id in the version (0.62.5-data-apps.0) and the npm dist-tag (62-data-apps). Leave empty on later bumps - the id is reused from the current version."
+        type: string
+        required: false
+
+concurrency:
+  # one version-bump in flight per branch at a time, to avoid racing PRs
+  group: ${{ github.workflow }}-${{ github.ref_name }}
+  cancel-in-progress: false
+
+jobs:
+  bump-version:
+    name: Bump SDK version and open review PR
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 10
+    permissions:
+      contents: write
+      pull-requests: write
+    env:
+      package_template: enterprise/frontend/src/embedding-sdk-package/package.template.json
+    steps:
+      - name: Check out the code
+        uses: actions/checkout@v6
+        with:
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+
+      - name: Setup git user
+        run: |
+          git config --global user.email "github-automation@metabase.com"
+          git config --global user.name "Metabase Automation"
+
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
+
+      - name: Compute version and sdkRelease metadata
+        id: metadata
+        uses: actions/github-script@v9
+        # Pass inputs via env, not inlined `${{ }}` in the script: github-script
+        # interpolates expressions into the JS source before running it, so a
+        # free-form input like prerelease_id could inject code. env values are
+        # read at runtime and can't escape into the code.
+        env:
+          BRANCH: ${{ github.ref_name }}
+          RELEASE_TYPE: ${{ inputs.release_type }}
+          PRERELEASE_ID: ${{ inputs.prerelease_id }}
+          LATEST_MAJOR_VERSION: ${{ vars.LATEST_MAJOR_VERSION }}
+          PACKAGE_TEMPLATE: ${{ env.package_template }}
+        with:
+          script: | # js
+            const { applySdkVersionBump } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            let result;
+            try {
+              result = applySdkVersionBump({
+                packageTemplatePath: process.env.PACKAGE_TEMPLATE,
+                branch: process.env.BRANCH,
+                releaseType: process.env.RELEASE_TYPE,
+                prereleaseId: process.env.PRERELEASE_ID,
+                latestMajorVersion: process.env.LATEST_MAJOR_VERSION,
+              });
+            } catch (error) {
+              core.setFailed(error.message);
+              return;
+            }
+
+            core.setOutput("previous_version", result.previousVersion);
+            core.setOutput("new_version", result.newVersion);
+            core.setOutput("major_version", result.majorVersion);
+            core.setOutput("dist_tag", result.distTag);
+            core.setOutput("tag_as_latest", String(result.tagAsLatest));
+
+      - name: Append workflow summary
+        env:
+          BRANCH: ${{ github.ref_name }}
+        run: |
+          tee -a "$GITHUB_STEP_SUMMARY" << EOF
+          **SDK version bump:**
+
+          - \`branch\`: $BRANCH
+          - \`release_type\`: ${{ inputs.release_type }}
+          - \`previous_version\`: ${{ steps.metadata.outputs.previous_version }}
+          - \`new_version\`: ${{ steps.metadata.outputs.new_version }}
+          - \`distTag\` (default, review before merging): ${{ steps.metadata.outputs.dist_tag }}
+          - \`tagAsLatest\` (auto-computed from \`vars.LATEST_MAJOR_VERSION\`, review before merging): ${{ steps.metadata.outputs.tag_as_latest }}
+
+          triggered by: @${{ github.event.sender.login }}
+          EOF
+
+      - name: Commit version bump
+        env:
+          BUMP_BRANCH: sdk-version-bump-${{ steps.metadata.outputs.new_version }}
+        run: |
+          # A leftover branch means an earlier bump to this same version was
+          # abandoned. Say so, rather than pushing a near-duplicate alongside it.
+          if git ls-remote --exit-code --heads origin "$BUMP_BRANCH" >/dev/null 2>&1; then
+            echo "::error::'$BUMP_BRANCH' already exists on origin - an earlier bump to this version was never merged. Close its PR, delete the branch, then re-run."
+            exit 1
+          fi
+
+          git checkout -b "$BUMP_BRANCH"
+          git add "$package_template"
+          git commit -m "chore(sdk): bump SDK version to ${{ steps.metadata.outputs.new_version }} (${{ inputs.release_type }})"
+          git push origin HEAD
+
+      - name: Open version-bump PR (using GitHub Metabase Automation account)
+        id: open-pr
+        env:
+          BRANCH: ${{ github.ref_name }}
+          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+        run: |
+          # TODO (EMB-2095) auto-approve and auto-merge this PR once the computed
+          # version/distTag/tagAsLatest have proven out over a few real releases.
+          # Nothing gates on review today - merging is only manual as a seatbelt.
+          #
+          # --reviewer tags the team so a release is visible, not because anything
+          # waits on a review. It needs the automation PAT: GITHUB_TOKEN cannot
+          # resolve an org team.
+          gh pr create --base "$BRANCH" \
+                       --assignee "${GITHUB_ACTOR}" \
+                       --reviewer metabase/embedding \
+                       --label sdk-release-trigger \
+                       --title "chore(sdk): bump SDK version on $BRANCH to ${{ steps.metadata.outputs.new_version }}" \
+                       --body "$(cat <<'BODY'
+          Bumps the Embedding SDK version in `package.template.json` and updates its `sdkRelease` metadata.
+
+          | | |
+          |---|---|
+          | Branch | `${{ github.ref_name }}` |
+          | Release type | `${{ inputs.release_type }}` |
+          | Version | `${{ steps.metadata.outputs.previous_version }}` → `${{ steps.metadata.outputs.new_version }}` |
+          | npm dist-tag | `${{ steps.metadata.outputs.dist_tag }}` |
+          | Tag as `latest` | `${{ steps.metadata.outputs.tag_as_latest }}` |
+
+          `distTag` and `tagAsLatest` are computed from the branch and release type. `tagAsLatest` is `true` only when patching the current gold major (`vars.LATEST_MAJOR_VERSION`).
+
+          Merging this PR (with the `sdk-release-trigger` label) triggers [release-embedding-sdk.yml](../actions/workflows/release-embedding-sdk.yml), which builds, publishes to npm, and tags the release.
+
+          _Opened by the [SDK Version Bump PR workflow](../actions/workflows/sdk-version-bump-pr.yml), triggered by @${{ github.event.sender.login }}._
+          BODY
+          )"

.github/workflows/semantic-search.yml

@@ -162,10 +162,17 @@ jobs:
             junit-name: semantic-search-tests-mysql-8-0
             mysql-image: mysql:8.0
             pgvector-image: pgvector/pgvector:pg17
-          - name: MySQL Latest with pgvector pg17
-            junit-name: semantic-search-tests-mysql-latest
-            mysql-image: mysql:latest
+          - name: MySQL 9 with pgvector pg17
+            junit-name: semantic-search-tests-mysql-9
+            mysql-image: mysql:9
             pgvector-image: pgvector/pgvector:pg17
+          # `mysql:latest` now resolves to MySQL 26.x, which fails in a way that floods the log
+          # until the runner cancels the job. A cancelled job can't be soft-failed with
+          # continue-on-error, so the leg is disabled until 26.x is supported.
+          # - name: MySQL Latest with pgvector pg17
+          #   junit-name: semantic-search-tests-mysql-latest
+          #   mysql-image: mysql:latest
+          #   pgvector-image: pgvector/pgvector:pg17
         job:
           - name: Semantic Search Tests
             build-static-viz: false

.github/workflows/tag-for-release.yml

@@ -140,8 +140,8 @@ jobs:
       run: |
         RELEASE_BRANCH=${{ steps.release_branch.outputs.result }}
         git checkout $RELEASE_BRANCH
-        git branch --contains ${{ inputs.commit }} | grep -q $RELEASE_BRANCH \
-          && echo "Commit found in correct release branch" \
+        (git branch --contains ${{ inputs.commit }} | grep -q $RELEASE_BRANCH \
+          && echo "Commit found in correct release branch") \
           || (echo "Commit not found in correct release branch" && exit 1)
         git checkout -
 
@@ -196,7 +196,7 @@ jobs:
           version='${{ needs.check-version.outputs.oss }}'
         fi
 
-        echo "VERSION=$version" >> $GITHUB_ENV
+        echo "VERSION=$version" >> "$GITHUB_ENV"
     - name: Setup Java
       uses: actions/setup-java@v5.2.0
       with:
@@ -215,9 +215,9 @@ jobs:
         echo "Old version.properties:"
         cat version.properties
         sed -i "s/^tag=.*/tag=$VERSION/" version.properties
-        echo "\n\nNew version.properties:"
+        printf "\n\nNew version.properties:"
         cat version.properties
-        echo "\n\nUpdating metabase.jar with new version.properties"
+        printf "\n\nUpdating metabase.jar with new version.properties"
         jar uf metabase.jar version.properties
 
     - name: Store commit's SHA-1 hash
@@ -280,12 +280,3 @@ jobs:
     with:
       commit: ${{ inputs.commit }}
       version: ${{ inputs.version }}
-
-  auto-publish-release:
-    name: Auto-publish release ${{ inputs.version }}
-    needs: run-pre-release-tests
-    uses: ./.github/workflows/release.yml
-    secrets: inherit
-    with:
-      version: ${{ inputs.version }}
-      commit: ${{ inputs.commit }}

.gitignore

@@ -89,6 +89,7 @@ cypress.env.json
 /resources/frontend_client/app/embedding-sdk.js.map
 /resources/frontend_client/app/embedding-sdk/
 /resources/frontend_client/tmp-*/
+/resources/frontend_client/data-app.html
 /resources/frontend_client/embed.html
 /resources/frontend_client/embed-sdk.html
 /resources/frontend_client/embed-mcp.html
@@ -150,6 +151,7 @@ mise.local.toml
 **/.clj-kondo/*
 !**/.clj-kondo/README.md
 !**/.clj-kondo/config.edn
+!**/.clj-kondo/ratchets.edn
 !**/.clj-kondo/config/
 !**/.clj-kondo/src/
 !**/.clj-kondo/test/

.typedoc/typedoc-plugin-not-exported.js

@@ -0,0 +1,27 @@
+import { Comment, Converter } from "typedoc";
+
+const TAG = "@notExported";
+
+export function load(app) {
+  app.options.getDeclaration("blockTags").defaultValue?.push?.(TAG);
+
+  app.converter.on(Converter.EVENT_RESOLVE_END, (context) => {
+    const project = context.project;
+    const intentional = new Set(app.options.getValue("intentionallyNotExported"));
+
+    for (const id in project.reflections) {
+      const ref = project.reflections[id];
+      const tags = ref.comment?.blockTags ?? [];
+      for (const tag of tags) {
+        if (tag.tag === TAG) {
+          const name = Comment.combineDisplayParts(tag.content).trim();
+          if (name) {
+            intentional.add(name);
+          }
+        }
+      }
+    }
+
+    app.options.setValue("intentionallyNotExported", [...intentional]);
+  });
+}

.typedoc/typedoc.common.config.js

@@ -10,6 +10,7 @@ const config = {
     "typedoc-plugin-dt-links",
     "typedoc-plugin-redirect",
     "./typedoc-plugin-replace-text.js",
+    "./typedoc-plugin-not-exported.js",
   ],
   entryPoints: ["../resources/embedding-sdk/dist/index.d.ts"],
   router: "structure",

CLAUDE.md

@@ -77,6 +77,36 @@ It piggybacks on a running dev nREPL (~5s) and auto-spawns a JVM if none is runn
 the four generated keys; structural changes it can't safely make (a new module needs a human `:team`, or
 modules need reordering) are printed as `WARNING:` lines for you to resolve by hand.
 
+## Kondo Ignore Ratchets
+
+`.clj-kondo/ratchets.edn` records, per linter, how many inline `:clj-kondo/ignore` forms the backend source
+tree may contain. `metabase.core.kondo-ratchet-test` fails when the budgets drift from the actual counts,
+in either direction. Prefer fixing the underlying warning over adding an ignore.
+
+Budget too high (you removed ignores): a local run of the test tightens the file for you — commit the
+change. PRs labelled `kondo-ratchets-self-healing` get the lowered budgets committed to the branch by CI.
+To tighten by hand (babashka, no JVM; a no-op prints `unchanged`):
+
+```bash
+./bin/mage fix-kondo-ratchets
+```
+
+Budget too low (you added an ignore): the task only raises a budget when told to. If the ignore is
+genuinely required, run `./bin/mage fix-kondo-ratchets --seed :the-linter` and defend the increase in the
+PR.
+
+Introducing a new linter: `./bin/mage kondo-insert-ignores :the-linter` inserts an ignore at every site it
+flags, then `./bin/mage fix-kondo-ratchets --seed :the-linter` records the budget — no big-bang cleanup.
+To burn debt down, `./bin/mage kondo-redundant-ignores` lists ignores that are no longer needed (slow:
+full kondo run). Kondo's redundancy report can't see hook-linter warnings, so `--fix` re-lints after
+removing, puts any still-working ignore back exactly as it was, and stamps it with a `[kondo-keep]`
+comment; marked sites are skipped on later runs. That verification needs a clean starting point, so
+files with pre-existing lint findings are excluded from the sweep and reported. `--fix --audit` rechecks the
+marked sites too, removing any that have become truly redundant along with their stamped marker
+comments (a marker trailing on a code line is left for a hand fix). `[kondo-keep]` can also be added
+by hand to protect an ignore whose exact form matters — it only counts on the line directly above the
+ignore, or trailing on the ignore's own line.
+
 ## Tool Preferences
 
 If `clojure-mcp` tools are available, prefer them over shell-based alternatives for Clojure development.

bb.edn

@@ -1,7 +1,8 @@
 {:min-bb-version "1.12.212"
  ;; we put path as bin, and everything is in the ./mage subdirectory,
  ;; so the namespaces are mage.cli, mage.format, etc.
- :paths ["mage/src" "mage/test" "bin/lint-migrations-file/src"]
+ ;; dev/src is here for tasks whose logic is shared with JVM tests (e.g. dev.kondo-ratchet)
+ :paths ["mage/src" "mage/test" "bin/lint-migrations-file/src" "dev/src"]
  ;; use Git version of dep temporarily until a new release > 0.16.4 is cut
  :deps {dev.weavejester/cljfmt {:git/sha "075eae26e3c8dad433b88f05927bcd50e3571328"
                                 :git/url "https://github.com/weavejester/cljfmt"} ;; run cljfmt from bb
@@ -12,7 +13,7 @@
         org.babashka/json {:mvn/version "0.1.6"} ;; json parsing
         table/table {:mvn/version "0.5.0"} ;; table printing
         }
- :pods {org.babashka/postgresql {:version "0.1.0"}}
+ ;; No :pods key on purpose: tasks lazily load only what they need.
  :tasks
  {:requires [[mage.cli :as cli]
              [mage.color :as c]]
@@ -274,6 +275,32 @@
    :requires [[mage.modules]]
    :task (task! (mage.modules/cli-fix-config (cli/parse! (current-task))))}
 
+  fix-kondo-ratchets
+  {:doc "Lower the per-linter ignore budgets in .clj-kondo/ratchets.edn to match the source tree."
+   :examples [["./bin/mage fix-kondo-ratchets" "Ratchet budgets down (never raises one; over-budget linters are only warned about)"]
+              ["./bin/mage fix-kondo-ratchets --seed :some-linter" "Also set :some-linter's budget to its actual count, for landing a new linter"]]
+   :options [["-s" "--seed LINTER" "Set LINTER's budget to the actual count (may add or raise it)"]]
+   :requires [[dev.kondo-ratchet]]
+   :task (task! (dev.kondo-ratchet/fix! (:options parsed)))}
+
+  kondo-redundant-ignores
+  {:doc "Report inline kondo ignores that are no longer necessary (slow: full kondo run)."
+   :examples [["./bin/mage kondo-redundant-ignores" "Scan the backend tree for removable ignores"]
+              ["./bin/mage kondo-redundant-ignores --fix" "Also remove them from source (restores + marks [kondo-keep] any that re-trigger)"]
+              ["./bin/mage kondo-redundant-ignores --fix --audit" "Recheck [kondo-keep] sites too, unmarking any now truly redundant"]]
+   :options [["-f" "--fix" "Remove the candidate ignores from source"]
+             ["-a" "--audit" "Include sites marked [kondo-keep] instead of skipping them"]]
+   :requires [[mage.kondo-ratchet]]
+   :task (task! (mage.kondo-ratchet/redundant-ignores parsed))}
+
+  kondo-insert-ignores
+  {:doc "Insert inline ignores at every site a linter flags -- for landing a new linter without a big-bang fix."
+   :examples [["./bin/mage kondo-insert-ignores :metabase/new-linter" "Insert ignores everywhere the linter fires, then seed its budget"]
+              ["./bin/mage kondo-insert-ignores :equals-true test/metabase/pulse" "Only under the given paths"]]
+   :arg-schema [:sequential [:string {:name "linter-then-paths"}]]
+   :requires [[mage.kondo-ratchet]]
+   :task (task! (mage.kondo-ratchet/insert-ignores (:arguments parsed)))}
+
   ls
   {:doc "List all mage public and private tasks"
    :examples [["./bin/mage ls" "List all tasks"]]

bin/build/src/metabuild_common/files.clj

@@ -169,7 +169,6 @@
        (doseq [^File file (file-seq source-path)
                :when (not (directory? file))
                :when
-               #_{:clj-kondo/ignore [:discouraged-var]}
                (or (str/ends-with? (str/lower-case file) "yaml")
                    (str/ends-with? (str/lower-case file) "yml"))]
          (when verbose (out/safe-println "Zipping file:" file))

bin/build/test/i18n/create_artifacts/backend_test.clj

@@ -27,7 +27,6 @@
 
 (deftest ^:parallel backend-message?
   (testing "messages present in any .clj and .cljc files are detected as backend messages"
-    #_{:clj-kondo/ignore [:equals-true]}
     (are [source-references expected] (= expected
                                          (i18n/backend-message? {:source-references source-references}))
       ;; Simple .clj and .cljc files with and without line numbers

bin/check-migration-versions

@@ -3,6 +3,7 @@ set -euo pipefail
 
 # Requires: BASE_REF, CURRENT_VERSION (for master)
 # Optional: PR_LABELS (comma-separated, for backport handling)
+#           OLDEST_SUPPORTED_VERSION (required when PR_LABELS contains `backport`)
 
 if [[ -z "${BASE_REF:-}" ]]; then
     echo "ERROR: BASE_REF is not set." >&2
@@ -39,30 +40,53 @@ elif [[ "$BASE_REF" == "master" ]]; then
     fi
     echo "CURRENT_VERSION: ${CURRENT_VERSION}"
 
