Superset Upgrade Playbook: Moving a Production Instance from 3.x to 4.x Without Downtime

A Superset upgrade has one property that shapes everything else: the metadata database migration runs forward and there is no supported migration backward. Once the schema is at 4.x, a 3.x image cannot start against it. Every other risk in an upgrade is recoverable by redeploying the old image. This one is recoverable only by restoring the database. The playbook below is built around that fact.It is written for the 3.x to 4.x jump on a self-hosted deployment (Docker, Kubernetes or VMs) and applies with small changes to any major version. The specifics of what changed in 4.0 are from the release’s UPDATING.md; read it for your exact source and target versions rather than relying on this summary.

Phase 1: Read

Before any environment is touched.

`UPDATING.md`. The Superset repository keeps a running file of breaking changes by version. Next, read every entry between your current version and your target. Then copy each one into a checklist with a column for “affects us” and “action”. For 3.x to 4.0 the entries most deployments hit:

  • Filter box removed. The legacy filter box chart type is gone. Dashboards that used it need native filters. Superset provides a migration, but it is a data change, so it is rehearsed like everything else.
  • Legacy chart migrations completed. Several older chart types (the legacy area, bar, line and others) were migrated to their ECharts replacements and the originals removed. Saved charts of those types must be migrated with the superset viz-migrations command.
  • Talisman on by default. Flask-Talisman and its content security policy are enabled. Anything that loads external resources (map tiles, fonts, scripts) or embeds Superset in an iframe needs TALISMAN_CONFIG entries. If you use embedded dashboards, frame-ancestors is now mandatory.
  • Python version. 4.x requires Python 3.9 or later (3.10 or 3.11 recommended at the time of 4.0). A custom image on an older base needs a new base.
  • Feature flag defaults. Several flags flipped, notably around generic chart axes, cross-filters and native filters becoming default-on. Diff superset/config.py between the two tags for the DEFAULT_FEATURE_FLAGS dictionary and note every change.
  • Removed configuration keys. Deprecated settings are removed at major versions. Superset logs a warning for unknown keys at startup; your rehearsal will surface them.

What your own environment adds

Next, your own inventory. From the metadata database: count of charts by viz_type, dashboards using filter boxes, custom plugins and their peer dependency pins, custom security manager or other Python extensions, CSS templates (they target internal class names), and alerts and reports (the report worker’s browser dependency may change).

Finally, dependencies. Database drivers pinned in your image, the Celery and Redis versions, the reverse proxy configuration for websocket support if you use it.

At the end of Phase 1 you have a checklist of actions and an estimate. Therefore, if the checklist has surprises, this is the cheap moment to find them.

Phase 2: Rehearse

Never run the first upgrade against production. Instead, rehearse against a copy of the production metadata database, because the metadata is where the risk is.

  • Snapshot production metadata. pg_dump the metadata database (or your provider’s snapshot). Restore it into a staging database.
  • Stand up staging on the current version against that copy, with the same superset_config.py and the same Redis topology (a fresh Redis is fine). Confirm it works: log in, open the top ten dashboards.
  • Build the target image. Same Dockerfile, new base tag, plugins rebuilt against the new @superset-ui versions (see the plugin compatibility guide), updated superset_config.py with the Phase 1 actions applied.
  • Run the schema migration against the staging copy:
bash
superset db upgrade
superset init

Timing the rehearsal

Next, time it. On a metadata database with years of logs the logs table can make migrations slow; if it is over a few minutes, plan to prune old logs (reports.prune_log in Celery, or a direct delete of logs rows older than your retention period) before the production run.

  • Run the visualisation migrations for the chart types listed in Phase 1:
bash
superset viz-migrations upgrade --viz_type area
superset viz-migrations upgrade --viz_type bar
# repeat per type named in UPDATING.md for your versions

Each rewrites saved charts’ form data to the new chart type and keeps a record so it can be downgraded with the matching downgrade command if needed before cutover.

  • Migrate filter boxes to native filters using the provided migration, then open every affected dashboard and check the filters do what they did.
  • Start the target image against the migrated staging database. Read the startup log for unknown configuration keys and deprecation warnings. Fix them.
  • Verify using the checklist in Phase 4. Fix what fails, rebuild, and repeat from step 1 with a fresh copy until the rehearsal is clean end to end.

The rehearsal produces the exact command sequence and timing for production, and a list of dashboards and charts that needed attention. So, keep both.

Rehearsed it — now who signs off on cutover?

The rehearsal catches most breakage; the cutover window is where custom plugins and RBAC config quietly slip through. A Superset Architecture Review reviews your specific instance before that window opens.

Book a Superset Architecture Review

Phase 3: Cut over

The migration constraint means true zero-downtime blue-green, where old and new run side by side against the same database, is not safe across a major version: the old version may fail or corrupt data on the new schema. What is achievable is a short read-only window measured in minutes, with a tested rollback.

The night before

  • Announce the window. Ten to twenty minutes is realistic for a rehearsed upgrade.
  • Confirm backups are running and a restore has been tested recently.
  • Pre-pull the target image on every node so the deploy is a restart, not a download.
  • Prune old logs rows if the rehearsal showed the migration was slow.

