Skip to content

bintocher/mcp-superset

v0.2.6 Bugfix

This release fixes issues for SREs watching stability and regressions.

Published 1mo MCP Data & Storage
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai-tools apache-superset claude fastmcp llm mcp
+3 more
mcp-server model-context-protocol superset

Affected surfaces

auth rbac rce_ssrf

Summary

AI summary

Fixed bulk role operation TypeError, enhanced DDL/DML guard to detect whole words including DO/EXECUTE, corrected pagination handling in *_list endpoints.

Changes in this release

Security Medium

DDL/DML guard in sqllab_execute now detects dangerous SQL keywords as whole words anywhere in the query.

DDL/DML guard in sqllab_execute now detects dangerous SQL keywords as whole words anywhere in the query.

Source: granite4.1:30b@2026-06-09-audit

Confidence: low

 —
Bugfix Medium

Bulk role operations no longer raise TypeError when using json_data= argument.

Bulk role operations no longer raise TypeError when using json_data= argument.

Source: llm_adapter@2026-06-09

Confidence: high

 —
Bugfix Medium

Pagination in *_list endpoints now respects page and page_size parameters via RISON.

Pagination in *_list endpoints now respects page and page_size parameters via RISON.

Source: llm_adapter@2026-06-09

Confidence: high

 —
Bugfix Medium

`granularity_sqla` guard now blocks only non‑temporal visualizations.

`granularity_sqla` guard now blocks only non‑temporal visualizations.

Source: llm_adapter@2026-06-09

Confidence: high

 —
Bugfix Medium

Auto‑sync datasource_access changes HTTP method from PUT to POST.

Auto‑sync datasource_access changes HTTP method from PUT to POST.

Source: llm_adapter@2026-06-09

Confidence: high

 —
Bugfix Medium

User‑provided JSON input to json.loads now returns a structured error instead of crashing.

User‑provided JSON input to json.loads now returns a structured error instead of crashing.

Source: llm_adapter@2026-06-09

Confidence: high

 —
Bugfix Medium

CSRF token refresh retries on 400 errors without masking validation messages.

CSRF token refresh retries on 400 errors without masking validation messages.

Source: llm_adapter@2026-06-09

Confidence: low

 —
Full changelog

Багфикс-релиз. Исправлены баги, найденные при ревью кода (+ независимое ревью второй моделью).

Fixed

  • Bulk role operations падали с TypeError (json= → json_data=)
  • DDL/DML-гард sqllab_execute обходился через WITH/;/скобки/EXPLAIN/COPY/DO $$ EXECUTE '...' — теперь поиск опасных слов (вкл. DO/EXECUTE) как целых слов в любом месте
  • Пагинация *_list (вкл. group_list) игнорировала page/page_size — переведена на RISON через client.get_page()
  • CSRF не обновлялся при протухании — retry на 400 с CSRF-ошибкой без маскирования ошибок валидации
  • granularity_sqla-гард блокировал нетемпоральные чарты (карты, pie) — теперь только для темпоральных viz
  • Auto-sync datasource_access: PUT .../permissions/ → POST .../permissions
  • json.loads пользовательского ввода → структурный {error} вместо краша

Changed

  • Консолидация дублированного datasource_access-хелпера
  • Убрана ссылка на несуществующий superset_rls_create_unsafe
  • Единый слеш в dataset/related_objects

Полный список: CHANGELOG.md

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track bintocher/mcp-superset

Get notified when new releases ship.

Sign up free

About bintocher/mcp-superset

MCP server for managing Apache Superset — 128+ tools for dashboards, charts, datasets, SQL Lab, access control

All releases →

Related context

Beta — feedback welcome: [email protected]