-    matches=0
-    for l in backport single-backport double-backport triple-backport; do
-        if [[ ",$labels," == *",$l,"* ]]; then
-            # N.B. not ((matches++)) — that exits 1 when matches=0 under set -e
-            matches=$((matches + 1))
+    # Backport labels shift the target version back so migrations land on the earliest release
+    # branch the backport will reach. `backport` targets every supported release line (see
+    # .github/workflows/auto-backport.yml), so its floor is the oldest supported major from
+    # version-info.json, passed in as OLDEST_SUPPORTED_VERSION. The legacy depth labels keep
+    # their fixed offsets from CURRENT_VERSION.
+    candidates=()
+    if [[ ",$labels," == *",backport,"* ]]; then
+        if [[ -z "${OLDEST_SUPPORTED_VERSION:-}" ]]; then
+            echo "ERROR: PR has the 'backport' label but OLDEST_SUPPORTED_VERSION is not set." >&2
+            exit 1
         fi
-    done
+        if ! [[ "$OLDEST_SUPPORTED_VERSION" =~ ^[1-9][0-9]*$ ]]; then
+            echo "ERROR: OLDEST_SUPPORTED_VERSION must be a positive integer, got: '${OLDEST_SUPPORTED_VERSION}'" >&2
+            exit 1
+        fi
+        echo "OLDEST_SUPPORTED_VERSION: ${OLDEST_SUPPORTED_VERSION}"
+        candidates+=("$OLDEST_SUPPORTED_VERSION")
+    fi
+    [[ ",$labels," == *",single-backport,"* ]] && candidates+=("$CURRENT_VERSION")
+    [[ ",$labels," == *",double-backport,"* ]] && candidates+=($((CURRENT_VERSION - 1)))
+    [[ ",$labels," == *",triple-backport,"* ]] && candidates+=($((CURRENT_VERSION - 2)))
 
     constraint="="
     version=$((CURRENT_VERSION + 1))
-    # Backport labels shift the target version back so migrations land on the correct release branch.
-    [[ ",$labels," == *",backport,"* ]]        && version=$((CURRENT_VERSION))
-    [[ ",$labels," == *",single-backport,"* ]] && version=$((CURRENT_VERSION))
-    [[ ",$labels," == *",double-backport,"* ]] && version=$((CURRENT_VERSION - 1))
-    [[ ",$labels," == *",triple-backport,"* ]] && version=$((CURRENT_VERSION - 2))
+    # ${arr[@]+...} guards the empty-array case, which trips `set -u` on bash < 4.4
+    for candidate in ${candidates[@]+"${candidates[@]}"}; do
+        [[ "$candidate" -lt "$version" ]] && version=$candidate
+    done
 
-    [[ $matches -gt 1 ]] && echo "NOTE: Multiple backport labels detected; using the earliest version (v${version})." >&2
+    [[ ${#candidates[@]} -gt 1 ]] && echo "NOTE: Multiple backport labels detected; using the earliest version (v${version})." >&2
 else
     echo "Target branch '${BASE_REF}' is not master or a release branch — skipping."
     exit 0
 fi
 
+# Per-feature migration directories (resources/migrations/NNN/) start at v60. Older versions keep a
+# single shared file (resources/migrations/0NN_update_migrations.yaml), and pre-60 release branches
+# only load those shared files (endsWithFilter: "_update_migrations.yaml"), so a per-feature file
+# targeting a pre-60 version would be silently ignored there.
+DIR_LAYOUT_FLOOR=60
+
 expected_dir=$(printf "%03d" "$version")
-echo "Expected directory: ${constraint} ${expected_dir}"
+if [[ "$version" -lt "$DIR_LAYOUT_FLOOR" ]]; then
+    echo "Expected location: resources/migrations/${expected_dir}_update_migrations.yaml (per-feature directories start at v${DIR_LAYOUT_FLOOR})"
+else
+    echo "Expected directory: ${constraint} ${expected_dir}"
+fi
 echo ""
 
 # Check that new migration files are in the correct directory
@@ -84,9 +108,16 @@ while IFS= read -r file; do
     dir_version=$((10#$dir))
     dir=$(printf "%03d" "$dir_version")
 
-    if [[ "$constraint" == "=" && "$dir_version" -ne "$version" ]] ||
+    if [[ "$dir_version" -lt "$DIR_LAYOUT_FLOOR" ]]; then
+        echo "ERROR: ${file} targets v${dir_version}, but per-feature directories start at v${DIR_LAYOUT_FLOOR} — a pre-${DIR_LAYOUT_FLOOR} changeset goes in resources/migrations/${dir}_update_migrations.yaml" >&2
+        errors=$((errors + 1))
+    elif [[ "$constraint" == "=" && "$dir_version" -ne "$version" ]] ||
         [[ "$constraint" == "<=" && "$dir_version" -gt "$version" ]]; then
-        echo "ERROR: ${file} is in ${dir} but expected ${constraint} ${expected_dir}" >&2
+        if [[ "$version" -lt "$DIR_LAYOUT_FLOOR" ]]; then
+            echo "ERROR: ${file} is in ${dir} but the changeset belongs in resources/migrations/${expected_dir}_update_migrations.yaml" >&2
+        else
+            echo "ERROR: ${file} is in ${dir} but expected ${constraint} ${expected_dir}" >&2
+        fi
         errors=$((errors + 1))
     fi
 done <<<"$changed_files"
@@ -98,19 +129,24 @@ if [[ "$errors" -gt 0 ]]; then
     echo "Why: Migration files must be in the directory matching the target release version." >&2
     echo "A misplaced migration misrepresents when it was introduced and will break downgrades spanning more than one version." >&2
     echo "" >&2
-    if [[ "$constraint" == "<=" ]]; then
-        echo "To fix: move the file(s) to resources/migrations/${expected_dir}/ or any earlier version directory." >&2
+    if [[ "$version" -lt "$DIR_LAYOUT_FLOOR" ]]; then
+        echo "To fix: append the changeset(s) to resources/migrations/${expected_dir}_update_migrations.yaml." >&2
+        echo "Pre-${DIR_LAYOUT_FLOOR} releases only load the shared per-version files, not NNN/ directories." >&2
+    elif [[ "$constraint" == "<=" ]]; then
+        echo "To fix: move the file(s) to resources/migrations/${expected_dir}/ or any earlier version directory (>= 0${DIR_LAYOUT_FLOOR})." >&2
     else
         echo "To fix: move the file(s) to resources/migrations/${expected_dir}/." >&2
     fi
     echo "" >&2
     echo "If this PR will be backported, ensure the correct backport label is applied" >&2
-    echo "(backport, single-backport, double-backport, or triple-backport) and re-run CI, even if you" >&2
-    echo "plan to create the backport PRs manually. Base the label on the oldest" >&2
-    echo "release you're targeting, and simply close any unwanted PRs." >&2
+    echo "and re-run CI, even if you plan to create the backport PRs manually:" >&2
+    echo "  - backport: all supported release lines (the check targets the oldest one)" >&2
+    echo "  - single-backport: the current release only" >&2
+    echo "  - double-backport / triple-backport: 1 or 2 releases before the current one" >&2
+    echo "Base the label on the oldest release you're targeting, and simply close any unwanted PRs." >&2
     echo "" >&2
-    echo "If you are backporting more than 3 releases back, or this is an exceptional" >&2
-    echo "circumstance, you will need to either update this script or force merge." >&2
+    echo "If none of the labels matches the releases you're targeting, or this is an" >&2
+    echo "exceptional circumstance, you will need to either update this script or force merge." >&2
     exit 1
 fi
 

bin/embedding-sdk/fixup-types-after-compilation.js

@@ -1,12 +1,15 @@
 #!/usr/bin/env node
 /* eslint-env node */
-/* eslint-disable import/no-commonjs, import/order, no-console */
+/* eslint-disable import/order */
 const fs = require("fs");
 const path = require("path");
+const { spawn } = require("child_process");
 const glob = require("glob");
-const { Extractor, ExtractorConfig } = require("@microsoft/api-extractor");
 
 const SDK_DIST_DIR_PATH = path.resolve("./resources/embedding-sdk/dist");
+const API_EXTRACTOR_BIN_PATH = path.resolve(
+  "./node_modules/@microsoft/api-extractor/bin/api-extractor",
+);
 
 /*
  * This script replaces all custom aliases in Embedding SDK generated ".d.ts" files so that this imports could be resolved
@@ -26,10 +29,52 @@ const REPLACES_MAP = {
   cljs: "target/cljs_release",
 };
 
-const API_EXTRACTOR_CONFIG_PATH = path.join(
-  __dirname,
-  "../../enterprise/frontend/src/embedding-sdk-package/embedding-sdk-api-extractor.json",
-);
+const DTS_ROLLUPS = [
+  {
+    name: "main",
+    configPath: path.join(
+      __dirname,
+      "../../enterprise/frontend/src/embedding-sdk-package/embedding-sdk-api-extractor.json",
+    ),
+    entryPointPath: path.join(
+      __dirname,
+      "../../resources/embedding-sdk/dist/enterprise/frontend/src/embedding-sdk-package/index.d.ts",
+    ),
+  },
+  {
+    name: "data-app",
+    configPath: path.join(
+      __dirname,
+      "../../enterprise/frontend/src/embedding-sdk-package/embedding-sdk-data-app-api-extractor.json",
+    ),
+    entryPointPath: path.join(
+      __dirname,
+      "../../resources/embedding-sdk/dist/enterprise/frontend/src/embedding-sdk-package/data-app.d.ts",
+    ),
+  },
+  {
+    name: "data-app-dev",
+    configPath: path.join(
+      __dirname,
+      "../../enterprise/frontend/src/embedding-sdk-package/embedding-sdk-data-app-dev-api-extractor.json",
+    ),
+    entryPointPath: path.join(
+      __dirname,
+      "../../resources/embedding-sdk/dist/enterprise/frontend/src/embedding-sdk-package/data-app-dev.d.ts",
+    ),
+  },
+  {
+    name: "data-app-dev-config",
+    configPath: path.join(
+      __dirname,
+      "../../enterprise/frontend/src/embedding-sdk-package/embedding-sdk-data-app-dev-config-api-extractor.json",
+    ),
+    entryPointPath: path.join(
+      __dirname,
+      "../../resources/embedding-sdk/dist/enterprise/frontend/src/embedding-sdk-package/data-app-dev.config.d.ts",
+    ),
+  },
+];
 
 const getLogger = (prefix) => {
   const verbose = process.env.SDK_FIXUP_VERBOSE_LOGS === "true";
@@ -110,7 +155,7 @@ const removeUnresolvedReexports = (filePath) => {
   }
 };
 
-const fixupTypesAfterCompilation = ({ isWatchMode }) => {
+const fixupTypesAfterCompilation = async ({ isWatchMode }) => {
   log("Fixing SDK d.ts files...");
 
   const dtsFilePaths = glob.sync(`${SDK_DIST_DIR_PATH}/**/*.d.ts`);
@@ -123,45 +168,97 @@ const fixupTypesAfterCompilation = ({ isWatchMode }) => {
   console.log("[dts fixup] Done!");
 
   if (!isWatchMode) {
-    generateDtsRollup();
+    await generateDtsRollup();
   }
 };
 
-const generateDtsRollup = () => {
+const generateDtsRollup = async () => {
   // Dts rollup logger
   const { log, error } = getLogger("dts rollup");
 
   log("Generate dts rollup...");
 
-  const dtsRollupEntryPointPath = path.resolve(
-    path.join(
-      __dirname,
-      "../../resources/embedding-sdk/dist/enterprise/frontend/src/embedding-sdk-package/index.d.ts",
-    ),
-  );
-  const dtsRollupEntryPointPathExist = fs.existsSync(dtsRollupEntryPointPath);
+  const existingEntryPointCount = DTS_ROLLUPS.filter(({ entryPointPath }) =>
+    fs.existsSync(path.resolve(entryPointPath)),
+  ).length;
 
-  if (!dtsRollupEntryPointPathExist) {
+  if (existingEntryPointCount === 0) {
     log("It looks like dts rollup is already generated, skipping...");
 
     return;
   }
 
-  const apiExtractorConfig = ExtractorConfig.loadFileAndPrepare(
-    API_EXTRACTOR_CONFIG_PATH,
+  if (existingEntryPointCount !== DTS_ROLLUPS.length) {
+    DTS_ROLLUPS.forEach(({ entryPointPath, name }) => {
+      const resolvedEntryPointPath = path.resolve(entryPointPath);
+      if (!fs.existsSync(resolvedEntryPointPath)) {
+        error(
+          `Dts rollup entry point for ${name} does not exist: ${resolvedEntryPointPath}`,
+        );
+      }
+    });
+    process.exitCode = 1;
+    return;
+  }
+
+  let hasExtractorFailure = false;
+
+  // The extractors are independent (each reads the shared compiled d.ts tree
+  // and writes its own rollup), so run them concurrently. Output is buffered
+  // per extractor and printed on completion so parallel runs don't interleave.
+  const runApiExtractor = ({ configPath, name }) =>
+    new Promise((resolve) => {
+      const child = spawn(
+        process.execPath,
+        [
+          API_EXTRACTOR_BIN_PATH,
+          "run",
+          "--local",
+          "--verbose",
+          "--config",
+          path.resolve(configPath),
+        ],
+        { stdio: ["ignore", "pipe", "pipe"] },
+      );
+
+      let output = "";
+      child.stdout.on("data", (chunk) => (output += chunk));
+      child.stderr.on("data", (chunk) => (output += chunk));
+      child.on("close", (status, signal) =>
+        resolve({ name, status, signal, output }),
+      );
+    });
+
+  const results = await Promise.all(
+    DTS_ROLLUPS.filter(({ entryPointPath, name }) => {
+      if (fs.existsSync(path.resolve(entryPointPath))) {
+        return true;
+      }
+
+      error(
+        `Dts rollup entry point for ${name} does not exist: ${path.resolve(entryPointPath)}`,
+      );
+      hasExtractorFailure = true;
+      return false;
+    }).map(runApiExtractor),
   );
 
-  const extractorResult = Extractor.invoke(apiExtractorConfig, {
-    localBuild: true,
-    showVerboseMessages: true,
-  });
+  for (const { name, status, signal, output } of results) {
+    log(`--- api-extractor: ${name} ---`);
+    process.stdout.write(output);
 
-  if (!extractorResult.succeeded) {
-    error(
-      `API Extractor completed with ${extractorResult.errorCount} errors` +
-        ` and ${extractorResult.warningCount} warnings`,
-    );
+    if (status !== 0 || signal) {
+      error(
+        `API Extractor failed for ${name}` +
+          (signal ? ` with signal ${signal}` : ""),
+      );
+      hasExtractorFailure = true;
+    }
+  }
+
+  if (hasExtractorFailure) {
     process.exitCode = 1;
+    return;
   }
 
   log("API Extractor completed successfully");
@@ -220,7 +317,7 @@ const isWatchMode = process.argv.includes("--watch");
 const run = async () => {
   // when running on a clean state and with --watch, the folder might not exist yet
   await waitForFolder(SDK_DIST_DIR_PATH);
-  fixupTypesAfterCompilation({ isWatchMode });
+  await fixupTypesAfterCompilation({ isWatchMode });
 
   if (isWatchMode) {
     console.log("\n\n\n");

bin/embedding-sdk/generate-sdk-package-files.js

@@ -42,10 +42,16 @@ function generateSdkPackage() {
   );
   const sdkPackageTemplateJsonContent = JSON.parse(sdkPackageTemplateJson);
 
+  // `sdkRelease` is release-process metadata (distTag/tagAsLatest) read by
+  // .github/workflows/release-embedding-sdk.yml — it must never ship inside
+  // the published npm package.json.
+  const { sdkRelease: _sdkRelease, ...publishableTemplateJsonContent } =
+    sdkPackageTemplateJsonContent;
+
   const todayDate = new Date().toJSON().slice(0, 10).replaceAll("-", "");
 
   const mergedContent = {
-    ...sdkPackageTemplateJsonContent,
+    ...publishableTemplateJsonContent,
     version: maybeCommitHash
       ? `${sdkPackageTemplateJsonContent.version}-${todayDate}-${maybeCommitHash}`
       : sdkPackageTemplateJsonContent.version,

bin/embedding-sdk/release_utils.bash

@@ -1,11 +0,0 @@
-#!/bin/bash
-function update_readme() {
-  sed -i -E 's|(embedding-sdk-)[0-9.]+|\1'"$1"'|' enterprise/frontend/src/embedding-sdk-package/README.md
-  sed -i -E 's|(http://downloads.metabase.com/sdk/v)[0-9.]+|\1'"$1"'|' enterprise/frontend/src/embedding-sdk-package/README.md
-}
-
-function update_package_json_template() {
-  sed -i -E 's/("version": ").*"/\1'"$1"'"/' enterprise/frontend/src/embedding-sdk-package/package.template.json
-}
-
-$1 $2

bin/lint-migrations-file/src/lint_migrations_file.cljc

@@ -207,16 +207,42 @@
                         (str/join ", " bad-ids))
                 {:invalid-ids (vec bad-ids)}))))))
 
-(defn require-primary-key-exists-has-table-name
-  "Ensures that all primaryKeyExists preconditions specify a tableName."
+(def ^:private table-scoped-preconditions
+  "Existence preconditions mapped to the key that scopes them to a single table. Without that key,
+  Liquibase answers the check by snapshotting the whole schema — ~2 seconds per precondition on a
+  large postgres appdb, which is how 27 name-only preconditions once added ~50s to every full
+  migration."
+  {:primaryKeyExists           :tableName
+   :indexExists                :tableName
+   :uniqueConstraintExists     :tableName
+   :foreignKeyConstraintExists :foreignKeyTableName})
+
+(defn- unscoped-preconditions
+  "Walk a preConditions tree (maps nested under and/or/not, in either flat-map or list form) and
+  return [precondition-key required-key] pairs for every table-scoped existence check that is
+  missing its table key."
+  [form]
+  (cond
+    (map? form)        (concat
+                        (for [[precondition required] table-scoped-preconditions
+                              :let [check (get form precondition)]
+                              :when (and (map? check) (not (contains? check required)))]
+                          [precondition required])
+                        (mapcat unscoped-preconditions (vals form)))
+    (sequential? form) (mapcat unscoped-preconditions form)
+    :else              nil))
+
+(defn require-table-scoped-existence-preconditions
+  "Ensures that primaryKeyExists/indexExists/uniqueConstraintExists preconditions specify a
+  tableName, and foreignKeyConstraintExists a foreignKeyTableName."
   [change-log]
   (doseq [{:keys [changeSet]} change-log
           :when changeSet
-          :let [s (pr-str (:preConditions changeSet))]
-          :when (and (str/includes? s ":primaryKeyExists")
-                     (not (str/includes? s ":tableName")))]
+          :let [[precondition required] (first (unscoped-preconditions (:preConditions changeSet)))]
+          :when precondition]
     (throw (validation-error
-            (format "Migration '%s' has primaryKeyExists precondition without tableName" (:id changeSet))
+            (format "Migration '%s' has %s precondition without %s: without it Liquibase snapshots the entire schema to answer the check (~2s per precondition on a large postgres appdb)"
+                    (:id changeSet) (name precondition) (name required))
             {:id (:id changeSet)}))))
 
