[SC-72636] chore: reset fork onto upstream 26.05.0-dev (Python 3.13 + Poetry + pnpm) by jcesarioatpeach · Pull Request #96 · peachfinance/redash

jcesarioatpeach · 2026-05-05T17:49:44Z

Summary

Resets peachfinance/redash onto upstream getredash/redash at 29425475 (26.05.0-dev). The fork's 40 commits were either already merged upstream (Datadog destination) or superseded by upstream's new stack. Only fork-specific files are carried forward.

Rollback tag: pre-upstream-reset-2026-05-04 (points to old master, still on origin)

Stack Migration

Before (fork)	After (upstream)
pip + requirements.txt	Poetry + pyproject.toml
yarn	pnpm
Python 3.8	Python 3.13
flake8	ruff + black
node:14	node:24
CircleCI (Python 3.7 config)	CircleCI (rewritten for new stack)

Fork-Specific Files Carried Forward

.snyk — ignore list for vulns blocked by third-party constraints + exclude globs
.gitignore — .claude/worktrees/ and .terraform/modules/ exclusions
.circleci/config.yml — rewritten for Python 3.13 + Poetry + pnpm + ruff/black

Snyk Vulnerability Fixes (applied on top of upstream)

Package	Before	After	Vulns Fixed
authlib	0.15.5	1.6.9	1 CRITICAL + 6 HIGH
pyjwt	2.4.0	2.12.0	1 HIGH
gunicorn	22.0.0	23.0.0	1 HIGH
sqlparse	0.5.0	0.5.4	1 HIGH
botocore/boto3	1.31.8/1.28.8	≥1.35.0	urllib3 2.x compat unblocked
mako	(transitive)	≥1.3.11 pin	1 HIGH (directory traversal)
pyasn1	(transitive)	≥0.6.3 pin	2 HIGH
axios (root)	0.27.2	0.31.1	2 CRITICAL + 3 HIGH
axios (viz-lib)	0.28.0	0.31.1	2 CRITICAL + 3 HIGH
lodash (viz-lib)	^4.17.10	^4.18.1	1 HIGH
follow-redirects	1.15.11	≥1.16.0 (pnpm override)	1 HIGH

Snyk ignored (blocked by third-party constraints, justified in .snyk):

SNYK-PYTHON-WERKZEUG-6808933 — fix needs Flask 3.x; debugger-only, prod-safe
SNYK-PYTHON-URLLIB3-* (3 vulns) — fix needs urllib3 2.x; blocked by advocate==1.0.0
SNYK-PYTHON-PYOPENSSL-15674459 — blocked by snowflake-connector-python==3.12.3
SNYK-PYTHON-CRYPTOGRAPHY-15263096 — blocked by snowflake-connector-python==3.12.3

Before / After

After: snyk test --severity-threshold=high --all-projects → ok: true, 0 vulnerable paths (3/3 projects)

⚠️ Post-Merge Action Required

6 new DB migrations were added in upstream since the fork diverged. Must run against staging first, then production with a backup:

flask db upgrade

Test Plan

snyk test --severity-threshold=high --all-projects → 0 vulnerable paths
poetry install --no-root resolves cleanly (Python 3.13)
pnpm install --ignore-scripts resolves cleanly
Pre-reset rollback tag pre-upstream-reset-2026-05-04 pushed to origin
.circleci/config.yml rewritten for Python 3.13 + pnpm + Poetry + ruff/black
CircleCI pipeline passes
flask db upgrade run on staging
flask db upgrade run on production (after staging validates)

🤖 Generated with Claude Code

* fix(aws-es): fixed es auth * fixed lock * rq v1.16

…ash#6890) This combines the manual steps needed for installing the Python dependencies into a single Makefile target.

This code was supposed to be temporary, and raises an exception if REDASH_MULTI_ORG=true is set.

