From fb53761ec8a11a33cf438eab172020b97b99dd3e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 21 Aug 2026 01:10:25 -0700
Subject: [PATCH 1/8] chore(deps-dev): bump baseline-browser-mapping from
 2.11.13 to 2.11.14 in /superset-frontend (#43381)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 superset-frontend/package-lock.json | 8 ++++----
 superset-frontend/package.json      | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/superset-frontend/package-lock.json b/superset-frontend/package-lock.json
index 8b91fcd51bdf..63ec163f43f2 100644
--- a/superset-frontend/package-lock.json
+++ b/superset-frontend/package-lock.json
@@ -218,7 +218,7 @@
         "babel-loader": "^10.1.1",
         "babel-plugin-dynamic-import-node": "^2.3.3",
         "babel-plugin-jsx-remove-data-test-id": "^3.0.0",
-        "baseline-browser-mapping": "^2.11.13",
+        "baseline-browser-mapping": "^2.11.14",
         "cheerio": "1.2.0",
         "concurrently": "^10.0.4",
         "copy-webpack-plugin": "^14.0.0",
@@ -15697,9 +15697,9 @@
       "license": "MIT"
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.11.13",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.13.tgz",
-      "integrity": "sha512-k9HNuUVMlqVjQ9UHzfPjIqiDbWw7WqT1AoT7GL8VwvF3r0ZfArtgiSPAlmupyNquNgOJHTuH4CKYf8ttMTWBTQ==",
+      "version": "2.11.14",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.14.tgz",
+      "integrity": "sha512-JyJ954WzuIR8/FFzX0o5krdSTrBAkcCSRfWSleRsIHSWV+cZe2FI1PKggVkFke1hBldRs+LRxUczzE9iPmgZww==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
diff --git a/superset-frontend/package.json b/superset-frontend/package.json
index be48a33313f6..8706bfa6963d 100644
--- a/superset-frontend/package.json
+++ b/superset-frontend/package.json
@@ -295,7 +295,7 @@
     "babel-loader": "^10.1.1",
     "babel-plugin-dynamic-import-node": "^2.3.3",
     "babel-plugin-jsx-remove-data-test-id": "^3.0.0",
-    "baseline-browser-mapping": "^2.11.13",
+    "baseline-browser-mapping": "^2.11.14",
     "cheerio": "1.2.0",
     "concurrently": "^10.0.4",
     "copy-webpack-plugin": "^14.0.0",

From 87743ef3f83ae20a54cb2dbf138a251131bee8e8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 21 Aug 2026 01:10:29 -0700
Subject: [PATCH 2/8] chore(deps): bump dompurify from 3.4.12 to 3.4.13 in
 /superset-frontend (#43380)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 superset-frontend/package-lock.json | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/superset-frontend/package-lock.json b/superset-frontend/package-lock.json
index 63ec163f43f2..7569e23a5523 100644
--- a/superset-frontend/package-lock.json
+++ b/superset-frontend/package-lock.json
@@ -43073,6 +43073,15 @@
         "node": ">=12"
       }
     },
+    "packages/superset-ui-core/node_modules/dompurify": {
+      "version": "3.4.13",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.13.tgz",
+      "integrity": "sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ==",
+      "license": "(MPL-2.0 OR Apache-2.0)",
+      "optionalDependencies": {
+        "@types/trusted-types": "^2.0.7"
+      }
+    },
     "packages/superset-ui-core/node_modules/react-ace": {
       "version": "14.0.1",
       "resolved": "https://registry.npmjs.org/react-ace/-/react-ace-14.0.1.tgz",

From 14408eb3db9630fb44d4ee26301ee096d3d1f7d5 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 21 Aug 2026 01:10:33 -0700
Subject: [PATCH 3/8] chore(deps-dev): bump the storybook group in
 /superset-frontend with 5 updates (#43379)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 superset-frontend/package-lock.json | 128 ++++++++++++++--------------
 superset-frontend/package.json      |  10 +--
 2 files changed, 69 insertions(+), 69 deletions(-)

diff --git a/superset-frontend/package-lock.json b/superset-frontend/package-lock.json
index 7569e23a5523..a41060313c59 100644
--- a/superset-frontend/package-lock.json
+++ b/superset-frontend/package-lock.json
@@ -180,9 +180,9 @@
         "@istanbuljs/nyc-config-typescript": "^1.0.1",
         "@playwright/test": "^1.62.1",
         "@pmmmwh/react-refresh-webpack-plugin": "^0.6.2",
-        "@storybook/addon-docs": "10.5.7",
-        "@storybook/addon-links": "10.5.7",
-        "@storybook/react-webpack5": "10.5.7",
+        "@storybook/addon-docs": "10.5.8",
+        "@storybook/addon-links": "10.5.8",
+        "@storybook/react-webpack5": "10.5.8",
         "@storybook/test-runner": "0.24.4",
         "@svgr/webpack": "^8.1.0",
         "@swc/core": "^1.15.47",
@@ -235,7 +235,7 @@
         "eslint-plugin-no-only-tests": "^3.4.0",
         "eslint-plugin-react-prefer-function-component": "^5.0.0",
         "eslint-plugin-react-you-might-not-need-an-effect": "^1.0.1",
-        "eslint-plugin-storybook": "10.5.7",
+        "eslint-plugin-storybook": "10.5.8",
         "eslint-plugin-testing-library": "^7.16.2",
         "eslint-plugin-theme-colors": "file:eslint-rules/eslint-plugin-theme-colors",
         "fetch-mock": "^12.6.0",
@@ -266,7 +266,7 @@
         "source-map": "^0.8.0",
         "source-map-support": "^0.5.21",
         "speed-measure-webpack-plugin": "^1.6.0",
-        "storybook": "10.5.7",
+        "storybook": "10.5.8",
         "style-loader": "^4.0.0",
         "stylelint": "^17.14.1",
         "swc-loader": "^0.2.7",
@@ -10765,16 +10765,16 @@
       "license": "MIT"
     },
     "node_modules/@storybook/addon-docs": {
-      "version": "10.5.7",
-      "resolved": "https://registry.npmjs.org/@storybook/addon-docs/-/addon-docs-10.5.7.tgz",
-      "integrity": "sha512-KNARJfjICaizinsR3INMEiipZm1ObYo+xw+E26gteu50Bcy2dIZUtk5uHY5XdtardU3AXX6yRXoBZ2HCY3lbHA==",
+      "version": "10.5.8",
+      "resolved": "https://registry.npmjs.org/@storybook/addon-docs/-/addon-docs-10.5.8.tgz",
+      "integrity": "sha512-NlHiMKW/UvW/uL8HXFDCEVwoH3qZeGYZ/qlWax4d7H471b/T54MBq2KcB4ZrdA785FfIH3numAJdBb5jwn00Mg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@mdx-js/react": "^3.0.0",
-        "@storybook/csf-plugin": "10.5.7",
+        "@storybook/csf-plugin": "10.5.8",
         "@storybook/icons": "^2.0.2",
-        "@storybook/react-dom-shim": "10.5.7",
+        "@storybook/react-dom-shim": "10.5.8",
         "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
         "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
         "ts-dedent": "^2.0.0"
@@ -10785,7 +10785,7 @@
       },
       "peerDependencies": {
         "@types/react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "storybook": "10.5.7"
+        "storybook": "10.5.8"
       },
       "peerDependenciesMeta": {
         "@types/react": {
@@ -10794,9 +10794,9 @@
       }
     },
     "node_modules/@storybook/addon-docs/node_modules/@storybook/csf-plugin": {
-      "version": "10.5.7",
-      "resolved": "https://registry.npmjs.org/@storybook/csf-plugin/-/csf-plugin-10.5.7.tgz",
-      "integrity": "sha512-IaX8FlM0H36HNFhJ2+4L9bCldqfvHGqcLg841SJNyK/DhfMlM7JsvY/GDH2ZFuWrUf8FSOx96GRRnHq6XfRKag==",
+      "version": "10.5.8",
+      "resolved": "https://registry.npmjs.org/@storybook/csf-plugin/-/csf-plugin-10.5.8.tgz",
+      "integrity": "sha512-/FHiMyOWWEXfwK/lM0WxmkP9GLzbSJJuzGtfeuNWSOVDnvAMbjavitxfHb5wSbWKIQo0XYC1EJ2Y7x91XNYP4w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10809,7 +10809,7 @@
       "peerDependencies": {
         "esbuild": "*",
         "rollup": "*",
-        "storybook": "10.5.7",
+        "storybook": "10.5.8",
         "vite": "*",
         "webpack": "*"
       },
@@ -10829,9 +10829,9 @@
       }
     },
     "node_modules/@storybook/addon-docs/node_modules/@storybook/react-dom-shim": {
-      "version": "10.5.7",
-      "resolved": "https://registry.npmjs.org/@storybook/react-dom-shim/-/react-dom-shim-10.5.7.tgz",
-      "integrity": "sha512-lxOkyh+wu/MiBXvYQHjZfD+DRKOa4bHBzbuGuiHXnHXmdOcTRdcrQTsoeN2FPtfugmmOG66cZUEgDwNX+k5eRA==",
+      "version": "10.5.8",
+      "resolved": "https://registry.npmjs.org/@storybook/react-dom-shim/-/react-dom-shim-10.5.8.tgz",
+      "integrity": "sha512-N8D13/Xny+V3kfe1KBgsAHS0nKWXLLdgOOXS9poKdYzVwVCN+CGEGBxWX0zMMtdCptqa6/57em9coPlZMoO+bg==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -10843,7 +10843,7 @@
         "@types/react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
         "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
         "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "storybook": "10.5.7"
+        "storybook": "10.5.8"
       },
       "peerDependenciesMeta": {
         "@types/react": {
@@ -10855,9 +10855,9 @@
       }
     },
     "node_modules/@storybook/addon-links": {
-      "version": "10.5.7",
-      "resolved": "https://registry.npmjs.org/@storybook/addon-links/-/addon-links-10.5.7.tgz",
-      "integrity": "sha512-17PxEOocLhAEaPeQ4q+8yul/LF9YEIePS1arknCAS7U1pQXTe0uj+R0pB6uPLVflM5gECQMiP4WzIj4tEiL6+A==",
+      "version": "10.5.8",
+      "resolved": "https://registry.npmjs.org/@storybook/addon-links/-/addon-links-10.5.8.tgz",
+      "integrity": "sha512-mpWw4alBJVGqgVh897LZ2keN/xnMHcH93wKJG+oGg4+cdEUA+06hCs5T4k+AS5Aa+EZ6LvdOoi2VPHssyQlCCA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10870,7 +10870,7 @@
       "peerDependencies": {
         "@types/react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
         "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "storybook": "10.5.7"
+        "storybook": "10.5.8"
       },
       "peerDependenciesMeta": {
         "@types/react": {
@@ -10964,15 +10964,15 @@
       }
     },
     "node_modules/@storybook/react-webpack5": {
-      "version": "10.5.7",
-      "resolved": "https://registry.npmjs.org/@storybook/react-webpack5/-/react-webpack5-10.5.7.tgz",
-      "integrity": "sha512-vvl07oXp2qfmHJHZ77Aw1F3LFOo7XubOta+lC8UmlEw3rDDJhQxJN3erJJVHavNhdA2jBTK6VUXQKdqQh7X7nQ==",
+      "version": "10.5.8",
+      "resolved": "https://registry.npmjs.org/@storybook/react-webpack5/-/react-webpack5-10.5.8.tgz",
+      "integrity": "sha512-HkPi42WaoNSHC0DAERsJEF7Vhnluzsp/aiuhnH65GGYG5TmdLL9G8KDiYvXHGDCyb4RfoAPYrtzxaLMFfPPFvQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@storybook/builder-webpack5": "10.5.7",
-        "@storybook/preset-react-webpack": "10.5.7",
-        "@storybook/react": "10.5.7"
+        "@storybook/builder-webpack5": "10.5.8",
+        "@storybook/preset-react-webpack": "10.5.8",
+        "@storybook/react": "10.5.8"
       },
       "funding": {
         "type": "opencollective",
@@ -10981,7 +10981,7 @@
       "peerDependencies": {
         "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
         "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "storybook": "10.5.7",
+        "storybook": "10.5.8",
         "typescript": ">= 4.9.x"
       },
       "peerDependenciesMeta": {
@@ -10991,13 +10991,13 @@
       }
     },
     "node_modules/@storybook/react-webpack5/node_modules/@storybook/builder-webpack5": {
-      "version": "10.5.7",
-      "resolved": "https://registry.npmjs.org/@storybook/builder-webpack5/-/builder-webpack5-10.5.7.tgz",
-      "integrity": "sha512-4n4c60LihFivZnjAcXGO5+XbgZthoUtKb/nPKVgypj3MpEetzjq6XR83A4UNnRsXYmjqfn6bsDWNgEJ/RvQg5A==",
+      "version": "10.5.8",
+      "resolved": "https://registry.npmjs.org/@storybook/builder-webpack5/-/builder-webpack5-10.5.8.tgz",
+      "integrity": "sha512-ke5x27gtWQ4gpXCLWxdGkr8ZlJwBykV/KjbBTAlC04dmS9OkI9MBzGj+TteUlgrcaN7LwoNTR5zRmxKStOZYzQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@storybook/core-webpack": "10.5.7",
+        "@storybook/core-webpack": "10.5.8",
         "case-sensitive-paths-webpack-plugin": "^2.4.0",
         "cjs-module-lexer": "^1.2.3",
         "css-loader": "^7.1.2",
@@ -11019,7 +11019,7 @@
         "url": "https://opencollective.com/storybook"
       },
       "peerDependencies": {
-        "storybook": "10.5.7"
+        "storybook": "10.5.8"
       },
       "peerDependenciesMeta": {
         "typescript": {
@@ -11028,9 +11028,9 @@
       }
     },
     "node_modules/@storybook/react-webpack5/node_modules/@storybook/builder-webpack5/node_modules/@storybook/core-webpack": {
-      "version": "10.5.7",
-      "resolved": "https://registry.npmjs.org/@storybook/core-webpack/-/core-webpack-10.5.7.tgz",
-      "integrity": "sha512-0dtDw/FNPREoeCHX2RgZz0OecxaAGol1R7bCobFevArxyFIPJisTfjDMUFHKr+3B7BilTd3vnatl7Nlvgs0EiA==",
+      "version": "10.5.8",
+      "resolved": "https://registry.npmjs.org/@storybook/core-webpack/-/core-webpack-10.5.8.tgz",
+      "integrity": "sha512-HccINB0UbTtnyJtKpaX+C35BRTSnAwnreIMwwI+LpeUd4x9mQg0G9orB7lfBBZwd5LQf8YhM2Vkjiawzo41GLg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11041,17 +11041,17 @@
         "url": "https://opencollective.com/storybook"
       },
       "peerDependencies": {
-        "storybook": "10.5.7"
+        "storybook": "10.5.8"
       }
     },
     "node_modules/@storybook/react-webpack5/node_modules/@storybook/preset-react-webpack": {
-      "version": "10.5.7",
-      "resolved": "https://registry.npmjs.org/@storybook/preset-react-webpack/-/preset-react-webpack-10.5.7.tgz",
-      "integrity": "sha512-xwNRcoVlIDx1/YYCFBAxfh/91vFiOgrVI+0Ir4u9eO87SH2leehRnJh619QEOrlQEU5px487y2BmL2ZVtmTpYA==",
+      "version": "10.5.8",
+      "resolved": "https://registry.npmjs.org/@storybook/preset-react-webpack/-/preset-react-webpack-10.5.8.tgz",
+      "integrity": "sha512-0JjgVoX5t9Wb+gwddYHx/Ej7KFqwd65lpHXEhBoT4pFWRqVI0pvfHu42M+DRGjsgOye3uE+3pH4yHR3+0/fCHA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@storybook/core-webpack": "10.5.7",
+        "@storybook/core-webpack": "10.5.8",
         "@storybook/react-docgen-typescript-plugin": "1.0.6--canary.9.0c3f3b7.0",
         "@types/semver": "^7.7.1",
         "magic-string": "^0.30.5",
@@ -11068,7 +11068,7 @@
       "peerDependencies": {
         "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
         "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "storybook": "10.5.7"
+        "storybook": "10.5.8"
       },
       "peerDependenciesMeta": {
         "typescript": {
@@ -11077,9 +11077,9 @@
       }
     },
     "node_modules/@storybook/react-webpack5/node_modules/@storybook/preset-react-webpack/node_modules/@storybook/core-webpack": {
-      "version": "10.5.7",
-      "resolved": "https://registry.npmjs.org/@storybook/core-webpack/-/core-webpack-10.5.7.tgz",
-      "integrity": "sha512-0dtDw/FNPREoeCHX2RgZz0OecxaAGol1R7bCobFevArxyFIPJisTfjDMUFHKr+3B7BilTd3vnatl7Nlvgs0EiA==",
+      "version": "10.5.8",
+      "resolved": "https://registry.npmjs.org/@storybook/core-webpack/-/core-webpack-10.5.8.tgz",
+      "integrity": "sha512-HccINB0UbTtnyJtKpaX+C35BRTSnAwnreIMwwI+LpeUd4x9mQg0G9orB7lfBBZwd5LQf8YhM2Vkjiawzo41GLg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11090,18 +11090,18 @@
         "url": "https://opencollective.com/storybook"
       },
       "peerDependencies": {
-        "storybook": "10.5.7"
+        "storybook": "10.5.8"
       }
     },
     "node_modules/@storybook/react-webpack5/node_modules/@storybook/react": {
-      "version": "10.5.7",
-      "resolved": "https://registry.npmjs.org/@storybook/react/-/react-10.5.7.tgz",
-      "integrity": "sha512-uFvty2MMdFXzW5PcQe1JqDAZkz6cQq7q/9G/cbGVnBEvP6zsOVeL+bmrQ0/WBlFQN0Ko9+ZoCTvaQ9s65zBa5g==",
+      "version": "10.5.8",
+      "resolved": "https://registry.npmjs.org/@storybook/react/-/react-10.5.8.tgz",
+      "integrity": "sha512-6qqkmqX6imtL+0Z9Uan2tIfYivOI0FiVmWr0zpqqQR15AkJ18JfNcNTQoyjeAlCO0Kei56SWqnu2qLq52TYplg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@storybook/global": "^5.0.0",
-        "@storybook/react-dom-shim": "10.5.7",
+        "@storybook/react-dom-shim": "10.5.8",
         "react-docgen": "^8.0.2",
         "react-docgen-typescript": "^2.2.2"
       },
@@ -11114,7 +11114,7 @@
         "@types/react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
         "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
         "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "storybook": "10.5.7",
+        "storybook": "10.5.8",
         "typescript": ">= 4.9.x"
       },
       "peerDependenciesMeta": {
@@ -11130,9 +11130,9 @@
       }
     },
     "node_modules/@storybook/react-webpack5/node_modules/@storybook/react/node_modules/@storybook/react-dom-shim": {
-      "version": "10.5.7",
-      "resolved": "https://registry.npmjs.org/@storybook/react-dom-shim/-/react-dom-shim-10.5.7.tgz",
-      "integrity": "sha512-lxOkyh+wu/MiBXvYQHjZfD+DRKOa4bHBzbuGuiHXnHXmdOcTRdcrQTsoeN2FPtfugmmOG66cZUEgDwNX+k5eRA==",
+      "version": "10.5.8",
+      "resolved": "https://registry.npmjs.org/@storybook/react-dom-shim/-/react-dom-shim-10.5.8.tgz",
+      "integrity": "sha512-N8D13/Xny+V3kfe1KBgsAHS0nKWXLLdgOOXS9poKdYzVwVCN+CGEGBxWX0zMMtdCptqa6/57em9coPlZMoO+bg==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -11144,7 +11144,7 @@
         "@types/react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
         "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
         "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "storybook": "10.5.7"
+        "storybook": "10.5.8"
       },
       "peerDependenciesMeta": {
         "@types/react": {
@@ -20219,9 +20219,9 @@
       }
     },
     "node_modules/eslint-plugin-storybook": {
-      "version": "10.5.7",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-storybook/-/eslint-plugin-storybook-10.5.7.tgz",
-      "integrity": "sha512-mLpamG1Rsica2jYbUzIZOEuy7Fm1IMtVLMvvxGTpjTVKUMxTXJsANx3MBpH2VSbGQB8Yzlt5399WL/O07K97Ig==",
+      "version": "10.5.8",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-storybook/-/eslint-plugin-storybook-10.5.8.tgz",
+      "integrity": "sha512-bf9W5nZyWdIaCUZf4aEZnEeD1mn+csNYX8dYUQjAo6L7/DkSLtr65R4zFZ1xeS4m6dOXO6UtUySesCSw4e8w1g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20230,7 +20230,7 @@
       },
       "peerDependencies": {
         "eslint": ">=8",
-        "storybook": "10.5.7"
+        "storybook": "10.5.8"
       }
     },
     "node_modules/eslint-plugin-testing-library": {
@@ -37711,9 +37711,9 @@
       }
     },
     "node_modules/storybook": {
-      "version": "10.5.7",
-      "resolved": "https://registry.npmjs.org/storybook/-/storybook-10.5.7.tgz",
-      "integrity": "sha512-oiKvWIwIoOhFP1i6dASYyMXwPHKEtVZMshqSB7EvIVYjWRh0l9H7gHEt1z4Gh2rLGFMekWdsm4s94rvwpR7gkg==",
+      "version": "10.5.8",
+      "resolved": "https://registry.npmjs.org/storybook/-/storybook-10.5.8.tgz",
+      "integrity": "sha512-rR4oFMSiWBSqI0lvsJPtcQUPj8+hzj3TkLu+Mw61Wo6YxPSb5FsLSHai0jZnuaIdKIlmu25KCfwlSQl4e1uvnA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
diff --git a/superset-frontend/package.json b/superset-frontend/package.json
index 8706bfa6963d..5ca3e1a2ba8a 100644
--- a/superset-frontend/package.json
+++ b/superset-frontend/package.json
@@ -257,9 +257,9 @@
     "@istanbuljs/nyc-config-typescript": "^1.0.1",
     "@playwright/test": "^1.62.1",
     "@pmmmwh/react-refresh-webpack-plugin": "^0.6.2",
-    "@storybook/addon-docs": "10.5.7",
-    "@storybook/addon-links": "10.5.7",
-    "@storybook/react-webpack5": "10.5.7",
+    "@storybook/addon-docs": "10.5.8",
+    "@storybook/addon-links": "10.5.8",
+    "@storybook/react-webpack5": "10.5.8",
     "@storybook/test-runner": "0.24.4",
     "@svgr/webpack": "^8.1.0",
     "@swc/core": "^1.15.47",
@@ -312,7 +312,7 @@
     "eslint-plugin-no-only-tests": "^3.4.0",
     "eslint-plugin-react-prefer-function-component": "^5.0.0",
     "eslint-plugin-react-you-might-not-need-an-effect": "^1.0.1",
-    "eslint-plugin-storybook": "10.5.7",
+    "eslint-plugin-storybook": "10.5.8",
     "eslint-plugin-testing-library": "^7.16.2",
     "eslint-plugin-theme-colors": "file:eslint-rules/eslint-plugin-theme-colors",
     "fetch-mock": "^12.6.0",
@@ -343,7 +343,7 @@
     "source-map": "^0.8.0",
     "source-map-support": "^0.5.21",
     "speed-measure-webpack-plugin": "^1.6.0",
-    "storybook": "10.5.7",
+    "storybook": "10.5.8",
     "style-loader": "^4.0.0",
     "stylelint": "^17.14.1",
     "swc-loader": "^0.2.7",