 (s/def ::changeSet
@@ -292,7 +318,7 @@
   (require-no-bare-blob-or-text-types change-log)
   (require-no-bare-boolean-types change-log file)
   (require-no-datetime-type change-log file)
-  (require-primary-key-exists-has-table-name change-log)
+  (require-table-scoped-existence-preconditions change-log)
   (let [{:keys [changeSet]
          :as all} (group-by only-key change-log)]
     (when-not (set/subset? (set (keys all)) #{:property :objectQuotingStrategy :changeSet :logicalFilePath})
@@ -368,17 +394,14 @@
           (println)
           #_:clj-kondo/ignore
           (printf "Error in %s:\t%s\n" (:file (ex-data e)) (.getMessage e))
-          #_:clj-kondo/ignore
           (printf "Details:\n\n %s" (with-out-str (pprint/pprint (dissoc (ex-data e) ::validation-error))))
           (println))
         (do
           (pprint/pprint (Throwable->map e))
           (println (.getMessage e))))
-      #_:clj-kondo/ignore
       (System/exit 1))
     (catch #_:clj-kondo/ignore
      Throwable e
            (pprint/pprint (Throwable->map e))
            (println (.getMessage e))
-           #_:clj-kondo/ignore
            (System/exit 1))))

bin/lint-migrations-file/test/lint_migrations_file_test.clj

@@ -398,3 +398,40 @@
                                                                                   :remarks "none"
                                                                                   :type "timestamp with time zone"}}]}}]
                                      :rollback nil))))))
+
+(deftest ^:parallel require-table-scoped-existence-preconditions-test
+  (testing "foreignKeyConstraintExists without foreignKeyTableName is rejected"
+    (is-thrown-with-error-info?
+     "Migration 'v49.2024-01-01T10:30:00' has foreignKeyConstraintExists precondition without foreignKeyTableName: without it Liquibase snapshots the entire schema to answer the check (~2s per precondition on a large postgres appdb)"
+     {:id "v49.2024-01-01T10:30:00"}
+     (validate
+      (mock-change-set
+       :preConditions [{:onFail "MARK_RAN"}
+                       {:not [{:foreignKeyConstraintExists {:foreignKeyName "fk_my_table_other_id"}}]}]))))
+  (testing "foreignKeyConstraintExists with foreignKeyTableName passes"
+    (is (= :ok
+           (validate
+            (mock-change-set
+             :preConditions [{:onFail "MARK_RAN"}
+                             {:not [{:foreignKeyConstraintExists {:foreignKeyName      "fk_my_table_other_id"
+                                                                  :foreignKeyTableName "my_table"}}]}])))))
+  (testing "indexExists without tableName is rejected, including in flat-map not form"
+    (is-thrown-with-error-info?
+     "Migration 'v49.2024-01-01T10:30:00' has indexExists precondition without tableName: without it Liquibase snapshots the entire schema to answer the check (~2s per precondition on a large postgres appdb)"
+     {:id "v49.2024-01-01T10:30:00"}
+     (validate
+      (mock-change-set
+       :preConditions [{:not {:indexExists {:indexName "idx_my_table_other_id"}}}]))))
+  (testing "indexExists with tableName passes"
+    (is (= :ok
+           (validate
+            (mock-change-set
+             :preConditions [{:not {:indexExists {:indexName "idx_my_table_other_id"
+                                                  :tableName "my_table"}}}])))))
+  (testing "primaryKeyExists without tableName is still rejected (previous rule subsumed)"
+    (is-thrown-with-error-info?
+     "Migration 'v49.2024-01-01T10:30:00' has primaryKeyExists precondition without tableName: without it Liquibase snapshots the entire schema to answer the check (~2s per precondition on a large postgres appdb)"
+     {:id "v49.2024-01-01T10:30:00"}
+     (validate
+      (mock-change-set
+       :preConditions [{:primaryKeyExists {:primaryKeyName "pk_my_table"}}])))))

bun.lock

@@ -67,7 +67,6 @@
         "@tiptap/starter-kit": "^3.2.0",
         "@tiptap/suggestion": "^3.2.0",
         "@types/js-yaml": "^4.0.9",
-        "@types/react-router": "3.0.27",
         "@uiw/react-codemirror": "^4.23.6",
         "@visx/axis": "^3.10.1",
         "@visx/clip-path": "^3.3.0",
@@ -102,7 +101,6 @@
         "formik": "^2.4.5",
         "frimousse": "^0.3.0",
         "fuse.js": "^7.1.0",
-        "history": "3",
         "html2canvas-pro": "^2.0.2",
         "icepick": "2.4.0",
         "iframe-resizer": "~4.3.2",
@@ -118,6 +116,7 @@
         "leaflet-draw": "^0.4.9",
         "lodash.debounce": "^4.0.8",
         "lodash.orderby": "^4.6.0",
+        "marked": "18.0.6",
         "merge-refs": "^1.3.0",
         "mustache": "^2.3.2",
         "normalizr": "^3.0.2",
@@ -145,7 +144,6 @@
         "react-qr-code": "^2.0.15",
         "react-redux": "^9.1.2",
         "react-resizable": "^3.1.3",
-        "react-router": "3",
         "react-transition-group": "^4.4.5",
         "react-use": "^17.5.1",
         "react-virtualized": "9.22.6",
@@ -153,6 +151,7 @@
         "redux-undo": "^1.1.0",
         "rehype-external-links": "^3.0.0",
         "remark-gfm": "^4.0.0",
+        "remend": "1.3.0",
         "reselect": "^5.1.0",
         "resize-observer-polyfill": "^1.5.1",
         "server-text-width": "^1.0.2",
@@ -277,6 +276,7 @@
         "@types/tether": "^1.4.6",
         "@types/underscore": "^1.13.0",
         "@types/use-sync-external-store": "^1.5.0",
+        "@vitejs/plugin-react": "^6.0.2",
         "ajv": "^8.5.0",
         "babel-loader": "^9.1.2",
         "babel-plugin-ttag": "^1.8.16",
@@ -378,7 +378,7 @@
         "raf": "^3.4.0",
         "react-docgen-typescript-plugin": "^1.0.6",
         "react-refresh": "^0.14.2",
-        "react-router-v7": "npm:react-router@7.18.1",
+        "react-router": "7.18.1",
         "reg-cli": "^0.17.7",
         "semver": "^7.6.3",
         "shadow-cljs": "^3.3.5",
@@ -402,6 +402,9 @@
         "typedoc-plugin-redirect": "^1.2.0",
         "typescript-eslint": "8.60.0",
         "typescript-plugin-css-modules": "^5.1.0",
+        "vite": "^8.0.16",
+        "vite-plugin-css-injected-by-js": "^3.5.2",
+        "vite-plugin-svgr": "^5.2.0",
         "web-streams-polyfill": "^4.1.0",
         "webpack": "5.105.0",
         "webpack-bundle-analyzer": "^4.10.1",
@@ -1275,6 +1278,8 @@
 
     "@opentelemetry/semantic-conventions": ["@opentelemetry/semantic-conventions@1.34.0", "", {}, "sha512-aKcOkyrorBGlajjRdVoJWHTxfxO1vCNHLJVlSDaRHDIdjU+pX8IYQPvPDkYiujKLbRnWU+1TBwEt0QRgSm4SGA=="],
 
+    "@oxc-project/types": ["@oxc-project/types@0.139.0", "", {}, "sha512-r9gHphtCs+1M7J0pw6Sn/hh/Wpa/iQrOOkrNAlVLF/gHq+/CJmHIWKKUUhdWjcD6CIa8idarspCsASiXCXvFUw=="],
+
     "@oxfmt/binding-android-arm-eabi": ["@oxfmt/binding-android-arm-eabi@0.38.0", "", { "os": "android", "cpu": "arm" }, "sha512-lTN4//sgYywK8ulQo7a/EZVzOTGomGQv2IG/7tMYdqTV3xN3QTqWpXcZBGUzaicC4B882N+5zJLYZ37IWfUMcg=="],
 
     "@oxfmt/binding-android-arm64": ["@oxfmt/binding-android-arm64@0.38.0", "", { "os": "android", "cpu": "arm64" }, "sha512-XbVgqR1WsIcCkfxwh2tdg3M1MWgR23YOboW2nbB8ab0gInNNLGy7cIAdr78XaoG/bGdaF4488XRhuGWq67xrzA=="],
@@ -1439,6 +1444,40 @@
 
     "@remirror/core-constants": ["@remirror/core-constants@3.0.0", "", {}, "sha512-42aWfPrimMfDKDi4YegyS7x+/0tlzaqwPQCULLanv3DMIlu96KTJR0fM5isWX2UViOqlGnX6YFgqWepcX+XMNg=="],
 
+    "@rolldown/binding-android-arm64": ["@rolldown/binding-android-arm64@1.1.5", "", { "os": "android", "cpu": "arm64" }, "sha512-lZg8fqIv2v7FF237bwMgzGZEJvGL79/s5knJ/i6FmsGF4XXlzccZ4jb+TrFIxtSSxFtIpdsgrPZeMk1I9AFcyQ=="],
+
+    "@rolldown/binding-darwin-arm64": ["@rolldown/binding-darwin-arm64@1.1.5", "", { "os": "darwin", "cpu": "arm64" }, "sha512-51Bnx9pNiMRKSUNtBfySkNJ9vMU9Hh3I1ozDd6gyPPYzaXCfnptUcEZxXGYFn+ul2dtcMUiqGR1Yai2K10uoTw=="],
+
+    "@rolldown/binding-darwin-x64": ["@rolldown/binding-darwin-x64@1.1.5", "", { "os": "darwin", "cpu": "x64" }, "sha512-Tm+gbfC0aHu1tBA/JvKQh32S0K6YgCHkiAF4/W6xX0K0RmNuc94VeK419dJoE65R5aRxmo+noZQSWrAMF6yb6g=="],
+
+    "@rolldown/binding-freebsd-x64": ["@rolldown/binding-freebsd-x64@1.1.5", "", { "os": "freebsd", "cpu": "x64" }, "sha512-JMzDKCCXq93YccG5gz3hvOs1oXRKAf0XYpfOS88e+wZrC8Iugj6j68867vrYZkvpDDpKn/KoKORThmchMpF6TA=="],
+
+    "@rolldown/binding-linux-arm-gnueabihf": ["@rolldown/binding-linux-arm-gnueabihf@1.1.5", "", { "os": "linux", "cpu": "arm" }, "sha512-uML21j2K5TfPGutKxub+M+nLjZIrWjXQ5Grx4lCe/nimTj9B4L63zHpjXLl4y0L3mcm2htEQIb06oCG/szerNw=="],
+
+    "@rolldown/binding-linux-arm64-gnu": ["@rolldown/binding-linux-arm64-gnu@1.1.5", "", { "os": "linux", "cpu": "arm64" }, "sha512-navSiuTMogvnQoZoM/v+l3ZWo50/NTwSHSzheABx/RCnmUPaKwq9qSo4Br2OYRs21+Fz8uFqITZM3H4opOB0/Q=="],
+
+    "@rolldown/binding-linux-arm64-musl": ["@rolldown/binding-linux-arm64-musl@1.1.5", "", { "os": "linux", "cpu": "arm64" }, "sha512-lAryqH7IteztmCXQXk0etKj4wBQ7Gx5S6LjKhsgp9zb8I5bsuvU/2llH1hDQcjsFeqIsovMVN339/8pUDDBXxA=="],
+
+    "@rolldown/binding-linux-ppc64-gnu": ["@rolldown/binding-linux-ppc64-gnu@1.1.5", "", { "os": "linux", "cpu": "ppc64" }, "sha512-fsK/sNBnxzBlL4O1JNrZakVQxPspqpED5dLtNsZS9oOKmtSpdNIzxH2kkol5HYTWJN47sE20ztMJPxfZ89qGOg=="],
+
+    "@rolldown/binding-linux-s390x-gnu": ["@rolldown/binding-linux-s390x-gnu@1.1.5", "", { "os": "linux", "cpu": "s390x" }, "sha512-gLYb4BIadlfTOYT5gO503n8zQjXflgzpD0FcyKh0Mzx3rqCZKnHoJWV9xe1KXUJ5lx2JfcSHr/mhzS0PC/McAA=="],
+
+    "@rolldown/binding-linux-x64-gnu": ["@rolldown/binding-linux-x64-gnu@1.1.5", "", { "os": "linux", "cpu": "x64" }, "sha512-FjcpEKUyJygHgs1o50VYNvkt5+7Le/VEdYt0AkRpkL33MnyQfwr8l5mXwMmfmTbyMPr5vJLC+8/Gd9gXnwU1QQ=="],
+
+    "@rolldown/binding-linux-x64-musl": ["@rolldown/binding-linux-x64-musl@1.1.5", "", { "os": "linux", "cpu": "x64" }, "sha512-Me+PfPI2TMeOQk0gYWfLQZtTktrmzbr8cDboqX83XKc7UrgAi55gF+2dUkWdxd19n55Essp2yeca+O9N5rBxHg=="],
+
+    "@rolldown/binding-openharmony-arm64": ["@rolldown/binding-openharmony-arm64@1.1.5", "", { "os": "none", "cpu": "arm64" }, "sha512-yc5WrLzXks6zCQfn9Oxr8pORKyl/pF+QjHmW/Qx3qu0oyrrNC+y2JLTU1E2rcWYAmzlnqngWXHQjy51VzW70Vw=="],
+
+    "@rolldown/binding-wasm32-wasi": ["@rolldown/binding-wasm32-wasi@1.1.5", "", { "dependencies": { "@emnapi/core": "1.11.1", "@emnapi/runtime": "1.11.1", "@napi-rs/wasm-runtime": "^1.1.6" }, "cpu": "none" }, "sha512-VbQGPX2b4r48TAMIM2cjgluIM1HYutm4pcTEJsle7iEP7sB1dFqtPLBVbdLAZCxy1txCcPxf4QFf4v8uvltPqA=="],
+
+    "@rolldown/binding-win32-arm64-msvc": ["@rolldown/binding-win32-arm64-msvc@1.1.5", "", { "os": "win32", "cpu": "arm64" }, "sha512-gHv82k63z4qpV5+Q1y/12KrK0ltWBukVDI8nZcbT7Tt/ZlOIVwppazneq0F93oDxTo3IgAMEDIoQh3E2n6mVsw=="],
+
+    "@rolldown/binding-win32-x64-msvc": ["@rolldown/binding-win32-x64-msvc@1.1.5", "", { "os": "win32", "cpu": "x64" }, "sha512-tTZuDBPw85tEN5PQi1pnEBzDy0Z49HtScLAbD5t6hyeU92A95pRWaSMw1GZZi/RwgSgUIl0xrSlXIT/9QzvYSA=="],
+
+    "@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.1", "", {}, "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw=="],
+
+    "@rollup/pluginutils": ["@rollup/pluginutils@5.4.0", "", { "dependencies": { "@types/estree": "^1.0.0", "estree-walker": "^2.0.2", "picomatch": "^4.0.2" }, "peerDependencies": { "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0" }, "optionalPeers": ["rollup"] }, "sha512-MfPp06CjRLfXQ3wY0R8vJDYBy/MvVcc9OulEfR0B8Iv9ko+GCNaRZ+EpJYFl27LhKsZK0o420sYCRHCjfCgeUg=="],
+
     "@rspack/binding": ["@rspack/binding@2.0.3", "", { "optionalDependencies": { "@rspack/binding-darwin-arm64": "2.0.3", "@rspack/binding-darwin-x64": "2.0.3", "@rspack/binding-linux-arm64-gnu": "2.0.3", "@rspack/binding-linux-arm64-musl": "2.0.3", "@rspack/binding-linux-x64-gnu": "2.0.3", "@rspack/binding-linux-x64-musl": "2.0.3", "@rspack/binding-wasm32-wasi": "2.0.3", "@rspack/binding-win32-arm64-msvc": "2.0.3", "@rspack/binding-win32-ia32-msvc": "2.0.3", "@rspack/binding-win32-x64-msvc": "2.0.3" } }, "sha512-4exVNhGhW5RFHjK87XeTKbkA/qAgI5NHJlT1jNqiJv0gcUXLqTOEU3w7f8+f9zUo4JMFvPc0c9veOi4M19YYTg=="],
 
     "@rspack/binding-darwin-arm64": ["@rspack/binding-darwin-arm64@2.0.3", "", { "os": "darwin", "cpu": "arm64" }, "sha512-4UyCjLJwU/WxR6K1/gG4u3+jUsoaRHJ5rNu9fto/UbvrItwdlVNULChAApqZFw6mcSetMddSjSICeuj5pSB6sA=="],
@@ -1969,8 +2008,6 @@
 
     "@types/react-resizable": ["@types/react-resizable@3.0.4", "", { "dependencies": { "@types/react": "*" } }, "sha512-+QguN9CDfC1lthq+4noG1fkxh8cqkV2Fv/Mu3mdknCCBiwwNLecnBdk1MmNNN7uJpT23Nx/aVkYsbt5NuWouFw=="],
 
-    "@types/react-router": ["@types/react-router@3.0.27", "", { "dependencies": { "@types/history": "^3", "@types/react": "*" } }, "sha512-Sq4bfTZ8TuHFTHXyzA3tu/BTGm/d4B8CwtOK4qOyJNoJMkY87qMOazkBizMHNpszVR1+kYOCNLjPdh/wAD7ESw=="],
-
     "@types/react-textarea-autosize": ["@types/react-textarea-autosize@4.3.6", "", { "dependencies": { "@types/react": "*" } }, "sha512-cTf8tCem0c8A7CERYbTuF+bRFaqYu7N7HLCa6ZhUhDx8XnUsTpGx5udMWljt87JpciUKuUkImKPEsy6kcKhrcQ=="],
 
     "@types/react-transition-group": ["@types/react-transition-group@4.4.5", "", { "dependencies": { "@types/react": "*" } }, "sha512-juKD/eiSM3/xZYzjuzH6ZwpP+/lejltmiS3QEzV/vmb/Q8+HfDmxu+Baga8UEMGBqV88Nbg4l2hY/K2DkyaLLA=="],
@@ -2157,6 +2194,8 @@
 
     "@visx/vendor": ["@visx/vendor@3.5.0", "", { "dependencies": { "@types/d3-array": "3.0.3", "@types/d3-color": "3.1.0", "@types/d3-delaunay": "6.0.1", "@types/d3-format": "3.0.1", "@types/d3-geo": "3.1.0", "@types/d3-interpolate": "3.0.1", "@types/d3-scale": "4.0.2", "@types/d3-time": "3.0.0", "@types/d3-time-format": "2.1.0", "d3-array": "3.2.1", "d3-color": "3.1.0", "d3-delaunay": "6.0.2", "d3-format": "3.1.0", "d3-geo": "3.1.0", "d3-interpolate": "3.0.1", "d3-scale": "4.0.2", "d3-time": "3.1.0", "d3-time-format": "4.1.0", "internmap": "2.0.3" } }, "sha512-yt3SEZRVmt36+APsCISSO9eSOtzQkBjt+QRxNRzcTWuzwMAaF3PHCCSe31++kkpgY9yFoF+Gfes1TBe5NlETiQ=="],
 