* consistent rq status naming and handling * test fix * make scheduled and deferred statuses cancelable

Co-authored-by: Peter Lee <yankeeguyu@gmail.com>

Use Webpack configuration for locating this asset in the same way that client/app/index.html does. This code path is when REDASH_MULTI_ORG=true. Co-authored-by: github-actions <github-actions@github.com>

…ash#6908)

Restore previous functionality. Ensure .env exists before building server. Co-authored-by: github-actions <github-actions@github.com>

The 'codecov-action@v4' requires an organization-level upload token, not a single repo upload token, so we're temporarily downgrading it until we can generate an organization-level upload token. Reference: codecov/codecov-action#1273

@andyundso

Thanks to substantial efforts by @andyundso, the Docker Hub images for pgautoupgrade are now multi-arch (x86_64 and ARM64). :)

…redash#6941)

* serialize errors * lint fix * cover successful case

This reverts commit bd115e7, as it turns out to be a useful security feature. In order to remove this in a better way, we'll need to replace it with something that provides equivalent functionality.

Bumps [jinja2](https://github.com/pallets/jinja) from 3.1.3 to 3.1.4. - [Release notes](https://github.com/pallets/jinja/releases) - [Changelog](https://github.com/pallets/jinja/blob/main/CHANGES.rst) - [Commits](pallets/jinja@3.1.3...3.1.4) --- updated-dependencies: - dependency-name: jinja2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

"Query in queue" should switch to "Executing query", but does not. Commands: git revert --no-commit bd17662 git revert --no-commit 5ac5d86 vim tests/handlers/test_query_results.py git add tests/handlers/test_query_results.py Co-authored-by: Justin Clift <justin@postgresql.org>

…antd tooltip if they are defined (getredash#6582)" (getredash#6971) This reverts commit c12d450. This commit did not sort tables properly by schema, then name

updated-dependencies: - dependency-name: requests dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Aggregate y-value for the same x * Fix styling error by prettier

Co-authored-by: Tsuneo Yoshioka <yoshiokatsuneo@gmail.com>

* Update Python version to 3.13 * Limit scope for supressing warning * Update td-client to 1.5.0 to avoid the warning

Signed-off-by: shunki-fujita <shunki-fujita@cybozu.co.jp> Co-authored-by: Tsuneo Yoshioka <yoshiokatsuneo@gmail.com>

* added cleint_tags added the option to pass client tags to trino clusters source * removed redundant checks * removed redundant test and fixed if condition --------- Co-authored-by: Tsuneo Yoshioka <yoshiokatsuneo@gmail.com>

…#7644) Trino ROW (struct) columns were serialized as plain arrays, losing all field name information. This converts NamedRowTuple values to dicts using the field name metadata from the trino library, so ROW fields appear as {"field": value} instead of [value]. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Tsuneo Yoshioka <yoshiokatsuneo@gmail.com>

* Update changelog from wiki release notes * Apply suggestions from code review Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> --------- Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>

…redash#7647) * Make gunicorn bind address configurable via REDASH_GUNICORN_BIND Upstream commit d2a7d87 hardcoded the bind address to [::]:5000 for IPv6 support, but this breaks on nodes where IPv6 is disabled in the kernel. Make the bind address configurable via REDASH_GUNICORN_BIND, defaulting to 0.0.0.0:5000 for IPv4. Users needing IPv6 dual-stack can set REDASH_GUNICORN_BIND="[::]:5000". Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Default REDASH_GUNICORN_BIND to [::]:5000 to preserve upstream behavior Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Tsuneo Yoshioka <yoshiokatsuneo@gmail.com>

