chore(release): v2.1 preflight — release/2.0 + 14 cherry-picks

[alfredo1996]

Summary

This PR exists to run CI against dev for the v2.1 preflight branch. The intent (pre-approved with user) is to force-push this branch over dev to ship v2.1, replacing dev's 813-commit divergence with the cleanly-landed release/2.0 cascade work + a small set of essential cherry-picks.

What's on this branch

Branched from origin/release/2.0 (which has cascade PRs #768–#775 + early stabilization). +14 commits applied:

Security cherry-picks from dev (5):

• Wildcard CORS removal on OpenAPI endpoint (fix(security): remove wildcard CORS from OpenAPI endpoint #689)
• HTTPS redirect middleware for production (fix(security): add HTTPS redirect middleware for production #690) + local-host detection widening
• REGISTRATION_ENABLED enforced in signup server action (fix(security): enforce REGISTRATION_ENABLED in signup server action #687)
• XSS escape in chart tooltips + Shiki sanitization
• Dedup of escapeHtml into single export

Feature cherry-picks from dev (3):

• Percent stacked bar chart mode (feat(component): percentage stacked bar chart mode #167) + refactor
• Markdown syntax highlighting for fenced code blocks (feat(component): syntax highlighting for markdown code blocks #166)
• Chart export as SVG (feat: export chart as SVG #706)

Follow-up fixes (3):

• displayValue typed as number|string for ECharts compat
• Shiki imports updated to @shikijs/themes/* for v4.x
• Dashboard test uses non-ECharts widget so SVG-export action assertion passes

Chore (1):

• CLI unused-import cleanup flagged by ESLint

Explicit scope decisions

• Multi-step form wizard (feat(component): multi-step form wizard #165) — dropped ("just noise for now"). Issue feat(widgets): re-implement form wizard on dev (HIGH RISK — from cascade #764) #785 will close without re-impl.
• JWT fix (fix(security): JWT maxAge + session invalidation on password/role change #691) — already on release/2.0 via cascade (0005_perfect_paibok.sql); no patch needed.
• tenantId on password reset (fix(security): add tenantId to admin password reset WHERE clause #686) — already on release/2.0.
• ~813 other dev-only commits are either already on release/2.0 under different SHAs, or noise.

Local verification (green)

• npm run build ✓
• npm -w app run test — 2608/2608 ✓
• npm -w component run test — 1271/1271 ✓
• npm run lint — 0 errors (2 pre-existing warnings)

Test plan

• CI passes (build, lint, unit, E2E, SonarCloud, CodeRabbit)
• No critical/major SonarCloud findings introduced
• No CodeRabbit blockers
• After green: force-push to dev (requires explicit user confirmation)

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Too many files!

This PR contains 273 files, which is 123 over the limit of 150.

To get a review, narrow the scope:
• coderabbit review --type committed # exclude uncommitted changes
• coderabbit review --dir # limit to a subdirectory
• coderabbit review --base # compare against a closer base

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 41b9969a-4819-4913-8347-df2a76c660fe

📥 Commits

Reviewing files that changed from the base of the PR and between eaca140 and 17ec7dd.

⛔ Files ignored due to path filters (27)