+    "@vitejs/plugin-react": ["@vitejs/plugin-react@6.0.3", "", { "dependencies": { "@rolldown/pluginutils": "^1.0.1" }, "peerDependencies": { "@rolldown/plugin-babel": "^0.1.7 || ^0.2.0", "babel-plugin-react-compiler": "^1.0.0", "vite": "^8.0.0" }, "optionalPeers": ["@rolldown/plugin-babel", "babel-plugin-react-compiler"] }, "sha512-vmFvco5/QuC2f9Oj+wTk0+9XeDFkHxSamwZKYc7MxYwKICfvUvlMhqKI0VuICPltGqh1neqBKDvO4kes1ya8vg=="],
+
     "@vitest/expect": ["@vitest/expect@2.0.5", "", { "dependencies": { "@vitest/spy": "2.0.5", "@vitest/utils": "2.0.5", "chai": "^5.1.1", "tinyrainbow": "^1.2.0" } }, "sha512-yHZtwuP7JZivj65Gxoi8upUN2OzHTi3zVfjwdpu2WrvCZPLwsJ2Ey5ILIPccoW23dd/zQBlJ4/dhi7DWNyXCpA=="],
 
     "@vitest/pretty-format": ["@vitest/pretty-format@2.1.8", "", { "dependencies": { "tinyrainbow": "^1.2.0" } }, "sha512-9HiSZ9zpqNLKlbIDRWOnAWqgcA7xu+8YxXSekhr0Ykab7PAYFkhkwoqVArPOtJhPmYeE2YHgKZlj3CP36z2AJQ=="],
@@ -2681,8 +2720,6 @@
 
     "create-hmac": ["create-hmac@1.1.7", "", { "dependencies": { "cipher-base": "^1.0.3", "create-hash": "^1.1.0", "inherits": "^2.0.1", "ripemd160": "^2.0.0", "safe-buffer": "^5.0.1", "sha.js": "^2.4.8" } }, "sha512-MJG9liiZ+ogc4TzUwuvbER1JRdgvUFSB5+VR/g5h82fGaIRWMWddtKBHi7/sVhfjQZ6SehlyhvQYrcYkaUIpLg=="],
 
-    "create-react-class": ["create-react-class@15.7.0", "", { "dependencies": { "loose-envify": "^1.3.1", "object-assign": "^4.1.1" } }, "sha512-QZv4sFWG9S5RUvkTYWbflxeZX+JG7Cz0Tn33rQBJ+WFQTqTfUTjMjiv9tnfXazjsO5r0KhPs+AqCjyrQX6h2ng=="],
-
     "crelt": ["crelt@1.0.6", "", {}, "sha512-VQ2MBenTq1fWZUH9DJNGti7kKv6EeAuYr3cLwxUWhIu1baTaXh4Ib5W2CqHVqib4/MqbYGJqiL3Zb8GJZr3l4g=="],
 
     "cron-expression-validator": ["cron-expression-validator@1.0.20", "", {}, "sha512-g0osBTdp+1ryDw2vzlG6UpDPaa4fO94ZChF2R0lEnRurbuUEL74XEVX7xZJ13m4Mq/gb3ni6UQu8+Oqt+eocsw=="],
@@ -2905,7 +2942,7 @@
 
     "destroy": ["destroy@1.2.0", "", {}, "sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg=="],
 
-    "detect-libc": ["detect-libc@1.0.3", "", { "bin": { "detect-libc": "./bin/detect-libc.js" } }, "sha512-pGjwhsmsp4kL2RTz08wcOlGN83otlqHeD/Z5T8GXZB+/YcpQ/dgo+lbU8ZsGxV0HIvqqxo9l7mqYwyYMD9bKDg=="],
+    "detect-libc": ["detect-libc@2.1.2", "", {}, "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ=="],
 
     "detect-newline": ["detect-newline@3.1.0", "", {}, "sha512-TLz+x/vEXm/Y7P7wn1EJFNLxYpUD4TgMosxY6fAVJUnJMbupHBOncxyWUG9OpTaH9EBD7uFI5LfEgmMOc54DsA=="],
 
@@ -3119,7 +3156,7 @@
 
     "estree-util-is-identifier-name": ["estree-util-is-identifier-name@3.0.0", "", {}, "sha512-hFtqIDZTIUZ9BXLb8y4pYGyk6+wekIivNVTcmvk8NoOh+VeRn5y6cEHzbURrWbfp1fIqdVipilzj+lfaadNZmg=="],
 
-    "estree-walker": ["estree-walker@0.6.1", "", {}, "sha512-SqmZANLWS0mnatqbSfRP5g8OXZC12Fgg1IwNtLsyHDzJizORW4khDfjPqJZsemPWBB2uqykUah5YpQ6epsqC/w=="],
+    "estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
 
     "esutils": ["esutils@2.0.3", "", {}, "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g=="],
 
@@ -3401,8 +3438,6 @@
 
     "headers-polyfill": ["headers-polyfill@4.0.3", "", {}, "sha512-IScLbePpkvO846sIwOtOTDjutRMWdXdJmXdMvk6gCBHxFO8d+QKOQedyZSxFTTFYRSmlgSTDtXqqq4pcenBXLQ=="],
 
-    "history": ["history@3.3.0", "", { "dependencies": { "invariant": "^2.2.1", "loose-envify": "^1.2.0", "query-string": "^4.2.2", "warning": "^3.0.0" } }, "sha1-/O3M6PEpdTcVRdc1RhAzV5ptrpw="],
-
     "hmac-drbg": ["hmac-drbg@1.0.1", "", { "dependencies": { "hash.js": "^1.0.3", "minimalistic-assert": "^1.0.0", "minimalistic-crypto-utils": "^1.0.1" } }, "sha1-0nRXAQJabHdabFRXk+1QL8DGSaE="],
 
     "hoist-non-react-statics": ["hoist-non-react-statics@3.3.2", "", { "dependencies": { "react-is": "^16.7.0" } }, "sha512-/gGivxi8JPKWNm/W0jSmzcMPpfpPLc3dY/6GxhX2hQ9iGj3aDfklV4ET7NjKpSinLpJ5vafa9iiGIEZg10SfBw=="],
@@ -3853,6 +3888,30 @@
 
     "lighthouse-logger": ["lighthouse-logger@1.4.2", "", { "dependencies": { "debug": "^2.6.9", "marky": "^1.2.2" } }, "sha512-gPWxznF6TKmUHrOQjlVo2UbaL2EJ71mb2CCeRs/2qBpi4L/g4LUVc9+3lKQ6DTUZwJswfM7ainGrLO1+fOqa2g=="],
 
+    "lightningcss": ["lightningcss@1.32.0", "", { "dependencies": { "detect-libc": "^2.0.3" }, "optionalDependencies": { "lightningcss-android-arm64": "1.32.0", "lightningcss-darwin-arm64": "1.32.0", "lightningcss-darwin-x64": "1.32.0", "lightningcss-freebsd-x64": "1.32.0", "lightningcss-linux-arm-gnueabihf": "1.32.0", "lightningcss-linux-arm64-gnu": "1.32.0", "lightningcss-linux-arm64-musl": "1.32.0", "lightningcss-linux-x64-gnu": "1.32.0", "lightningcss-linux-x64-musl": "1.32.0", "lightningcss-win32-arm64-msvc": "1.32.0", "lightningcss-win32-x64-msvc": "1.32.0" } }, "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ=="],
+
+    "lightningcss-android-arm64": ["lightningcss-android-arm64@1.32.0", "", { "os": "android", "cpu": "arm64" }, "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg=="],
+
+    "lightningcss-darwin-arm64": ["lightningcss-darwin-arm64@1.32.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ=="],
+
+    "lightningcss-darwin-x64": ["lightningcss-darwin-x64@1.32.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w=="],
+
+    "lightningcss-freebsd-x64": ["lightningcss-freebsd-x64@1.32.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig=="],
+
+    "lightningcss-linux-arm-gnueabihf": ["lightningcss-linux-arm-gnueabihf@1.32.0", "", { "os": "linux", "cpu": "arm" }, "sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw=="],
+
+    "lightningcss-linux-arm64-gnu": ["lightningcss-linux-arm64-gnu@1.32.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ=="],
+
+    "lightningcss-linux-arm64-musl": ["lightningcss-linux-arm64-musl@1.32.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg=="],
+
+    "lightningcss-linux-x64-gnu": ["lightningcss-linux-x64-gnu@1.32.0", "", { "os": "linux", "cpu": "x64" }, "sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA=="],
+
+    "lightningcss-linux-x64-musl": ["lightningcss-linux-x64-musl@1.32.0", "", { "os": "linux", "cpu": "x64" }, "sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg=="],
+
+    "lightningcss-win32-arm64-msvc": ["lightningcss-win32-arm64-msvc@1.32.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw=="],
+
+    "lightningcss-win32-x64-msvc": ["lightningcss-win32-x64-msvc@1.32.0", "", { "os": "win32", "cpu": "x64" }, "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q=="],
+
     "lilconfig": ["lilconfig@2.1.0", "", {}, "sha512-utWOt/GHzuUxnLKxB6dk81RoOeoNeHgbrXiuGk4yyF5qlRz+iIVWu56E2fqGHFrXz0QNUhLB/8nKqvRH66JKGQ=="],
 
     "lines-and-columns": ["lines-and-columns@1.1.6", "", {}, "sha1-HADHQ7QzzQpOgHWPe2SldEDZ/wA="],
@@ -3953,7 +4012,7 @@
 
     "markdown-table": ["markdown-table@3.0.4", "", {}, "sha512-wiYz4+JrLyb/DqW2hkFJxP7Vd7JuTDm77fvbM8VfEQdmSMqcImWeeRbHwZjBjIFki/VaMK2BhFi7oUUZeM5bqw=="],
 
-    "marked": ["marked@4.3.0", "", { "bin": { "marked": "bin/marked.js" } }, "sha512-PRsaiG84bK+AMvxziE/lCFss8juXjNaWzVbN5tXAm4XjeaS9NAHhop+PjQxz2A9h8Q4M/xGmzP8vqNwy6JeK0A=="],
+    "marked": ["marked@18.0.6", "", { "bin": { "marked": "bin/marked.js" } }, "sha512-MrV5puXBfuiy6wl6DLaq3BtIJQAJToAd5zt/ZKhRfGRAuFPALE7/4Y7jnxRQoEgK/pBgurGqLyAuRgZ2xOjr6w=="],
 
     "marky": ["marky@1.2.5", "", {}, "sha512-q9JtQJKjpsVxCRVgQ+WapguSbKC3SQ5HEzFGPAJMStgh3QjCawp00UKv3MTTAArTmGmmPUvllHZoNbZ3gs0I+Q=="],
 
@@ -4629,8 +4688,6 @@
 
     "qs": ["qs@6.15.2", "", { "dependencies": { "side-channel": "^1.1.0" } }, "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw=="],
 
-    "query-string": ["query-string@4.3.4", "", { "dependencies": { "object-assign": "^4.1.0", "strict-uri-encode": "^1.0.0" } }, "sha1-u7aTucqRXCMlFbIosaArYJBD2+s="],
-
     "querystring": ["querystring@0.2.0", "", {}, "sha1-sgmEkgO7Jd+CDadW50cAWHhSFiA="],
 
     "querystring-es3": ["querystring-es3@0.2.1", "", {}, "sha1-nsYfeQSYdXB9aUFFlv2Qek1xHnM="],
@@ -4713,9 +4770,7 @@
 
     "react-resizable": ["react-resizable@3.1.3", "", { "dependencies": { "prop-types": "15.x", "react-draggable": "^4.5.0" }, "peerDependencies": { "react": ">= 16.3", "react-dom": ">= 16.3" } }, "sha512-liJBNayhX7qA4tBJiBD321FDhJxgGTJ07uzH5zSORXoE8h7PyEZ8mLqmosST7ppf6C4zUsbd2gzDMmBCfFp9Lw=="],
 
-    "react-router": ["react-router@3.2.6", "", { "dependencies": { "create-react-class": "^15.5.1", "history": "^3.0.0", "hoist-non-react-statics": "^3.3.2", "invariant": "^2.2.1", "loose-envify": "^1.2.0", "prop-types": "^15.7.2", "react-is": "^16.13.0", "warning": "^3.0.0" } }, "sha512-nlxtQE8B22hb/JxdaslI1tfZacxFU8x8BJryXOnR2RxB4vc01zuHYAHAIgmBkdk1kzXaA25hZxK6KAH/+CXArw=="],
-
-    "react-router-v7": ["react-router@7.18.1", "", { "dependencies": { "cookie": "^1.0.1", "set-cookie-parser": "^2.6.0" }, "peerDependencies": { "react": ">=18", "react-dom": ">=18" }, "optionalPeers": ["react-dom"] }, "sha512-GDLgg3i3uM0aeJO3Fm+TCS+sDQ7gu12T6x0qdTEzcwqEfleci7JwugVNIF3U//0FWKnJT7ptG+20B2jfDqnZAg=="],
+    "react-router": ["react-router@7.18.1", "", { "dependencies": { "cookie": "^1.0.1", "set-cookie-parser": "^2.6.0" }, "peerDependencies": { "react": ">=18", "react-dom": ">=18" }, "optionalPeers": ["react-dom"] }, "sha512-GDLgg3i3uM0aeJO3Fm+TCS+sDQ7gu12T6x0qdTEzcwqEfleci7JwugVNIF3U//0FWKnJT7ptG+20B2jfDqnZAg=="],
 
     "react-style-singleton": ["react-style-singleton@2.2.3", "", { "dependencies": { "get-nonce": "^1.0.0", "tslib": "^2.0.0" } }, "sha512-b6jSvxvVnyptAiLjbkWLE/lOnR4lfTtDAl+eUC7RZy+QQWc6wRzIV2CE6xBuMmDxc2qIihtDCZD5NPOFl7fRBQ=="],
 
@@ -4811,6 +4866,8 @@
 
     "remedial": ["remedial@1.0.8", "", {}, "sha512-/62tYiOe6DzS5BqVsNpH/nkGlX45C/Sp6V+NtiN6JQNS1Viay7cWkazmRkrQrdFj2eshDe96SIQNIoMxqhzBOg=="],
 
+    "remend": ["remend@1.3.0", "", {}, "sha512-iIhggPkhW3hFImKtB10w0dz4EZbs28mV/dmbcYVonWEJ6UGHHpP+bFZnTh6GNWJONg5m+U56JrL+8IxZRdgWjw=="],
+
     "remove-trailing-spaces": ["remove-trailing-spaces@1.0.8", "", {}, "sha512-O3vsMYfWighyFbTd8hk8VaSj9UAGENxAtX+//ugIst2RMk5e03h6RoIS+0ylsFxY1gvmPuAY/PO4It+gPEeySA=="],
 
     "renderkid": ["renderkid@3.0.0", "", { "dependencies": { "css-select": "^4.1.3", "dom-converter": "^0.2.0", "htmlparser2": "^6.1.0", "lodash": "^4.17.21", "strip-ansi": "^6.0.1" } }, "sha512-q/7VIQA8lmM1hF+jn+sFSPWGlMkSAeNYcPLmDQx2zzuiDfaLrOmumR8iaUKlenFgh0XRPIUeSPlH3A+AW3Z5pg=="],
@@ -4869,6 +4926,8 @@
 
     "robust-predicates": ["robust-predicates@3.0.2", "", {}, "sha512-IXgzBWvWQwE6PrDI05OvmXUIruQTcoMDzRsOd5CDvHCVLcLHMTSYvOK5Cm46kWqlV3yAbuSpBZdJ5oP5OUoStg=="],
 
+    "rolldown": ["rolldown@1.1.5", "", { "dependencies": { "@oxc-project/types": "=0.139.0", "@rolldown/pluginutils": "^1.0.0" }, "optionalDependencies": { "@rolldown/binding-android-arm64": "1.1.5", "@rolldown/binding-darwin-arm64": "1.1.5", "@rolldown/binding-darwin-x64": "1.1.5", "@rolldown/binding-freebsd-x64": "1.1.5", "@rolldown/binding-linux-arm-gnueabihf": "1.1.5", "@rolldown/binding-linux-arm64-gnu": "1.1.5", "@rolldown/binding-linux-arm64-musl": "1.1.5", "@rolldown/binding-linux-ppc64-gnu": "1.1.5", "@rolldown/binding-linux-s390x-gnu": "1.1.5", "@rolldown/binding-linux-x64-gnu": "1.1.5", "@rolldown/binding-linux-x64-musl": "1.1.5", "@rolldown/binding-openharmony-arm64": "1.1.5", "@rolldown/binding-wasm32-wasi": "1.1.5", "@rolldown/binding-win32-arm64-msvc": "1.1.5", "@rolldown/binding-win32-x64-msvc": "1.1.5" }, "bin": { "rolldown": "./bin/cli.mjs" } }, "sha512-t9z29cJjXf/vxQ8dyhCSpt6H6aSwHTk8cT5I3iy6SMXuFpk5mB6PL6XfC8PCwrPTx93udwKUm9HRteAlTGBLiA=="],
+
     "rollup-plugin-inject": ["rollup-plugin-inject@3.0.2", "", { "dependencies": { "estree-walker": "^0.6.1", "magic-string": "^0.25.3", "rollup-pluginutils": "^2.8.1" } }, "sha512-ptg9PQwzs3orn4jkgXJ74bfs5vYz1NCZlSQMBUA0wKcGp5i5pA1AO3fOUEte8enhGUC+iapTCzEWw2jEFFUO/w=="],
 
     "rollup-plugin-node-polyfills": ["rollup-plugin-node-polyfills@0.2.1", "", { "dependencies": { "rollup-plugin-inject": "^3.0.0" } }, "sha512-4kCrKPTJ6sK4/gLL/U5QzVT8cxJcofO0OU74tnB19F40cmuAKSzH5/siithxlofFEjwvw1YAhPmbvGNA6jEroA=="],
@@ -5093,8 +5152,6 @@
 
     "strict-event-emitter": ["strict-event-emitter@0.5.1", "", {}, "sha512-vMgjE/GGEPEFnhFub6pa4FmJBRBVOLpIII2hvCZ8Kzb7K0hlHo7mQv6xYrBvCL2LtAIBwFUK8wvuJgTVSQ5MFQ=="],
 
-    "strict-uri-encode": ["strict-uri-encode@1.1.0", "", {}, "sha1-J5siXfHVgrH1TmWt3UNS4Y+qBxM="],
-
     "string-argv": ["string-argv@0.3.2", "", {}, "sha512-aqD2Q0144Z+/RqG52NeHEkZauTAUWJO8c6yTftGJKO3Tja5tUgIfmIl6kExvhtxSDP7fXB6DvzkfMpCd/F3G+Q=="],
 