* Snapshot: 24.07.0-dev * Snapshot: 24.08.0-dev * Snapshot: 24.09.0-dev * Snapshot: 24.10.0-dev * Snapshot: 24.11.0-dev * Snapshot: 24.12.0-dev * Snapshot: 25.01.0-dev * Snapshot: 25.02.0-dev * Snapshot: 25.03.0-dev * Snapshot: 25.04.0-dev * Upgrade Node.js version to 24 in Dockerfile and .nvmrc; update package.json engine constraints * Update major dependencies * Switch from yarn to pnpm * Switch from yarn to pnpm: ci * Update Python version to 3.13 in CI workflow * Refactor Netlify build command to remove pnpm installation step * Update ESLint configuration for improved compatibility and disable specific rules * Restyled by prettier * Add typeRoots and types to tsconfig for improved type definitions * Update Dockerfile.cypress to use Node 24 and streamline installation steps * Fixed tests * Restyled by prettier * Update Jest snapshot comments to point to the official documentation URL * viz-lib: refactor test setup and update snapshots for consistency * Add babel-jest as a dev dependency for improved testing support * Add virtual prop to visualization type selector for improved functionality * Remove CJS/ESM compatibility shim for color-rgba * Restyled by prettier * Enable ESLintPlugin conditionally based on production environment * Import d3 library in d3box.ts * Fix pip install command in CI workflow to use python -m * Replace d3 import with global declaration for compatibility with d3 v3 --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Restyled.io <commits@restyled.io>

fixed typos & grammar; AppMetrica spelling, articles

@arikfr

* cloudflare d1 support * updated to use sessions instead of request as suggested by @arikfr * Refactor imports and remove dependency check Removed dependency check for requests_session and cleaned up imports. * Remove blank line in column info extraction Removed unnecessary blank line in the column information extraction section. * Add TYPE_DATETIME to query runner imports * fix Import block is un-sorted & Local variable 'e' * ran ruff check for fixing the lint error * fix backend-lint errors --------- Co-authored-by: Arik Fraimovich <arik@arikfr.com>

…72636] Resets peachfinance/redash onto upstream/master (2942547) — 658 upstream commits since fork diverged. All 40 fork commits were either already merged upstream (Datadog destination) or superseded by upstream's new stack (Poetry, pnpm, Python 3.13). Pre-reset rollback tag: pre-upstream-reset-2026-05-04 Fork-specific additions carried forward: - .snyk: ignore list for vulns blocked by third-party constraints - .gitignore: .claude/worktrees/ and .terraform/modules/ exclusions - .circleci/: config rewritten for Python 3.13 + Poetry + pnpm + ruff/black Snyk vuln fixes applied on top of upstream: Python (pyproject.toml): - authlib 0.15.5 → 1.6.9 (1 CRITICAL + 6 HIGH) - pyjwt 2.4.0 → 2.12.0 (1 HIGH: improper sig verification) - gunicorn 22.0.0 → 23.0.0 (1 HIGH: HTTP request smuggling) - sqlparse 0.5.0 → 0.5.4 (1 HIGH: resource exhaustion) - botocore/boto3 1.31.8/1.28.8 → >=1.35.0 (urllib3 2.x compat) - mako pinned >=1.3.11 (1 HIGH: directory traversal, transitive) - pyasn1 pinned >=0.6.3 (2 HIGH: recursion + allocation, transitive) JS (pnpm): - axios 0.27.2→0.31.1 (root), 0.28.0→0.31.1 (viz-lib): 2 CRITICAL + 4 HIGH - lodash ^4.17.10→^4.18.1 (1 HIGH: code injection) - follow-redirects forced >=1.16.0 via pnpm.overrides (1 HIGH) Snyk ignored (blocked by transitive constraints, justified in .snyk): - SNYK-PYTHON-WERKZEUG-6808933: fix needs Flask 3.x (debugger-only, prod-safe) - SNYK-PYTHON-URLLIB3-*: fix needs urllib3 2.x, blocked by advocate==1.0.0 - SNYK-PYTHON-PYOPENSSL-15674459: blocked by snowflake-connector-python==3.12.3 - SNYK-PYTHON-CRYPTOGRAPHY-15263096: blocked by snowflake-connector-python==3.12.3 Result: snyk test --severity-threshold=high → 0 vulnerable paths (3/3 projects) Post-merge action required: run `flask db upgrade` on staging then prod (6 new upstream DB migrations since fork diverged). Take DB backup first. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…usr/local/bin/pnpm)