The sequence

  • Freeze writes. Put the web tier into maintenance (a static page at the load balancer, or scale web replicas to zero). Stop Celery beat so no scheduled reports or warm-ups run mid-migration. Let in-flight Celery tasks finish, then stop workers.
  • Snapshot the metadata database. This is the rollback point. Do not skip it because you have nightly backups; you want the state from thirty seconds ago.
  • Run the migration with the rehearsed commands from a one-off container on the target image: superset db upgrade, superset init, the viz-migrations commands, the filter box migration. Compare the timing to rehearsal.
  • Flush the caches you configured: metadata cache certainly, data cache preferably. Cached metadata from the old version can render incorrectly on the new one.
  • Deploy the target image to workers first, then beat, then web. Health check /health on each web replica.
  • Smoke test while still in maintenance: log in, open two dashboards, run one SQL Lab query, load one embedded dashboard if you have them.
  • Open traffic.

Overall, elapsed time for a rehearsed upgrade on a moderate metadata database: five to fifteen minutes, dominated by the migration.

Rollback

However, if the smoke test fails and the cause is not obvious within a few minutes:

  • Stop the target web, beat and workers.
  • Restore the metadata database from the step 2 snapshot.
  • Redeploy the previous image to workers, beat and web.
  • Flush caches, smoke test, open traffic.

Also, rehearse the rollback at least once in staging. A rollback you have never run is a plan, not a procedure.

Phase 4: Verify

Do this in staging during rehearsal and again in production after cutover. Also, automate as much as you can, because you will do it again next year.

  • Authentication. SSO login, role assignment, an admin action, a viewer’s restricted view. Custom security managers are a common casualty.
  • Top dashboards. Every dashboard in the top twenty by views over the last month, opened and visually checked. A script that requests each dashboard’s chart data endpoints and asserts 200 with rows catches most breakage without eyes.
  • Migrated charts. Every chart touched by viz-migrations, opened in Explore. Colours, stacking and axis formatting are what typically drift.
  • Filters. Every dashboard that had a filter box, with each filter exercised.
  • Custom plugins. Every saved chart using each plugin, plus one new chart created from scratch.
  • SQL Lab. A query on each database connection, one async.
  • Alerts and reports. Trigger one report manually and check the screenshot renders with the new Talisman policy.
  • Embedded dashboards. Load one from the embedding application; the Talisman frame-ancestors change is the number one post-upgrade embedding failure.
  • Performance. Compare the dashboard load times to the numbers you noted before. New defaults occasionally disable a cache you relied on.
  • Logs. Tail the web and worker logs for the first hour for tracebacks and deprecation warnings.

Between major versions

Minor and patch upgrades (4.0 to 4.1, 4.1.1 to 4.1.2) use the same playbook with less reading. The migration step is still one-way, so the snapshot before migration is still mandatory, but the rehearsal can be lighter and the window shorter. So, do them regularly; the longer the gap between upgrades, the more entries in UPDATING.md and the more painful the jump. Overall, quarterly is a good cadence, with security patches applied as they land.

Common failures, from experience

Symptom Cause Prevention
Migration takes an hour Huge logs table Prune before, set a retention policy after
Embedded dashboards blank after upgrade Talisman enabled, no frame-ancestors Configure TALISMAN_CONFIG in Phase 1
Maps show no tiles CSP blocks the tile server Add tile and API hosts to connect-src and img-src
Charts show “Unknown viz type” Legacy chart types removed, migration skipped Run viz-migrations for every listed type
Dashboards lost their filters Filter box removed Run the filter box migration and review each dashboard
Custom plugin missing from picker Not rebuilt against new @superset-ui versions Rebuild in Phase 2
Startup warns about unknown config keys Deprecated settings removed Fix in rehearsal; do not ignore warnings
Login page broken Custom security manager uses a changed FAB API Test auth first in rehearsal
Everything works, dashboards slow A feature flag default changed caching or async behaviour Diff DEFAULT_FEATURE_FLAGS in Phase 1; compare load times in Phase 4

Before the next one

Two habits make the next upgrade cheaper. First, keep your superset_config.py free of anything not deliberately set, so the diff against defaults stays small. Second, keep a UPGRADE.md in your deployment repository with the exact commands, timings and gotchas from this run; the person doing the next upgrade will thank you, and it is often you.

Frequently Asked Questions

What breaks when upgrading Apache Superset from 3.x to 4.x?

In short, the entries most deployments hit are the removal of the legacy filter box, the completed legacy chart migrations (older area, bar and line types must be migrated with superset viz-migrations), Flask-Talisman and its content security policy being on by default, the Python 3.9-or-later requirement, several feature-flag defaults flipping, and removed configuration keys. Read every UPDATING.md entry between your current version and your target, and turn each into a checklist row with “affects us” and “action” columns.

Can a Superset major-version upgrade really be done without downtime?

For read traffic, yes, with a rehearsal against a restored copy of production, a blue-green or rolling cut-over, and a tested rollback. However, the part that is not free is the database migration: schema changes on a large metadata database take time, which is why the rehearsal exists, to measure that time before the change window rather than during it.

What is the most common post-upgrade failure?

Embedded dashboards going blank, because Talisman is on by default in 4.x and frame-ancestors is now mandatory for any origin that frames Superset. Similarly, custom security managers are the other frequent casualty, so SSO login and role assignment are the first things on the verification list rather than the last.