     "string-length": ["string-length@6.0.0", "", { "dependencies": { "strip-ansi": "^7.1.0" } }, "sha512-1U361pxZHEQ+FeSjzqRpV+cu2vTzYeWeafXFLykiFlv4Vc0n3njgU8HrMbyik5uwm77naWMuVG8fhEF+Ovb1Kg=="],
@@ -5461,6 +5518,12 @@
 
     "vfile-message": ["vfile-message@4.0.2", "", { "dependencies": { "@types/unist": "^3.0.0", "unist-util-stringify-position": "^4.0.0" } }, "sha512-jRDZ1IMLttGj41KcZvlrYAaI3CfqpLpfpf+Mfig13viT6NKvRzWZ+lXz0Y5D60w6uJIBAOGq9mSHf0gktF0duw=="],
 
+    "vite": ["vite@8.1.4", "", { "dependencies": { "lightningcss": "^1.32.0", "picomatch": "^4.0.5", "postcss": "^8.5.16", "rolldown": "~1.1.4", "tinyglobby": "^0.2.17" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "@vitejs/devtools": "^0.3.0", "esbuild": "^0.27.0 || ^0.28.0", "jiti": ">=1.21.0", "less": "^4.0.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "@vitejs/devtools", "esbuild", "jiti", "less", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-bTT9PsdWO+MQMNG9ZXIP/qM9wGh37DFxTV/sPq9cFpHr3w4jkgef032PkAL9jAqhk3Nz8NQw3O8n6/xFkqO4QQ=="],
+
+    "vite-plugin-css-injected-by-js": ["vite-plugin-css-injected-by-js@3.5.2", "", { "peerDependencies": { "vite": ">2.0.0-0" } }, "sha512-2MpU/Y+SCZyWUB6ua3HbJCrgnF0KACAsmzOQt1UvRVJCGF6S8xdA3ZUhWcWdM9ivG4I5az8PnQmwwrkC2CAQrQ=="],
+
+    "vite-plugin-svgr": ["vite-plugin-svgr@5.2.0", "", { "dependencies": { "@rollup/pluginutils": "^5.3.0", "@svgr/core": "^8.1.0", "@svgr/plugin-jsx": "^8.1.0" }, "peerDependencies": { "vite": ">=3.0.0" } }, "sha512-qj2eAKF8C6PZWemVTvQA0xgQIcP1hHU6Buh7fl6BhvayWwnuxE+z417miKxeDvRWbDrupQ1oK99hfxElopJ3sQ=="],
+
     "vitest-axe": ["vitest-axe@0.1.0", "", { "dependencies": { "aria-query": "^5.0.0", "axe-core": "^4.4.2", "chalk": "^5.0.1", "dom-accessibility-api": "^0.5.14", "lodash-es": "^4.17.21", "redent": "^3.0.0" } }, "sha512-jvtXxeQPg8R/2ANTY8QicA5pvvdRP4F0FsVUAHANJ46YCDASie/cuhlSzu0DGcLmZvGBSBNsNuK3HqfaeknyvA=="],
 
     "vm-browserify": ["vm-browserify@1.1.2", "", {}, "sha512-2ham8XPWTONajOR0ohOKOHXkm3+gaBmGut3SRuu75xLd/RRaY6vqgh8NBYYk7+RW3u5AtzPQZG8F10LHkl0lAQ=="],
@@ -5473,8 +5536,6 @@
 
     "walker": ["walker@1.0.8", "", { "dependencies": { "makeerror": "1.0.12" } }, "sha512-ts/8E8l5b7kY0vlWLewOkDXMmPdLcVV4GmOQLyxuSswIJsweeFZtAsMF7k1Nszz+TYBQrlYRmzOnr398y1JemQ=="],
 
-    "warning": ["warning@3.0.0", "", { "dependencies": { "loose-envify": "^1.0.0" } }, "sha1-MuU3fLVy3kqwR1O9+IIcAe1gW3w="],
-
     "watchpack": ["watchpack@2.5.1", "", { "dependencies": { "glob-to-regexp": "^0.4.1", "graceful-fs": "^4.1.2" } }, "sha512-Zn5uXdcFNIA1+1Ei5McRd+iRzfhENPCe7LeABkJtNulSxjma+l7ltNx55BWZkRlwRnpOgHqxnjyaDgJnNXnqzg=="],
 
     "watskeburt": ["watskeburt@5.0.3", "", { "bin": { "watskeburt": "dist/run-cli.js" } }, "sha512-g9CXukMjazlJJVQ3OHzXsnG25KFYgSgKMIyoJrD8ggr0DbS9UNF7OzIqWmmKKBMedkxj3T01uqEaGnn+y7QhMA=="],
@@ -5815,6 +5876,8 @@
 
     "@nicolo-ribaudo/eslint-scope-5-internals/eslint-scope": ["eslint-scope@5.1.1", "", { "dependencies": { "esrecurse": "^4.3.0", "estraverse": "^4.1.1" } }, "sha512-2NxwbF/hZ0KpepYN0cNbo+FN6XoK7GaHlQhgx/hIZl6Va0bF45RQOOwhLIy8lQDbuCiadSLCBnH2CFYquit5bw=="],
 
+    "@parcel/watcher/detect-libc": ["detect-libc@1.0.3", "", { "bin": { "detect-libc": "./bin/detect-libc.js" } }, "sha512-pGjwhsmsp4kL2RTz08wcOlGN83otlqHeD/Z5T8GXZB+/YcpQ/dgo+lbU8ZsGxV0HIvqqxo9l7mqYwyYMD9bKDg=="],
+
     "@pmmmwh/react-refresh-webpack-plugin/source-map": ["source-map@0.7.3", "", {}, "sha512-CkCj6giN3S+n9qrYiBTX5gystlENnRW5jZeNLHpe6aue+SrHcG5VYwujhW9s4dY31mEGsxBDrHR6oI69fTXsaQ=="],
 
     "@redocly/cli/ajv": ["@redocly/ajv@8.17.4", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-BieiCML/IgP6x99HZByJSt7fJE4ipgzO7KAFss92Bs+PEI35BhY7vGIysFXLT+YmS7nHtQjZjhOQyPPEf7xGHA=="],
@@ -5835,6 +5898,16 @@
 
     "@redocly/respect-core/colorette": ["colorette@2.0.20", "", {}, "sha512-IfEDxwoWIjkeXL1eXcDiow4UbKjhLdq6/EuSVR9GMN7KVH3r9gQ83e73hsz1Nd1T3ijd5xv1wcWRYO+D6kCI2w=="],
 
+    "@rolldown/binding-wasm32-wasi/@emnapi/core": ["@emnapi/core@1.11.1", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.2", "tslib": "^2.4.0" } }, "sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ=="],
+
+    "@rolldown/binding-wasm32-wasi/@emnapi/runtime": ["@emnapi/runtime@1.11.1", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw=="],
+
+    "@rolldown/binding-wasm32-wasi/@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.1.6", "", { "dependencies": { "@tybys/wasm-util": "^0.10.3" }, "peerDependencies": { "@emnapi/core": "^1.7.1", "@emnapi/runtime": "^1.7.1" } }, "sha512-ZLv/JdUfkvOy9eCnnBaGfiO+XimbjebAeO+MRQqD/B+FR1tnRN0tpKSJHRbE8sFfS6aqsXZ67TQjfwfsxULVbg=="],
+
+    "@rollup/pluginutils/@types/estree": ["@types/estree@1.0.8", "", {}, "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w=="],
+
+    "@rollup/pluginutils/picomatch": ["picomatch@4.0.4", "", {}, "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A=="],
+
     "@rushstack/node-core-library/ajv": ["ajv@8.18.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A=="],
 
     "@rushstack/node-core-library/fs-extra": ["fs-extra@11.3.0", "", { "dependencies": { "graceful-fs": "^4.2.0", "jsonfile": "^6.0.1", "universalify": "^2.0.0" } }, "sha512-Z4XaCL6dUDHfP/jT25jJKMmtxvuwbkrD1vNSMFlo9lNLY2c5FHYSQgHPRZUjAB26TpDEoW9HCOgplrdbaPV/ew=="],
@@ -6055,12 +6128,8 @@
 
     "@vue/compiler-core/entities": ["entities@7.0.1", "", {}, "sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA=="],
 
-    "@vue/compiler-core/estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
-
     "@vue/compiler-sfc/@babel/parser": ["@babel/parser@7.29.2", "", { "dependencies": { "@babel/types": "^7.29.0" }, "bin": "./bin/babel-parser.js" }, "sha512-4GgRzy/+fsBa72/RZVJmGKPmZu9Byn8o4MoLpmNe1m8ZfYnz5emHLQz3U4gLud6Zwl0RZIcgiLD7Uq7ySFuDLA=="],
 
-    "@vue/compiler-sfc/estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
-
     "@vue/compiler-sfc/magic-string": ["magic-string@0.30.21", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.5" } }, "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ=="],
 
     "@vue/compiler-sfc/postcss": ["postcss@8.5.10", "", { "dependencies": { "nanoid": "^3.3.11", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ=="],
@@ -6953,9 +7022,7 @@
 
     "react-remove-scroll-bar/tslib": ["tslib@2.8.1", "", {}, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
 
-    "react-router/react-is": ["react-is@16.13.1", "", {}, "sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ=="],
-
-    "react-router-v7/cookie": ["cookie@1.1.1", "", {}, "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ=="],
+    "react-router/cookie": ["cookie@1.1.1", "", {}, "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ=="],
 
     "react-style-singleton/tslib": ["tslib@2.8.1", "", {}, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
 
@@ -6985,6 +7052,8 @@
 
     "redoc/classnames": ["classnames@2.5.1", "", {}, "sha512-saHYOzhIQs6wy2sVxTM6bUDsQO4F50V9RQ22qBpEdCW+I+/Wmke2HOl6lS6dTpdxVhb88/I6+Hs+438c3lfUow=="],
 
+    "redoc/marked": ["marked@4.3.0", "", { "bin": { "marked": "bin/marked.js" } }, "sha512-PRsaiG84bK+AMvxziE/lCFss8juXjNaWzVbN5tXAm4XjeaS9NAHhop+PjQxz2A9h8Q4M/xGmzP8vqNwy6JeK0A=="],
+
     "reduce-css-calc/balanced-match": ["balanced-match@0.4.2", "", {}, "sha512-STw03mQKnGUYtoNjmowo4F2cRmIIxYEGiMsjjwla/u5P1lxadj/05WkNaFjNiKTgJkj8KiXbgAiRTmcQRwQNtg=="],
 
     "reduce-function-call/balanced-match": ["balanced-match@1.0.2", "", {}, "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="],
@@ -7007,8 +7076,12 @@
 
     "ripemd160/hash-base": ["hash-base@3.1.0", "", { "dependencies": { "inherits": "^2.0.4", "readable-stream": "^3.6.0", "safe-buffer": "^5.2.0" } }, "sha512-1nmYp/rhMDiE7AYkDw+lLwlAzz0AntGIe51F3RfFfEqyQ3feY2eI/NcwC6umIQVOASPMsWJLJScWKSSvzL9IVA=="],
 
+    "rollup-plugin-inject/estree-walker": ["estree-walker@0.6.1", "", {}, "sha512-SqmZANLWS0mnatqbSfRP5g8OXZC12Fgg1IwNtLsyHDzJizORW4khDfjPqJZsemPWBB2uqykUah5YpQ6epsqC/w=="],
+
     "rollup-plugin-inject/magic-string": ["magic-string@0.25.9", "", { "dependencies": { "sourcemap-codec": "^1.4.8" } }, "sha512-RmF0AsMzgt25qzqqLc1+MbHmhdx0ojF2Fvs4XnOqz2ZOBXzzkEwc/dJQZCYHAn7v1jbVOjAZfK8msRn4BxO4VQ=="],
 
+    "rollup-pluginutils/estree-walker": ["estree-walker@0.6.1", "", {}, "sha512-SqmZANLWS0mnatqbSfRP5g8OXZC12Fgg1IwNtLsyHDzJizORW4khDfjPqJZsemPWBB2uqykUah5YpQ6epsqC/w=="],
+
     "router/path-to-regexp": ["path-to-regexp@8.4.0", "", {}, "sha512-PuseHIvAnz3bjrM2rGJtSgo1zjgxapTLZ7x2pjhzWwlp4SJQgK3f3iZIQwkpEnBaKz6seKBADpM4B4ySkuYypg=="],
 
     "rxjs/tslib": ["tslib@2.6.2", "", {}, "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="],
@@ -7197,6 +7270,12 @@
 
     "vfile-message/@types/unist": ["@types/unist@3.0.2", "", {}, "sha512-dqId9J8K/vGi5Zr7oo212BGii5m3q5Hxlkwy3WpYuKPklmBEvsbMYYyLxAQpSffdLl/gdW0XUpKWFvYmyoWCoQ=="],
 
+    "vite/picomatch": ["picomatch@4.0.5", "", {}, "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A=="],
+
+    "vite/postcss": ["postcss@8.5.16", "", { "dependencies": { "nanoid": "^3.3.12", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-vuwillviilfKZsg0VGj5R/YwwcHx4SLsIOI/7K6mQkWx+l5cUHTjj5g0AasTBcyXsbfTgrwsUNmVUb5xVwyPwg=="],
+
+    "vite/tinyglobby": ["tinyglobby@0.2.17", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g=="],
+
     "vitest-axe/aria-query": ["aria-query@5.0.0", "", {}, "sha512-V+SM7AbUwJ+EBnB8+DXs0hPZHO0W6pqBcc0dW90OwtVG02PswOu/teuARoLQjdDOH+t9pJgGnW5/Qmouf3gPJg=="],
 
     "vitest-axe/chalk": ["chalk@5.4.1", "", {}, "sha512-zgVZuo2WcZgfUEmsn6eO3kINexW8RAE4maiQ8QNs8CtpPCSyMiYsULR3HQYkm3w8FIA3SberyMJMSldGsW+U3w=="],
@@ -7463,6 +7542,14 @@
 
     "@redocly/cli/react-dom/scheduler": ["scheduler@0.23.2", "", { "dependencies": { "loose-envify": "^1.1.0" } }, "sha512-UOShsPwz7NrMUqhR6t0hWjFduvOzbtv7toDH1/hIrfRNIDBnnBWd0CwJTGvTpngVlmwGCdP9/Zl/tVrDqcuYzQ=="],
 
+    "@rolldown/binding-wasm32-wasi/@emnapi/core/@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA=="],
+
+    "@rolldown/binding-wasm32-wasi/@emnapi/core/tslib": ["tslib@2.8.1", "", {}, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
+
+    "@rolldown/binding-wasm32-wasi/@emnapi/runtime/tslib": ["tslib@2.8.1", "", {}, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
+
+    "@rolldown/binding-wasm32-wasi/@napi-rs/wasm-runtime/@tybys/wasm-util": ["@tybys/wasm-util@0.10.3", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg=="],
+
     "@storybook/addon-docs/react-dom/scheduler": ["scheduler@0.23.2", "", { "dependencies": { "loose-envify": "^1.1.0" } }, "sha512-UOShsPwz7NrMUqhR6t0hWjFduvOzbtv7toDH1/hIrfRNIDBnnBWd0CwJTGvTpngVlmwGCdP9/Zl/tVrDqcuYzQ=="],
 
     "@storybook/addon-webpack5-compiler-babel/babel-loader/find-cache-dir": ["find-cache-dir@4.0.0", "", { "dependencies": { "common-path-prefix": "^3.0.0", "pkg-dir": "^7.0.0" } }, "sha512-9ZonPT4ZAK4a+1pUPVPZJapbi7O5qbbJPdYw/NOQWZZbVLdDTYM3A4R9z/DpAM08IDaFGsvPgiGZ82WEwUDWjg=="],
@@ -8331,6 +8418,8 @@
 
     "unbox-primitive/which-boxed-primitive/is-number-object": ["is-number-object@1.1.1", "", { "dependencies": { "call-bound": "^1.0.3", "has-tostringtag": "^1.0.2" } }, "sha512-lZhclumE1G6VYD8VHe35wFaIif+CTy5SJIi5+3y4psDgWu4wPDoBhF8NxUOinEc7pHgiTsT6MaBb92rKhhD+Xw=="],
 
+    "vite/postcss/nanoid": ["nanoid@3.3.15", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA=="],
+
     "webpack-dev-middleware/mime-types/mime-db": ["mime-db@1.51.0", "", {}, "sha512-5y8A56jg7XVQx2mbv1lu49NR4dokRnhZYTtL+KGfaa27uq4pSTXkwQkFJl4pkRMyNFz/EtYDSkiiEHx3F7UN6g=="],
 
     "webpack-dev-middleware/schema-utils/@types/json-schema": ["@types/json-schema@7.0.9", "", {}, "sha512-qcUXuemtEu+E5wZSJHNxUXeCZhAfXKQ41D+duX+VYPde7xyEVZci+/oXKJL13tnRs9lR2pr4fod59GT6/X1/yQ=="],
@@ -8517,6 +8606,8 @@
 
     "@redocly/cli/glob/minimatch/brace-expansion": ["brace-expansion@5.0.2", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-Pdk8c9poy+YhOgVWw1JNN22/HcivgKWwpxKq04M/jTmHyCZn12WPJebZxdjSa5TmBqISrUSgNYU3eRORljfCCw=="],
 
+    "@rolldown/binding-wasm32-wasi/@napi-rs/wasm-runtime/@tybys/wasm-util/tslib": ["tslib@2.8.1", "", {}, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
+
     "@storybook/addon-webpack5-compiler-babel/babel-loader/find-cache-dir/pkg-dir": ["pkg-dir@7.0.0", "", { "dependencies": { "find-up": "^6.3.0" } }, "sha512-Ie9z/WINcxxLp27BKOCHGde4ITq9UklYKDzVo1nhk5sqGEXU3FpkwP5GM2voTGJkGd9B3Otl+Q4uwSOeSUtOBA=="],
 