From 132340b6529a94c613d8501771e007fc78fb447e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 21 Aug 2026 01:10:37 -0700
Subject: [PATCH 4/8] chore(deps): bump astral-sh/setup-uv from 10.0.0 to
 10.0.1 (#43378)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/bump-python-package.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/bump-python-package.yml b/.github/workflows/bump-python-package.yml
index 50cc0d2a805c..1ba8bba2ef1b 100644
--- a/.github/workflows/bump-python-package.yml
+++ b/.github/workflows/bump-python-package.yml
@@ -48,7 +48,7 @@ jobs:
           python-version: "3.11"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           python-version: "3.11"
           enable-cache: true

From 6e22050b5097ef467f7e96cbe8f7328c54f8ced7 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 21 Aug 2026 01:10:41 -0700
Subject: [PATCH 5/8] chore(deps): bump the storybook group in /docs with 2
 updates (#43377)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 docs/package.json |  4 ++--
 docs/yarn.lock    | 36 ++++++++++++++++++------------------
 2 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/docs/package.json b/docs/package.json
index cbd50bdd617e..82c1d539d467 100644
--- a/docs/package.json
+++ b/docs/package.json
@@ -58,7 +58,7 @@
     "@fontsource/inter": "^5.3.0",
     "@mdx-js/react": "^3.1.1",
     "@saucelabs/theme-github-codeblock": "^0.3.0",
-    "@storybook/addon-docs": "^10.5.7",
+    "@storybook/addon-docs": "^10.5.8",
     "@superset-ui/core": "^0.20.4",
     "@swc/core": "^1.15.47",
     "antd": "^6.6.0",
@@ -77,7 +77,7 @@
     "react-table": "^7.8.0",
     "remark-import-partial": "^0.0.2",
     "reselect": "^5.2.0",
-    "storybook": "^10.5.7",
+    "storybook": "^10.5.8",
     "swagger-ui-react": "^5.32.13",
     "swc-loader": "^0.2.7",
     "tinycolor2": "^1.4.2",
diff --git a/docs/yarn.lock b/docs/yarn.lock
index 6c22e5ee02bc..e8394d070862 100644
--- a/docs/yarn.lock
+++ b/docs/yarn.lock
@@ -4122,23 +4122,23 @@
   resolved "https://registry.yarnpkg.com/@standard-schema/utils/-/utils-0.3.0.tgz#3d5e608f16c2390c10528e98e59aef6bf73cae7b"
   integrity sha512-e7Mew686owMaPJVNNLs55PUvgz371nKgwsc4vxE49zsODpJEnxgxRo2y/OKrqueavXgZNMDVj3DdHFlaSAeU8g==
 
-"@storybook/addon-docs@^10.5.7":
-  version "10.5.7"
-  resolved "https://registry.yarnpkg.com/@storybook/addon-docs/-/addon-docs-10.5.7.tgz#6d599c94fc871c248ce06a5c081f57655c83f40a"
-  integrity sha512-KNARJfjICaizinsR3INMEiipZm1ObYo+xw+E26gteu50Bcy2dIZUtk5uHY5XdtardU3AXX6yRXoBZ2HCY3lbHA==
+"@storybook/addon-docs@^10.5.8":
+  version "10.5.8"
+  resolved "https://registry.yarnpkg.com/@storybook/addon-docs/-/addon-docs-10.5.8.tgz#767c10c7a4cc1b625b93f869b2a2b09fc8514f2e"
+  integrity sha512-NlHiMKW/UvW/uL8HXFDCEVwoH3qZeGYZ/qlWax4d7H471b/T54MBq2KcB4ZrdA785FfIH3numAJdBb5jwn00Mg==
   dependencies:
     "@mdx-js/react" "^3.0.0"
-    "@storybook/csf-plugin" "10.5.7"
+    "@storybook/csf-plugin" "10.5.8"
     "@storybook/icons" "^2.0.2"
-    "@storybook/react-dom-shim" "10.5.7"
+    "@storybook/react-dom-shim" "10.5.8"
     react "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
     react-dom "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
     ts-dedent "^2.0.0"
 
-"@storybook/csf-plugin@10.5.7":
-  version "10.5.7"
-  resolved "https://registry.yarnpkg.com/@storybook/csf-plugin/-/csf-plugin-10.5.7.tgz#bc73f164d1b5f8e2931b2774f4b389a06453cf6e"
-  integrity sha512-IaX8FlM0H36HNFhJ2+4L9bCldqfvHGqcLg841SJNyK/DhfMlM7JsvY/GDH2ZFuWrUf8FSOx96GRRnHq6XfRKag==
+"@storybook/csf-plugin@10.5.8":
+  version "10.5.8"
+  resolved "https://registry.yarnpkg.com/@storybook/csf-plugin/-/csf-plugin-10.5.8.tgz#c626c5bfe55d0e279b2457e5cf150a788d1fc637"
+  integrity sha512-/FHiMyOWWEXfwK/lM0WxmkP9GLzbSJJuzGtfeuNWSOVDnvAMbjavitxfHb5wSbWKIQo0XYC1EJ2Y7x91XNYP4w==
   dependencies:
     unplugin "^2.3.5"
 
@@ -4152,10 +4152,10 @@
   resolved "https://registry.yarnpkg.com/@storybook/icons/-/icons-2.1.0.tgz#edfc2450a39c5e780f28c6cbc49acd7bff59b41a"
   integrity sha512-Fxh9vYpX9bQqFeHRiY8h2ApeRGDzRSMLwJwNZ/AIRqnyOKHxRKL+yFe+ctEkVJmuptRE9u1Hrn8ZZNHyfDKKNg==
 
-"@storybook/react-dom-shim@10.5.7":
-  version "10.5.7"
-  resolved "https://registry.yarnpkg.com/@storybook/react-dom-shim/-/react-dom-shim-10.5.7.tgz#9a5aa0e0f89c09e71c6cbfc6bb1abeb537e5aabf"
-  integrity sha512-lxOkyh+wu/MiBXvYQHjZfD+DRKOa4bHBzbuGuiHXnHXmdOcTRdcrQTsoeN2FPtfugmmOG66cZUEgDwNX+k5eRA==
+"@storybook/react-dom-shim@10.5.8":
+  version "10.5.8"
+  resolved "https://registry.yarnpkg.com/@storybook/react-dom-shim/-/react-dom-shim-10.5.8.tgz#40cc3e32af424baa2e4109a325dae2ede29999e2"
+  integrity sha512-N8D13/Xny+V3kfe1KBgsAHS0nKWXLLdgOOXS9poKdYzVwVCN+CGEGBxWX0zMMtdCptqa6/57em9coPlZMoO+bg==
 
 "@superset-ui/core@^0.20.4":
   version "0.20.4"
@@ -14783,10 +14783,10 @@ stop-iteration-iterator@^1.1.0:
     es-errors "^1.3.0"
     internal-slot "^1.1.0"
 
-storybook@^10.5.7:
-  version "10.5.7"
-  resolved "https://registry.yarnpkg.com/storybook/-/storybook-10.5.7.tgz#adfc465e51f337291c095278c23f1b8024ef2da7"
-  integrity sha512-oiKvWIwIoOhFP1i6dASYyMXwPHKEtVZMshqSB7EvIVYjWRh0l9H7gHEt1z4Gh2rLGFMekWdsm4s94rvwpR7gkg==
+storybook@^10.5.8:
+  version "10.5.8"
+  resolved "https://registry.yarnpkg.com/storybook/-/storybook-10.5.8.tgz#d5f051983e6232c0a73ea02149a72c7bafb43275"
+  integrity sha512-rR4oFMSiWBSqI0lvsJPtcQUPj8+hzj3TkLu+Mw61Wo6YxPSb5FsLSHai0jZnuaIdKIlmu25KCfwlSQl4e1uvnA==
   dependencies:
     "@storybook/global" "^5.0.0"
     "@storybook/icons" "^2.0.2"