What should be verified after the cut-over?

Authentication end to end, every dashboard in the top twenty by views over the last month, every chart touched by viz-migrations, every dashboard that previously used a filter box, every saved chart from each custom plugin plus one new one, a query per database connection including an async one, one manually triggered report, one embedded dashboard loaded from the embedding application, and a load-time comparison against the numbers you recorded beforehand. Then tail the web and worker logs for the first hour.

Build It With Andolasoft

Upgrade readiness is one of the six areas in our Superset Architecture Review: the version gap, the UPDATING.md entries that apply to your deployment, the plugins and extensions that need rebuilding, and the state of your metadata database. In addition, it is a fixed-scope five-day review with a written report you can run the upgrade from. Under Managed Support we run the upgrades on a schedule, including the rehearsal, so the playbook above is something you read once rather than execute. The production configuration the upgrade has to preserve is covered in Superset in production, and the plugin side in what breaks between 3.x and 4.x for plugins.

If you have an upgrade on the calendar and a deployment people depend on, talk to us. We will tell you what in your specific instance breaks, how long the migration takes on your metadata database, and what the rollback looks like.

Superset Plugin Compatibility: What Breaks Between 3.x and 4.x and How to Migrate a Plugin

A custom chart plugin is compiled into the Superset frontend bundle. That is what makes it fast and first-class, and it is also why an upgrade can break it: the plugin is built against one version of @superset-ui/core and @superset-ui/chart-controls, and after the upgrade it runs against another. Minor releases rarely matter. Major ones, and the 3.x to 4.x jump in particular, changed enough that most plugins need at least a rebuild and some need real changes.This post is the checklist we work through when we carry a plugin across that line. It assumes you have a plugin structured the way the build guide describes: index.ts, buildQuery.ts, controlPanel.ts, transformProps.ts and a React component, registered in MainPreset.js.

One caveat up front. The exact list of breaking changes depends on the two versions you are moving between. The authoritative source is UPDATING.md in the Superset repository, read for every release between your current tag and your target. What follows is the set that has affected plugins we maintain.

Why plugins break at all

Three kinds of coupling exist between a plugin and the Superset it runs in:

  • Package coupling. The plugin imports from @superset-ui/core, @superset-ui/chart-controls and often @superset-ui/plugin-chart-echarts. These packages live inside the Superset monorepo and are versioned with it. A type that was exported in one version may be renamed or removed in the next.
  • Behavioural coupling. The plugin relies on how Superset builds queries, passes form data, applies filters and handles cross-filter events. Feature flags that flip their default between versions change this behaviour without changing any API.
  • Toolchain coupling. The plugin is compiled by Superset’s webpack, TypeScript and Babel configuration, on the Node version the Superset frontend requires. A stricter TypeScript setting or a newer Node can fail a build that has not changed.

Most upgrade pain comes from the second and third, because they do not show up as type errors.

What changed between 3.x and 4.x that plugin authors notice

Node and build tooling

The 4.x frontend requires Node 18. If your plugin’s CI still runs Node 16, the first symptom is a build failure with no obvious connection to your code. Align the Node version in your plugin repository, your Dockerfile and your CI with superset-frontend/package.json at the target tag.

TypeScript configuration also tightened across the 3.x line. Code that compiled with implicit any or loose null checks can start failing. Fix the types rather than loosening the config; the Superset build uses its own settings, not yours.

Peer dependency pins

Every plugin declares @superset-ui/core and @superset-ui/chart-controls as peer dependencies pinned to specific versions. Those versions moved through the 3.x and 4.x releases. A mismatch produces one of two failures:

  • The package manager resolves two copies of @superset-ui/core into the bundle. Registries and theme contexts are singletons, so the plugin’s copy cannot see the charts, colour schemes or theme registered by Superset’s copy. The symptom is an error along the lines of “theme is undefined” or a chart that never appears in the picker.
  • A type or helper the plugin imports no longer exists at the new version, which is a compile error and at least easy to find.

Update the pins to match the target Superset before doing anything else.

Time range and axis controls

The GENERIC_CHART_AXES feature flag, which lets any column be the x-axis and moves the time range into ad-hoc filters, became the default behaviour in the 3.x line and is the only behaviour in 4.x. Plugins built for 2.x or early 3.x often still use the legacy time section:

typescript
controlPanelSections: [
  sections.legacyRegularTime,
  // ...
]

This still compiles, and for regular (non-time-series) charts it still works. For time-series plugins it produces a control panel that does not match the rest of the product: users expect a time column and a time grain as controls, and the time range as a filter. Move to the generic axis pattern used by the ECharts time-series plugins: an x_axis control, a time_grain_sqla control, and no legacy time section. Your buildQuery then reads formData.x_axis and includes it in columns rather than assuming a __timestamp column.

Filter box removal

Superset 4.0 removed the legacy filter box chart. Plugins are rarely affected directly, but dashboards that used filter boxes to drive your chart now drive it through native filters, which arrive in extra_form_data on the query object. If your buildQuery manipulated extras or filters by hand, check that native filter values still reach the query. The buildQueryContext helper handles this correctly; hand-rolled query construction sometimes does not.