     "@storybook/addon-webpack5-compiler-babel/babel-loader/schema-utils/@types/json-schema": ["@types/json-schema@7.0.9", "", {}, "sha512-qcUXuemtEu+E5wZSJHNxUXeCZhAfXKQ41D+duX+VYPde7xyEVZci+/oXKJL13tnRs9lR2pr4fod59GT6/X1/yQ=="],

cross-version/dev.sh

@@ -74,6 +74,8 @@ if [[ ! -d "$SPECS_DIR" ]]; then
   closest=""
   closest_dist=999
   for dir in "$REPO_ROOT"/e2e/cross-version/[0-9]*/; do
+    # Skip the literal pattern when the glob matches no numbered folders
+    [[ -d "$dir" ]] || continue
     v=$(basename "$dir")
     (( v < MAJOR )) && continue
     dist=$(( v - MAJOR ))

cross-version/test.sh

@@ -89,6 +89,8 @@ run_e2e() {
   if [[ ! -d "$specs_dir" ]]; then
     local closest="" closest_dist=999
     for dir in "$REPO_ROOT"/e2e/cross-version/[0-9]*/; do
+      # Skip the literal pattern when the glob matches no numbered folders
+      [[ -d "$dir" ]] || continue
       local v=$(basename "$dir")
       (( v < major )) && continue
       local dist=$(( v - major ))

deps.edn

@@ -80,7 +80,7 @@
   hiccup/hiccup                             {:mvn/version "2.0.0"}              ; HTML templating
   inflections/inflections                   {:mvn/version "0.15.0"}             ; Clojure/Script library used for prularizing words
   instaparse/instaparse                     {:mvn/version "1.5.0"}              ; Make your own parser
-  io.github.camsaul/toucan2                 {:mvn/version "1.0.571"}
+  io.github.camsaul/toucan2                 {:mvn/version "1.0.572"}
   io.github.eerohele/pp                     {#_#_:git/tag "2024-11-13.77"       ; super fast pretty-printing library
                                              :git/sha "ffc4edc482c057cd9412c62f018a41e9140c618b"
                                              :git/url "https://github.com/eerohele/pp"}
@@ -126,7 +126,7 @@
   {:mvn/version "2.26.1"}             ; allows the custom json logging format
   org.apache.logging.log4j/log4j-slf4j2-impl
   {:mvn/version "2.26.1"}             ; allows the slf4j2 API to work with log4j 2
-  org.apache.pdfbox/pdfbox                  {:mvn/version "3.0.5"}              ; PDF generation (backend dashboard PDF prototype)
+  org.apache.pdfbox/pdfbox                  {:mvn/version "3.0.8"}              ; PDF generation (backend dashboard PDF prototype)
   org.apache.poi/poi                        {:mvn/version "5.5.1"}              ; Work with Office documents (e.g. Excel spreadsheets) -- newer version than one specified by Docjure
   org.apache.poi/poi-ooxml                  {:mvn/version "5.5.1"
                                              :exclusions  [org.bouncycastle/bcpkix-jdk15on

dev/src/dev.clj

@@ -158,7 +158,6 @@
   (let [h2-dbs (t2/select :model/Database :engine :h2)
         in-memory? (fn [db] (some-> db :details :db (str/starts-with? "mem:")))
         can-connect? (fn [db]
-                       #_:clj-kondo/ignore
                        (binding [driver.settings/*allow-testing-h2-connections* true]
                          (try
                            (driver/can-connect? :h2 (:details db))

dev/src/dev/kondo_ratchet.clj

@@ -0,0 +1,252 @@
+(ns dev.kondo-ratchet
+  "Ratchet on inline kondo ignore forms.
+
+  Per-linter budgets live in `.clj-kondo/ratchets.edn`.
+  `metabase.core.kondo-ratchet-test` fails when they drift from the tree;
+  `./bin/mage fix-kondo-ratchets` lowers budgets, never raises them.
+  Loaded by both the bb task and the JVM test, so keep it dependency-free."
+  {:clj-kondo/config '{:linters {:discouraged-var {clojure.core/println {:level :off}}}}}
+  (:require
+   [clojure.edn :as edn]
+   [clojure.java.io :as io]
+   [clojure.string :as str]))
+
+(set! *warn-on-reflection* true)
+
+(def ratchets-file
+  "The budgets file, relative to the repo root."
+  ".clj-kondo/ratchets.edn")
+
+(def ^:private source-roots
+  ["src" "test" "enterprise" "modules/drivers" "dev" "bin" "mage"])
+
+(def ^:private source-extensions
+  [".clj" ".cljc" ".cljs"])
+
+;; Concatenated so this file never contains a literal ignore marker.
+(def ^:private ignore-marker
+  (str ":clj-kondo" "/ignore"))
+
+;; `#_{... [:some-linter]}`, `^{... [:some-linter]}`, and the prefix-less attr-map form
+;; `(ns foo {... [:some-linter]})`; the vector may span lines. The lazy tail after the vector runs to the
+;; map's own closing brace, so extra keys still count and removal spans the whole form; a nested-brace
+;; value stops the match at the vector instead.
+(def ^:private vector-form-re
+  (re-pattern (str "(?:(?:#_|\\^)\\s*)?\\{\\s*" ignore-marker "\\s*\\[([^\\]]*)\\](?:[^{}]*?\\})?")))
+
+;; Bare `#_kw` / `^kw` with no linter vector: suppresses every linter on the next form.
+(def ^:private bare-form-re
+  (re-pattern (str "(?:#_\\s*|\\^)" ignore-marker "(?![\\w./-])")))
+
+(defn mask-strings-and-comments
+  "`content` with string-literal and line-comment interiors replaced by spaces, newlines kept.
+  Same length as the input, so offsets and line numbers carry over.
+  Ignore forms inside strings (test fixtures) or commented-out code must not count."
+  [content]
+  (let [sb (StringBuilder. ^String content)
+        n  (count content)]
+    (loop [i 0, state :code]
+      (if (>= i n)
+        (str sb)
+        (let [c (.charAt sb i)]
+          (case state
+            :code    (case c
+                       \" (recur (inc i) :string)
+                       \; (do (.setCharAt sb i \space)
+                              (recur (inc i) :comment))
+                       ;; char literal: never treat the next char as a delimiter
+                       \\ (recur (+ i 2) :code)
+                       (recur (inc i) :code))
+            :string  (case c
+                       \" (recur (inc i) :code)
+                       \\ (do (.setCharAt sb i \space)
+                              (when (< (inc i) n)
+                                (when-not (= (.charAt sb (inc i)) \newline)
+                                  (.setCharAt sb (inc i) \space)))
+                              (recur (+ i 2) :string))
+                       \newline (recur (inc i) :string)
+                       (do (.setCharAt sb i \space)
+                           (recur (inc i) :string)))
+            :comment (if (= c \newline)
+                       (recur (inc i) :code)
+                       (do (.setCharAt sb i \space)
+                           (recur (inc i) :comment)))))))))
+
+(defn- linter-keywords
+  [vector-contents]
+  (map (comp keyword #(subs % 1))
+       (re-seq #":[A-Za-z][A-Za-z0-9*+!?<>=._/-]*" vector-contents)))
+
+(defn line-linters
+  "Linter keywords suppressed by inline ignore forms on `line`.
+  The bare vector-less form counts as `:all`.
+  Like [[scan]], ignore forms inside string literals or line comments don't count."
+  [line]
+  (let [masked (mask-strings-and-comments line)]
+    (concat (mapcat (comp linter-keywords second) (re-seq vector-form-re masked))
+            (repeat (count (re-seq bare-form-re masked)) :all))))
+
+(defn- offset->line
+  "1-based line number of character offset `i` in `content`."
+  [content i]
+  (inc (count (filter #(= % \newline) (subs content 0 i)))))
+
+(defn- matches-with-offsets
+  "Like re-seq, but returns `{:start _, :end _, :linters [...]}` for each match of `re` in `masked`."
+  [re masked bare?]
+  (let [m (re-matcher re masked)]
+    (loop [acc []]
+      (if (.find m)
+        (recur (conj acc {:start   (.start m)
+                          :end     (.end m)
+                          :linters (if bare? [:all] (vec (linter-keywords (.group m 1))))}))
+        acc))))
+
+(defn ignore-matches
+  "Inline ignore matches in `content`, in file order:
+  `{:start _, :end _, :line _, :linters [...]}` with character offsets and a 1-based line.
+  Matches inside string literals or line comments are excluded."
+  [content]
+  (let [masked (mask-strings-and-comments content)]
+    (->> (concat (matches-with-offsets vector-form-re masked false)
+                 (matches-with-offsets bare-form-re masked true))
+         (sort-by :start)
+         (map #(assoc % :line (offset->line masked (:start %)))))))
+
+(defn scan
+  "Occurrences of inline ignore forms under `roots` (relative to the repo root).
+  Returns `{:file \"src/...\", :line 42, :linters [...]}` maps.
+  Forms inside string literals or line comments don't count."
+  ([]
+   (scan source-roots))
+  ([roots]
+   (for [root  roots
+         ^java.io.File f (file-seq (io/file root))
+         :when (and (.isFile f)
+                    (some #(str/ends-with? (.getPath f) %) source-extensions))
+         :let  [content (slurp f)]
+         :when (str/includes? content ignore-marker)
+         m     (ignore-matches content)]
+     {:file    (.getPath f)
+      :line    (:line m)
+      :linters (:linters m)})))
+
+(defn actual-counts
+  "Per-linter occurrence counts for `occurrences`, as returned by [[scan]]."
+  [occurrences]
+  (frequencies (mapcat :linters occurrences)))
+
+(defn- sorted-by-str
+  [kvs]
+  (into (sorted-map-by #(compare (str %1) (str %2))) kvs))
+
+(defn drift
+  "Linters whose count in `occurrences` differs from its budget in `recorded` (absent = 0, either side).
+  Returns `{linter {:recorded _, :actual _}}`, plus `:examples` (up to 5 `file:line`) when over budget."
+  [recorded occurrences]
+  (let [actual (actual-counts occurrences)]
+    (sorted-by-str
+     (for [linter (into (set (keys actual)) (keys recorded))
+           :let   [budget (get recorded linter 0)
+                   n      (get actual linter 0)]
+           :when  (not= budget n)]
+       [linter (cond-> {:recorded budget, :actual n}
+                 (> n budget)
+                 (assoc :examples (->> occurrences
+                                       (filter #(some #{linter} (:linters %)))
+                                       (map #(str (:file %) ":" (:line %)))
+                                       (take 5)
+                                       vec)))]))))
+
+(defn read-ratchets
+  "Parsed contents of [[ratchets-file]], with empty defaults when the file doesn't exist."
+  []
+  (merge {:ignore-counts {}}
+         (when (.exists (io/file ratchets-file))
+           (edn/read-string (slurp ratchets-file)))))
+
+(def ^:private header
+  (str ";; Per-linter budgets for inline `" ignore-marker "` forms.\n"
+       ";; metabase.core.kondo-ratchet-test fails when the budgets drift from the actual counts.\n"
+       ";; `./bin/mage fix-kondo-ratchets` lowers budgets to match the tree; local test runs do it\n"
+       ";; automatically. Raising a budget, or adding one for a new linter (`--seed`), is a hand edit\n"
+       ";; to defend in your PR.\n"
+       ";; :all is the vector-less ignore form, which suppresses every linter on the next form.\n"))
+
+(defn render
+  "Text of the ratchets file for the `{:ignore-counts _}` map `ratchets`.
+  Byte-stable: [[fix!]] idempotency and the file-hygiene test depend on it."
+  [{:keys [ignore-counts]}]
+  (let [counts-indent (apply str (repeat (count "{:ignore-counts {") \space))]
+    (str header
+         "{:ignore-counts "
+         (if (empty? ignore-counts)
+           "{}"
+           (let [entries (sort-by (comp str first) ignore-counts)
+                 width   (apply max (map (comp count str first) entries))]
+             (str "{"
+                  (str/join (str "\n" counts-indent)
+                            (for [[linter n] entries]
+                              (format (str "%-" width "s %d") (str linter) n)))
+                  "}")))
+         "}\n")))
+
+(defn lowered-counts
+  "`recorded` with each budget lowered to its actual count; entries with no ignores left are dropped.
+  Linters in `seeded` get their budget set to the actual count outright — the explicit escape hatch for
+  landing a new linter. Otherwise never raises a budget, never adds one."
+  [recorded actual seeded]
+  (into (sorted-by-str
+         (for [linter seeded
+               :when  (pos? (get actual linter 0))]
+           [linter (get actual linter)]))
+        (keep (fn [[linter budget]]
+                (let [n (get actual linter 0)]
+                  (cond
+                    (contains? (set seeded) linter) nil
+                    (zero? n)                       nil
+                    (< n budget)                    [linter n]
+                    :else                           [linter budget]))))
+        recorded))
+
+(defn change-report
+  "The lines [[fix!]] prints: lowered/dropped/seeded budgets, plus warnings for anything over budget."
+  [{:keys [ignore-counts]} occurrences seeded]
+  (let [actual (actual-counts occurrences)]
+    (concat
+     (for [linter seeded
+           :let   [n (get actual linter 0)]]
+       (if (pos? n)
+         (format "seeded %s at %d" linter n)
+         (format "WARNING: %s has no inline ignores -- nothing to seed" linter)))
+     (for [[linter budget] (sort-by (comp str first) (apply dissoc ignore-counts seeded))
+           :let            [n (get actual linter 0)]
+           :when           (not= n budget)]
+       (cond
+         (zero? n)    (format "dropped %s (no ignores left)" linter)
+         (< n budget) (format "lowered %s %d -> %d" linter budget n)
+         :else        (format "WARNING: %s is over budget (%d recorded, %d actual) -- remove ignores, or accept them all with `--seed %s`"
+                              linter budget n linter)))
+     (for [[linter n] (sort-by (comp str first) (apply dissoc actual (concat seeded (keys ignore-counts))))]
+       (format "WARNING: %s has %d ignores but no budget entry -- seed one with `./bin/mage fix-kondo-ratchets --seed %s`"
+               linter n linter)))))
+
+(defn fix!
+  "Rewrite [[ratchets-file]]: lower budgets and normalize formatting.
+  `--seed LINTER` (`{:seed \"...\"}` here) sets that budget to the actual count, adding or raising it.
+  Prints the [[change-report]], or `unchanged` on a no-op."
+  ([]
+   (fix! nil))
+  ([{:keys [seed]}]
+   (let [{:keys [ignore-counts] :as ratchets} (read-ratchets)
+         occurrences (scan)
+         seeded      (if seed [(keyword (str/replace-first seed #"^:" ""))] [])
+         actual      (actual-counts occurrences)
+         text        (render {:ignore-counts (lowered-counts ignore-counts actual seeded)})
+         file        (io/file ratchets-file)
+         old         (when (.exists file) (slurp file))]
+     (run! println (change-report ratchets occurrences seeded))
+     (if (= old text)
+       (println "unchanged")
+       (do (spit file text)
+           (println (str "wrote " ratchets-file)))))))

docs/README.md

@@ -182,6 +182,7 @@ Metabase's reference documentation.
 - [Managing people and groups](./people-and-groups/managing.md)
 - [Password complexity](./people-and-groups/changing-password-complexity.md)
 - [Session expiration](./people-and-groups/changing-session-expiration.md)
+- [Two-factor authentication](./people-and-groups/two-factor-authentication.md)
 - [Google Sign-In](./people-and-groups/google-sign-in.md)
 - [LDAP](./people-and-groups/ldap.md)
 - [API keys](./people-and-groups/api-keys.md)

docs/actions/custom.md

@@ -76,7 +76,7 @@ If something goes wrong, Metabase will display the error message it received fro
 