From 65910abf21f251a48483ac8937545fb49a73472f Mon Sep 17 00:00:00 2001
From: Mehmet Salih Yavuz <salih.yavuz@proton.me>
Date: Fri, 21 Aug 2026 12:56:42 +0300
Subject: [PATCH 6/8] fix(sqllab): disable Save dataset until the query runs
 successfully (#43330)

---
 .../SaveDatasetActionButton.test.tsx          | 26 +++++++++++-
 .../SaveDatasetActionButton/index.tsx         |  9 +++-
 .../components/SaveQuery/SaveQuery.test.tsx   |  1 +
 .../src/SqlLab/components/SaveQuery/index.tsx |  3 ++
 .../components/SqlEditor/SqlEditor.test.tsx   | 42 +++++++++++++++++++
 .../src/SqlLab/components/SqlEditor/index.tsx |  8 +++-
 6 files changed, 85 insertions(+), 4 deletions(-)

diff --git a/superset-frontend/src/SqlLab/components/SaveDatasetActionButton/SaveDatasetActionButton.test.tsx b/superset-frontend/src/SqlLab/components/SaveDatasetActionButton/SaveDatasetActionButton.test.tsx
index faaa5cb67fca..5df12e95a0c6 100644
--- a/superset-frontend/src/SqlLab/components/SaveDatasetActionButton/SaveDatasetActionButton.test.tsx
+++ b/superset-frontend/src/SqlLab/components/SaveDatasetActionButton/SaveDatasetActionButton.test.tsx
@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { render, screen } from 'spec/helpers/testing-library';
+import { render, screen, userEvent } from 'spec/helpers/testing-library';
 import SaveDatasetActionButton from 'src/SqlLab/components/SaveDatasetActionButton';
 
 // eslint-disable-next-line no-restricted-globals -- TODO: Migrate from describe blocks
@@ -27,6 +27,7 @@ describe('SaveDatasetActionButton', () => {
       <SaveDatasetActionButton
         setShowSave={() => true}
         onSaveAsExplore={onSaveAsExplore}
+        canSaveDataset
       />,
     );
 
@@ -41,4 +42,27 @@ describe('SaveDatasetActionButton', () => {
     expect(saveBtn).toBeVisible();
     expect(saveDatasetBtn).toBeVisible();
   });
+
+  test('disables the save dataset button when the query did not run successfully', async () => {
+    render(
+      <SaveDatasetActionButton
+        setShowSave={() => true}
+        onSaveAsExplore={jest.fn()}
+        canSaveDataset={false}
+      />,
+    );
+
+    const saveDatasetBtn = screen.getByRole('button', {
+      name: /save dataset/i,
+    });
+    expect(saveDatasetBtn).toBeDisabled();
+
+    // the disabled button is wrapped in a span so the tooltip still triggers
+    userEvent.hover(saveDatasetBtn.parentElement as HTMLElement);
+    expect(
+      await screen.findByRole('tooltip', {
+        name: 'You must run the query successfully first',
+      }),
+    ).toBeInTheDocument();
+  });
 });
diff --git a/superset-frontend/src/SqlLab/components/SaveDatasetActionButton/index.tsx b/superset-frontend/src/SqlLab/components/SaveDatasetActionButton/index.tsx
index a592c786b95f..774ef5b99fda 100644
--- a/superset-frontend/src/SqlLab/components/SaveDatasetActionButton/index.tsx
+++ b/superset-frontend/src/SqlLab/components/SaveDatasetActionButton/index.tsx
@@ -23,11 +23,13 @@ import { Button } from '@superset-ui/core/components';
 interface SaveDatasetActionButtonProps {
   setShowSave: (arg0: boolean) => void;
   onSaveAsExplore?: () => void;
+  canSaveDataset: boolean;
 }
 
 const SaveDatasetActionButton = ({
   setShowSave,
   onSaveAsExplore,
+  canSaveDataset,
 }: SaveDatasetActionButtonProps) => (
   <>
     <Button
@@ -43,8 +45,13 @@ const SaveDatasetActionButton = ({
         color="default"
         variant="text"
         onClick={() => onSaveAsExplore?.()}
+        disabled={!canSaveDataset}
         icon={<Icons.TableOutlined />}
-        tooltip={t('Save or Overwrite Dataset')}
+        tooltip={
+          canSaveDataset
+            ? t('Save or Overwrite Dataset')
+            : t('You must run the query successfully first')
+        }
         aria-label={t('Save dataset')}
       />
     )}
diff --git a/superset-frontend/src/SqlLab/components/SaveQuery/SaveQuery.test.tsx b/superset-frontend/src/SqlLab/components/SaveQuery/SaveQuery.test.tsx
index 22fe9452b8b3..20b40792fb54 100644
--- a/superset-frontend/src/SqlLab/components/SaveQuery/SaveQuery.test.tsx
+++ b/superset-frontend/src/SqlLab/components/SaveQuery/SaveQuery.test.tsx
@@ -35,6 +35,7 @@ const mockedProps = {
   onSave: () => {},
   saveQueryWarning: null,
   columns: [],
+  canSaveDataset: true,
 };
 
 const mockState = {
diff --git a/superset-frontend/src/SqlLab/components/SaveQuery/index.tsx b/superset-frontend/src/SqlLab/components/SaveQuery/index.tsx
index 15957b93d43e..81a493df6218 100644
--- a/superset-frontend/src/SqlLab/components/SaveQuery/index.tsx
+++ b/superset-frontend/src/SqlLab/components/SaveQuery/index.tsx
@@ -52,6 +52,7 @@ interface SaveQueryProps {
   onUpdate: (arg0: QueryPayload, id: string) => void;
   saveQueryWarning: string | null;
   database: Partial<DatabaseObject> | undefined;
+  canSaveDataset: boolean;
 }
 
 export type QueryPayload = {
@@ -81,6 +82,7 @@ const SaveQuery = ({
   saveQueryWarning,
   database,
   columns,
+  canSaveDataset,
 }: SaveQueryProps) => {
   const queryEditor = useQueryEditor(queryEditorId, [
     'autorun',
@@ -207,6 +209,7 @@ const SaveQuery = ({
         <SaveDatasetActionButton
           setShowSave={setShowSave}
           onSaveAsExplore={canExploreDatabase ? onSaveAsExplore : undefined}
+          canSaveDataset={canSaveDataset}
         />
       )}
       <SaveDatasetModal
diff --git a/superset-frontend/src/SqlLab/components/SqlEditor/SqlEditor.test.tsx b/superset-frontend/src/SqlLab/components/SqlEditor/SqlEditor.test.tsx
index 86c4a6b23da8..a251299adc57 100644
--- a/superset-frontend/src/SqlLab/components/SqlEditor/SqlEditor.test.tsx
+++ b/superset-frontend/src/SqlLab/components/SqlEditor/SqlEditor.test.tsx
@@ -21,6 +21,7 @@ import {
   isFeatureEnabled,
   getExtensionsRegistry,
   FeatureFlag,
+  QueryState,
 } from '@superset-ui/core';
 import {
   act,
@@ -334,6 +335,47 @@ describe('SqlEditor', () => {
     expect(await findByText('10 000')).toBeInTheDocument();
   });
 
+  const setupWithLatestQuery = (overrides: Partial<typeof latestQuery>) =>
+    setup(
+      mockedProps,
+      createStore({
+        ...mockInitialState,
+        sqlLab: {
+          ...mockInitialState.sqlLab,
+          queries: {
+            [latestQuery.id]: { ...latestQuery, ...overrides },
+          },
+          databases: {
+            1991: {
+              ...mockInitialState.sqlLab.databases[1991],
+              allows_virtual_table_explore: true,
+            },
+          },
+        },
+      }),
+    );
+
+  test('enables the save dataset button when the latest query succeeded', async () => {
+    const { findByRole } = setupWithLatestQuery({ state: QueryState.Success });
+    expect(await findByRole('button', { name: 'Save dataset' })).toBeEnabled();
+  });
+
+  test('disables the save dataset button when the latest query failed', async () => {
+    const { findByRole } = setupWithLatestQuery({
+      state: QueryState.Failed,
+      results: undefined,
+    });
+    expect(await findByRole('button', { name: 'Save dataset' })).toBeDisabled();
+  });
+
+  test('disables the save dataset button when the results are not loaded', async () => {
+    const { findByRole } = setupWithLatestQuery({
+      state: QueryState.Success,
+      results: undefined,
+    });
+    expect(await findByRole('button', { name: 'Save dataset' })).toBeDisabled();
+  });
+
   test('renders an Extension if provided', async () => {
     const extensionsRegistry = getExtensionsRegistry();
 
diff --git a/superset-frontend/src/SqlLab/components/SqlEditor/index.tsx b/superset-frontend/src/SqlLab/components/SqlEditor/index.tsx
index 540b78c73825..2e75c38fb714 100644
--- a/superset-frontend/src/SqlLab/components/SqlEditor/index.tsx
+++ b/superset-frontend/src/SqlLab/components/SqlEditor/index.tsx
@@ -40,6 +40,7 @@ import {
   getExtensionsRegistry,
   QueryResponse,
   Query,
+  QueryState,
 } from '@superset-ui/core';
 import { Alert } from '@apache-superset/core/components';
 import { css, styled, useTheme } from '@apache-superset/core/theme';
@@ -295,6 +296,9 @@ const SqlEditor: FC<Props> = ({
 
   const SqlFormExtension = extensionsRegistry.get('sqleditor.extension.form');
 
+  const successful = latestQuery?.state === QueryState.Success;
+  const resultColumns = latestQuery?.results?.columns || [];
+
   const startQuery = useCallback(
     (
       ctasArg = false,
@@ -712,7 +716,6 @@ const SqlEditor: FC<Props> = ({
 
   const getSecondaryMenuItems = () => {
     const qe = queryEditor;
-    const successful = latestQuery?.state === 'success';
     const scheduleToolTip = successful
       ? t('Schedule the query periodically')
       : t('You must run the query successfully first');
@@ -858,13 +861,14 @@ const SqlEditor: FC<Props> = ({
           )}
         <SaveQuery
           queryEditorId={queryEditor.id}
-          columns={latestQuery?.results?.columns || []}
+          columns={resultColumns}
           onSave={onSaveQuery}
           onUpdate={(query, remoteId) =>
             dispatch(updateSavedQuery(query, remoteId))
           }
           saveQueryWarning={saveQueryWarning}
           database={database}
+          canSaveDataset={successful && resultColumns.length > 0}
         />
         <ShareSqlLabQuery queryEditorId={queryEditor.id} />
       </>

From e45dd2d3f16cad4e98bf107f9edc531acee8afef Mon Sep 17 00:00:00 2001
From: Evan Rusackas <evan@preset.io>
Date: Fri, 21 Aug 2026 04:11:37 -0700
Subject: [PATCH 7/8] ci: pull CI service images from GHCR mirror (fork-safe)
 [depends on #40880] (#40882)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/superset-e2e.yml                   |  8 ++++----
 .../workflows/superset-python-integrationtest.yml    | 12 +++++-------
 .github/workflows/superset-python-presto-hive.yml    | 10 +++++-----
 3 files changed, 14 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/superset-e2e.yml b/.github/workflows/superset-e2e.yml
index cd7198374da8..7c00ce36c3a4 100644
--- a/.github/workflows/superset-e2e.yml
+++ b/.github/workflows/superset-e2e.yml
@@ -78,14 +78,14 @@ jobs:
       USE_DASHBOARD: ${{ github.event.inputs.use_dashboard == 'true' || 'false' }}
     services:
       postgres:
-        image: postgres:17-alpine
+        image: ghcr.io/apache/superset/ci/postgres:17-alpine
         env:
           POSTGRES_USER: superset
           POSTGRES_PASSWORD: superset
         ports:
           - 15432:5432
       redis:
-        image: redis:7-alpine
+        image: ghcr.io/apache/superset/ci/redis:7-alpine
         ports:
           - 16379:6379
     steps:
@@ -186,14 +186,14 @@ jobs:
       GITHUB_TOKEN: ${{ github.token }}
     services:
       postgres:
-        image: postgres:17-alpine
+        image: ghcr.io/apache/superset/ci/postgres:17-alpine
         env:
           POSTGRES_USER: superset
           POSTGRES_PASSWORD: superset
         ports:
           - 15432:5432
       redis:
-        image: redis:7-alpine
+        image: ghcr.io/apache/superset/ci/redis:7-alpine
         ports:
           - 16379:6379
     steps:
diff --git a/.github/workflows/superset-python-integrationtest.yml b/.github/workflows/superset-python-integrationtest.yml
index 62239f6425aa..ee898202b50b 100644
--- a/.github/workflows/superset-python-integrationtest.yml
+++ b/.github/workflows/superset-python-integrationtest.yml
@@ -53,9 +53,7 @@ jobs:
         mysql+mysqldb://superset:superset@127.0.0.1:13306/superset?charset=utf8mb4&binary_prefix=true
     services:
       mysql:
-        image: mysql:8.0
-        # Authenticated pulls use our higher Docker Hub rate limit. Empty on
-        # fork PRs (secrets unavailable) -> runner falls back to anonymous.
+        image: ghcr.io/apache/superset/ci/mysql:8.0
         env:
           MYSQL_ROOT_PASSWORD: root
         ports:
@@ -66,7 +64,7 @@ jobs:
           --health-timeout=5s
           --health-retries=5
       redis:
-        image: redis:7-alpine
+        image: ghcr.io/apache/superset/ci/redis:7-alpine
         options: --entrypoint redis-server
         ports:
           - 16379:6379
@@ -143,7 +141,7 @@ jobs:
       SUPERSET__SQLALCHEMY_DATABASE_URI: postgresql+psycopg2://superset:superset@127.0.0.1:15432/superset
     services:
       postgres:
-        image: postgres:17-alpine
+        image: ghcr.io/apache/superset/ci/postgres:17-alpine
         env:
           POSTGRES_USER: superset
           POSTGRES_PASSWORD: superset
@@ -152,7 +150,7 @@ jobs:
           # GitHub action runner's default installations
           - 15432:5432
       redis:
-        image: redis:7-alpine
+        image: ghcr.io/apache/superset/ci/redis:7-alpine
         ports:
           - 16379:6379
     steps:
@@ -202,7 +200,7 @@ jobs:
         sqlite:///${{ github.workspace }}/.temp/examples.db?check_same_thread=true
     services:
       redis:
-        image: redis:7-alpine
+        image: ghcr.io/apache/superset/ci/redis:7-alpine
         ports:
           - 16379:6379
     steps:
diff --git a/.github/workflows/superset-python-presto-hive.yml b/.github/workflows/superset-python-presto-hive.yml
index 363dea34e027..373970d2d2ba 100644
--- a/.github/workflows/superset-python-presto-hive.yml
+++ b/.github/workflows/superset-python-presto-hive.yml
@@ -52,7 +52,7 @@ jobs:
       SUPERSET__SQLALCHEMY_EXAMPLES_URI: presto://localhost:15433/memory/default
     services:
       postgres:
-        image: postgres:17-alpine
+        image: ghcr.io/apache/superset/ci/postgres:17-alpine
         env:
           POSTGRES_USER: superset
           POSTGRES_PASSWORD: superset
@@ -61,7 +61,7 @@ jobs:
           # GitHub action runner's default installations
           - 15432:5432
       presto:
-        image: starburstdata/presto:350-e.6
+        image: ghcr.io/apache/superset/ci/presto:350-e.6
         env:
           POSTGRES_USER: superset
           POSTGRES_PASSWORD: superset
@@ -70,7 +70,7 @@ jobs:
           # GitHub action runner's default installations
           - 15433:8080
       redis:
-        image: redis:7-alpine
+        image: ghcr.io/apache/superset/ci/redis:7-alpine
         ports:
           - 16379:6379
     steps:
@@ -116,7 +116,7 @@ jobs:
       UPLOAD_FOLDER: /tmp/.superset/uploads/
     services:
       postgres:
-        image: postgres:17-alpine
+        image: ghcr.io/apache/superset/ci/postgres:17-alpine
         env:
           POSTGRES_USER: superset
           POSTGRES_PASSWORD: superset
@@ -125,7 +125,7 @@ jobs:
           # GitHub action runner's default installations
           - 15432:5432
       redis:
-        image: redis:7-alpine
+        image: ghcr.io/apache/superset/ci/redis:7-alpine
         ports:
           - 16379:6379
     steps:

From 05842a6350f41bfcd57982b45b34bc8e29d81680 Mon Sep 17 00:00:00 2001
From: Evan Rusackas <evan@preset.io>
Date: Fri, 21 Aug 2026 04:15:17 -0700
Subject: [PATCH 8/8] feat(metrics): add MEDIAN/STDDEV_SAMP/VAR_SAMP as
 system-wide aggregates (#42895)

Co-authored-by: Claude Code <noreply@anthropic.com>
---
 UPDATING.md                                   |  17 ++
 docs/sip/median-stddev-variance-aggregates.md | 236 ++++++++++++++++++
 .../src/query/types/Metric.ts                 |   5 +-
 .../test/plugin/utilities.test.ts             |  19 ++
 .../MetricControl/AdhocMetric.test.ts         |  39 +++
 .../controls/MetricControl/AdhocMetric.ts     |  13 +
 .../AdhocMetricEditPopover/index.tsx          |   3 +-
 superset-frontend/src/explore/constants.ts    |  13 +-
 superset/charts/schemas.py                    |  11 +-
 superset/connectors/sqla/models.py            |  27 +-
 superset/db_engine_specs/base.py              |  27 ++
 superset/db_engine_specs/cockroachdb.py       |   9 +-
 superset/db_engine_specs/doris.py             |   8 +-
 superset/db_engine_specs/duckdb.py            |  16 +-
 superset/db_engine_specs/greenplum.py         |  10 +
 superset/db_engine_specs/hana.py              |   8 +-
 superset/db_engine_specs/hologres.py          |  10 +
 superset/db_engine_specs/mysql.py             |  18 ++
 superset/db_engine_specs/netezza.py           |   9 +
 superset/db_engine_specs/oceanbase.py         |   9 +-
 superset/db_engine_specs/postgres.py          |  21 ++
 superset/db_engine_specs/redshift.py          |  22 +-
 superset/db_engine_specs/risingwave.py        |  10 +
 superset/db_engine_specs/snowflake.py         |   8 +-
 superset/db_engine_specs/starrocks.py         |   9 +-
 superset/db_engine_specs/vertica.py           |   9 +
 superset/db_engine_specs/yugabytedb.py        |  10 +
 superset/mcp_service/chart/chart_utils.py     |  13 +-
 .../chart/prompts/create_chart_guided.py      |   4 +-
 superset/mcp_service/chart/schemas.py         |   9 +-
 .../chart/validation/dataset_validator.py     |  10 +-
 .../validation/runtime/format_validator.py    |   9 +-
 superset/models/helpers.py                    |  27 +-
 superset/utils/core.py                        |  18 +-
 tests/unit_tests/charts/test_schemas.py       |  21 ++
 .../unit_tests/db_engine_specs/test_aurora.py |  37 +++
 tests/unit_tests/db_engine_specs/test_base.py |  19 ++
 .../unit_tests/db_engine_specs/test_duckdb.py |  59 +++++
 .../test_extended_aggregations_unverified.py  |  68 +++++
 .../db_engine_specs/test_mariadb.py           |  35 +++
 .../unit_tests/db_engine_specs/test_mysql.py  |  36 +++
 .../db_engine_specs/test_postgres.py          |  27 ++
 .../db_engine_specs/test_redshift.py          |  30 +++
 .../db_engine_specs/test_timescaledb.py       |  37 +++
 .../mcp_service/chart/test_chart_utils.py     |  18 ++
 tests/unit_tests/models/helpers_test.py       |  70 ++++++
 tests/unit_tests/utils/map_type_tests.py      |  15 ++
 47 files changed, 1124 insertions(+), 34 deletions(-)
 create mode 100644 docs/sip/median-stddev-variance-aggregates.md
 create mode 100644 tests/unit_tests/db_engine_specs/test_extended_aggregations_unverified.py
 create mode 100644 tests/unit_tests/db_engine_specs/test_mariadb.py
 create mode 100644 tests/unit_tests/db_engine_specs/test_timescaledb.py

diff --git a/UPDATING.md b/UPDATING.md
index 11de4acf7f2f..a4adec96cf3b 100644
--- a/UPDATING.md
+++ b/UPDATING.md
@@ -125,6 +125,23 @@ dialect; each package's constraint in `pyproject.toml` documents why.
 No application-level configuration changes are required for deployments
 that don't touch SQLAlchemy directly.
 
+### New metric aggregates: MEDIAN, Sample Standard Deviation, Sample Variance
+
+`MEDIAN`, `STDDEV_SAMP`, and `VAR_SAMP` are now available anywhere a metric
+aggregate is chosen (every chart type, SQL Lab, MCP), not only in Pivot
+Table's controls. Support is opt-in per database engine *spec class*,
+verified against a live instance before being enabled: Postgres, MySQL
+(`STDDEV_SAMP`/`VAR_SAMP` only, no `MEDIAN`), DuckDB, and Redshift (inherits
+Postgres's support, not yet separately verified) ship enabled in this
+release. Engine specs that subclass one of those (e.g. MariaDB, Aurora
+MySQL/Postgres, TimescaleDB) inherit the same support, on the same
+not-yet-independently-verified basis. Picking one of these aggregates on a
+database that has not opted in returns a clear "not supported on this
+database" error rather than a failed query. See
+`docs/sip/median-stddev-variance-aggregates.md` for the full design
+rationale, including why this is safe to add without reintroducing the
+totals/subtotals correctness bug fixed by #41184 (SIP-216).
+
 ### Soft delete is on by default, and purging is live
 
 `SOFT_DELETE` now ships **on** (`DEFAULT_FEATURE_FLAGS`), so deleting a
diff --git a/docs/sip/median-stddev-variance-aggregates.md b/docs/sip/median-stddev-variance-aggregates.md
new file mode 100644
index 000000000000..08a514818f48
--- /dev/null
+++ b/docs/sip/median-stddev-variance-aggregates.md
@@ -0,0 +1,236 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# SIP: System-wide MEDIAN, Sample Standard Deviation, and Sample Variance metric aggregates
+
+## [DRAFT — proposal for discussion]
+
+This document now has an accompanying implementation in this PR, for the
+proposed mechanism plus a first, empirically-verified engine set (Postgres,
+MySQL, DuckDB, Redshift by inheritance). It is intended to seed discussion on
+whether this is the right shape and scope before it goes up for a formal SIP
+vote, not to pre-empt that discussion, the code exists so reviewers have a
+concrete design to react to rather than a description of one.
+
+## Motivation
+
+Before #41184 (SIP-216, the non-additive-totals fix), the Pivot Table chart
+exposed an "Aggregation function" control with 18 choices, including
+`Median`, `Sample Standard Deviation`, `Sample Variance`, `First`, `Last`,
+`Count Unique Values`, and `List Unique Values`. #41184 deleted that control
+wholesale, and deliberately so: it re-aggregated already-aggregated cell
+values to compute totals/subtotals, which is exactly the class of bug
+SIP-216 fixed (summing per-group averages, averaging per-group medians, etc.
+produces silently wrong totals). #42761 subsequently restored the one piece
+of that control's functionality that was cleanly separable from the
+correctness bug, the "show as % of row/column/total" display option,
+redesigned as a decoupled, post-hoc-only `showValuesAs` control.
+
+A user has since noticed that several of the other pre-#41184 options never
+came back. Checking today's metric aggregate list (`AVG, COUNT,
+COUNT_DISTINCT, MAX, MIN, SUM`, see
+`superset-frontend/packages/superset-ui-core/src/query/types/Metric.ts`),
+most of these have a reasonable equivalent already: `Count Unique Values`
+maps to `COUNT_DISTINCT`; `Count`/`Average`/`Max`/`Min` are already standard
+aggregates; the two "fraction of" variants are already covered by
+`showValuesAs`. But `Median`, `Sample Standard Deviation`, and `Sample
+Variance` have no equivalent today anywhere in Superset, not just in Pivot
+Table, in any chart type, since the aggregate list is shared across the
+whole app.
+
+This is a real, currently-live gap, not a hypothetical one:
+`superset/mcp_service/chart/chart_utils.py`, `schemas.py`, and
+`prompts/create_chart_guided.py` already treat `STDDEV`, `VAR`, `MEDIAN`,
+and `PERCENTILE` as valid aggregate values in their own validation and
+documentation, but those values are never recognized by
+`superset/connectors/sqla/models.py`'s `sqla_aggregations` dict (the actual
+mapping from aggregate name to SQL), so an AI agent using the MCP tool to
+build a chart with `"aggregate": "STDDEV"` today creates a chart that
+**errors at query time** with "Adhoc metric aggregate is invalid." This SIP
+proposes closing that gap for real, at the source, rather than patching
+around it in MCP.
+
+## Proposed change
+
+Add `MEDIAN`, `STDDEV_SAMP`, and `VAR_SAMP` as first-class, system-wide
+metric aggregates, available anywhere a metric aggregate is chosen (every
+chart type, SQL Lab metric picker, MCP), not as a Pivot-Table-specific
+control.
+
+**Why this is safe with respect to SIP-216, and needs no Pivot-Table-specific
+code at all:** Pivot Table's non-additive-totals machinery
+(`superset-frontend/plugins/plugin-chart-pivot-table/src/plugin/utilities.ts`)
+already classifies any metric aggregate not in `ADDITIVE_AGGREGATES = {SUM,
+COUNT, MIN, MAX}` as non-additive, which routes totals/subtotals through the
+correct DB-`GROUPING SETS`-rollup path rather than client-side
+re-aggregation (`AVG` and `COUNT_DISTINCT` already go through this path
+today). `MEDIAN`/`STDDEV_SAMP`/`VAR_SAMP` fall into that bucket
+automatically, with zero changes needed to the additivity logic. So once
+these are valid, buildable SQL aggregates, Pivot Table (and every other
+chart) gets correct behavior for free. This is the version of "restore the
+control" that does not reopen the bug that was just fixed.
+
+**Where the actual change needs to land, and what this PR does:**
+
+1. **Done.** `superset-frontend/packages/superset-ui-core/src/query/types/Metric.ts`,
+   extended the `Aggregate` type.
+2. **Done.** `superset-frontend/src/explore/constants.ts`, added to `AGGREGATES`
+   (drives `AGGREGATES_OPTIONS`, the dropdown in `AdhocMetricEditPopover`).
+3. **Done**, but not consolidated. `superset/connectors/sqla/models.py`
+   (`sqla_aggregations`) and `superset/models/helpers.py`
+   (`ExploreMixin.sqla_aggregations`) are both wired to consult the new
+   `BaseEngineSpec.get_extended_aggregation_func`, in addition to their
+   existing 6-aggregate dict, so neither's original, already-tested behavior
+   changed. They remain two separate dicts, consolidating them into one
+   source of truth is left as a follow-up (see Open questions).
+4. **Done**, and it surfaced a second, smaller bug on top of the one this SIP
+   opened with: MCP's own aggregate names (`STDDEV`, `VAR`) never matched any
+   real Superset aggregate, before or after this PR, they were always going
+   to error regardless of what this SIP does. `superset/mcp_service/chart/*`
+   now accepts the old shorthand as an alias, normalized to the real,
+   unambiguous names (`STDDEV_SAMP`, `VAR_SAMP`) this PR ships, and the guided
+   prompt text points at the correct names going forward. `MEDIAN`/
+   `PERCENTILE` were already spelled correctly in MCP; `PERCENTILE` remains
+   unimplemented (it needs a parameter this schema has no field for) and is
+   unchanged by this PR, out of scope here.
+
+**The part that needs real engineering care, this must not be a blind
+`sa.func.MEDIAN` / `sa.func.STDDEV_SAMP` / `sa.func.VAR_SAMP`:**
+
+`sqla_aggregations` today is a flat, engine-unaware dict (`sa.func.AVG`,
+etc., SQLAlchemy emits whatever function name it is given, with zero
+validation that the target dialect actually has it). Superset already has
+precedent for exactly this class of per-engine capability difference:
+`BaseEngineSpec.supports_grouping_sets` and `_time_grain_expressions`, both
+introduced by #41184 itself. This SIP proposes the same shape, a new
+per-engine-overridable mechanism (for example
+`BaseEngineSpec.get_aggregate_sql(aggregate, column)` with a sensible
+default, overridden per engine spec where the default does not hold),
+rather than a single hardcoded dict.
+
+Verified findings so far (via `sqlglot.transpile`, cross-checked against
+known engine docs; **not** exhaustively tested against live databases, that
+is necessary follow-up work this SIP alone cannot complete):
+
+| Engine | `MEDIAN(x)` | `STDDEV_SAMP(x)` | `VAR_SAMP(x)` |
+|---|---|---|---|
+| Postgres | `PERCENTILE_CONT(0.5) WITHIN GROUP (ORDER BY x)` | native | native |
+| MySQL | no native equivalent, needs explicit "unsupported" handling, not a blind emit | native | MySQL's `VARIANCE()` is an alias for `VAR_POP` (population), not `VAR_SAMP` (sample); a naive dialect-name substitution would silently compute the wrong statistic and needs an explicit, verified expression instead |
+| SQLite | only if the specific build was compiled with the (non-default) `SQLITE_ENABLE_PERCENTILE` extension (added in SQLite 3.43, 2023), cannot be assumed available | not available in core SQLite | not available in core SQLite |
+| BigQuery / Snowflake / DuckDB / Redshift / Oracle / T-SQL / Databricks / Spark | native `MEDIAN(x)` | native | native on BigQuery/Snowflake/Databricks/Spark, where `VARIANCE` is correctly sample variance; T-SQL has no function named `VARIANCE` at all and needs `VAR(x)` instead |
+| Trino / Presto / Hive | `PERCENTILE_CONT` / `approx_percentile` (dialect- and exactness-dependent) | native | `variance` is correctly sample variance per Trino/Presto docs |
+
+This table is deliberately not exhaustive, Superset has roughly 75
+`db_engine_specs` files. The proposed default (`BaseEngineSpec`) should be
+the safe choice (mark unsupported, surface a clear user-facing error) rather
+than an optimistic one, with individual engine specs opting in once
+verified. Ship for the handful of engines above first, extend
+opportunistically.
+
+**`Count Unique Values`, `First`, `Last`, `List Unique Values`, explicitly
+out of scope for this SIP:**
+
+- `Count Unique Values` needs no work, it is already `COUNT_DISTINCT`.
+- `First`/`Last` have no well-defined, unambiguous meaning as a plain
+  `GROUP BY` aggregate without an explicit ordering; most engines only
+  support this via window functions (`FIRST_VALUE`/`LAST_VALUE` `OVER
+  (ORDER BY ...)`) or do not support it as a simple aggregate at all
+  (Postgres has neither built in). Restoring this properly would mean
+  designing an "order by" sub-control on the metric, a real, separate
+  feature, not a one-line aggregate addition. Proposed as a follow-up SIP if
+  there is demand.
+- `List Unique Values` maps to the `STRING_AGG`/`GROUP_CONCAT`/`LISTAGG`/
+  `ARRAY_AGG(DISTINCT ...)` family, real dialect differences, plus an open
+  UX question (unbounded cell content for high-cardinality columns).
+  Proposed as a follow-up SIP.
+
+## New or changed public interfaces
+
+- New `Aggregate` values (`MEDIAN`, `STDDEV_SAMP`, `VAR_SAMP`) selectable
+  anywhere the standard metric control appears, every chart type, not just
+  Pivot Table.
+- New `BaseEngineSpec` extensibility point for per-engine aggregate SQL
+  generation (exact shape TBD in implementation, likely mirrors
+  `_time_grain_expressions`).
+- No REST API surface changes beyond the existing metric aggregate field
+  accepting new values.
+
+## Migration plan and compatibility
+
+No new tables/columns needed for the aggregate addition itself.
+
+Restoring prior chart settings, the way #42761 restored `show_values_as` for
+charts that had it before #41184, is murkier here than it was for that PR
+and needs its own design pass: the old `aggregate_function` was a single
+Pivot-Table-level setting applied uniformly to every metric on the chart,
+not a per-metric property. A chart that had `aggregate_function: Median`
+before #41184, with a metric of `SUM(sales)`, was already silently wrong
+under the old architecture (that is the bug that was fixed); mechanically
+rewriting its metric to `MEDIAN(sales)` on upgrade would change what the
+chart's leaf cells display, not just its totals, which may not match user
+intent. This SIP proposes a best-effort, flagged-for-review migration
+(surface affected charts to admins rather than silently rewriting them)
+rather than a fully automatic one-to-one restoration.
+
+## Rejected alternatives
+
+- **Restoring the old `aggregateFunction` Pivot-Table control as-is.**
+  Rejected: this is the literal mechanism SIP-216 removed because it
+  reintroduces incorrect totals for non-additive metrics. Any fix has to go
+  through the metric's own aggregate, not a separate pivot-level override.
+- **Routing all metric SQL generation through `sqlglot` expression-building
+  instead of SQLAlchemy's `sa.func`.** More architecturally thorough (would
+  give correct dialect syntax for free across more of the roughly 75 engine
+  specs), but a much larger, more invasive change to a hot path used by
+  every chart query. Noted as a possible future direction, not this SIP's
+  scope; this SIP proposes the smaller, `supports_grouping_sets`-shaped
+  extensibility point instead.
+
+## Open questions
+
+- **Resolved for this PR, worth confirming as the community's preferred
+  shape:** implemented as `BaseEngineSpec._extended_aggregations` (a
+  `{aggregate_name: sqla_column -> sqla_column}` dict) plus a
+  `get_extended_aggregation_func` accessor, set on the concrete or shared
+  base engine spec class per engine (e.g. on `PostgresBaseEngineSpec` so
+  Redshift inherits it, but *not* on `PrestoBaseEngineSpec` so Hive/Spark/
+  Databricks don't silently inherit unverified behavior, mirroring how
+  `supports_grouping_sets` is opted into per-concrete-engine there today).
+  Did not route through the `superset/sql/dialects/` sqlglot-based layer;
+  that layer is for SQL Lab parsing, wiring it into chart-metric query
+  building felt like a separate, larger change from this SIP's scope.
+- **Still open, not addressed in this PR:** how aggressively should
+  `MEDIAN` degrade on engines without a native or exact equivalent?
+  Trino/Presto/Hive were left unimplemented (unsupported) specifically to
+  avoid silently answering this with an approximate function
+  (`approx_percentile`) that changes the semantics of what a user asked
+  for. If someone wants `MEDIAN` on those engines, this needs a real
+  decision: require explicit opt-in, show a UI warning, or keep it
+  disallowed.
+- **Resolved for this PR:** left the two `sqla_aggregations` dicts
+  (`connectors/sqla/models.py` and `models/helpers.py`) unconsolidated,
+  both now separately wired to the same new `get_extended_aggregation_func`
+  hook. Consolidating them into one source of truth is real but unrelated
+  cleanup, not bundled here to keep the diff reviewable.
+- **New, from implementation:** only Postgres, MySQL (partial), DuckDB, and
+  Redshift (by inheritance, unverified) ship enabled. BigQuery, Snowflake,
+  Trino, Presto, Hive, Spark, Databricks, Oracle, and T-SQL all have
+  documented (not live-verified) support per the table above but are not
+  yet wired up, each needs the same live-instance verification treatment
+  before being enabled, this PR intentionally didn't guess.
diff --git a/superset-frontend/packages/superset-ui-core/src/query/types/Metric.ts b/superset-frontend/packages/superset-ui-core/src/query/types/Metric.ts
index 15b59fb22ab3..d9b7f82be3ec 100644
--- a/superset-frontend/packages/superset-ui-core/src/query/types/Metric.ts
+++ b/superset-frontend/packages/superset-ui-core/src/query/types/Metric.ts
@@ -25,8 +25,11 @@ export type Aggregate =
   | 'COUNT'
   | 'COUNT_DISTINCT'
   | 'MAX'
+  | 'MEDIAN'
   | 'MIN'
-  | 'SUM';
+  | 'STDDEV_SAMP'
+  | 'SUM'
+  | 'VAR_SAMP';
 