Cross-filter behaviours

Cross-filtering matured across 3.x and is on by default in 4.x. A plugin that declares Behavior.InteractiveChart is expected to emit and respond to cross-filters properly. Two things to check:

  • Emitting. The plugin should call setDataMask with both extraFormData.filters and filterState.value when the user selects an element, and clear both on deselect. Plugins that set only one of these leave the dashboard in an inconsistent state.
  • Receiving. When another chart filters this one, the filter arrives through the normal query path. Verify the chart re-queries rather than showing stale data.

If the plugin cannot participate in cross-filtering, remove Behavior.InteractiveChart from its metadata so the dashboard does not offer the option.

Theme tokens and styling

Superset’s theme object gained and reorganised tokens through 3.x. Plugins that reach into theme.colors.* or theme.gridUnit should be checked against the theme type exported by the target @superset-ui/core. Hard-coded colours keep working but look wrong in a customised deployment, which is the moment stakeholders notice.

Note for readers on the 5.x line: Superset 5 replaced the theme system with Ant Design 5 design tokens and a JSON theme format. That is a larger change than anything in 3.x to 4.x and deserves its own migration pass.

Content Security Policy

4.0 turned on Flask-Talisman and its Content Security Policy by default. Plugins that load scripts, fonts or images from external domains, for example a map tile server or a CDN-hosted library, are blocked unless TALISMAN_CONFIG allows those origins. This is a deployment change rather than a plugin change, but the plugin author is usually the one who has to explain the blank map.

Legacy visualisation migrations

4.0 completed the migration of several legacy charts to their ECharts replacements and removed the old implementations. This matters to plugin authors in one specific case: if your plugin extended or copied code from a legacy chart, the shared code it borrowed may be gone. Search your plugin for imports from legacy-plugin-chart-* packages.

Got more than one custom plugin to check?

Auditing every plugin against this list scales badly past two or three. A Plugin Scoping Call gets you a migration estimate across your whole plugin set, not just one at a time.

Book a Plugin Scoping Call

How to find out which of these affect you

Do this before touching any code.

  • Read `UPDATING.md` from your current tag to the target tag. Note every entry that mentions the frontend, feature flags, @superset-ui, or chart behaviour.
  • Diff the feature flag defaults between the two versions in superset/config.py. Any flag that flipped and touches charts or dashboards is a behavioural change your plugin will see.
  • Check the two package versions of @superset-ui/core and @superset-ui/chart-controls in superset-frontend/package.json at both tags, and read the changelogs for those packages.
  • Grep your plugin for the things listed above: legacyRegularTime, __timestamp, setDataMask, theme.colors, hard-coded colours, external URLs, and any import from a legacy- package.

You now have a list. Usually it is short.

Migration sequence

Work in this order; each step gives you a stable checkpoint.

  • Branch the plugin and name the branch for the target Superset version.
  • Bump the peer dependencies and dev dependencies to the target versions. Set Node to the target version.
  • Build the plugin alone (npm run build). Fix compile and type errors. This clears the package coupling.
  • Link it into a Superset checkout at the target tag and run the dev server. Open the chart in Explore. This surfaces registry and theme problems immediately.
  • Work through the behavioural list: time controls, filters, cross-filters, CSP. Test each in a dashboard, not only in Explore, because filters and cross-filters only exist on dashboards.
  • Restore or re-record thumbnails if the chart’s appearance changed.
  • Run the tests and update fixtures for any changed ChartProps shape.
  • Build the production image from the target tag with the plugin included, deploy to staging, and load every saved chart that uses the plugin. A saved chart carries the form data it was created with; charts saved under the old control panel are where migration bugs hide.

Budget half a day for a minor version and one to two days for a major one, assuming a single plugin of moderate complexity. Multiply for plugins that render maps or use WebGL.

Tests that make the next upgrade cheaper

  • Golden `ChartProps` fixtures. Save a real chartProps object from the running product for each chart configuration you support and assert transformProps output against it. When the shape changes, the diff tells you exactly what moved.
  • Saved-chart smoke test. A script that lists every saved chart with your viz_type and loads each one’s data endpoint. Run it against staging after every upgrade.
  • Control panel snapshot. A test that renders the control panel config and snapshots the control names. A rename in sharedControls shows up here instead of in production.

Keeping the fork thin

The lines you maintain inside the Superset repository should be two: the dependency in superset-frontend/package.json and the registration in MainPreset.js. Every upgrade is a rebase of those two lines onto the new tag. If your fork has grown beyond that, the upgrade cost is no longer about the plugin, and it is worth moving the extra code into the plugin package or a separate extension before the next major version.

Frequently Asked Questions

Will my Superset 3.x plugin work on 4.x without any changes?

Sometimes, but do not plan for it. A plugin that only uses stable @superset-ui/core exports and no time-range controls often survives untouched. Anything that uses the legacy time section, the filter box, hard-coded colours or the older cross-filter callbacks will need work. The only reliable answer comes from building the plugin against the target version and reading the errors.

What is the most common cause of a plugin breaking after a Superset upgrade?

Two copies of @superset-ui/core in the same bundle. Registries and theme contexts are singletons, so when the plugin’s copy differs from Superset’s copy, the plugin cannot see the charts, colour schemes or theme that Superset registered. It usually surfaces as “theme is undefined” or a chart that never appears in the picker. Align the peer dependency pins before investigating anything else.