• app/.screenshots/after/api-keys-create-dialog.png is excluded by !**/*.png, !app/.screenshots/**
• app/.screenshots/after/api-keys-populated-table.png is excluded by !**/*.png, !app/.screenshots/**
• app/.screenshots/before/api-keys-create-dialog.png is excluded by !**/*.png, !app/.screenshots/**
• app/.screenshots/before/api-keys-created-dialog.png is excluded by !**/*.png, !app/.screenshots/**
• app/.screenshots/before/api-keys-empty-state.png is excluded by !**/*.png, !app/.screenshots/**
• app/.screenshots/before/api-keys-populated-table.png is excluded by !**/*.png, !app/.screenshots/**
• app/.screenshots/before/api-keys-revoke-confirm.png is excluded by !**/*.png, !app/.screenshots/**
• app/.screenshots/form-widget-403-write-permission.png is excluded by !**/*.png, !app/.screenshots/**
• app/drizzle/migrations/0000_wooden_zeigeist.sql is excluded by !app/drizzle/migrations/**
• app/drizzle/migrations/0001_rapid_iron_monger.sql is excluded by !app/drizzle/migrations/**
• app/drizzle/migrations/0002_redundant_night_nurse.sql is excluded by !app/drizzle/migrations/**
• app/drizzle/migrations/0003_loving_centennial.sql is excluded by !app/drizzle/migrations/**
• app/drizzle/migrations/0004_furry_scourge.sql is excluded by !app/drizzle/migrations/**
• app/drizzle/migrations/0005_perfect_paibok.sql is excluded by !app/drizzle/migrations/**
• app/drizzle/migrations/0006_busy_champions.sql is excluded by !app/drizzle/migrations/**
• app/drizzle/migrations/0007_free_loners.sql is excluded by !app/drizzle/migrations/**
• app/drizzle/migrations/meta/0000_snapshot.json is excluded by !app/drizzle/migrations/**
• app/drizzle/migrations/meta/0001_snapshot.json is excluded by !app/drizzle/migrations/**
• app/drizzle/migrations/meta/0002_snapshot.json is excluded by !app/drizzle/migrations/**
• app/drizzle/migrations/meta/0003_snapshot.json is excluded by !app/drizzle/migrations/**
• app/drizzle/migrations/meta/0004_snapshot.json is excluded by !app/drizzle/migrations/**
• app/drizzle/migrations/meta/0005_snapshot.json is excluded by !app/drizzle/migrations/**
• app/drizzle/migrations/meta/0006_snapshot.json is excluded by !app/drizzle/migrations/**
• app/drizzle/migrations/meta/0007_snapshot.json is excluded by !app/drizzle/migrations/**
• app/drizzle/migrations/meta/_journal.json is excluded by !app/drizzle/migrations/**
• app/public/logo.svg is excluded by !**/*.svg
• app/public/og-image.svg is excluded by !**/*.svg

📒 Files selected for processing (273)