 ### Example `UPDATE` action
 
-You could write an action that would update the `plan` column for a record in the `invoices` table in the Sample Database:
+You could write an action that would update the `plan` column for a record in the `invoices` table:
 
 ```sql
 {% raw %}

docs/ai/system-prompts.md

@@ -15,7 +15,7 @@ System prompts let you customize instructions for Metabot. You can write a separ
 - **Natural language queries**: query-builder questions generated from natural language.
 - **SQL generation**: SQL written from prompts (sidebar or [inline](./metabot.md#inline-sql-editing)).
 
-Like text cards on dashboards, prompts support [Markdown](https://www.metabase.com/learn/metabase-basics/querying-and-dashboards/dashboards/markdown).
+Like text cards on dashboards, prompts support [Markdown](../dashboards/markdown.md).
 
 ## Prompt tips
 

docs/cloud/limitations.md

@@ -20,7 +20,7 @@ Metabase Cloud only works with:
 
 - [Metabase's officially supported databases](../databases/connecting.md#connecting-to-supported-databases) (with the exception of SQLite and H2).
 
-Metabase Cloud doesn't support [community database drivers](../developers-guide/community-drivers.md), or file-based databases (SQLite and H2), because there's currently no file storage available.
+Metabase Cloud doesn't support [community database drivers](../developers-guide/community-drivers.md), or file-based databases (SQLite), because there's currently no file storage available.
 
 ## Limited custom certificate support
 

docs/configuring-metabase/config-file.md

@@ -6,9 +6,9 @@ title: "Configuration file"
 
 {% include plans-blockquote.html feature="Loading from a configuration file" self-hosted-only="true" %}
 
-On self-hosted [Pro](https://www.metabase.com/product/pro) and [Enterprise](https://www.metabase.com/product/enterprise) plans, Metabase supports initialization on launch from a config file named `config.yml`. The config file should be located at:
+On self-hosted [Pro](https://www.metabase.com/product/pro) and [Enterprise](https://www.metabase.com/product/enterprise) plans, Metabase supports initialization on launch from a config file. The config file should be located at:
 
-- The current directory (the directory where the running Metabase JAR is located).
+- A file named `config.yml` or `config.yaml` in the current directory (the directory where the running Metabase JAR is located).
 - The path specified by the [`MB_CONFIG_FILE_PATH`](./environment-variables.md#mb_config_file_path) environment variable.
 
 The settings in the config file work the same as if you'd set the settings in the Admin Settings in your Metabase. Settings defined in this configuration file will update any existing settings. If, for example, a database already exists (that is, you'd already added it via the initial set up or **Admin settings** > **Databases**, Metabase will update the database entry based on the data in the config file). Which means: if you define a setting in the config file, and then later change that setting in your Metabase application, keep in mind that the config file will overwrite that change whenever Metabase restarts. Let's reiterate that in a blockquote:

docs/configuring-metabase/config-template.md

@@ -210,8 +210,26 @@ config:
     ldap-user-filter: (&(objectClass=inetOrgPerson)(|(uid={login})(mail={login})))
     ldap-user-provisioning-enabled: true
     license-token-missing-banner-dismissal-timestamp: []
+    llm-anthropic-api-base-url: https://api.anthropic.com
     llm-anthropic-api-key: null
+    llm-anthropic-model: claude-opus-4-5-20251101
+    llm-azure-api-base-url: null
+    llm-azure-api-key: null
+    llm-bedrock-access-key-id: null
+    llm-bedrock-region: us-east-1
+    llm-bedrock-secret-access-key: null
+    llm-bedrock-session-token: null
+    llm-connection-timeout-ms: 5000
+    llm-max-tokens: 4096
     llm-metabot-provider: anthropic/claude-sonnet-4-6
+    llm-openai-api-base-url: https://api.openai.com
+    llm-openai-api-key: null
+    llm-openai-model: gpt-5.4
+    llm-openrouter-api-base-url: https://openrouter.ai/api
+    llm-openrouter-api-key: null
+    llm-rate-limit-per-ip: 100
+    llm-rate-limit-per-user: 20
+    llm-request-timeout-ms: 60000
     load-analytics-content: true
     loading-message: doing-science
     login-page-illustration: default
@@ -242,9 +260,10 @@ config:
     persisted-model-refresh-cron-schedule: 0 0 0/6 * * ? *
     persisted-models-enabled: false
     premium-embedding-token: null
+    query-caching-early-refresh-ratio: 0.1
     query-caching-max-kb: 2000
     query-caching-max-ttl: 3024000.0
-    queue-backend: quartz
+    queue-backend: null
     queue-max-retries: 5
     queue-no-listener-max-age-ms: 86400000
     redirect-all-requests-to-https: false

docs/configuring-metabase/environment-variables.md

@@ -1287,6 +1287,14 @@ When set to `true`, users who log in via LDAP will automatically get a Metabase
 
 The array of last two ISO8601 dates when an admin dismissed the license token missing banner.
 
+### `MB_LLM_ANTHROPIC_API_BASE_URL`
+
+- Type: string
+- Default: `https://api.anthropic.com`
+- [Configuration file name](./config-file.md): `llm-anthropic-api-base-url`
+
+The Anthropic API base URL.
+
 ### `MB_LLM_ANTHROPIC_API_KEY`
 
 - Type: string
@@ -1295,6 +1303,78 @@ The array of last two ISO8601 dates when an admin dismissed the license token mi
 
 The Anthropic API Key.
 
+### `MB_LLM_ANTHROPIC_MODEL`
+
+- Type: string
+- Default: `claude-opus-4-5-20251101`
+- [Configuration file name](./config-file.md): `llm-anthropic-model`
+
+The Anthropic model to use.
+
+### `MB_LLM_AZURE_API_BASE_URL`
+
+- Type: string
+- Default: `null`
+- [Configuration file name](./config-file.md): `llm-azure-api-base-url`
+
+The base URL of the Azure resource's OpenAI- or Anthropic-compatible surface, e.g. `https://<resource>.services.ai.azure.com/openai`.
+
+### `MB_LLM_AZURE_API_KEY`
+
+- Type: string
+- Default: `null`
+- [Configuration file name](./config-file.md): `llm-azure-api-key`
+
+The API key for the Azure resource hosting your models.
+
+### `MB_LLM_BEDROCK_ACCESS_KEY_ID`
+
+- Type: string
+- Default: `null`
+- [Configuration file name](./config-file.md): `llm-bedrock-access-key-id`
+
+The AWS Access Key ID for Amazon Bedrock.
+
+### `MB_LLM_BEDROCK_REGION`
+
+- Type: string
+- Default: `us-east-1`
+- [Configuration file name](./config-file.md): `llm-bedrock-region`
+
+The AWS region for Amazon Bedrock (e.g. us-east-1).
+
+### `MB_LLM_BEDROCK_SECRET_ACCESS_KEY`
+
+- Type: string
+- Default: `null`
+- [Configuration file name](./config-file.md): `llm-bedrock-secret-access-key`
+
+The AWS Secret Access Key for Amazon Bedrock.
+
+### `MB_LLM_BEDROCK_SESSION_TOKEN`
+
+- Type: string
+- Default: `null`
+- [Configuration file name](./config-file.md): `llm-bedrock-session-token`
+
+The AWS Session Token for Amazon Bedrock. Only needed for temporary credentials.
+
+### `MB_LLM_CONNECTION_TIMEOUT_MS`
+
+- Type: integer
+- Default: `5000`
+- [Configuration file name](./config-file.md): `llm-connection-timeout-ms`
+
+Connection timeout in milliseconds for LLM API requests.
+
+### `MB_LLM_MAX_TOKENS`
+
+- Type: integer
+- Default: `4096`
+- [Configuration file name](./config-file.md): `llm-max-tokens`
+
+Maximum tokens for LLM responses.
+
 ### `MB_LLM_METABOT_PROVIDER`
 
 - Type: string
@@ -1303,6 +1383,70 @@ The Anthropic API Key.
 
 The AI provider and model for Metabot. Format: provider/model-name, e.g. `anthropic/claude-haiku-4-5`, `openai/gpt-5.4`, `openrouter/anthropic/claude-haiku-4.5`.
 
+### `MB_LLM_OPENAI_API_BASE_URL`
+
+- Type: string
+- Default: `https://api.openai.com`
+- [Configuration file name](./config-file.md): `llm-openai-api-base-url`
+
+The OpenAI API base URL.
+
+### `MB_LLM_OPENAI_API_KEY`
+
+- Type: string
+- Default: `null`
+- [Configuration file name](./config-file.md): `llm-openai-api-key`
+
+The OpenAI API Key.
+
+### `MB_LLM_OPENAI_MODEL`
+
+- Type: string
+- Default: `gpt-5.4`
+- [Configuration file name](./config-file.md): `llm-openai-model`
+
+The OpenAI Model (e.g. 'gpt-5.5', 'gpt-5.4-mini').
+
+### `MB_LLM_OPENROUTER_API_BASE_URL`
+
+- Type: string
+- Default: `https://openrouter.ai/api`
+- [Configuration file name](./config-file.md): `llm-openrouter-api-base-url`
+
+The OpenRouter API base URL used for Chat Completions.
+
+### `MB_LLM_OPENROUTER_API_KEY`
+
+- Type: string
+- Default: `null`
+- [Configuration file name](./config-file.md): `llm-openrouter-api-key`
+
+The OpenRouter API Key.
+
+### `MB_LLM_RATE_LIMIT_PER_IP`
+
+- Type: integer
+- Default: `100`
+- [Configuration file name](./config-file.md): `llm-rate-limit-per-ip`
+
+Maximum SQL generation requests per IP address per minute.
+
+### `MB_LLM_RATE_LIMIT_PER_USER`
+
+- Type: integer
+- Default: `20`
+- [Configuration file name](./config-file.md): `llm-rate-limit-per-user`
+
+Maximum SQL generation requests per user per minute.
+
+### `MB_LLM_REQUEST_TIMEOUT_MS`
+
+- Type: integer
+- Default: `60000`
+- [Configuration file name](./config-file.md): `llm-request-timeout-ms`
+
+Socket timeout in milliseconds for LLM API requests.
+
 ### `MB_LOAD_ANALYTICS_CONTENT`
 
 - Type: boolean
@@ -1580,6 +1724,14 @@ Allow persisting models into the source database.
 
 Token for premium features. Go to the MetaStore to get yours!
 
+### `MB_QUERY_CACHING_EARLY_REFRESH_RATIO`
+
+- Type: double
+- Default: `0.1`
+- [Configuration file name](./config-file.md): `query-caching-early-refresh-ratio`
+
+Refresh cached results this fraction of their cache duration before they expire, so requests keep being served from cache instead of waiting for a recomputation. Set to 0 to only refresh once results have expired.
+
 ### `MB_QUERY_CACHING_MAX_KB`
 
 - Type: integer
@@ -1599,9 +1751,9 @@ The absolute maximum time to keep any cached query results, in seconds.
 ### `MB_QUEUE_BACKEND`
 
 - Type: string
-- Default: `quartz`
+- Default: `null`
 
-Which queue backend to use. Valid values: `quartz`, `memory`.
+Which queue backend to use. Valid values: `quartz`, `memory`. When unset, defaults to `quartz`, or to `memory` when the task scheduler is disabled (`MB_DISABLE_SCHEDULER`).
 
 ### `MB_QUEUE_MAX_RETRIES`
 
@@ -1881,8 +2033,7 @@ on your IdP, this usually looks something like `http://www.example.com/141xkex60
 - Default: `null`
 - [Configuration file name](./config-file.md): `saml-identity-provider-slo-uri`
 
-This is the URL where your users go to logout of your identity provider. Depending on which IdP you're
-using, this usually looks like `https://your-org-name.example.com` or `https://example.com/app/my_saml_app/abc123/sso/slo`.
+If SAML single logout (SLO) is enabled, Metabase will make an HTTP-Redirect SLO request to this endpoint when a user logs out of Metabase.
 
 ### `MB_SAML_IDENTITY_PROVIDER_URI`
 
@@ -1933,7 +2084,7 @@ Absolute path to the Keystore file to use for signing SAML requests.
 - Default: `false`
 - [Configuration file name](./config-file.md): `saml-slo-enabled`
 
-Is SAML Single Log Out enabled?
+If enabled, Metabase will redirect users to your configured SAML Single Logout endpoint when they log out of Metabase.
 
 ### `MB_SAML_USER_PROVISIONING_ENABLED`
 

docs/dashboards/introduction.md

@@ -82,7 +82,7 @@ You can use [Markdown](https://commonmark.org/help/) to format the text in your
 
 ![Result](images/result.png)
 
-To learn more, see [Fun with Markdown in your dashboards](https://www.metabase.com/learn/metabase-basics/querying-and-dashboards/dashboards/markdown).
+To learn more, see [Format text with Markdown](./markdown.md).
 
 ### Including variables in text cards
 
@@ -321,12 +321,14 @@ See [Caching per dashboard](../configuring-metabase/caching.md#dashboard-caching
 
 ## Sharing dashboards with public links
 
-If your Metabase administrator has enabled [public sharing](../embedding/public-links.md) on a saved question or dashboard, you can go to that question or dashboard and click on the **sharing** icon to find its public links.
+If your Metabase administrator has enabled [public sharing](../embedding/public-links.md) on a saved question or dashboard, you can go to that question or dashboard and click on the **Share** icon to find its public links.
 
 ![Share icon](./images/share-icon.png)
 
 Public links can be viewed by anyone, even if they don't have access to Metabase. You can also use the public embedding code to embed your question or dashboard in a simple web page or blog post. Check out examples of simple apps with embedded dashboards in our [embedding-reference-apps repository](https://github.com/metabase/embedding-reference-apps). To learn more about [embedding](../embedding/introduction.md), check out our article on [How to use Metabase to deliver analytics to your customers](https://www.metabase.com/learn/metabase-basics/embedding/overview), as well as an article on how to combine branding, Single Sign-On, full app embedding, and row and column security to deliver [multi-tenant, self-service analytics](https://www.metabase.com/learn/metabase-basics/embedding/multi-tenant-self-service-analytics).
 
+Admins can also [create an account](../people-and-groups/managing.md#creating-an-account) for someone and point them to a specific dashboard or question. On a dashboard or question, click the **Sharing** icon and select **Invite someone to view this**.
+
 ## Exporting results from a dashboard
 
 You can export the entire dashboard as PDF, or export results of individual questions on the dashboard. See [Exporting results](../questions/exporting-results.md).

docs/dashboards/markdown.md

@@ -79,7 +79,7 @@ To nest a bulleted item under another bulleted item, indent the nested item with
 To add a link, put the link text in square brackets, followed by the URL in parentheses:
 
 ```text
-[the internet's finest webpage](https://www.metabase.com)
+[the internet's finest webpage](https://www.example.com)
 ```
 
 This renders as a clickable link: [the internet's finest webpage](https://www.metabase.com).

docs/data-studio/managing-tables.md

@@ -34,7 +34,7 @@ People in the Data Analyst group will have table metadata and data structure acc
 
 _Data Studio > Tables_
 
-You can see all tables in all databases connected to your Metabase in **Data Studio > Tables**, together with their owner, row count, and published state. For now, Metabase only displays row counts for PostgreSQL tables.
+You can see all tables in all databases connected to your Metabase in **Data Studio > Tables**, together with their owner, visibility layer, row count, and published state. For now, Metabase only displays row counts for PostgreSQL tables.
 
 You can search for table names, but the search will only match beginnings of words in table names. So for example, if you search for "base", results will include names like "Baseball stats" and "All your base are belong to us", but the results won't include tables like "Metabase secrets".
 

docs/data-studio/transforms/addons.md

@@ -37,7 +37,7 @@ With basic transforms, you can:
 
 - **Metabase Cloud**: Basic transform functionality on Metabase Cloud - Starter, Pro, or Enterprise - comes with an additional small fee per successful transform run, see [Pricing](https://www.metabase.com/pricing).
 
-    Only people logged in with an email of a [Metabase Store admin](../../cloud/accounts-and-billing.md#add-managers) (not just Metabase _instance_ admins) can [enable basic transforms](./transforms-overview.md#enable-transforms).
+  Only people logged in with an email of a [Metabase Store admin](../../cloud/accounts-and-billing.md#add-managers) (not just Metabase _instance_ admins) can [enable basic transforms](./transforms-overview.md#enable-transforms).
 
 ### Cancel basic transforms
 
@@ -65,6 +65,8 @@ The Advanced transforms add-on comes with an additional charge per successful tr
 
 To enable Advanced transforms functionality, you need to have [Basic transforms](#basic-transforms) already, see [Enable basic transforms](#enable-basic-transforms).
 
+For the full self-hosted setup see [Set up transforms on a self-hosted Metabase](transforms-overview.md#set-up-transforms-on-a-self-hosted-metabase).
+
 There are two ways to enable Advanced transforms:
 
 - **From your Metabase instance**: you can navigate to a feature requiring advanced transforms (like Python transforms or transform inspector), and follow the prompts to upgrade.

docs/data-studio/transforms/jobs-and-runs.md

@@ -38,7 +38,7 @@ Jobs have two components: schedule and tags.
 - **Schedule** determines when the job will be executed: daily, hourly, etc. You can specify a custom cron schedule (e.g. "Every weekday at 9:05 AM"). The times are given in your Metabase's system timezone.
 - **Tags** determine _which_ transforms a job runs, not when the job runs. For example, you can create a `Weekdays` tag, add that tag to a few transforms, then create a job that runs all the transforms with the `Weekdays` tag every weekday at 9:05AM.
 
-Jobs will run all transforms tagged with any of the tags, plus any transforms that the tagged transforms depend on, see [Jobs will run all dependent transforms](#jobs-will-run-all-dependent-transforms).
+Jobs will run all transforms tagged with any of the tags, plus any transforms that the tagged transforms depend on that aren't already up to date, see [Jobs include all dependent transforms](#jobs-include-all-dependent-transforms).
 
 You can see which transforms a job will run and in which order on the job's page.
 
@@ -104,13 +104,22 @@ To delete a job:
 2. Find the job you want to delete and click the **three dots** icon to the right of the job's name.
 3. Select **Delete**.
 
-## Jobs will run all dependent transforms
+## Jobs include all dependent transforms
 
-If one transform depends on another, Metabase will run the dependency first, even if that transform isn't tagged in the job. So if transform B depends on A, Metabase will first run A, even if A doesn't have a tag.
+If one transform depends on another, Metabase adds the dependency to the job and runs it first, even if that transform isn't tagged in the job. So if transform B depends on A, Metabase makes sure A is up to date before running B.
 
-This means that you can explicitly tag transform A to run daily, and transform B hourly, but because transform B depends on transform A, transform A will _also_ run hourly (in addition to daily), despite not having the tag.
+## Jobs skip dependencies that are already up to date
 
-You can see which transforms a job will run (and in which order) on the job's page in **Data Studio > Jobs**.
+Metabase won't re-run a dependency that's still fresh. That way, a transform pulled into a frequent job doesn't get rebuilt more often than its own schedule calls for. So, for example, if you tag transform A `daily`, and transform B `hourly`, and hourly B depends on daily A, then A runs on its own daily schedule. The hourly job that runs B won't rerun A every hour.
+
+Metabase skips a dependency when the dependency:
+
+- Has its own tags and jobs, and none of those jobs' schedules have come due since the dependency last ran successfully.
+- Has no tags at all, and it's already run successfully at least once.
+
+## See which transforms a job will run
+
+The job's page in **Data Studio > Jobs** lists every transform the job will run and in which order. The **Notes** column tells you when Metabase will skip a dependency, and flags dependencies that have no schedule of their own.
 
 ## Runs
 
@@ -120,4 +129,11 @@ You can see all past and current transform runs (both manual and scheduled) by g
 
 You can click on any transform run to see more details about the run, like the error logs. To go to the transform definition from the transform run page, click on the icon next the transform name in the right sidebar.
 
-The "Tags" column in the **Runs** table will only show the transform's specific tags. But the run might not have anything to do with those tags. Another job with different tags could have run the transform because [jobs will run _all_ dependent transforms](#jobs-will-run-all-dependent-transforms).
+The "Tags" column in the **Runs** table will only show the transform's specific tags. But the run might not have anything to do with those tags. Another job with different tags could have run the transform because [jobs include all dependent transforms](#jobs-include-all-dependent-transforms).
+
+## Emails about failed transforms
+
+If your Metabase is [set up to send email](../../configuring-metabase/email.md), Metabase will let people know when transforms fail.
+
+- **Individual transform failures**: when transforms fail during a scheduled job run, Metabase emails the last person to edit each failed transform (or the transform's creator, or admins if neither is active). Each email covers a single job run.
+- **Daily digest of job failures**: each morning, Metabase emails all admins a summary of the scheduled job runs that failed or timed out the previous day. Manual runs aren't included in the digest, and Metabase skips the email entirely if no scheduled runs failed.

docs/data-studio/transforms/python-runner.md

@@ -11,7 +11,7 @@ To run Python transforms from a self-hosted Metabase, you'll need to configure a
 
 ## Prerequisites
 
-- Docker installed and running.
+- Docker installed and running, or an infrastructure that can run containers.
 - **Self-hosted Metabase Pro or Enterprise license** (Python Runner requires a Pro/Enterprise plan).
 - For production: an S3-compatible storage bucket (AWS S3, MinIO, etc.).
 
@@ -69,13 +69,13 @@ docker network create metabase-network
 docker run -d \
   --network metabase-network \
   -e AUTH_TOKEN=your-secure-token-here \
-  --name python-runner metabase/python-runner:latest
+  --name python-runner --hostname python-runner metabase/python-runner:latest
 
 docker run -d \
   --network metabase-network \
   -p 3000:3000 \
   -e MB_PYTHON_RUNNER_URL=http://python-runner:5000 \
-  -e MB_PYTHON_RUNNER_API_TOKEN=your-secure-token-here \
+  -e MB_PYTHON_RUNNER_API_TOKEN=<your-secure-token-here> \
   -e MB_PYTHON_STORAGE_S_3_ENDPOINT=https://s3.amazonaws.com \
   -e MB_PYTHON_STORAGE_S_3_BUCKET=your-bucket-name \
   -e MB_PYTHON_STORAGE_S_3_REGION=us-east-1 \
@@ -97,82 +97,27 @@ docker run -d \
 
 These settings can also be configured in the Metabase UI at **Admin** > **Settings** > **Python Runner**. Note that environment variables take precedence over UI settings.
 
-| Variable                                  | Description                                                                        |
-| ----------------------------------------- | ---------------------------------------------------------------------------------- |
-| `MB_PYTHON_RUNNER_URL`                    | URL where Metabase can reach the Python Runner (e.g., `http://python-runner:5000`) |
-| `MB_PYTHON_RUNNER_API_TOKEN`              | Authentication token. Must match `AUTH_TOKEN` in the Python Runner.                |
-| `MB_PYTHON_STORAGE_S_3_ENDPOINT`          | S3 endpoint URL.                                                                   |
-| `MB_PYTHON_STORAGE_S_3_BUCKET`            | S3 bucket name for storing Python artifacts                                        |
-| `MB_PYTHON_STORAGE_S_3_REGION`            | AWS region (e.g., `us-east-1`)                                                     |
-| `MB_PYTHON_STORAGE_S_3_ACCESS_KEY`        | S3 access key                                                                      |
-| `MB_PYTHON_STORAGE_S_3_SECRET_KEY`        | S3 secret key                                                                      |
-| `MB_PYTHON_STORAGE_S_3_PATH_STYLE_ACCESS` | (Optional) Set to `true` for S3-compatible services like MinIO or LocalStack       |
+| Variable                                   | Description                                                                        |
+| ------------------------------------------ | ---------------------------------------------------------------------------------- |
+| `MB_PYTHON_RUNNER_URL`                     | URL where Metabase can reach the Python Runner (e.g., `http://python-runner:5000`) |
+| `MB_PYTHON_RUNNER_API_TOKEN`               | Authentication token. Must match `AUTH_TOKEN` in the Python Runner.                |
+| `MB_PYTHON_STORAGE_S_3_ENDPOINT`           | S3 endpoint URL.                                                                   |
+| `MB_PYTHON_STORAGE_S_3_CONTAINER_ENDPOINT` | S3 endpoint seen from the runner container, if different from the main endpoint.   |
+| `MB_PYTHON_STORAGE_S_3_BUCKET`             | S3 bucket name for storing Python artifacts                                        |
+| `MB_PYTHON_STORAGE_S_3_REGION`             | AWS region (e.g., `us-east-1`)                                                     |
+| `MB_PYTHON_STORAGE_S_3_ACCESS_KEY`         | S3 access key                                                                      |
+| `MB_PYTHON_STORAGE_S_3_SECRET_KEY`         | S3 secret key                                                                      |
+| `MB_PYTHON_STORAGE_S_3_PATH_STYLE_ACCESS`  | (Optional) Set to `true` for S3-compatible services like MinIO or LocalStack       |
+
+`MB_PYTHON_STORAGE_S_3_CONTAINER_ENDPOINT` is the host Metabase signs into the presigned URLs the runner uploads to and downloads from. Set it when the runner resolves storage by a different hostname than Metabase does.
 
 ## Using Docker Compose
 
-Docker Compose simplifies managing multiple containers. Below are example configurations for different scenarios.
+Below are example configurations for different scenarios.
 
-### Simple setup with LocalStack
+### Self-hosted storage with MinIO
 
-For simple setup and local testing, you can use LocalStack to simulate S3:
-
-```yml
-name: metabase-python-runner
-services:
-  metabase:
-    image: metabase/metabase-enterprise:latest
-    ports:
-      - "3000:3000"
-    environment:
-      - MB_PYTHON_RUNNER_URL=http://python-runner:5000
-      - MB_PYTHON_RUNNER_API_TOKEN=your-secure-token-here
-      - MB_PYTHON_STORAGE_S_3_ENDPOINT=http://localstack:4566
-      - MB_PYTHON_STORAGE_S_3_BUCKET=metabase-python-runner
-      - MB_PYTHON_STORAGE_S_3_REGION=us-east-1
-      - MB_PYTHON_STORAGE_S_3_PATH_STYLE_ACCESS=true
-      - MB_PYTHON_STORAGE_S_3_ACCESS_KEY=test
-      - MB_PYTHON_STORAGE_S_3_SECRET_KEY=test
-    depends_on:
-      localstack-init:
-        condition: service_completed_successfully
-      python-runner:
-        condition: service_started
-
-  python-runner:
-    image: metabase/python-runner:latest
-    environment:
-      - AUTH_TOKEN=your-secure-token-here
-
-  localstack:
-    image: localstack/localstack:latest
-    environment:
-      - SERVICES=s3
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:4566/_localstack/health"]
-      interval: 5s
-      timeout: 5s
-      retries: 10
-
-  localstack-init:
-    image: localstack/localstack:latest
-    entrypoint:
-      ["/bin/sh", "-c", "awslocal s3 mb s3://metabase-python-runner || true"]
-    environment:
-      - AWS_ENDPOINT_URL=http://localstack:4566
-    depends_on:
-      localstack:
-        condition: service_healthy
-```
-
-Then run:
-
-```bash
-docker compose up -d
-```
-
-### Production setup
-
-For production, use an external S3-compatible storage service:
+[MinIO](https://min.io/) is an S3-compatible server you can run yourself, which makes it a common pick for self-hosted Metabase. This Compose file runs Metabase, the Python runner, MinIO, and a short-lived container that creates the bucket Metabase will use — neither MinIO nor Metabase creates that bucket for you.
 