The filter box was removed in 4.x. Do I have to rewrite my plugin?

Only if your plugin depended on it. The filter box was a chart type, not a plugin API, so most custom charts are unaffected. What does change is the surrounding dashboard: filters now come from native dashboard filters and cross-filters, so a plugin that read filter state the old way needs updating to the current hooks.

How long does a 3.x to 4.x plugin migration usually take?

For a single plugin with current dependency pins and no legacy time controls, a day is realistic, most of it spent on the build tooling and the test pass. Plugins that span more than one major version, borrow from legacy chart code, or have no tests take substantially longer, and the estimate is worth getting before the upgrade is scheduled rather than after.

Build It With Andolasoft

If the plugin was written by someone who has left, if it borrows from legacy chart code, or if the upgrade spans more than one major version, the cheapest first step is a scoping conversation rather than a spike. Our Plugin Scoping Call is free and 45 minutes; you leave with a written estimate of the migration effort. The wider service is described on the Superset plugin development page, and if the upgrade itself is the worry, the Architecture Review covers upgrade readiness for the whole deployment.

If a Superset upgrade is already on the calendar and the custom charts are the unknown, book a Plugin Scoping Call. We will review the plugins you have, tell you which of the changes above apply to each, and give you a written migration estimate before you commit to an upgrade date.

How to Build a Custom Chart Plugin for Apache Superset 4.x

Apache Superset ships with more than fifty chart types, and for most dashboards that is plenty. Then someone asks for a bullet chart against a target band, a Sankey with a custom node order, a map layer the built-in deck.gl charts do not offer, or a KPI tile that colours itself against three thresholds instead of one. At that point you have two options: bend an existing chart until it almost fits, or write a plugin.Plugins are how Superset itself is built. Every chart in the Explore view, from the humble table to the ECharts time series, is a plugin registered through the same ChartPlugin API you are about to use. Nothing about a custom plugin is second-class. It gets the same query layer, the same control panel framework, the same dashboard filters and cross-filters, and the same theming.

This guide builds a small but complete plugin for Superset 4.x. The chart is deliberately simple, a bar per category with a configurable highlight threshold, so that the plugin mechanics stay in focus. Swap the rendering for ECharts, D3, or deck.gl once the plumbing is in place.

What a plugin is made of

A Superset chart plugin is an npm package that exports a class extending ChartPlugin from @superset-ui/core. The class wires together five things:

Piece File Job
Metadata index.ts Name, description, thumbnail, category, tags, and behaviours shown in the chart picker
Query builder buildQuery.ts Turns the form data from the control panel into one or more query objects for Superset’s backend
Control panel controlPanel.ts Declares which controls appear in Explore and how they are grouped
Props transformer transformProps.ts Converts raw query results and form data into the props your component needs
Component HelloChart.tsx The React component that draws the chart

The flow at runtime is: the user changes a control, Superset runs buildQuery, sends the query to the backend, receives rows, calls transformProps with those rows plus the form data, and renders your component with the result. Controls flagged as renderTrigger skip the query and go straight to transformProps, which is how colour and label changes stay instant.

Prerequisites

  • Node.js at the version your Superset release pins. Read the engines field in superset-frontend/package.json at the tag you deploy rather than trusting a blog post: the 4.x line started on Node 18 and later releases accept Node 20 as well. Use nvm or fnm; a mismatched Node version is the most common cause of a build that fails for no obvious reason.
  • A checkout of the Superset repository at the exact tag you run in production, for example git clone --branch 4.1.1 https://github.com/apache/superset.git. You will run the frontend dev server from it and, later, build the production image from it.
  • A running Superset backend to develop against. The repo’s docker-compose setup works, or a local superset run -p 8088 --with-threads --reload --debugger.
  • Working knowledge of React and TypeScript. Plugins are TypeScript by default and there is no reason to fight that.

Step 1: Scaffold the plugin

Superset maintains a Yeoman generator that produces a working plugin skeleton. Install it and run it in a new directory next to, not inside, your Superset checkout:

bash
npm install -g yo @superset-ui/generator-superset

mkdir superset-plugin-chart-hello
cd superset-plugin-chart-hello
yo @superset-ui/superset

Answer the prompts: choose Chart plugin, accept the package name, add a one-line description, and pick Regular as the chart type (choose Time-series if your chart has a time axis; it changes the default controls). The generator writes a package.json, TypeScript config, Jest setup, a src/ folder with the five files above, and a src/images/thumbnail.png placeholder.

If the published generator lags behind the Superset version you are targeting, run it from your checkout instead:

bash
cd superset/superset-frontend/packages/generator-superset
npm install
npm link
cd ../../../../superset-plugin-chart-hello
yo @superset-ui/superset

Open package.json and check the peerDependencies. The generator pins @superset-ui/core and @superset-ui/chart-controls to the versions in the checkout you ran it from. These must match the Superset you deploy, or the plugin will compile against one API and run against another.