• .claude/.gitignore
• .claude/agents/code-reviewer.md
• .claude/agents/feature-reviewer.md
• .claude/agents/lint-fix.md
• .claude/agents/project-architect.md
• .claude/agents/test-runner.md
• .claude/agents/user-sim-admin.md
• .claude/agents/user-sim-creator.md
• .claude/agents/ux-crawler.md
• .claude/hooks/check-boundaries.sh
• .claude/hooks/check-coverage.sh
• .claude/hooks/check-credential-logging.sh
• .claude/hooks/check-migration-guard.sh
• .claude/hooks/check-query-safety.sh
• .claude/hooks/enforce-e2e.sh
• .claude/hooks/format-and-lint.sh
• .claude/hooks/session-context.sh
• .claude/settings.json
• .claude/skills/code/SKILL.md
• .claude/skills/commit/SKILL.md
• .claude/skills/components/SKILL.md
• .claude/skills/design-review/skill.md
• .claude/skills/drill/SKILL.md
• .claude/skills/fix-pr-reviews/SKILL.md
• .claude/skills/github-workflow/SKILL.md
• .claude/skills/harden/SKILL.md
• .claude/skills/issue/SKILL.md
• .claude/skills/next/SKILL.md
• .claude/skills/plan/SKILL.md
• .claude/skills/pr/SKILL.md
• .claude/skills/prioritize/SKILL.md
• .claude/skills/release-plan/SKILL.md
• .claude/skills/review/SKILL.md
• .claude/skills/test/SKILL.md
• .coderabbit.yaml
• .dockerignore
• .editorconfig
• .env.example
• .github/CODE_OF_CONDUCT.md
• .github/CONTRIBUTING.md
• .github/ISSUE_TEMPLATE/bug-report.yml
• .github/ISSUE_TEMPLATE/config.yml
• .github/ISSUE_TEMPLATE/feature-request.yml
• .github/PULL_REQUEST_TEMPLATE.md
• .github/SECURITY.md
• .github/dependabot.yml
• .github/workflows/ci.yml
• .github/workflows/cli-integration.yml
• .github/workflows/connection-tests.yml
• .github/workflows/release.yml
• .gitignore
• .gitmodules
• .husky/pre-commit
• .mcp.json
• .nvmrc
• ARCHITECTURE.md
• CHANGELOG.md
• CLAUDE.md
• DEVELOPMENT.md
• Dockerfile
• LICENSE
• PLUGINS.md
• README.md
• app/.env.example
• app/drizzle.config.ts
• app/e2e/api-docs.spec.ts
• app/e2e/api-keys.spec.ts
• app/e2e/auth-states.spec.ts
• app/e2e/auth.spec.ts
• app/e2e/auto-refresh.spec.ts
• app/e2e/charts.spec.ts
• app/e2e/code-completion.spec.ts
• app/e2e/connection-advanced.spec.ts
• app/e2e/connections.spec.ts
• app/e2e/content-widgets.spec.ts
• app/e2e/dashboard-metadata.spec.ts
• app/e2e/dashboard-portability.spec.ts
• app/e2e/dashboard-states.spec.ts
• app/e2e/dashboard-visibility.spec.ts
• app/e2e/dashboards.spec.ts
• app/e2e/design-system.spec.ts
• app/e2e/empty-states.spec.ts
• app/e2e/fixtures.ts
• app/e2e/fixtures/imports/malformed.txt
• app/e2e/fixtures/imports/missing-fields.json
• app/e2e/fixtures/imports/neodash-sample.json
• app/e2e/fixtures/imports/two-connections.json
• app/e2e/form-widget.spec.ts
• app/e2e/global-setup.ts
• app/e2e/global-teardown.ts
• app/e2e/grid.spec.ts
• app/e2e/heavy-widgets.spec.ts
• app/e2e/import-validation.spec.ts
• app/e2e/navigation.spec.ts
• app/e2e/new-charts.spec.ts
• app/e2e/pages/auth.ts
• app/e2e/pages/sidebar.ts
• app/e2e/parameter-types.spec.ts
• app/e2e/parameters.spec.ts
• app/e2e/performance.spec.ts
• app/e2e/query-safety.spec.ts
• app/e2e/responsive.spec.ts
• app/e2e/settings-profile.spec.ts
• app/e2e/sharing-permissions.spec.ts
• app/e2e/sidebar-states.spec.ts
• app/e2e/styling-rules.spec.ts
• app/e2e/theme.spec.ts
• app/e2e/transforms.spec.ts
• app/e2e/users.spec.ts
• app/e2e/widget-lab.spec.ts
• app/e2e/widget-states.spec.ts
• app/e2e/widgets.spec.ts
• app/e2e/write-permissions.spec.ts
• app/next-env.d.ts
• app/next.config.ts
• app/package.json
• app/playwright.config.ts
• app/postcss.config.js
• app/public/site.webmanifest
• app/scripts/lint-migrations.mjs
• app/src/__tests__/helpers/drizzle-mocks.ts
• app/src/__tests__/helpers/next-mocks.ts
• app/src/__tests__/helpers/request-helpers.ts
• app/src/__tests__/instrumentation.test.ts
• app/src/__tests__/proxy.test.ts
• app/src/__tests__/security-headers.test.ts
• app/src/app/(auth)/change-password/page.tsx