 ```yml
 name: metabase-python-runner
@@ -184,12 +129,16 @@ services:
     environment:
       - MB_PYTHON_RUNNER_URL=http://python-runner:5000
       - MB_PYTHON_RUNNER_API_TOKEN=${AUTH_TOKEN}
-      - MB_PYTHON_STORAGE_S_3_ENDPOINT=${S3_ENDPOINT}
-      - MB_PYTHON_STORAGE_S_3_BUCKET=${S3_BUCKET}
-      - MB_PYTHON_STORAGE_S_3_REGION=${S3_REGION:-us-east-1}
-      - MB_PYTHON_STORAGE_S_3_ACCESS_KEY=${S3_ACCESS_KEY}
-      - MB_PYTHON_STORAGE_S_3_SECRET_KEY=${S3_SECRET_KEY}
+      - MB_PYTHON_STORAGE_S_3_ENDPOINT=http://minio:9000
+      - MB_PYTHON_STORAGE_S_3_CONTAINER_ENDPOINT=http://minio:9000
+      - MB_PYTHON_STORAGE_S_3_BUCKET=metabase-python-runner
+      - MB_PYTHON_STORAGE_S_3_REGION=us-east-1
+      - MB_PYTHON_STORAGE_S_3_PATH_STYLE_ACCESS=true
+      - MB_PYTHON_STORAGE_S_3_ACCESS_KEY=${MINIO_ROOT_USER}
+      - MB_PYTHON_STORAGE_S_3_SECRET_KEY=${MINIO_ROOT_PASSWORD}
     depends_on:
+      minio-init:
+        condition: service_completed_successfully
       python-runner:
         condition: service_started
 
@@ -197,21 +146,58 @@ services:
     image: metabase/python-runner:latest
     environment:
       - AUTH_TOKEN=${AUTH_TOKEN}
+
+  minio:
+    image: quay.io/minio/minio:latest
+    command: server /data --console-address ":9001"
+    environment:
+      - MINIO_ROOT_USER=${MINIO_ROOT_USER}
+      - MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}
+    volumes:
+      - minio-data:/data
+
+  minio-init:
+    image: quay.io/minio/mc:latest
+    depends_on:
+      minio:
+        condition: service_started
+    entrypoint:
+      - /bin/sh
+      - -c
+      - |
+        until mc alias set local http://minio:9000 "${MINIO_ROOT_USER}" "${MINIO_ROOT_PASSWORD}" >/dev/null 2>&1; do
+          echo "waiting for minio..."; sleep 2;
+        done
+        mc mb --ignore-existing local/metabase-python-runner
+
+volumes:
+  minio-data: {}
 ```
 
-Create a `.env` file with your configuration:
+Both S3 endpoint variables point at `http://minio:9000` because Metabase and the runner share the Compose network and reach MinIO by the same hostname. `MB_PYTHON_STORAGE_S_3_CONTAINER_ENDPOINT` sets the host Metabase signs into the presigned URLs the runner uploads to and downloads from — if your runner resolves storage by a different hostname than Metabase does, set this to the runner's view of it.
+
+Create a `.env` file:
 
 ```bash
 AUTH_TOKEN=your-secure-token-here
-S3_ENDPOINT=https://s3.amazonaws.com
-S3_BUCKET=metabase-python-runner
-S3_REGION=us-east-1
-S3_ACCESS_KEY=your-access-key
-S3_SECRET_KEY=your-secret-key
+MINIO_ROOT_USER=minioadmin
+MINIO_ROOT_PASSWORD=minioadmin
 ```
 
-Then run:
+Then bring everything up and try a transform:
 
-```bash
-docker compose up -d
-```
+1. Put a strong shared secret in `AUTH_TOKEN` (the runner and Metabase have to agree on it):
+
+   ```bash
+   openssl rand -hex 32
+   ```
+
+2. Start the stack:
+
+   ```bash
+   docker compose up -d
+   ```
+
+3. You'll need a Pro or Enterprise license with the [Advanced transforms add-on](addons.md). In Metabase, [enable transforms](transforms-overview.md#enable-transforms), then [create a Python transform](python-transforms.md#create-a-python-transform) and click **Run**.
+
+4. Open **Data Studio > Jobs > Runs** and find your run. If it failed, the run's logs will usually tell you whether Metabase couldn't reach the runner, or the runner couldn't reach MinIO.

docs/data-studio/transforms/python-transforms.md

@@ -108,7 +108,7 @@ To use functions or classes from your Python library:
 
 ## Incremental Python transforms
 
-By default, Metabase will process all the data in all input tables, drop the existing target table (if one exists), and create a new table with the processed data. You can tell Metabase to only write **new** data to your target table by marking your transform as incremental.
+By default, Metabase will process all the data in all input tables, drop the existing target table (if one exists), and create a new table with the processed data. You can tell Metabase to only process **new** data by marking your transform as incremental.
 
 ### Prerequisites for incremental transforms
 
@@ -120,7 +120,8 @@ To make a Python transform incremental:
 
 1. Go to the transform's page in **Data studio > Transforms**.
 2. Switch to **Settings** tab.
-3. In **Column to check for new values**, select the column in one of the source tables that Metabase should check to determine which values are new. Only some columns are eligible. See [prerequisites for incremental transforms](./transforms-overview.md#prerequisites-for-incremental-transforms).
+3. In **Field to check for new values**, select the field in one of the source tables that Metabase should scan to determine which records are new or changed. Only some fields are eligible. See [prerequisites for incremental transforms](./transforms-overview.md#prerequisites-for-incremental-transforms).
+4. (Optional) To update matching rows instead of appending new ones, [add a merge key](./transforms-overview.md#add-merge-keys-to-upsert-rows).
 
 ## Current limitations of Python transforms
 

docs/data-studio/transforms/query-transforms.md

@@ -92,7 +92,7 @@ See [Run a transform](transforms-overview.md#run-a-transform). You'll see logs f
 
 ## Incremental query transforms
 
-By default, on every transform run after the first one, Metabase will process all the data in all input tables, then drop the existing target table, and create a new table with the processed data. You can tell Metabase to only write **new** data to your target table by marking your transform as incremental.
+By default, on every transform run after the first one, Metabase will process all the data in all input tables, then drop the existing target table, and create a new table with the processed data. You can tell Metabase to only process **new** data by marking your transform as incremental.
 
 ### Prerequisites for incremental transforms
 
@@ -102,6 +102,8 @@ Your data has to have certain structure for incremental transforms to work. See
 
 For a transform to run incrementally, you'll need to pick a column ("checkpoint") that Metabase needs to check for new values. Then, behind the scenes, Metabase will add a filter around your transform query that will filter the results of the query for values greater than the last written checkpoint value.
 
+If you set a [merge key](transforms-overview.md#add-merge-keys-to-upsert-rows), Metabase updates the target rows that match the key instead of adding new ones.
+
 ### Make a query transform incremental
 
 #### Use table variables for incremental SQL transforms
@@ -152,7 +154,8 @@ To make a query transform incremental:
 
 1. Go to the transform's page in **Data studio > Transforms**.
 2. Switch to **Settings** tab.
-3. In **Column to check for new values**, select the column in one of the source tables that Metabase should check to determine which values are new. Only some columns are eligible. See [prerequisites for incremental transforms](./transforms-overview.md#prerequisites-for-incremental-transforms).
+3. In **Field to check for new values**, select the field in one of the source tables that Metabase should scan to determine which records are new or changed. Only some fields are eligible. See [prerequisites for incremental transforms](./transforms-overview.md#prerequisites-for-incremental-transforms).
+4. (Optional) To update matching rows instead of appending new ones, [add a merge key](./transforms-overview.md#add-merge-keys-to-upsert-rows).
 
 ## Convert models to transforms
 

docs/data-studio/transforms/transforms-overview.md

@@ -56,6 +56,16 @@ Permission configuration for transform depends on your plan.
   - To **see** the list of transforms on your instance, people need to be able to access Data Studio, so they need to be either an Admin or a member of the special [Data Analyst group](../../people-and-groups/managing.md).
   - To **execute** transforms on a database, people need to be either Admins on belong to the special [Data Analyst group](../../people-and-groups/managing.md). Additionally people need to have the [Transform permissions](../../permissions/data.md) for that database.
 
+## Set up transforms on a self-hosted Metabase
+
+If you run Metabase yourself, here's the path to working transforms:
+
+1. **Check your plan.** [Basic transforms](addons.md#basic-transforms) (query-based) are included on self-hosted Metabase. [Advanced transforms](addons.md#advanced-transforms) — Python transforms, the [transform inspector](transform-inspector.md), and [writable connections](../../databases/writable-connection.md) — need a self-hosted Pro or Enterprise plan with the Advanced transforms add-on.
+2. **Connect a database that can write.** Transforms create and replace tables in your database, so the database user needs create, drop, and write privileges. See [Database users, roles, and privileges](../../databases/users-roles-privileges.md). For cleaner isolation, point the transform at a [writable connection](../../databases/writable-connection.md). Only some databases [support transforms](#databases-that-support-transforms).
+3. **For Python transforms, set up a runner.** Query-based transforms need nothing extra — they run inside your database. Python transforms run in a separate execution environment, so you'll point Metabase at a [self-hosted Python runner](python-runner.md) backed by S3-compatible storage (AWS S3, MinIO, and so on).
+4. **[Enable transforms](#enable-transforms)** in Data Studio.
+5. **Create and run a transform.** [Create a query-based transform](query-transforms.md#create-a-query-based-transform) or a [Python transform](python-transforms.md#create-a-python-transform), run it manually, and check the result under **Runs**. Once it works, [schedule it with jobs](jobs-and-runs.md).
+
 ## Enable transforms
 
 Before you can start writing transforms, you'll need to enable transforms in your Metabase instance.
@@ -220,13 +230,17 @@ Metabase will track transform dependencies and execute transforms in a reasonabl
 
 On Metabase Pro or Enterprise plans, you can see the transform dependencies graph by going to **Data Studio > Transforms** and go to the **Dependencies** tab.
 
-If a job includes a transform that depends on a table created by another transform, then the job will run all the tagged transforms and their dependencies, even if they lack tags, see [Jobs and runs](jobs-and-runs.md) for more information.
+If a job includes a transform that depends on a table created by another transform, then the job will run all the tagged transforms, plus any of their [dependencies that aren't already up to date](jobs-and-runs.md#jobs-include-all-dependent-transforms).
 
 ## Incremental transforms
 
 _Data Studio > Transforms > Settings_
 
-Incremental transforms only append new data since the previous transform run. For example, you might have new transaction data coming in every day, and run the transform nightly. With each run, the incremental transform would only write the rows added after the previous run the night before.
+Incremental transforms only process the data that's new since the previous transform run. For example, you might have new transaction data coming in every day, and run the transform nightly. With each run, the incremental transform would only handle the rows added after the previous run the night before.
+
+By default, Metabase appends those rows to the target table. If your source tables track changes to a record over time, you can use an incremental strategy by setting a [merge key](#add-merge-keys-to-upsert-rows) so that Metabase updates the existing rows instead of adding duplicate rows.
+
+In this case, the checkpoint field decides which rows count as new, and the merge key decides whether Metabase appends those rows or updates the matching ones.
 
 ### Prerequisites for incremental transforms
 
@@ -234,6 +248,30 @@ Incremental transforms only append new data since the previous transform run. Fo
 - The checkpoint column has to have increasing values, like a sequential ID or timestamp column. Metabase will determine what "new" data is by looking for values that are _greater than_ already-written checkpoint values.
 - Your schema is stable, meaning that the structure of the tables is not going to change from run to run.
 
+### Add merge keys to upsert rows
+
+By default, Metabase will append rows when outputting a transform. You can add a merge key to upsert (update or append) instead.
+
+Why you'd want to add a merge key: some source tables get a new row each time a record changes. So for example the same order shows up once as `created`, again as `paid`, and again as `shipped`. If you append those rows, you end up with three rows for the same order. That may be what you want. But if instead you want to update these records in place, you can select one or more columns as merge keys, like an order ID column. If a merge key is set, Metabase will first try to update existing records that match the key. If no match is found, Metabase will append a new record.
+
+To add a merge key:
+
+1. Go to the transform's page in **Data studio > Transforms**.
+2. Switch to the **Settings** tab and turn on **Only process new data**.
+3. In **Merge key**, choose the columns that identify a record. If the target table already exists, you'll pick from a list of its columns. If the transform hasn't run yet, there's no table to pick from, so type each column name and press comma or enter. In that case, type the column's name in the database, which may differ from the display name you'd see in the list.
+
+The merge key refers to columns in the _target_ table (the columns your transform outputs), not columns in the _source_ tables. If identifying a record requires a combination of columns, like an `id` plus a `region`, pick more than one column as merge keys.
+
+Merge keys need a checkpoint field that increases every time a row is written, like an `updated_at` timestamp, otherwise the transform never sees the change.
+
+### Reprocess all data to rebuild the target table
+
+Once an incremental transform has run, its **Settings** tab shows **Last processed [checkpoint field]**, followed by the highest checkpoint value Metabase has written so far. That value is how Metabase knows where to pick up, since each run only handles rows past it.
+
+To clear that value and reprocess all rows, click **Reprocess all data**. The next run will then rebuild the target table from scratch, processing every row instead of only the new ones. The run doesn't start right away; you'll need to run the transform manually, or wait for the transform's next scheduled run.
+
+Changing the checkpoint field also resets the stored value, so a transform will rebuild from scratch on its next run after you pick a different field to use for checkpointing.
+
 ### Make a transform incremental
 
 Incremental transforms work differently for query-based transforms and Python transforms, so see [incremental query transforms](query-transforms.md#incremental-query-transforms) and [incremental Python transforms](./python-transforms.md#incremental-python-transforms) for more information.

docs/databases/connecting.md

@@ -48,7 +48,7 @@ The databases listed below have official drivers maintained by the Metabase team
 
 If you don't see your database listed here, see [Community drivers](../developers-guide/community-drivers.md).
 
-As of version 46.6.4, Metabase [no longer supports H2 connections](https://www.metabase.com/blog/vulnerability-post-mortem). But Metabase still ships with an H2 database to include an embedded application database, as well as to provide some sample data out of the box.
+As of version 46.6.4, Metabase [no longer supports H2 connections](https://www.metabase.com/blog/vulnerability-post-mortem). But Metabase still ships with an H2 database to include an embedded application database.
 
 ## Connecting to databases hosted by a cloud provider