… reset (history reset PR) # Conflicts: # requirements.txt # requirements_all_ds.txt # viz-lib/yarn.lock # yarn.lock

…updated specifiers

…build for type-check); parameterize docker_build to use DOCKER_REPOSITORY env var

…kg.dev/$GOOGLE_PROJECT_ID/peach-docker); remove DOCKER_CONTENT_TRUST (unsupported on GAR)

…ash; switch .ci/docker_build to GCP Artifact Registry

jcesarioatpeach · 2026-05-05T19:19:20Z

@cursor carefully review, read only, think hard, MAXIMUM EFFORT!

cursor · 2026-05-05T19:19:27Z

Now I have a complete picture. Let me create a comprehensive review document:

Comprehensive Review - PR #96: Reset Fork onto Upstream 26.05.0-dev

Executive Summary

This PR represents a major strategic reset of the peachfinance/redash fork onto upstream getredash/redash at commit 294254752 (26.05.0-dev). The reset is well-executed with systematic vulnerability remediation and proper preservation of fork-specific customizations.

✅ Strengths & Positive Observations

1. Fork Reset Execution - EXCELLENT

Clean reset onto upstream commit 294254752 (26.05.0-dev)
Rollback tag pre-upstream-reset-2026-05-04 properly created and pushed
All 40 fork commits correctly assessed (Datadog feature already merged upstream, other changes superseded)
Stack migration fully aligned with upstream's modernization

2. Vulnerability Remediation - COMPREHENSIVE

All claimed vulnerability fixes are correctly applied:

Python (pyproject.toml):

✅ authlib: 0.15.5 → 1.6.9 (fixes 1 CRITICAL + 6 HIGH)
✅ pyjwt: 2.4.0 → 2.12.0 (fixes 1 HIGH)
✅ gunicorn: 22.0.0 → 23.0.0 (fixes 1 HIGH)
✅ sqlparse: 0.5.0 → 0.5.4 (fixes 1 HIGH)
✅ boto3/botocore: 1.28.8/1.31.8 → ≥1.35.0
✅ mako: pinned ≥1.3.11 (transitive fix)
✅ pyasn1: pinned ≥0.6.3 (transitive fix)

JavaScript (pnpm):

✅ axios (root): 0.27.2 → 0.31.1
✅ axios (viz-lib): 0.28.0 → 0.31.1
✅ lodash (root devDeps): ^4.17.21 → ^4.18.1
✅ lodash (viz-lib): ^4.17.10 → ^4.18.1
✅ follow-redirects: ≥1.16.0 via pnpm.overrides

3. Fork-Specific Files - PROPERLY PRESERVED

✅ .snyk: Comprehensive ignore policy with justified exceptions
✅ .gitignore: Fork-specific exclusions (.claude/, .terraform/)
✅ .circleci/config.yml: Completely rewritten for Python 3.13 + Poetry + pnpm

4. Stack Migration - VERIFIED

Component	Before	After	Status
Python	3.8	3.13	✅ Dockerfile verified
Dependency Mgmt	requirements.txt	Poetry + pyproject.toml	✅ No requirements.txt present
Node	yarn	pnpm@10.30.3	✅ package.json verified
Linting	flake8	ruff + black	✅ CircleCI config verified
Node version	14	24	✅ CircleCI + Dockerfile verified

5. Database Migrations - ACCURATELY DOCUMENTED

The PR correctly identifies 6 new upstream migrations:

1038c2174f5d_make_case_insensitive_hash_of_query_text.py
1655999df5e3_default_alert_selector.py
7205816877ec_change_type_of_json_fields_from_varchar_.py
7ce5925f832b_create_sqlalchemy_searchable_expressions.py
9e8c841d1a30_fix_hash.py
db0aca1ebd32_12_column_dashboard_layout.py

⚠️ CRITICAL: These require flask db upgrade on staging then production

6. GCP Artifact Registry Migration - COMPLETED

✅ .ci/docker_build: Updated to push to us-docker.pkg.dev/${GOOGLE_PROJECT_ID}/peach-docker
✅ .circleci/docker_build: Updated to use GCP Artifact Registry
✅ Repository references: Updated from getredash/redash to peachfinance/redash in build scripts

⚠️ Issues Found - 1 MINOR INCONSISTENCY

Issue #1: Incomplete Repository Reference Update

Severity: MINOR (cosmetic)

Location: viz-lib/package.json:24

"url": "git+https://github.com/getredash/redash.git"

Should be:

"url": "git+https://github.com/peachfinance/redash.git"

Impact: This is purely metadata used by npm/pnpm for package info. It doesn't affect build, runtime, or functionality. However, for consistency with the other updates in commit 37e5022a7, it should be updated.

Other acceptable references: The remaining getredash/redash references found are appropriate:

CHANGELOG.md, README.md, CONTRIBUTING.md: Historical PR links and upstream references
Code comments: References to specific upstream issues/PRs for context
bin/release_manager.py: Upstream repo reference (may be unused in fork)

📊 Technical Verification

Commit History Analysis

37e5022a7 - fix: update hardcoded getredash/redash references (GCP Artifact Registry)
5589ff873 - fix: update Docker push targets to GCP Artifact Registry
5a0048c61 - fix: remove --ignore-scripts from frontend-unit-tests
f49902e2d - fix: regenerate pnpm-lock.yaml after auto-merge
c2ada5ee2 - Merge peachfinance/master (conflict resolution)
c90278a0b - fix: use sudo for corepack enable in CircleCI
209093447 - chore: reset fork onto upstream 26.05.0-dev + resolve Snyk vulns ⭐
294254752 - Snapshot: 26.05.0-dev (upstream base)

The commit history shows iterative fixes after the main reset, which is normal for complex migrations.

CircleCI Configuration

The new .circleci/config.yml is comprehensive:

✅ backend-lint: Python 3.13 + ruff + black
✅ backend-unit-tests: Docker Compose + Poetry
✅ frontend-lint: Node 24 + pnpm
✅ frontend-unit-tests: Full test suite
✅ build-docker-image: Proper integration

🎯 Recommendations

REQUIRED Before Merge:

✅ Update viz-lib/package.json repository URL for consistency
✅ Verify CircleCI passes (currently 1 failed check - Restyled, which is cosmetic)

REQUIRED After Merge (Production):

⚠️ Run flask db upgrade on STAGING first
⚠️ Validate staging environment thoroughly
⚠️ Take production database backup
⚠️ Run flask db upgrade on production
⚠️ Monitor for migration-related issues

Optional (Lower Priority):

Consider updating .github/ISSUE_TEMPLATE/ references (currently point to upstream)
Consider whether bin/release_manager.py should point to fork

📝 Summary Assessment

Overall Grade: A-

This is an exceptionally well-executed fork reset with:

✅ Complete stack migration aligned with upstream
✅ Comprehensive vulnerability remediation (10 packages fixed)
✅ Proper preservation of fork-specific customizations
✅ Accurate documentation of migration requirements
✅ Clean commit history with iterative fixes
⚠️ One minor inconsistency (viz-lib package.json)

Risk Level: MEDIUM (primarily due to 6 new DB migrations requiring production deployment)

Recommendation: APPROVE after fixing viz-lib/package.json reference

The work demonstrates strong technical discipline in:

Fork maintenance strategy
Security vulnerability management
Build system modernization
Dependency management hygiene

The only concern is ensuring the database migrations are tested thoroughly on staging before production deployment.