 export interface AdhocMetricBase {
   hasCustomLabel?: boolean;
diff --git a/superset-frontend/plugins/plugin-chart-pivot-table/test/plugin/utilities.test.ts b/superset-frontend/plugins/plugin-chart-pivot-table/test/plugin/utilities.test.ts
index bdd3d2ea6973..6fd67b9f97f9 100644
--- a/superset-frontend/plugins/plugin-chart-pivot-table/test/plugin/utilities.test.ts
+++ b/superset-frontend/plugins/plugin-chart-pivot-table/test/plugin/utilities.test.ts
@@ -290,6 +290,25 @@ test('isAdditiveMetric: non-additive aggregates, SQL, and saved metrics are not
   expect(isAdditiveMetric('count')).toBe(false);
 });
 
+test('isAdditiveMetric: MEDIAN/STDDEV_SAMP/VAR_SAMP are non-additive, with no dedicated code needed', () => {
+  // Regression guard: MEDIAN/STDDEV_SAMP/VAR_SAMP are new system-wide metric
+  // aggregates (not pivot-table-specific). They must fall outside
+  // ADDITIVE_AGGREGATES so totals/subtotals route through the correct
+  // DB-rollup path automatically, same as AVG/COUNT_DISTINCT already do --
+  // averaging per-group medians (or variances) is exactly the class of bug
+  // SIP-216 fixed for AVG, and would be equally wrong here.
+  (['MEDIAN', 'STDDEV_SAMP', 'VAR_SAMP'] as const).forEach(aggregate => {
+    expect(
+      isAdditiveMetric({
+        expressionType: 'SIMPLE',
+        aggregate,
+        column: { column_name: 'num' },
+        label: `${aggregate.toLowerCase()}_num`,
+      } as QueryFormMetric),
+    ).toBe(false);
+  });
+});
+
 test('allMetricsAdditive: all additive vs any non-additive vs empty', () => {
   const sum = {
     expressionType: 'SIMPLE',
diff --git a/superset-frontend/src/explore/components/controls/MetricControl/AdhocMetric.test.ts b/superset-frontend/src/explore/components/controls/MetricControl/AdhocMetric.test.ts
index 50c819248fa7..060d3097102b 100644
--- a/superset-frontend/src/explore/components/controls/MetricControl/AdhocMetric.test.ts
+++ b/superset-frontend/src/explore/components/controls/MetricControl/AdhocMetric.test.ts
@@ -191,6 +191,29 @@ describe('AdhocMetric', () => {
     expect(adhocMetric2.inferSqlExpressionAggregate()).toBeNull();
   });
 
+  test('can infer the new extended aggregates (STDDEV_SAMP/VAR_SAMP/MEDIAN) from sql expressions', () => {
+    const stddevSamp = new AdhocMetric({
+      expressionType: EXPRESSION_TYPES.SQL,
+      sqlExpression: 'STDDEV_SAMP(my_column)',
+    });
+    expect(stddevSamp.inferSqlExpressionColumn()).toBe('my_column');
+    expect(stddevSamp.inferSqlExpressionAggregate()).toBe('STDDEV_SAMP');
+
+    const varSamp = new AdhocMetric({
+      expressionType: EXPRESSION_TYPES.SQL,
+      sqlExpression: 'VAR_SAMP(my_column)',
+    });
+    expect(varSamp.inferSqlExpressionColumn()).toBe('my_column');
+    expect(varSamp.inferSqlExpressionAggregate()).toBe('VAR_SAMP');
+
+    const median = new AdhocMetric({
+      expressionType: EXPRESSION_TYPES.SQL,
+      sqlExpression: 'MEDIAN(my_column)',
+    });
+    expect(median.inferSqlExpressionColumn()).toBe('my_column');
+    expect(median.inferSqlExpressionAggregate()).toBe('MEDIAN');
+  });
+
   test('will infer columns and aggregates when converting to a simple expression', () => {
     const adhocMetric = new AdhocMetric({
       expressionType: EXPRESSION_TYPES.SQL,
@@ -248,4 +271,20 @@ describe('AdhocMetric', () => {
     ).toBe('COUNT_DISTINCT');
     expect(emptyColumnName.getDefaultLabel()).toBe('COUNT_DISTINCT');
   });
+
+  test('should prefill a portable MEDIAN expression for the Custom SQL tab, but keep the raw label', () => {
+    const median = new AdhocMetric({
+      column: valueColumn,
+      aggregate: AGGREGATES.MEDIAN,
+      hasCustomLabel: false,
+    });
+    // MEDIAN(column) isn't valid SQL on every engine this PR verifies it
+    // for (e.g. PostgreSQL has no MEDIAN function), so the editable Custom
+    // SQL tab is prefilled with the portable, standards-based spelling.
+    expect(median.translateToSql({ transformCountDistinct: true })).toBe(
+      'PERCENTILE_CONT(0.5) WITHIN GROUP (ORDER BY value)',
+    );
+    // The display label stays the concise, human-readable form.
+    expect(median.getDefaultLabel()).toBe('MEDIAN(value)');
+  });
 });
diff --git a/superset-frontend/src/explore/components/controls/MetricControl/AdhocMetric.ts b/superset-frontend/src/explore/components/controls/MetricControl/AdhocMetric.ts
index ef4f373548a2..8eb24c02f0b9 100644
--- a/superset-frontend/src/explore/components/controls/MetricControl/AdhocMetric.ts
+++ b/superset-frontend/src/explore/components/controls/MetricControl/AdhocMetric.ts
@@ -153,6 +153,19 @@ export default class AdhocMetric {
       ) {
         return `COUNT(DISTINCT ${column.slice(1, -1)})`;
       }
+      // MEDIAN(column) isn't a real function on every engine this PR
+      // verifies it for -- PostgreSQL/Redshift compile it to
+      // PERCENTILE_CONT(0.5) WITHIN GROUP instead. `transformCountDistinct`
+      // signals this call is prefilling the *editable, executable* Custom
+      // SQL tab (not just a display label), so use the portable,
+      // standards-based spelling there instead of the raw aggregate name.
+      if (
+        params.transformCountDistinct &&
+        aggregate === AGGREGATES.MEDIAN &&
+        /^\(.*\)$/.test(column)
+      ) {
+        return `PERCENTILE_CONT(0.5) WITHIN GROUP (ORDER BY ${column.slice(1, -1)})`;
+      }
       return aggregate + column;
     }
     if (this.expressionType === EXPRESSION_TYPES.SQL) {
diff --git a/superset-frontend/src/explore/components/controls/MetricControl/AdhocMetricEditPopover/index.tsx b/superset-frontend/src/explore/components/controls/MetricControl/AdhocMetricEditPopover/index.tsx
index f685d5d301e4..a84504f91fed 100644
--- a/superset-frontend/src/explore/components/controls/MetricControl/AdhocMetricEditPopover/index.tsx
+++ b/superset-frontend/src/explore/components/controls/MetricControl/AdhocMetricEditPopover/index.tsx
@@ -36,6 +36,7 @@ import {
 import sqlKeywords from 'src/SqlLab/utils/sqlKeywords';
 import { noOp } from 'src/utils/common';
 import {
+  AGGREGATES_LABELS,
   AGGREGATES_OPTIONS,
   POPOVER_INITIAL_HEIGHT,
   POPOVER_INITIAL_WIDTH,
@@ -548,7 +549,7 @@ function AdhocMetricEditPopover({
                   <Select
                     options={AGGREGATES_OPTIONS.map(option => ({
                       value: option,
-                      label: option,
+                      label: AGGREGATES_LABELS[option] ?? option,
                       key: option,
                     }))}
                     {...aggregateSelectProps}
diff --git a/superset-frontend/src/explore/constants.ts b/superset-frontend/src/explore/constants.ts
index 929b88a72098..93f56ceab08d 100644
--- a/superset-frontend/src/explore/constants.ts
+++ b/superset-frontend/src/explore/constants.ts
@@ -23,11 +23,22 @@ export const AGGREGATES = {
   COUNT: 'COUNT',
   COUNT_DISTINCT: 'COUNT_DISTINCT',
   MAX: 'MAX',
+  MEDIAN: 'MEDIAN',
   MIN: 'MIN',
+  STDDEV_SAMP: 'STDDEV_SAMP',
   SUM: 'SUM',
+  VAR_SAMP: 'VAR_SAMP',
 };
 export const AGGREGATES_OPTIONS = Object.values(AGGREGATES);
 