Step 2: The five files

The generated code works as-is. The point of walking through each file is to know what to change when your chart needs something different.

index.ts: metadata and wiring

typescript
import { t, ChartMetadata, ChartPlugin } from '@superset-ui/core';
import buildQuery from './buildQuery';
import controlPanel from './controlPanel';
import transformProps from './transformProps';
import thumbnail from './images/thumbnail.png';

export default class HelloChartPlugin extends ChartPlugin {
  constructor() {
    const metadata = new ChartMetadata({
      name: t('Hello Chart'),
      description: t('One bar per category, with bars above a threshold highlighted.'),
      thumbnail,
      category: t('Custom'),
      tags: [t('Comparison'), t('Custom')],
    });

    super({
      buildQuery,
      controlPanel,
      loadChart: () => import('./HelloChart'),
      metadata,
      transformProps,
    });
  }
}

loadChart is a dynamic import so the component is code-split and only downloaded when someone opens a dashboard that uses it. Wrap every user-visible string in t() so it goes through Superset’s translation layer.

Note what is not here: a behaviors array. Adding Behavior.InteractiveChart tells Superset the chart emits cross-filters, and it does put cross-filter controls in the UI, but the affordance does nothing until your component actually calls setDataMask, which Superset passes in through chartProps.hooks. Declaring the behaviour before you wire the hook produces a menu item that silently fails. Add the behaviour and the hook together, or neither. Dashboard native filters apply to your chart either way; they arrive as part of the query, not through this flag.

buildQuery.ts: from form data to a query

typescript
import { buildQueryContext, QueryFormData } from '@superset-ui/core';

export default function buildQuery(formData: QueryFormData) {
  const { cols: groupby } = formData;
  return buildQueryContext(formData, baseQueryObject => [
    {
      ...baseQueryObject,
      groupby,
    },
  ]);
}

buildQueryContext assembles a query object from the standard controls (metrics, filters, row limit, time range) and hands it to your callback. You return an array of query objects; one is normal, two or more is how charts like the big number with trendline fetch both a total and a series. The generator names the group-by control cols and maps it onto the query’s groupby. Recent Superset versions also accept columns; either works on 4.x.

controlPanel.ts: what the user can change

typescript
import { t, validateNonEmpty } from '@superset-ui/core';
import {
  ControlPanelConfig,
  sharedControls,
} from '@superset-ui/chart-controls';

const config: ControlPanelConfig = {
  controlPanelSections: [
    {
      label: t('Query'),
      expanded: true,
      controlSetRows: [
        [
          {
            name: 'cols',
            config: {
              ...sharedControls.groupby,
              label: t('Category column'),
              description: t('One bar per distinct value'),
            },
          },
        ],
        [
          {
            name: 'metrics',
            config: {
              ...sharedControls.metrics,
              validators: [validateNonEmpty],
            },
          },
        ],
        ['adhoc_filters'],
        ['row_limit'],
      ],
    },
    {
      label: t('Hello Chart options'),
      expanded: true,
      controlSetRows: [
        [
          {
            name: 'threshold',
            config: {
              type: 'TextControl',
              isInt: true,
              default: 0,
              renderTrigger: true,
              label: t('Highlight threshold'),
              description: t('Bars at or above this value are highlighted'),
            },
          },
        ],
        [
          {
            name: 'highlight_color',
            config: {
              type: 'ColorPickerControl',
              default: { r: 26, g: 169, b: 202, a: 1 },
              renderTrigger: true,
              label: t('Highlight colour'),
            },
          },
        ],
      ],
    },
  ],
};

export default config;

Two things to notice. First, sharedControls gives you the same metric, group-by and filter controls every built-in chart uses, so the Explore experience is consistent. Second, renderTrigger: true on the threshold and colour controls means changing them re-renders without re-querying the database. Anything that only affects drawing should be a render trigger; anything that changes what data comes back should not.

The generator’s template may also import a sections helper and open the panel with a time section such as sections.legacyRegularTime. Whether that export exists depends on the release you pin: the time controls were reworked across the 4.x line as the generic chart axes behaviour became the default. Check what your @superset-ui/chart-controls actually exports before importing it, because a missing export takes out the whole control panel rather than one control. The config above needs no time section at all; adhoc_filters covers time filtering.

Control names are snake_case here. They arrive in transformProps as camelCase (highlight_color becomes highlightColor), because ChartProps runs the form data through a camelCase conversion and keeps the original on rawFormData. This conversion is the single most common source of “my control value is undefined”.

transformProps.ts: shaping data for the component

typescript
import { ChartProps, DataRecord } from '@superset-ui/core';

export interface HelloChartProps {
  width: number;
  height: number;
  data: DataRecord[];
  categoryColumn: string;
  metricLabel: string;
  threshold: number;
  highlightColor: string;
}

export default function transformProps(chartProps: ChartProps): HelloChartProps {
  const { width, height, formData, queriesData } = chartProps;
  const { cols, metrics, threshold, highlightColor } = formData;

  const data = (queriesData[0]?.data ?? []) as DataRecord[];
  const metric = metrics?.[0];
  const metricLabel =
    typeof metric === 'string' ? metric : metric?.label ?? 'value';
  const rgba = highlightColor
    ? `rgba(${highlightColor.r}, ${highlightColor.g}, ${highlightColor.b}, ${highlightColor.a})`
    : '#1aa9ca';

  return {
    width,
    height,
    data,
    categoryColumn: Array.isArray(cols) ? cols[0] : cols,
    metricLabel,
    threshold: Number(threshold) || 0,
    highlightColor: rgba,
  };
}

queriesData is an array with one entry per query object you returned from buildQuery. Each entry has a data array of row objects keyed by column or metric label. Metrics can be plain strings (saved metrics) or ad-hoc metric objects with a label; handle both. Keep this function pure and cheap; it runs on every render trigger.