AndrewChubatiuk and others added 30 commits April 17, 2024 17:46

Rq upgrade (getredash#6902)

7e8a61c

* fix(aws-es): fixed es auth * fixed lock * rq v1.16

Add pydeps Makefile target for installing Python dependencies (getred…

6c68b48

…ash#6890) This combines the manual steps needed for installing the Python dependencies into a single Makefile target.

Remove workaround from check_csrf() (getredash#6919)

e2a39de

This code was supposed to be temporary, and raises an exception if REDASH_MULTI_ORG=true is set.

bugfix: unable to parse elasticsearch index mappings (getredash#6918)

5e4764a

consistent rq status naming and handling (getredash#6913)

5ac5d86

* consistent rq status naming and handling * test fix * make scheduled and deferred statuses cancelable

Update widgets.py (getredash#6926)

1c48b22

mssql-odbc-arm64 (getredash#6924)

3399e37

Co-authored-by: Peter Lee <yankeeguyu@gmail.com>

Use staticPath var to fetch unsupportedRedirect.js (getredash#6923)

84e6d3c

Use Webpack configuration for locating this asset in the same way that client/app/index.html does. This code path is when REDASH_MULTI_ORG=true. Co-authored-by: github-actions <github-actions@github.com>

aggregate Y column values rather than displaying last Y value (getred…

f097603

…ash#6908)

Flatten all level for MongoDB data source (getredash#6844)

0624471

Source .env when running docker containers (getredash#6927)

dbab9ca

Restore previous functionality. Ensure .env exists before building server. Co-authored-by: github-actions <github-actions@github.com>

Snapshot: 24.05.0-dev

2b974e1

pgautoupgrade now does multi-arch builds (getredash#6939)

897c683

Thanks to substantial efforts by @andyundso, the Docker Hub images for pgautoupgrade are now multi-arch (x86_64 and ARM64). :)

Fix 'str' object has no attribute 'pop' error when parsing query (get…

b7f22b1

…redash#6941)

Fixed error serialization (getredash#6937)

bd17662

* serialize errors * lint fix * cover successful case

Remove deprecated advocate package (getredash#6944)

bd115e7

Revert "Remove deprecated advocate package (getredash#6944)"

62890c3

This reverts commit bd115e7, as it turns out to be a useful security feature. In order to remove this in a better way, we'll need to replace it with something that provides equivalent functionality.

sync .nvmrc with workflow (getredash#6958)

1b946b5

Revert CI workflow (1 of 2) (getredash#6965)

753ea84

Revert build (2 of 2) (getredash#6967)

58cc49b

Update MSSQL OBDC driver to v18 (getredash#6968)

408ba78

Bump pyodbc from 4.0.28 to 5.1.0 (getredash#6962)

f3a3236

Revert "show pg and athena column comments and table descriptions as …

10a46fd

…antd tooltip if they are defined (getredash#6582)" (getredash#6971) This reverts commit c12d450. This commit did not sort tables properly by schema, then name

Typo fix in message (getredash#6979)

bd4ba96

Merge pull request from GHSA-32fw-wc7f-7qg9

60d3c66

--- (getredash#6981)

ec051a8

updated-dependencies: - dependency-name: requests dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Snapshot: 24.06.0-dev

60a12e9

yoshiokatsuneo and others added 27 commits February 20, 2026 13:50

Aggregate y value for same x (getredash#7631)

3b0ea56

* Aggregate y-value for the same x * Fix styling error by prettier

Add charset option to RDS MySQL datasource (getredash#7616)

55fa213

Co-authored-by: Tsuneo Yoshioka <yoshiokatsuneo@gmail.com>

Update plotly.js to 3.3.1, react-pivottable to 0.11.0 (getredash#7634)