+// Human-readable labels for aggregates whose raw enum value isn't
+// self-explanatory in the UI. Aggregates absent here (AVG, COUNT, MAX,
+// MEDIAN, MIN, SUM, ...) are already clear as their raw value.
+export const AGGREGATES_LABELS: Record<string, string> = {
+  STDDEV_SAMP: t('Sample Standard Deviation'),
+  VAR_SAMP: t('Sample Variance'),
+};
+
 export enum Operators {
   Equals = 'EQUALS',
   NotEquals = 'NOT_EQUALS',
@@ -176,7 +187,7 @@ export const DISABLE_INPUT_OPERATORS = [
 export const sqlaAutoGeneratedMetricNameRegex =
   /^(sum|min|max|avg|count|count_distinct)__.*$/i;
 export const sqlaAutoGeneratedMetricRegex =
-  /^(LONG|DOUBLE|FLOAT)?(SUM|AVG|MAX|MIN|COUNT)\([A-Z0-9_."]*\)$/i;
+  /^(LONG|DOUBLE|FLOAT)?(SUM|AVG|MAX|MIN|COUNT|MEDIAN|STDDEV_SAMP|VAR_SAMP)\([A-Z0-9_."]*\)$/i;
 
 export const TIME_FILTER_LABELS = {
   time_range: t('Time range'),
diff --git a/superset/charts/schemas.py b/superset/charts/schemas.py
index e5c62e3e69f3..a96d827b6255 100644
--- a/superset/charts/schemas.py
+++ b/superset/charts/schemas.py
@@ -42,6 +42,7 @@
 from superset.utils.core import (
     AnnotationType,
     DatasourceType,
+    EXTENDED_METRIC_AGGREGATES,
     FilterOperator,
     PostProcessingBoxplotWhiskerType,
     PostProcessingContributionOrientation,
@@ -434,7 +435,15 @@ class ChartDataAdhocMetricSchema(Schema):
             "Only required for simple expression types."
         },
         validate=validate.OneOf(
-            choices=("AVG", "COUNT", "COUNT_DISTINCT", "MAX", "MIN", "SUM")
+            choices=(
+                "AVG",
+                "COUNT",
+                "COUNT_DISTINCT",
+                "MAX",
+                "MIN",
+                "SUM",
+                *sorted(EXTENDED_METRIC_AGGREGATES),
+            )
         ),
     )
     column = fields.Nested(ChartDataColumnSchema)
diff --git a/superset/connectors/sqla/models.py b/superset/connectors/sqla/models.py
index 8445caeb3a0b..63f2f535a107 100644
--- a/superset/connectors/sqla/models.py
+++ b/superset/connectors/sqla/models.py
@@ -1898,11 +1898,6 @@ def adhoc_metric_to_sqla(
 
         if expression_type == utils.AdhocMetricExpressionType.SIMPLE:
             aggregate: Any = metric.get("aggregate")
-            if (
-                not isinstance(aggregate, str)
-                or aggregate not in self.sqla_aggregations
-            ):
-                raise QueryObjectValidationError(_("Adhoc metric aggregate is invalid"))
             metric_column = metric.get("column") or {}
             column_name = cast(str, metric_column.get("column_name"))
             table_column: TableColumn | None = columns_by_name.get(column_name)
@@ -1912,7 +1907,27 @@ def adhoc_metric_to_sqla(
                 )
             else:
                 sqla_column = column(column_name)
-            sqla_metric = self.sqla_aggregations[aggregate](sqla_column)
+
+            if isinstance(aggregate, str) and aggregate in self.sqla_aggregations:
+                sqla_metric = self.sqla_aggregations[aggregate](sqla_column)
+            elif isinstance(aggregate, str) and (
+                extended_func := self.db_engine_spec.get_extended_aggregation_func(
+                    aggregate
+                )
+            ):
+                sqla_metric = extended_func(sqla_column)
+            elif (
+                isinstance(aggregate, str)
+                and aggregate in utils.EXTENDED_METRIC_AGGREGATES
+            ):
+                raise QueryObjectValidationError(
+                    _(
+                        "The %(aggregate)s aggregate is not supported on this database",
+                        aggregate=aggregate,
+                    )
+                )
+            else:
+                raise QueryObjectValidationError(_("Adhoc metric aggregate is invalid"))
         elif expression_type == utils.AdhocMetricExpressionType.SQL:
             expression: str | None = metric.get("sqlExpression")
             if not isinstance(expression, str) or not expression.strip():
diff --git a/superset/db_engine_specs/base.py b/superset/db_engine_specs/base.py
index 6bf6040b8680..91b411ce2199 100644
--- a/superset/db_engine_specs/base.py
+++ b/superset/db_engine_specs/base.py
@@ -632,6 +632,33 @@ class BaseEngineSpec:  # pylint: disable=too-many-public-methods
     # issuing one query per level. Conservative default of False; engines opt in.
     supports_grouping_sets = False
 
+    # SQL-generating callables for metric aggregates that have no safe, universal
+    # cross-dialect spelling -- unlike SUM/COUNT/AVG/MIN/MAX/COUNT_DISTINCT (see
+    # `SqlaTable.sqla_aggregations`), which SQLAlchemy's generic `sa.func` can emit
+    # unchanged on every engine. Keyed by `Aggregate` name (see
+    # `superset-frontend/packages/superset-ui-core/src/query/types/Metric.ts`);
+    # each value takes a SQLAlchemy column and returns the aggregate expression.
+    # Absent by default: an aggregate not present here is unsupported on this
+    # engine, and callers must surface a clear "not supported" error rather than
+    # emit unverified SQL (a wrong statistic returned silently is worse than an
+    # error). Engines opt in via `get_extended_aggregation_func` below once the
+    # expression has been verified against real engine behavior, not assumed
+    # from syntax alone -- see the MySQL engine spec for a concrete example of
+    # why this distinction matters (its `VARIANCE()` computes the *population*
+    # variance, not the *sample* variance `VAR_SAMP` denotes).
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {}
+
+    @classmethod
+    def get_extended_aggregation_func(
+        cls, aggregate: str
+    ) -> Callable[[ColumnElement], ColumnElement] | None:
+        """
+        SQL-generating callable for an aggregate not handled by the generic
+        `sa.func` mapping (e.g. MEDIAN, STDDEV_SAMP, VAR_SAMP). Returns None if
+        this engine has no verified, correct expression for it.
+        """
+        return cls._extended_aggregations.get(aggregate)
+
     # Is the DB engine spec able to change the default schema? This requires implementing  # noqa: E501
     # a custom `adjust_engine_params` method.
     supports_dynamic_schema = False
diff --git a/superset/db_engine_specs/cockroachdb.py b/superset/db_engine_specs/cockroachdb.py
index d200c6e0274f..172fd23229cb 100644
--- a/superset/db_engine_specs/cockroachdb.py
+++ b/superset/db_engine_specs/cockroachdb.py
@@ -15,9 +15,10 @@
 # specific language governing permissions and limitations
 # under the License.
 from datetime import datetime
-from typing import Any, Optional
+from typing import Any, Callable, Optional
 
 from sqlalchemy import types
+from sqlalchemy.sql.elements import ColumnElement
 
 from superset.db_engine_specs.base import DatabaseCategory
 from superset.db_engine_specs.postgres import PostgresEngineSpec
@@ -27,6 +28,12 @@ class CockroachDbEngineSpec(PostgresEngineSpec):
     engine = "cockroachdb"
     engine_name = "CockroachDB"
 
+    # `PostgresEngineSpec._extended_aggregations` (MEDIAN/STDDEV_SAMP/VAR_SAMP)
+    # is verified against real Postgres behavior, not CockroachDB's distributed
+    # query engine; disable it here until someone confirms the same expressions
+    # against a live CockroachDB instance.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {}
+
     metadata = {
         "description": (
             "CockroachDB is a distributed SQL database built for cloud applications."
diff --git a/superset/db_engine_specs/doris.py b/superset/db_engine_specs/doris.py
index 6aeb3d288a82..9d2564783268 100644
--- a/superset/db_engine_specs/doris.py
+++ b/superset/db_engine_specs/doris.py
@@ -17,13 +17,14 @@
 import logging
 import re
 from re import Pattern
-from typing import Any, Optional
+from typing import Any, Callable, Optional
 from urllib import parse
 
 from flask_babel import gettext as __
 from sqlalchemy import Float, Integer, Numeric, String, TEXT, text, types
 from sqlalchemy.engine.reflection import Inspector
 from sqlalchemy.engine.url import URL
+from sqlalchemy.sql.elements import ColumnElement
 from sqlalchemy.sql.type_api import TypeEngine
 
 from superset.db_engine_specs.base import DatabaseCategory
@@ -121,6 +122,11 @@ class DorisEngineSpec(MySQLEngineSpec):
     # while technically supported by Doris, this generates invalid table identifiers
     supports_cross_catalog_queries = False
 
+    # `MySQLEngineSpec._extended_aggregations` (STDDEV_SAMP/VAR_SAMP) is verified
+    # against real MySQL behavior, not Doris's OLAP query engine; disable it here
+    # until someone confirms the same expressions against a live Doris instance.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {}
+
     metadata = {
         "description": (
             "Apache Doris is a high-performance real-time analytical database."
diff --git a/superset/db_engine_specs/duckdb.py b/superset/db_engine_specs/duckdb.py
index 87e02c37761e..d3b9ead673d0 100644
--- a/superset/db_engine_specs/duckdb.py
+++ b/superset/db_engine_specs/duckdb.py
@@ -20,8 +20,9 @@
 import re
 from datetime import datetime
 from re import Pattern
-from typing import Any, TYPE_CHECKING, TypedDict
+from typing import Any, Callable, TYPE_CHECKING, TypedDict
 
+import sqlalchemy as sa
 from apispec import APISpec
 from apispec.ext.marshmallow import MarshmallowPlugin
 from flask import current_app as app
@@ -30,6 +31,7 @@
 from sqlalchemy import text, types
 from sqlalchemy.engine.reflection import Inspector
 from sqlalchemy.engine.url import URL
+from sqlalchemy.sql.elements import ColumnElement
 
 from superset.constants import TimeGrain
 from superset.databases.utils import make_url_safe
@@ -202,6 +204,18 @@ class DuckDBEngineSpec(DuckDBParametersMixin, BaseEngineSpec):
     sqlalchemy_uri_placeholder = "duckdb:////path/to/duck.db"
     supports_multivalues_insert = True
 
+    # Verified against a live duckdb instance (in-process, no server needed),
+    # including under GROUPING SETS: the grand total correctly reflects every
+    # row, not an aggregate-of-aggregates. STDDEV_SAMP/VAR_SAMP values match
+    # postgres/mysql exactly for the same inputs; MEDIAN matches postgres
+    # (mysql has no native MEDIAN to compare against). Inherited by
+    # MotherDuckEngineSpec.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {
+        "MEDIAN": sa.func.median,
+        "STDDEV_SAMP": sa.func.stddev_samp,
+        "VAR_SAMP": sa.func.var_samp,
+    }
+
     metadata = {
         "description": (
             "DuckDB is an in-process OLAP database designed for fast "
diff --git a/superset/db_engine_specs/greenplum.py b/superset/db_engine_specs/greenplum.py
index 06c72bc6c38b..b418daf0be45 100644
--- a/superset/db_engine_specs/greenplum.py
+++ b/superset/db_engine_specs/greenplum.py
@@ -15,6 +15,10 @@
 # specific language governing permissions and limitations
 # under the License.
 
+from typing import Callable
+
+from sqlalchemy.sql.elements import ColumnElement
+
 from superset.db_engine_specs.base import DatabaseCategory
 from superset.db_engine_specs.postgres import PostgresEngineSpec
 
@@ -30,6 +34,12 @@ class GreenplumEngineSpec(PostgresEngineSpec):
     engine_name = "Greenplum"
     default_driver = "psycopg2"
 
+    # `PostgresEngineSpec._extended_aggregations` (MEDIAN/STDDEV_SAMP/VAR_SAMP) is
+    # verified against real Postgres behavior, not Greenplum's MPP query engine;
+    # disable it here until someone confirms the same expressions against a live
+    # Greenplum instance.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {}
+
     metadata = {
         "description": (
             "VMware Greenplum is a massively parallel processing (MPP) "
diff --git a/superset/db_engine_specs/hana.py b/superset/db_engine_specs/hana.py
index d0d36dcb6dff..af2ceb65fd8e 100644
--- a/superset/db_engine_specs/hana.py
+++ b/superset/db_engine_specs/hana.py
@@ -15,9 +15,10 @@
 # specific language governing permissions and limitations
 # under the License.
 from datetime import datetime
-from typing import Any, Optional
+from typing import Any, Callable, Optional
 
 from sqlalchemy import types
+from sqlalchemy.sql.elements import ColumnElement
 
 from superset.constants import TimeGrain
 from superset.db_engine_specs.base import DatabaseCategory
@@ -29,6 +30,11 @@ class HanaEngineSpec(PostgresBaseEngineSpec):
     engine = "hana"
     engine_name = "SAP HANA"
 
+    # `PostgresBaseEngineSpec._extended_aggregations` (MEDIAN/STDDEV_SAMP/VAR_SAMP)
+    # is verified against real Postgres behavior, not HANA's; disable it here
+    # until someone confirms the same expressions against a live HANA instance.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {}
+
     metadata = {
         "description": (
             "SAP HANA is an in-memory relational database and application platform."
diff --git a/superset/db_engine_specs/hologres.py b/superset/db_engine_specs/hologres.py
index ce4cb3c905be..b5f0589a1d62 100644
--- a/superset/db_engine_specs/hologres.py
+++ b/superset/db_engine_specs/hologres.py
@@ -17,6 +17,10 @@
 
 from __future__ import annotations
 
+from typing import Callable
+
+from sqlalchemy.sql.elements import ColumnElement
+
 from superset.db_engine_specs.base import DatabaseCategory
 from superset.db_engine_specs.postgres import PostgresBaseEngineSpec
 
@@ -32,6 +36,12 @@ class HologresEngineSpec(PostgresBaseEngineSpec):
     engine_name = "Hologres"
     default_driver = "psycopg2"
 
+    # `PostgresBaseEngineSpec._extended_aggregations` (MEDIAN/STDDEV_SAMP/VAR_SAMP)
+    # is verified against real Postgres behavior, not Hologres's real-time analytics
+    # engine; disable it here until someone confirms the same expressions against a
+    # live Hologres instance.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {}
+
     metadata = {
         "description": (
             "Alibaba Cloud Hologres is a real-time interactive analytics service, "
diff --git a/superset/db_engine_specs/mysql.py b/superset/db_engine_specs/mysql.py
index 93f764703d00..d178f328e343 100644
--- a/superset/db_engine_specs/mysql.py
+++ b/superset/db_engine_specs/mysql.py
@@ -25,6 +25,7 @@
 from typing import Any, Callable, Optional, TYPE_CHECKING
 from urllib import parse
 
+import sqlalchemy as sa
 from flask_babel import gettext as __
 from sqlalchemy import types
 from sqlalchemy.dialects.mysql import (
@@ -40,6 +41,7 @@
     TINYTEXT,
 )
 from sqlalchemy.engine.url import URL
+from sqlalchemy.sql.elements import ColumnElement
 
 from superset.constants import TimeGrain
 from superset.db_engine_specs.base import (
@@ -94,6 +96,22 @@ class MySQLEngineSpec(BasicParametersMixin, BaseEngineSpec):
     supports_dynamic_schema = True
     supports_multivalues_insert = True
 
+    # Verified against a live mysql:8.0 instance, including under GROUP BY ...
+    # WITH ROLLUP. `STDDEV_SAMP`/`VAR_SAMP` are native, correct sample
+    # statistics. MEDIAN is deliberately absent: MySQL has neither a `MEDIAN`
+    # function nor `PERCENTILE_CONT` (confirmed: both error). Its `VARIANCE()`
+    # function is population variance, not sample variance, so it is not a
+    # valid stand-in for VAR_SAMP either.
+    # Inherited by MariaDB (a MySQL fork implementing the same aggregate
+    # functions) and by Aurora MySQL / its Data API variant (AWS's wire- and
+    # SQL-compatible managed MySQL) -- unlike CockroachDB/Greenplum/HANA
+    # relative to Postgres, none of these run a materially different query
+    # engine, so no separate reset is needed.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {
+        "STDDEV_SAMP": sa.func.stddev_samp,
+        "VAR_SAMP": sa.func.var_samp,
+    }
+
     metadata = {
         "description": "MySQL is a popular open-source relational database.",
         "logo": "mysql.png",
diff --git a/superset/db_engine_specs/netezza.py b/superset/db_engine_specs/netezza.py
index c007b0a03019..f42c195cc5b5 100644
--- a/superset/db_engine_specs/netezza.py
+++ b/superset/db_engine_specs/netezza.py
@@ -14,6 +14,10 @@
 # KIND, either express or implied.  See the License for the
 # specific language governing permissions and limitations
 # under the License.
+from typing import Callable
+
+from sqlalchemy.sql.elements import ColumnElement
+
 from superset.constants import TimeGrain
 from superset.db_engine_specs.base import DatabaseCategory
 from superset.db_engine_specs.postgres import PostgresBaseEngineSpec
@@ -24,6 +28,11 @@ class NetezzaEngineSpec(PostgresBaseEngineSpec):
     default_driver = "nzpy"
     engine_name = "IBM Netezza Performance Server"
 
