apache/superset · warning · Error

Please provide both time bounds (Since and Until)

Error message

Please provide both time bounds (Since and Until)

What it means

Same LANGUAGE_CODE_RE validation as the JSON pack endpoint, but on the versioned script endpoint (superset/views/core.py:722, /language_pack/<lang>/<version>/script.js). This route is deliberately unauthenticated (static public translation catalog for the SPA), so the regex is the first trust-boundary check; a lang not matching ^[a-z]{2,3}(_[A-Z]{2}|_[A-Z][a-z]{3})?$ aborts with 400 before the version check or filesystem lookup.

Source

Thrown at superset-frontend/plugins/plugin-chart-calendar/src/transformData.ts:88

    weeks: Math.floor(days / 7),
  };
};

/**
 * Ports the legacy CalHeatmapViz.get_data reshape: per-metric value maps
 * keyed by unix seconds, plus the domain range computed from the query's
 * time bounds exactly like the backend's relativedelta arithmetic.
 */
export default function transformData(
  records: Record<string, unknown>[],
  metricLabels: string[],
  fromDttm: number | null | undefined,
  toDttm: number | null | undefined,
  domain: string,
  subdomain: string,
): CalHeatmapPayload {
  if (fromDttm == null || toDttm == null) {
    throw new Error(t('Please provide both time bounds (Since and Until)'));
  }
  const data: Record<string, Record<string, unknown>> = {};
  metricLabels.forEach(metric => {
    const values: Record<string, unknown> = {};
    records.forEach(record => {
      const timestamp = record[DTTM_ALIAS];
      if (timestamp != null) {
        values[String((timestamp as number) / 1000)] = record[metric];
      }
    });
    data[metric] = values;
  });

  const start = new Date(fromDttm);
  const end = new Date(toDttm);
  const delta = calendarDelta(start, end);
  const diffSecs = (toDttm - fromDttm) / 1000;

View on GitHub (pinned to f4587218dd)

Solutions

1. Normalize to Superset's underscore format before building the URL (lowercase lang, _Uppercase region)
2. Source the lang from the same constant/config the SPA uses for /language_pack/<lang>/ so both endpoints agree
3. On 400, fall back to the English script.js rather than blocking app boot

Example fix

# before
url = f"/language_pack/{'zh-CN'}/{version}/script.js"  # 400

# after
url = f"/language_pack/{'zh_CN'.replace('-', '_')}/{version}/script.js"

import re
LANGUAGE_CODE_RE = re.compile(r"^[a-z]{2,3}(_[A-Z]{2}|_[A-Z][a-z]{3})?$")
assert LANGUAGE_CODE_RE.match(lang), f"bad lang {lang!r} — normalize e.g. 'zh-CN' -> 'zh_CN'"

const isLanguageCode = (l: string): boolean =>
  /^[a-z]{2,3}(_[A-Z]{2}|_[A-Z][a-z]{3})?$/.test(l);

When it happens

Trigger: GET /language_pack/zh-CN/abc123def456/script.js (hyphenated tag), uppercase 'EN', 4-letter language subtag, or traversal-style input in <lang>; the version segment can be perfectly valid and this still fires because lang is checked first.

Common situations: Browser locale tags (BCP-47, hyphenated) passed through unmodified; stale cached index.html requesting a locale key that a config rename changed; monitoring probes hitting the URL with raw Accept-Language values.

Related errors

• All values must be numeric
• validation_error
• Unsupported whisker type: ${whiskerOptions}
• Found invalid orderby options
• Unknown Error

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/c91389ceaf231258. Report an issue: GitHub.