• app/src/app/(auth)/login/__tests__/page.test.tsx
• app/src/app/(auth)/login/page.tsx
• app/src/app/(auth)/signup/__tests__/page.test.tsx
• app/src/app/(auth)/signup/page.tsx
• app/src/app/(dashboard)/[id]/edit/page.tsx
• app/src/app/(dashboard)/[id]/page.tsx
• app/src/app/(dashboard)/__tests__/layout.test.tsx
• app/src/app/(dashboard)/connections/page.tsx
• app/src/app/(dashboard)/dashboards/page.tsx
• app/src/app/(dashboard)/layout.tsx
• app/src/app/(dashboard)/page.tsx
• app/src/app/(dashboard)/settings/__tests__/page.test.ts
• app/src/app/(dashboard)/settings/api-keys/page.tsx
• app/src/app/(dashboard)/settings/authentication/__tests__/page.test.tsx
• app/src/app/(dashboard)/settings/authentication/page.tsx
• app/src/app/(dashboard)/settings/layout.tsx
• app/src/app/(dashboard)/settings/page.tsx
• app/src/app/(dashboard)/settings/profile/page.tsx
• app/src/app/(dashboard)/users/page.tsx
• app/src/app/(dashboard)/widget-lab/page.tsx
• app/src/app/api/admin/rotate-key/__tests__/route.test.ts
• app/src/app/api/admin/rotate-key/route.ts
• app/src/app/api/audit-logs/__tests__/route.test.ts
• app/src/app/api/audit-logs/route.ts
• app/src/app/api/auth/[...nextauth]/route.ts
• app/src/app/api/auth/bootstrap-status/__tests__/route.test.ts
• app/src/app/api/auth/bootstrap-status/route.ts
• app/src/app/api/auth/sso-providers/__tests__/route.test.ts
• app/src/app/api/auth/sso-providers/route.ts
• app/src/app/api/connections/[id]/__tests__/route.test.ts
• app/src/app/api/connections/[id]/databases/__tests__/route.test.ts
• app/src/app/api/connections/[id]/databases/route.ts
• app/src/app/api/connections/[id]/reassign/__tests__/route.test.ts
• app/src/app/api/connections/[id]/reassign/route.ts
• app/src/app/api/connections/[id]/route.ts
• app/src/app/api/connections/[id]/schema/__tests__/route.test.ts
• app/src/app/api/connections/[id]/schema/route.ts
• app/src/app/api/connections/[id]/test/__tests__/route.test.ts
• app/src/app/api/connections/[id]/test/route.ts
• app/src/app/api/connections/[id]/usage/__tests__/route.test.ts
• app/src/app/api/connections/[id]/usage/route.ts
• app/src/app/api/connections/__tests__/route.test.ts
• app/src/app/api/connections/list-databases-inline/__tests__/route.test.ts
• app/src/app/api/connections/list-databases-inline/route.ts
• app/src/app/api/connections/route.ts
• app/src/app/api/connections/test-inline/__tests__/route.test.ts
• app/src/app/api/connections/test-inline/route.ts
• app/src/app/api/dashboards/[id]/__tests__/route.test.ts
• app/src/app/api/dashboards/[id]/duplicate/__tests__/route.test.ts
• app/src/app/api/dashboards/[id]/duplicate/route.ts
• app/src/app/api/dashboards/[id]/export/__tests__/route.test.ts
• app/src/app/api/dashboards/[id]/export/route.ts
• app/src/app/api/dashboards/[id]/route.ts
• app/src/app/api/dashboards/[id]/share/__tests__/route.test.ts
• app/src/app/api/dashboards/[id]/share/route.ts
• app/src/app/api/dashboards/__tests__/route.test.ts
• app/src/app/api/dashboards/import/__tests__/route.test.ts
• app/src/app/api/dashboards/import/route.ts
• app/src/app/api/dashboards/route.ts
• app/src/app/api/docs/__tests__/route.test.ts
• app/src/app/api/docs/route.ts
• app/src/app/api/features/__tests__/route.test.ts
• app/src/app/api/features/route.ts
• app/src/app/api/health/__tests__/route.test.ts
• app/src/app/api/health/route.ts
• app/src/app/api/keys/[id]/__tests__/route.test.ts
• app/src/app/api/keys/[id]/route.ts
• app/src/app/api/keys/__tests__/route.test.ts
• app/src/app/api/keys/route.ts
• app/src/app/api/openapi.json/__tests__/route.test.ts
• app/src/app/api/openapi.json/route.ts
• app/src/app/api/openapi/__tests__/route.test.ts
• app/src/app/api/openapi/route.ts
• app/src/app/api/query/__tests__/route.test.ts
• app/src/app/api/query/route.ts
• app/src/app/api/query/write/__tests__/route.test.ts