+    # `PostgresBaseEngineSpec._extended_aggregations` (MEDIAN/STDDEV_SAMP/VAR_SAMP)
+    # is verified against real Postgres behavior, not Netezza's; disable it here
+    # until someone confirms the same expressions against a live Netezza instance.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {}
+
     metadata = {
         "description": "IBM Netezza Performance Server is a data warehouse appliance.",
         "logo": "netezza.png",
diff --git a/superset/db_engine_specs/oceanbase.py b/superset/db_engine_specs/oceanbase.py
index ebc47abdfab6..1870aab3bb6b 100644
--- a/superset/db_engine_specs/oceanbase.py
+++ b/superset/db_engine_specs/oceanbase.py
@@ -17,10 +17,11 @@
 import logging
 import re
 from re import Pattern
-from typing import Any, Optional
+from typing import Any, Callable, Optional
 
 from flask_babel import gettext as __
 from sqlalchemy import Numeric, TEXT, types
+from sqlalchemy.sql.elements import ColumnElement
 from sqlalchemy.sql.type_api import TypeEngine
 
 from superset.db_engine_specs.base import DatabaseCategory
@@ -84,6 +85,12 @@ class OceanBaseEngineSpec(MySQLEngineSpec):
     encryption_parameters = {"ssl": "0"}
     supports_dynamic_schema = True
 
+    # `MySQLEngineSpec._extended_aggregations` (STDDEV_SAMP/VAR_SAMP) is verified
+    # against real MySQL behavior, not OceanBase's distributed query engine;
+    # disable it here until someone confirms the same expressions against a live
+    # OceanBase instance.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {}
+
     metadata = {
         "description": "OceanBase is a distributed relational database.",
         "logo": "oceanbase.svg",
diff --git a/superset/db_engine_specs/postgres.py b/superset/db_engine_specs/postgres.py
index 53cc97e597bb..218661f3265d 100644
--- a/superset/db_engine_specs/postgres.py
+++ b/superset/db_engine_specs/postgres.py
@@ -23,12 +23,14 @@
 from re import Pattern
 from typing import Any, Callable, Optional, TYPE_CHECKING
 
+import sqlalchemy as sa
 from flask_babel import gettext as __
 from sqlalchemy import text, types
 from sqlalchemy.dialects.postgresql import DOUBLE_PRECISION, ENUM, INTERVAL, JSON
 from sqlalchemy.dialects.postgresql.base import PGInspector
 from sqlalchemy.engine.reflection import Inspector
 from sqlalchemy.engine.url import URL
+from sqlalchemy.sql.elements import ColumnElement
 from sqlalchemy.sql.expression import ColumnClause
 from sqlalchemy.types import Date, DateTime, String
 
@@ -192,6 +194,25 @@ class PostgresBaseEngineSpec(BaseEngineSpec):
         TimeGrain.YEAR: "DATE_TRUNC('year', {col})",
     }
 
+    # Verified against a live postgres:16 instance, including under GROUPING
+    # SETS (the pivot table's non-additive-total rollup pattern): the grand
+    # total correctly reflects every row, not an aggregate-of-aggregates.
+    # STDDEV_SAMP/VAR_SAMP (not MEDIAN -- see its override) are inherited by
+    # Redshift (a Postgres fork); its SQL function reference documents the
+    # same support, but that has not been separately verified against a live
+    # Redshift instance.
+    # Also inherited by TimescaleDB (a Postgres extension, not a forked query
+    # engine -- it runs unmodified Postgres aggregate execution) and by
+    # Aurora PostgreSQL / its Data API variant (AWS's wire- and
+    # SQL-compatible managed Postgres). Engines that share the SQL dialect
+    # but run a materially different query engine (CockroachDB, Greenplum,
+    # SAP HANA) reset this to `{}` instead -- see those engine specs.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {
+        "MEDIAN": lambda col: sa.func.percentile_cont(0.5).within_group(col),
+        "STDDEV_SAMP": sa.func.stddev_samp,
+        "VAR_SAMP": sa.func.var_samp,
+    }
+
     custom_errors: dict[Pattern[str], tuple[str, SupersetErrorType, dict[str, Any]]] = {
         CONNECTION_INVALID_USERNAME_REGEX: (
             __('The username "%(username)s" does not exist.'),
diff --git a/superset/db_engine_specs/redshift.py b/superset/db_engine_specs/redshift.py
index c4c266ab6e8f..ee416277bd52 100644
--- a/superset/db_engine_specs/redshift.py
+++ b/superset/db_engine_specs/redshift.py
@@ -20,10 +20,12 @@
 import re
 import warnings
 from re import Pattern
-from typing import Any
+from typing import Any, Callable
 
 import pandas as pd
+import sqlalchemy as sa
 from flask_babel import gettext as __
+from sqlalchemy.sql.elements import ColumnElement
 from sqlalchemy.types import NVARCHAR
 
 from superset.db_engine_specs.base import BasicParametersMixin, DatabaseCategory
@@ -277,6 +279,24 @@ def normalize_table_name_for_upload(
         "$.aws_iam.role_arn": "AWS IAM Role ARN",
     }
 
+    # Redshift inherits `PostgresBaseEngineSpec._extended_aggregations` for
+    # STDDEV_SAMP/VAR_SAMP (plain, non-sort-based aggregate calls), but
+    # overrides MEDIAN here instead of inheriting Postgres's spelling.
+    # Postgres has no native MEDIAN function and compiles it to
+    # `percentile_cont(0.5) WITHIN GROUP (ORDER BY col)`; Redshift, unlike
+    # Postgres, documents a native `MEDIAN(x)` aggregate function. Using
+    # that native spelling -- rather than the inherited WITHIN-GROUP form --
+    # also sidesteps a documented Redshift restriction rejecting more than
+    # one sort-based aggregate (MEDIAN, PERCENTILE_CONT, LISTAGG WITHIN
+    # GROUP, ...) with a different ORDER BY in the same query, e.g.
+    # `MEDIAN(sales)` alongside `MEDIAN(margin)`: a plain function call has
+    # no explicit ORDER BY clause to conflict.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {
+        "MEDIAN": sa.func.median,
+        "STDDEV_SAMP": PostgresBaseEngineSpec._extended_aggregations["STDDEV_SAMP"],
+        "VAR_SAMP": PostgresBaseEngineSpec._extended_aggregations["VAR_SAMP"],
+    }
+
     @staticmethod
     def update_params_from_encrypted_extra(
         database: Database,
diff --git a/superset/db_engine_specs/risingwave.py b/superset/db_engine_specs/risingwave.py
index 899a9f4c8341..07217e5744dd 100644
--- a/superset/db_engine_specs/risingwave.py
+++ b/superset/db_engine_specs/risingwave.py
@@ -14,6 +14,10 @@
 # KIND, either express or implied.  See the License for the
 # specific language governing permissions and limitations
 # under the License.
+from typing import Callable
+
+from sqlalchemy.sql.elements import ColumnElement
+
 from superset.db_engine_specs.base import DatabaseCategory
 from superset.db_engine_specs.postgres import PostgresEngineSpec
 
@@ -26,6 +30,12 @@ class RisingWaveDbEngineSpec(PostgresEngineSpec):
         "risingwave://user:password@host:port/dbname[?key=value&key=value...]"
     )
 
+    # `PostgresEngineSpec._extended_aggregations` (MEDIAN/STDDEV_SAMP/VAR_SAMP) is
+    # verified against real Postgres behavior, not RisingWave's streaming query
+    # engine; disable it here until someone confirms the same expressions against
+    # a live RisingWave instance.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {}
+
     metadata = {
         "description": "RisingWave is a distributed streaming database.",
         "logo": "risingwave.svg",
diff --git a/superset/db_engine_specs/snowflake.py b/superset/db_engine_specs/snowflake.py
index 0687464ac226..6025bb7adc0c 100644
--- a/superset/db_engine_specs/snowflake.py
+++ b/superset/db_engine_specs/snowflake.py
@@ -20,7 +20,7 @@
 import re
 from datetime import datetime
 from re import Pattern
-from typing import Any, Optional, TYPE_CHECKING, TypedDict
+from typing import Any, Callable, Optional, TYPE_CHECKING, TypedDict
 from urllib import parse
 
 from apispec import APISpec
@@ -33,6 +33,7 @@
 from sqlalchemy import text, types
 from sqlalchemy.engine.reflection import Inspector
 from sqlalchemy.engine.url import URL
+from sqlalchemy.sql.elements import ColumnElement
 
 from superset.constants import TimeGrain
 from superset.databases.utils import make_url_safe
@@ -87,6 +88,11 @@ class SnowflakeEngineSpec(PostgresBaseEngineSpec):
     force_column_alias_quotes = True
     max_column_name_length = 256
 
+    # `PostgresBaseEngineSpec._extended_aggregations` (MEDIAN/STDDEV_SAMP/VAR_SAMP)
+    # is verified against real Postgres behavior, not Snowflake's; disable it here
+    # until someone confirms the same expressions against a live Snowflake instance.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {}
+
     # Snowflake doesn't support IS true/false syntax, use = true/false instead
     use_equality_for_boolean_filters = True
 
diff --git a/superset/db_engine_specs/starrocks.py b/superset/db_engine_specs/starrocks.py
index a4be6922a912..9fcaab308d90 100644
--- a/superset/db_engine_specs/starrocks.py
+++ b/superset/db_engine_specs/starrocks.py
@@ -18,13 +18,14 @@
 import logging
 import re
 from re import Pattern
-from typing import Any
+from typing import Any, Callable
 from urllib import parse
 
 from flask_babel import gettext as __
 from sqlalchemy import Float, Integer, Numeric, text, types
 from sqlalchemy.engine.reflection import Inspector
 from sqlalchemy.engine.url import URL
+from sqlalchemy.sql.elements import ColumnElement
 from sqlalchemy.sql.type_api import TypeEngine
 
 from superset import is_feature_enabled
@@ -103,6 +104,12 @@ class StarRocksEngineSpec(MySQLEngineSpec):
     supports_dynamic_schema = True
     supports_catalog = supports_dynamic_catalog = supports_cross_catalog_queries = True
 
+    # `MySQLEngineSpec._extended_aggregations` (STDDEV_SAMP/VAR_SAMP) is verified
+    # against real MySQL behavior, not StarRocks's OLAP query engine; disable it
+    # here until someone confirms the same expressions against a live StarRocks
+    # instance.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {}
+
     metadata = {
         "description": (
             "StarRocks is a high-performance analytical database "
diff --git a/superset/db_engine_specs/vertica.py b/superset/db_engine_specs/vertica.py
index 28e85d4cf496..329ccc99cd69 100644
--- a/superset/db_engine_specs/vertica.py
+++ b/superset/db_engine_specs/vertica.py
@@ -14,6 +14,10 @@
 # KIND, either express or implied.  See the License for the
 # specific language governing permissions and limitations
 # under the License.
+from typing import Callable
+
+from sqlalchemy.sql.elements import ColumnElement
+
 from superset.db_engine_specs.base import DatabaseCategory
 from superset.db_engine_specs.postgres import PostgresBaseEngineSpec
 
@@ -22,6 +26,11 @@ class VerticaEngineSpec(PostgresBaseEngineSpec):
     engine = "vertica"
     engine_name = "Vertica"
 
+    # `PostgresBaseEngineSpec._extended_aggregations` (MEDIAN/STDDEV_SAMP/VAR_SAMP)
+    # is verified against real Postgres behavior, not Vertica's; disable it here
+    # until someone confirms the same expressions against a live Vertica instance.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {}
+
     metadata = {
         "description": "Vertica is a column-oriented analytics database.",
         "logo": "vertica.png",
diff --git a/superset/db_engine_specs/yugabytedb.py b/superset/db_engine_specs/yugabytedb.py
index 21b8a8eb2e70..6eb17294b1aa 100644
--- a/superset/db_engine_specs/yugabytedb.py
+++ b/superset/db_engine_specs/yugabytedb.py
@@ -17,6 +17,10 @@
 
 from __future__ import annotations
 
+from typing import Callable
+
+from sqlalchemy.sql.elements import ColumnElement
+
 from superset.db_engine_specs.base import DatabaseCategory
 from superset.db_engine_specs.postgres import PostgresBaseEngineSpec
 
@@ -32,6 +36,12 @@ class YugabyteDBEngineSpec(PostgresBaseEngineSpec):
     engine_name = "YugabyteDB"
     default_driver = "psycopg2"
 
+    # `PostgresBaseEngineSpec._extended_aggregations` (MEDIAN/STDDEV_SAMP/VAR_SAMP)
+    # is verified against real Postgres behavior, not YugabyteDB's distributed
+    # query engine; disable it here until someone confirms the same expressions
+    # against a live YugabyteDB instance.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {}
+
     metadata = {
         "description": (
             "YugabyteDB is a distributed SQL database built on top of PostgreSQL."
diff --git a/superset/mcp_service/chart/chart_utils.py b/superset/mcp_service/chart/chart_utils.py
index 98ded317c09e..1055bbbf55b0 100644
--- a/superset/mcp_service/chart/chart_utils.py
+++ b/superset/mcp_service/chart/chart_utils.py
@@ -607,12 +607,19 @@ def create_metric_object(col: ColumnRef) -> Dict[str, Any] | str:
         "MIN",
         "MAX",
         "COUNT_DISTINCT",
-        "STDDEV",
-        "VAR",
+        "STDDEV_SAMP",
+        "VAR_SAMP",
         "MEDIAN",
         "PERCENTILE",
     }
-    aggregate = col.aggregate or "SUM"
+    # Accept the pre-SIP shorthand names too, mapped onto the real,
+    # unambiguous aggregate names Superset actually supports (bare
+    # "STDDEV"/"VAR" are ambiguous between sample and population statistics,
+    # and differ by engine -- see docs/sip/median-stddev-variance-aggregates.md).
+    aggregate_aliases = {"STDDEV": "STDDEV_SAMP", "VAR": "VAR_SAMP"}
+    aggregate = aggregate_aliases.get(
+        (col.aggregate or "SUM").upper(), col.aggregate or "SUM"
+    )
 
     # Validate aggregate function (final safety check)
     if aggregate.upper() not in valid_aggregates:
diff --git a/superset/mcp_service/chart/prompts/create_chart_guided.py b/superset/mcp_service/chart/prompts/create_chart_guided.py
index 1c378c240cbb..f1868fa74972 100644
--- a/superset/mcp_service/chart/prompts/create_chart_guided.py
+++ b/superset/mcp_service/chart/prompts/create_chart_guided.py
@@ -137,7 +137,9 @@ async def create_chart_guided_prompt(
 - If the chart type doesn't suit the data, try a different kind
 
 ## Available Aggregations
-SUM, COUNT, AVG, MIN, MAX, COUNT_DISTINCT, STDDEV, VAR, MEDIAN
+SUM, COUNT, AVG, MIN, MAX, COUNT_DISTINCT, STDDEV_SAMP, VAR_SAMP, MEDIAN
+(support for STDDEV_SAMP/VAR_SAMP/MEDIAN depends on the connected database;
+an unsupported choice returns a clear error naming the unsupported aggregate)
 
