rusackas opened a new pull request, #42126: URL: https://github.com/apache/superset/pull/42126
### SUMMARY Closes #41045. Removes deck.gl's "JavaScript tooltip" family of controls — `js_tooltip`, `js_onclick_href`, `js_data_mutator`, and the GeoJSON layer's label/icon JavaScript-mode generators (`label_javascript_config_generator`, `icon_javascript_config_generator`) — along with the `ENABLE_JAVASCRIPT_CONTROLS` feature flag that gated them. These let a user write arbitrary JavaScript, executed via a Node `vm`-based sandbox at chart-render time, to customize deck.gl tooltips, click behavior, and data transforms. The flag defaulted off and the feature saw negligible real-world use, so this is a straightforward removal rather than a migration. **What's removed:** - The 5 form-data controls above, across all 10 deck.gl layer control panels (`js_columns` — used independently for the built-in field-based tooltips and cross-filtering — is kept). - `jsFunctionControl`/`jsFunctionInfo` (the shared control-panel factory for these fields) from `Shared_DeckGL.tsx`. - `sandboxedEval()` and its whole file (`utils/sandbox.ts`), plus every call site across the deck.gl layers. - The backend `JS_CONTROL_FORM_DATA_KEYS`/`REJECTED_FORM_DATA_KEYS` form-data-stripping mechanism in `superset/views/utils.py` — now moot since nothing evaluates these keys as JS anymore. - `ENABLE_JAVASCRIPT_CONTROLS` from `superset/config.py`, `FRONTEND_CONF_KEYS` in `superset/views/base.py`, and the frontend `FeatureFlag` enum. - The now-dead `vm-browserify` webpack polyfill/devDependency and the `underscore` package, which `sandbox.ts` alone pulled into the deck.gl plugin. - Tests, fixtures, and docs (`docs/static/feature-flags.json`, regenerated via `scripts/extract_feature_flags.py`) specific to the removed feature. **On vm2:** the issue's premise was that this feature depends on the deprecated `vm2` package. That turned out not to be the case — the actual sandbox always used Node's built-in `vm` module (browser-polyfilled via `vm-browserify`, now also removed). `vm2` was only ever a *transitive* dev-dependency of the unrelated Cartodiagram plugin, via `geostyler` → `typescript-json-schema`. I confirmed `[email protected]` dropped `vm2` upstream, that geostyler ships no code that actually touches `typescript-json-schema` at runtime (only a dangling `package.json` dependency declaration), and forced that resolution via an npm `overrides` entry. `vm2` is now fully gone from `package-lock.json`; Cartodiagram's build and full test suite still pass. **Backwards compatibility:** any saved chart with these fields set will simply ignore them going forward and fall back to deck.gl's built-in field-based tooltips (`tooltip_contents`/`tooltip_template`) and native click/cross-filter behavior. No migration needed — see the `UPDATING.md` entry. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF N/A — no UI change for the common case; removed controls simply no longer appear in the "Advanced" section of deck.gl chart control panels. ### TESTING INSTRUCTIONS - `cd superset-frontend && npx oxlint -c oxlint.json` — 0 errors. - `npx tsc --noEmit -p tsconfig.json` — 0 errors (after `npm run plugins:build -- "*"`). - Ran the full deck.gl plugin Jest suite (27 files, 374 tests) and the Cartodiagram plugin's Jest suite (12 files, 46 tests) — all pass. - `ruff check`, `ruff format --check`, and `mypy` clean on the touched Python files (one pre-existing, unrelated mypy finding in `views/utils.py` confirmed via `git stash` to predate this change). - `pytest tests/unit_tests/views/` (159 tests) and the relevant integration tests (`viz_tests.py -k deck`, `commands_tests.py::TestImportChartsCommand::test_import_v1_chart`) pass. - `pre-commit run` (prettier, oxlint, custom-rules, stylelint, type-checking, ruff, pylint, feature-flags-doc-sync) all pass on the full changed-file set. ### ADDITIONAL INFORMATION - [x] Has associated issue: closes #41045 - [ ] Required feature flags: - [x] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [x] Removes existing feature or API 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