• app/src/app/api/query/write/route.ts
• app/src/app/api/sso-providers/__tests__/route.test.ts
• app/src/app/api/sso-providers/route.ts
• app/src/app/api/users/[id]/__tests__/route.test.ts
• app/src/app/api/users/[id]/reset-password/__tests__/route.test.ts
• app/src/app/api/users/[id]/reset-password/route.ts
• app/src/app/api/users/[id]/route.ts
• app/src/app/api/users/__tests__/route.test.ts
• app/src/app/api/users/me/__tests__/route.test.ts
• app/src/app/api/users/me/password/__tests__/route.test.ts
• app/src/app/api/users/me/password/route.ts
• app/src/app/api/users/me/route.ts
• app/src/app/api/users/route.ts
• app/src/app/api/widget-templates/[id]/__tests__/route.test.ts
• app/src/app/api/widget-templates/[id]/route.ts
• app/src/app/api/widget-templates/__tests__/route.test.ts
• app/src/app/api/widget-templates/route.ts
• app/src/app/api/widget-templates/shared.ts
• app/src/app/error.tsx
• app/src/app/global-error.tsx
• app/src/app/globals.css
• app/src/app/layout.tsx
• app/src/components/__tests__/card-container-states.test.tsx
• app/src/components/__tests__/card-container.test.tsx
• app/src/components/__tests__/chart-error-boundary-unit.test.tsx
• app/src/components/__tests__/chart-error-boundary.test.tsx
• app/src/components/__tests__/chart-renderer.test.tsx
• app/src/components/__tests__/dashboard-container-branches.test.tsx
• app/src/components/__tests__/dashboard-container-dblclick.test.tsx
• app/src/components/__tests__/dashboard-error-boundary.test.tsx
• app/src/components/__tests__/form-widget-renderer-fields.test.tsx
• app/src/components/__tests__/form-widget-renderer-readonly.test.tsx
• app/src/components/__tests__/form-widget-renderer.test.ts
• app/src/components/__tests__/format-parameter-value.test.ts
• app/src/components/__tests__/widget-outdated.test.ts
• app/src/components/card-container.tsx
• app/src/components/chart-error-boundary.tsx
• app/src/components/chart-renderer.tsx
• app/src/components/dashboard-assign-panel.tsx
• app/src/components/dashboard-container.tsx
• app/src/components/dashboard-error-boundary.tsx
• app/src/components/dashboard-picker-dialog.tsx
• app/src/components/db-logos.tsx
• app/src/components/debounced-text-input.tsx
• app/src/components/form-widget-renderer.tsx
• app/src/components/graph-exploration-wrapper.tsx
• app/src/components/page-tabs.tsx
• app/src/components/parameter-widget-renderer.tsx
• app/src/components/parameters/__tests__/debounce-logic.test.ts
• app/src/components/parameters/__tests__/param-cascading-select.test.ts
• app/src/components/parameters/__tests__/param-date-range.test.ts
• app/src/components/parameters/__tests__/param-date-relative.test.ts
• app/src/components/parameters/__tests__/param-date.test.ts
• app/src/components/parameters/__tests__/param-multi-select.test.ts
• app/src/components/parameters/__tests__/param-number-range.test.ts
• app/src/components/parameters/__tests__/param-select.test.ts
• app/src/components/parameters/__tests__/param-text.test.ts
• app/src/components/parameters/__tests__/seed-query-logic.test.ts
• app/src/components/parameters/__tests__/use-cascading-clear.test.ts
• app/src/components/parameters/__tests__/use-param-actions.test.ts
• app/src/components/parameters/index.ts
• app/src/components/parameters/param-cascading-select.tsx
• app/src/components/parameters/param-date-range.tsx
• app/src/components/parameters/param-date-relative.tsx
• app/src/components/parameters/param-date.tsx
• app/src/components/parameters/param-multi-select.tsx
• app/src/components/parameters/param-number-range.tsx
• app/src/components/parameters/param-select.tsx
• app/src/components/parameters/param-text.tsx
• app/src/components/parameters/use-cascading-clear.ts

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/release-2.0-preflight

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}