HelloChart.tsx: the component

tsx
import React from 'react';
import { styled } from '@superset-ui/core';
import { HelloChartProps } from './transformProps';

const Wrapper = styled.div<{ height: number; width: number }>`
  height: ${({ height }) => height}px;
  width: ${({ width }) => width}px;
  box-sizing: border-box;
  display: flex;
  align-items: stretch;
  gap: 6px;
  padding: 8px;
  font-family: ${({ theme }) => theme.typography.families.sansSerif};
`;

/* One column per row: bar area on top, label pinned underneath. */
const Column = styled.div`
  flex: 1 1 0;
  min-width: 0;
  display: flex;
  flex-direction: column;
`;

/* Gives the bar a definite height to take a percentage of. */
const BarArea = styled.div`
  flex: 1 1 auto;
  min-height: 0;
  display: flex;
  align-items: flex-end;
`;

const Bar = styled.div<{ pct: number; color: string }>`
  width: 100%;
  height: ${({ pct }) => pct}%;
  background-color: ${({ color }) => color};
  border-radius: 2px 2px 0 0;
`;

const Label = styled.div`
  flex: 0 0 auto;
  padding-top: 4px;
  font-size: 11px;
  text-align: center;
  white-space: nowrap;
  overflow: hidden;
  text-overflow: ellipsis;
`;

export default function HelloChart({
  width,
  height,
  data,
  categoryColumn,
  metricLabel,
  threshold,
  highlightColor,
}: HelloChartProps) {
  const max = Math.max(1, ...data.map(row => Number(row[metricLabel]) || 0));

  return (
    <Wrapper width={width} height={height}>
      {data.map(row => {
        const value = Number(row[metricLabel]) || 0;
        const pct = (value / max) * 100;
        const hot = value >= threshold;
        const category = String(row[categoryColumn]);
        return (
          <Column key={category} title={`${category}: ${value}`}>
            <BarArea>
              <Bar pct={pct} color={hot ? highlightColor : '#ccc'} />
            </BarArea>
            <Label>{category}</Label>
          </Column>
        );
      })}
    </Wrapper>
  );
}

The nesting is worth a moment, because it is the part people get wrong first. A percentage height only resolves against a parent with a definite height. Wrapper gets one from the pixel height Superset hands it, and BarArea gets one from being a flex child of Wrapper, so height: ${pct}% on the bar works. Put that percentage directly inside an auto-height div and every bar collapses to nothing.

Otherwise this is plain HTML and CSS on purpose. It has no chart library dependency, it is trivially testable, and it demonstrates the two things every component must do: fill the width and height Superset gives it, and read its theme from @superset-ui/core rather than hard-coding fonts. For anything more demanding, look at how @superset-ui/plugin-chart-echarts wraps ECharts, or how the deck.gl plugins handle WebGL. The pattern is the same; only the drawing changes.

This chart type more involved than a tutorial covers?

If your plugin needs custom interactions, non-standard data shapes, or has to survive the next major-version bump, a Superset Plugin Scoping Call gets you a build estimate before you sink a sprint into it.

Book a Plugin Scoping Call

Step 3: Run it inside Superset

The plugin has to be part of the Superset frontend bundle. Superset does carry an experimental DYNAMIC_PLUGINS feature flag that fetches a plugin from a URL at runtime, but it has stayed experimental for years and nothing in the dashboard experience is built around it, so treat compiling into the bundle as the supported path.

The package’s entry point is its build output, not its source, so build it before linking:

bash
cd superset-plugin-chart-hello
npm i --force
npm run build

The --force is there because the generator’s peer dependency ranges rarely resolve cleanly against a single Superset checkout. Then link the package into the Superset frontend:

bash
cd ../superset/superset-frontend
npm i -S ../../superset-plugin-chart-hello

Then open src/visualizations/presets/MainPreset.js and add the plugin alongside the built-ins:

javascript
import HelloChartPlugin from 'superset-plugin-chart-hello';

// ... inside the plugins array passed to super()
new HelloChartPlugin().configure({ key: 'hello_chart' }),

The key is the chart’s viz_type. It is stored on every saved chart that uses the plugin, so choose it once and never change it.

Now run three processes: the backend, the Superset dev server, and a watch build for the plugin.

bash
# terminal 1, from the repo root with your virtualenv active
superset run -p 8088 --with-threads --reload --debugger

# terminal 2
cd superset/superset-frontend
npm run dev-server

# terminal 3, in the plugin directory
npm run dev

That third terminal is not optional. Superset resolves the linked package through its main field, which points at compiled output, so editing src/HelloChart.tsx changes nothing until the plugin is rebuilt. npm run dev is the generator’s watch build; check the scripts block in your package.json if the name differs. Without it you will edit code for twenty minutes and conclude that hot reloading is broken.