5de63be

Update Python version to 3.13 (getredash#7636)

ee2afc1

* Update Python version to 3.13 * Limit scope for supressing warning * Update td-client to 1.5.0 to avoid the warning

cli: add --json option to users list command (getredash#7624)

a81f777

Signed-off-by: shunki-fujita <shunki-fujita@cybozu.co.jp> Co-authored-by: Tsuneo Yoshioka <yoshiokatsuneo@gmail.com>

Add last 2 years, last 3 years to the Date Range list (getredash#7635)

8f76f84

Add pivot chart (getredash#7632)

dd0d87e

Fix regular expression warning (getredash#7650)

d410be6

Snapshot: 26.03.0-dev

57567c7

Add annotated query option in trino datasource (getredash#7657)

6ab5fe0

Update README.md (getredash#7501)

773ad0a

fixed typos & grammar; AppMetrica spelling, articles

Fix error on pnpm install (getredash#7670)

fc1b23f

Snapshot: 26.04.0-dev

e2437d8

Snapshot: 26.05.0-dev

2942547

fix: use sudo for corepack enable in CircleCI (permission denied on /…

c90278a

…usr/local/bin/pnpm)

Merge peachfinance/master; resolve all conflicts in favor of upstream…

c2ada5e

… reset (history reset PR) # Conflicts: # requirements.txt # requirements_all_ds.txt # viz-lib/yarn.lock # yarn.lock

fix: regenerate pnpm-lock.yaml after viz-lib/package.json auto-merge …

f49902e

…updated specifiers

fix: remove --ignore-scripts from frontend-unit-tests (viz-lib needs …

5a0048c

…build for type-check); parameterize docker_build to use DOCKER_REPOSITORY env var

fix: update Docker push targets to GCP Artifact Registry (us-docker.p…

5589ff8

…kg.dev/$GOOGLE_PROJECT_ID/peach-docker); remove DOCKER_CONTENT_TRUST (unsupported on GAR)

fix: update hardcoded getredash/redash references to peachfinance/red…

37e5022

…ash; switch .ci/docker_build to GCP Artifact Registry

fix: update viz-lib/package.json repository URL to peachfinance/redash

766682f

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[SC-72636] chore: reset fork onto upstream 26.05.0-dev (Python 3.13 + Poetry + pnpm)#96

[SC-72636] chore: reset fork onto upstream 26.05.0-dev (Python 3.13 + Poetry + pnpm)#96
jcesarioatpeach wants to merge 666 commits intomasterfrom
johncesario/reset-onto-upstream-26.05

jcesarioatpeach commented May 5, 2026

Uh oh!

jcesarioatpeach commented May 5, 2026

Uh oh!

cursor Bot commented May 5, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

19 participants

Conversation

jcesarioatpeach commented May 5, 2026

Summary

Stack Migration

Fork-Specific Files Carried Forward

Snyk Vulnerability Fixes (applied on top of upstream)

Before / After

⚠️ Post-Merge Action Required

Test Plan

Uh oh!

jcesarioatpeach commented May 5, 2026

Uh oh!

cursor Bot commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Comprehensive Review - PR #96: Reset Fork onto Upstream 26.05.0-dev

Executive Summary

✅ Strengths & Positive Observations

1. Fork Reset Execution - EXCELLENT

2. Vulnerability Remediation - COMPREHENSIVE

3. Fork-Specific Files - PROPERLY PRESERVED

4. Stack Migration - VERIFIED

5. Database Migrations - ACCURATELY DOCUMENTED

6. GCP Artifact Registry Migration - COMPLETED

⚠️ Issues Found - 1 MINOR INCONSISTENCY

Issue #1: Incomplete Repository Reference Update

📊 Technical Verification

Commit History Analysis

CircleCI Configuration

🎯 Recommendations

REQUIRED Before Merge:

REQUIRED After Merge (Production):

Optional (Lower Priority):

📝 Summary Assessment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

19 participants

cursor Bot commented May 5, 2026 •

edited

Loading