Open http://localhost:9000, create a chart, and search for “Hello Chart” in the picker. Pick a dataset, a category column and a metric, and you should see bars. Change the threshold and watch the bars recolour without a spinner, which confirms the render trigger is wired correctly.

If the dev server does not pick up a rebuilt plugin, restart it; watching across a symlink is occasionally flaky on Windows and in Docker volumes.

Step 4: Getting it into production

Because the plugin is compiled into the bundle, production means building Superset’s frontend with your plugin included. The official apache/superset image does not contain the frontend source, so you build from the repository at the tag you deploy:

  • In your Superset checkout, add the plugin dependency to superset-frontend/package.json and the registration line in MainPreset.js. Use a git URL or a private registry entry, not the relative path you developed against: the plugin directory sits outside the Docker build context, so a relative dependency fails at npm ci rather than merely being untidy. Commit both changes on a branch named for the Superset version, for example 4.1.1-acme.
  • Build the image from the repo root: docker build -t registry.example.com/superset:4.1.1-acme .. The Dockerfile’s frontend build stage runs npm ci and the frontend build, which now includes your plugin.
  • Deploy that image in place of the official one. Nothing else changes: same configuration, same metadata database, same Helm chart or compose file.

When you upgrade Superset, rebase the branch onto the new tag, bump the plugin’s @superset-ui/* peer dependencies to match, rebuild, and run the plugin’s tests. Budget half a day for a minor version and more for a major one; the ChartPlugin API is stable, but control-panel helpers and theme tokens do move.

Step 5: Tests worth writing

The generator sets up Jest. Three tests pay for themselves immediately:

  • transformProps with a realistic ChartProps fixture: assert the metric label resolution for both string and ad-hoc metrics, the camelCase control names, and the empty queriesData case.
  • buildQuery with sample form data: assert the query object contains the expected groupby and metrics, so a control rename does not silently produce an empty query.
  • The component with React Testing Library: render with three rows, assert three bars, and assert the highlighted count for a given threshold.

Superset’s frontend also has a Storybook (superset-frontend/storybook). Adding a story for your plugin gives designers and stakeholders a place to look at it without a running backend.

Pitfalls that cost time

  • Peer dependency drift. @superset-ui/core in your plugin must be the version the Superset frontend uses. Two copies of the library in one bundle produce baffling errors about themes or registries being undefined.
  • Forgetting the plugin’s watch build. The linked package serves compiled output, so source edits are invisible until it rebuilds.
  • camelCase vs snake_case. Controls are defined in snake_case and read in camelCase. Log formData once in transformProps if a value is missing.
  • Forgetting renderTrigger. Every cosmetic control without it forces a database round trip.
  • Declaring behaviours you have not implemented. Behavior.InteractiveChart without a setDataMask call gives users a cross-filter option that does nothing.
  • Percentage sizing inside auto-height containers. Give the parent a definite height or the chart renders empty at full data.
  • Hard-coded colours and fonts. Read them from the theme so the chart looks right in a themed or white-labelled Superset.
  • Changing the viz_type key. Saved charts reference it. Renaming it orphans every chart built on the plugin.
  • Ignoring width and height. Superset tells your component its size. A chart that sizes itself overflows dashboard grid cells.
  • Forking Superset core. Put chart logic in the plugin package, not in the Superset repo. The only lines you should be maintaining in the fork are the dependency and the registration.

Going further

Once the skeleton renders, the next problems tend to arrive in this order:

Frequently Asked Questions

Do I have to fork Superset to add a custom chart plugin?

Not for the chart itself. The plugin lives in its own npm package, and that is where all of its logic belongs. It does have to be compiled into the Superset frontend bundle, because the DYNAMIC_PLUGINS flag is still experimental, so you keep a branch of Superset at your production tag with two small changes: the plugin dependency in superset-frontend/package.json and its registration in MainPreset.js.

What files make up a Superset chart plugin?

Five: index.ts for metadata and wiring, buildQuery.ts to turn form data into a query, controlPanel.ts to declare the Explore controls, transformProps.ts to shape query results into props, and the React component that draws the chart.

Why does changing a control re-run the database query?

Because the control is not marked renderTrigger: true. Controls without it go back through buildQuery and the backend; controls with it skip the query and go straight to transformProps. Anything that only affects drawing, such as colours, labels or thresholds, should be a render trigger.

What happens to my plugin when I upgrade Superset?

Rebase your Superset branch onto the new tag, bump the plugin's @superset-ui/* peer dependencies to match, rebuild, and run the plugin's tests. The ChartPlugin API is stable, but control-panel helpers and theme tokens do move, so budget half a day for a minor version and more for a major one.

Build It With Andolasoft

The mechanics above are the same ones behind the plugins we have written up on this blog: a dual-axis line chart for Superset 4 that plots two measures on independent axes and takes part in cross-filtering, and a multi-threshold heatmap for Superset 4.1 that colours cells against several hard limits instead of one gradient. Both started as exactly the skeleton in this post.

If you have a chart in mind and want to know what it would take, our Plugin Scoping Call is a free 45-minute session with a plugin engineer. You describe the visualisation, we walk through the data shape and interactions, and within 48 hours you get a written scope, effort estimate, and timeline you can act on with or without us. The wider service is described on our Superset plugin development page.

To talk through a chart you need built, or a plugin that has stopped working after an upgrade, contact us.