 ## Custom SQL Metrics
 For ratio metrics, weighted averages, and conditional aggregates,
diff --git a/superset/mcp_service/chart/schemas.py b/superset/mcp_service/chart/schemas.py
index 841e75990858..1952cd2387cc 100644
--- a/superset/mcp_service/chart/schemas.py
+++ b/superset/mcp_service/chart/schemas.py
@@ -718,10 +718,15 @@ class ColumnRef(UnknownFieldCheckMixin):
             "MIN",
             "MAX",
             "COUNT_DISTINCT",
-            "STDDEV",
-            "VAR",
+            "STDDEV_SAMP",
+            "VAR_SAMP",
             "MEDIAN",
             "PERCENTILE",
+            # Pre-SIP shorthand, accepted and normalized to the names above by
+            # `chart_utils.create_metric_object`; kept here so schema
+            # validation doesn't reject them before that normalization runs.
+            "STDDEV",
+            "VAR",
         ]
         | None
     ) = Field(None, description="SQL aggregate function")
diff --git a/superset/mcp_service/chart/validation/dataset_validator.py b/superset/mcp_service/chart/validation/dataset_validator.py
index c96e60044c04..0d53047460d9 100644
--- a/superset/mcp_service/chart/validation/dataset_validator.py
+++ b/superset/mcp_service/chart/validation/dataset_validator.py
@@ -693,7 +693,15 @@ def _validate_aggregations(
                 # and text in most SQL engines, so restricting them here would
                 # produce false-positive errors.  Leave those to the Tier-2
                 # compile check.
-                numeric_aggs = ["SUM", "AVG", "STDDEV", "VAR", "MEDIAN"]
+                numeric_aggs = [
+                    "SUM",
+                    "AVG",
+                    "STDDEV_SAMP",
+                    "VAR_SAMP",
+                    "MEDIAN",
+                    "STDDEV",
+                    "VAR",
+                ]
                 if (
                     col_ref.aggregate in numeric_aggs
                     and not col_info.get("is_numeric", False)
diff --git a/superset/mcp_service/chart/validation/runtime/format_validator.py b/superset/mcp_service/chart/validation/runtime/format_validator.py
index 73f8c450fa99..413ff3efb401 100644
--- a/superset/mcp_service/chart/validation/runtime/format_validator.py
+++ b/superset/mcp_service/chart/validation/runtime/format_validator.py
@@ -217,7 +217,14 @@ def suggest_format(column: ColumnRef) -> str:
         """Suggest appropriate format based on column and aggregation."""
         if column.aggregate in ["COUNT", "COUNT_DISTINCT"]:
             return ",d"  # Integer with thousands separator
-        elif column.aggregate in ["AVG", "STDDEV", "VAR"]:
+        elif column.aggregate in [
+            "AVG",
+            "MEDIAN",
+            "STDDEV_SAMP",
+            "VAR_SAMP",
+            "STDDEV",
+            "VAR",
+        ]:
             return ",.2f"  # Two decimals for statistical measures
         elif column.aggregate in ["SUM", "MIN", "MAX"]:
             # Could be currency or regular number, default to flexible
diff --git a/superset/models/helpers.py b/superset/models/helpers.py
index 1344e7876d1f..ad5a16dc0e40 100644
--- a/superset/models/helpers.py
+++ b/superset/models/helpers.py
@@ -3518,15 +3518,30 @@ def adhoc_metric_to_sqla(
 
         if expression_type == utils.AdhocMetricExpressionType.SIMPLE:
             aggregate: Any = metric.get("aggregate")
-            if (
-                not isinstance(aggregate, str)
-                or aggregate not in self.sqla_aggregations
-            ):
-                raise QueryObjectValidationError(_("Adhoc metric aggregate is invalid"))
             metric_column = metric.get("column") or {}
             column_name = cast(str, metric_column.get("column_name"))
             sqla_column = sa.column(column_name)
-            sqla_metric = self.sqla_aggregations[aggregate](sqla_column)
+
+            if isinstance(aggregate, str) and aggregate in self.sqla_aggregations:
+                sqla_metric = self.sqla_aggregations[aggregate](sqla_column)
+            elif isinstance(aggregate, str) and (
+                extended_func := self.db_engine_spec.get_extended_aggregation_func(
+                    aggregate
+                )
+            ):
+                sqla_metric = extended_func(sqla_column)
+            elif (
+                isinstance(aggregate, str)
+                and aggregate in utils.EXTENDED_METRIC_AGGREGATES
+            ):
+                raise QueryObjectValidationError(
+                    _(
+                        "The %(aggregate)s aggregate is not supported on this database",
+                        aggregate=aggregate,
+                    )
+                )
+            else:
+                raise QueryObjectValidationError(_("Adhoc metric aggregate is invalid"))
         elif expression_type == utils.AdhocMetricExpressionType.SQL:
             expression: Any = metric.get("sqlExpression")
             if not isinstance(expression, str) or not expression.strip():
diff --git a/superset/utils/core.py b/superset/utils/core.py
index abfe9b221b9f..81c168b41240 100644
--- a/superset/utils/core.py
+++ b/superset/utils/core.py
@@ -176,6 +176,8 @@ def build_email_attachment(name: str, body: bytes | str) -> MIMEApplication:
     "PERCENTILE": "floating",
     "VARIANCE": "floating",
     "STDDEV": "floating",
+    "STDDEV_SAMP": "floating",
+    "VAR_SAMP": "floating",
 }
 
 
@@ -184,6 +186,15 @@ class AdhocMetricExpressionType(StrEnum):
     SQL = "SQL"
 
 
+# Aggregates with no safe, universal cross-dialect spelling -- unlike
+# SUM/COUNT/AVG/MIN/MAX/COUNT_DISTINCT, whose SQL is generated the same way on
+# every engine. Support for these is opt-in per `BaseEngineSpec` (see
+# `get_extended_aggregation_func`); used to distinguish a genuinely invalid
+# aggregate name from one that is valid but unsupported on the current database,
+# for a clearer user-facing error.
+EXTENDED_METRIC_AGGREGATES = frozenset({"MEDIAN", "STDDEV_SAMP", "VAR_SAMP"})
+
+
 class SqlExpressionType(StrEnum):
     """Types of SQL expressions that can be validated."""
 
@@ -1820,11 +1831,14 @@ def get_metric_type_from_column(column: Any, datasource: Explorable) -> str:
     expression: str = metric.expression
 
     match = re.match(
-        r"(SUM|AVG|COUNT|COUNT_DISTINCT|MIN|MAX|FIRST|LAST)\((.*)\)", expression
+        r"(SUM|AVG|COUNT|COUNT_DISTINCT|MIN|MAX|FIRST|LAST"
+        r"|MEDIAN|STDDEV_SAMP|VAR_SAMP)\s*\((.*)\)",
+        expression,
+        re.IGNORECASE,
     )
 
     if match:
-        operation = match.group(1)
+        operation = match.group(1).upper()
         return METRIC_MAP_TYPE.get(operation, "")
 
     logger.debug("Unexpected metric expression type: %s", expression)
diff --git a/tests/unit_tests/charts/test_schemas.py b/tests/unit_tests/charts/test_schemas.py
index 736672bc07ea..153e8a9734b1 100644
--- a/tests/unit_tests/charts/test_schemas.py
+++ b/tests/unit_tests/charts/test_schemas.py
@@ -22,6 +22,7 @@
 from pytest_mock import MockerFixture
 
 from superset.charts.schemas import (
+    ChartDataAdhocMetricSchema,
     ChartDataExtrasSchema,
     ChartDataPostProcessingOperationSchema,
     ChartDataProphetOptionsSchema,
@@ -538,3 +539,23 @@ def test_post_processing_extra_op_is_accepted(app_context: None) -> None:
     schema = ChartDataPostProcessingOperationSchema()
 
     assert schema.load({"operation": "_custom_op"})["operation"] == "_custom_op"
+
+
+@pytest.mark.parametrize("aggregate", ["MEDIAN", "STDDEV_SAMP", "VAR_SAMP"])
+def test_chart_data_adhoc_metric_schema_accepts_extended_aggregates(
+    app_context: None, aggregate: str
+) -> None:
+    """
+    The chart-data REST schema's ``aggregate`` enum must stay in sync with
+    ``EXTENDED_METRIC_AGGREGATES``, otherwise Swagger/generated clients
+    reject requests using these compiler-supported aggregates.
+    """
+    schema = ChartDataAdhocMetricSchema()
+    result = schema.load(
+        {
+            "expressionType": "SIMPLE",
+            "aggregate": aggregate,
+            "column": {"column_name": "value"},
+        }
+    )
+    assert result["aggregate"] == aggregate
diff --git a/tests/unit_tests/db_engine_specs/test_aurora.py b/tests/unit_tests/db_engine_specs/test_aurora.py
index 9b979c278bd6..cbfe887f300a 100644
--- a/tests/unit_tests/db_engine_specs/test_aurora.py
+++ b/tests/unit_tests/db_engine_specs/test_aurora.py
@@ -301,6 +301,43 @@ def test_aurora_mysql_update_params_from_encrypted_extra_with_iam() -> None:
     # SSL should be configured via the database's extra settings.
 
 
+def test_aurora_postgres_inherits_extended_aggregations() -> None:
+    """
+    Aurora PostgreSQL (and its Data API variant) is AWS's wire- and
+    SQL-compatible managed Postgres, not a forked query engine, so it
+    inherits `_extended_aggregations` from `PostgresBaseEngineSpec`
+    unmodified -- see the comment above that dict.
+    """
+    from superset.db_engine_specs.aurora import (
+        AuroraPostgresDataAPI,
+        AuroraPostgresEngineSpec,
+    )
+
+    for spec in (AuroraPostgresEngineSpec, AuroraPostgresDataAPI):
+        assert spec.get_extended_aggregation_func("MEDIAN") is not None
+        assert spec.get_extended_aggregation_func("STDDEV_SAMP") is not None
+        assert spec.get_extended_aggregation_func("VAR_SAMP") is not None
+
+
+def test_aurora_mysql_inherits_extended_aggregations() -> None:
+    """
+    Aurora MySQL (and its Data API variant) is AWS's wire- and
+    SQL-compatible managed MySQL, not a forked query engine, so it inherits
+    `_extended_aggregations` from `MySQLEngineSpec` unmodified -- see the
+    comment above that dict.
+    """
+    from superset.db_engine_specs.aurora import (
+        AuroraMySQLDataAPI,
+        AuroraMySQLEngineSpec,
+    )
+
+    for spec in (AuroraMySQLEngineSpec, AuroraMySQLDataAPI):
+        assert spec.get_extended_aggregation_func("STDDEV_SAMP") is not None
+        assert spec.get_extended_aggregation_func("VAR_SAMP") is not None
+        # Same as MySQL, MEDIAN is not supported.
+        assert spec.get_extended_aggregation_func("MEDIAN") is None
+
+
 def test_aurora_data_api_classes_unchanged() -> None:
     from superset.db_engine_specs.aurora import (
         AuroraMySQLDataAPI,
diff --git a/tests/unit_tests/db_engine_specs/test_base.py b/tests/unit_tests/db_engine_specs/test_base.py
index bb53f4ddc66c..e4e495ff58c2 100644
--- a/tests/unit_tests/db_engine_specs/test_base.py
+++ b/tests/unit_tests/db_engine_specs/test_base.py
@@ -1508,3 +1508,22 @@ def test_array_capabilities_raise_when_unsupported(method: str) -> None:
     args = (column("c"), ["v"]) if "contains" in method else (column("c"),)
     with pytest.raises(NotImplementedError):
         fn(*args)
+
+
+@pytest.mark.parametrize("aggregate", ["MEDIAN", "STDDEV_SAMP", "VAR_SAMP"])
+def test_base_spec_extended_aggregation_func_defaults_to_unsupported(
+    aggregate: str,
+) -> None:
+    """
+    By default, an engine spec has no verified expression for the "extended"
+    aggregates (MEDIAN/STDDEV_SAMP/VAR_SAMP) -- they must be explicitly opted
+    into per engine spec, the same way `supports_grouping_sets` and
+    `_time_grain_expressions` work. Silence here means "unsupported", not
+    "untested" -- callers must not fall back to guessing SQL.
+    """
+    assert BaseEngineSpec.get_extended_aggregation_func(aggregate) is None
+
+
+def test_base_spec_extended_aggregation_func_unknown_name_is_unsupported() -> None:
+    """An aggregate name outside the known extended set is also just None."""
+    assert BaseEngineSpec.get_extended_aggregation_func("NOT_A_REAL_AGGREGATE") is None
diff --git a/tests/unit_tests/db_engine_specs/test_duckdb.py b/tests/unit_tests/db_engine_specs/test_duckdb.py
index 5ad991a3b2c3..79bfcecc9dc0 100644
--- a/tests/unit_tests/db_engine_specs/test_duckdb.py
+++ b/tests/unit_tests/db_engine_specs/test_duckdb.py
@@ -191,3 +191,62 @@ def test_fetch_data_preserves_cursor_description(mocker: MockerFixture) -> None:
         assert [col[0] for col in cursor.description] == ["col1", "col2"]
     finally:
         raw_conn.close()
+
+
+def test_extended_aggregation_func_median_stddev_var_compiles() -> None:
+    """
+    MEDIAN/STDDEV_SAMP/VAR_SAMP compile to the expected DuckDB SQL function
+    calls. See `test_extended_aggregation_func_median_stddev_var_executes`
+    for verification against a live in-process DuckDB instance.
+    """
+    from sqlalchemy import column
+
+    from superset.db_engine_specs.duckdb import DuckDBEngineSpec
+
+    col = column("sales")
+
+    for aggregate, expected_sql in [
+        ("MEDIAN", "median(sales)"),
+        ("STDDEV_SAMP", "stddev_samp(sales)"),
+        ("VAR_SAMP", "var_samp(sales)"),
+    ]:
+        func = DuckDBEngineSpec.get_extended_aggregation_func(aggregate)
+        assert func is not None
+        compiled = str(func(col).compile(compile_kwargs={"literal_binds": True}))
+        assert compiled == expected_sql
+
+
+def test_extended_aggregation_func_median_stddev_var_executes() -> None:
+    """
+    MEDIAN/STDDEV_SAMP/VAR_SAMP execute against a live in-process DuckDB
+    instance and return values matching Python's `statistics` module
+    (sample standard deviation/variance) for the same input.
+    """
+    import statistics
+
+    from sqlalchemy import create_engine, literal_column, select, text
+
+    from superset.db_engine_specs.duckdb import DuckDBEngineSpec
+
+    values = [1.0, 2.0, 4.0, 8.0, 16.0]
+
+    engine = create_engine("duckdb:///:memory:")
+    with engine.connect() as conn:
+        conn.execute(text("CREATE TABLE t (sales DOUBLE)"))
+        conn.execute(
+            text("INSERT INTO t VALUES (:sales)"),
+            [{"sales": v} for v in values],
+        )
+
+        expected = {
+            "MEDIAN": statistics.median(values),
+            "STDDEV_SAMP": statistics.stdev(values),
+            "VAR_SAMP": statistics.variance(values),
+        }
+
+        for aggregate, expected_value in expected.items():
+            func = DuckDBEngineSpec.get_extended_aggregation_func(aggregate)
+            assert func is not None
+            query = select(func(literal_column("sales"))).select_from(text("t"))
+            result = conn.execute(query).scalar()
+            assert result == pytest.approx(expected_value)
diff --git a/tests/unit_tests/db_engine_specs/test_extended_aggregations_unverified.py b/tests/unit_tests/db_engine_specs/test_extended_aggregations_unverified.py
new file mode 100644
index 000000000000..a5fc530a3228
--- /dev/null
+++ b/tests/unit_tests/db_engine_specs/test_extended_aggregations_unverified.py
@@ -0,0 +1,68 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+"""
+`_extended_aggregations` (MEDIAN/STDDEV_SAMP/VAR_SAMP) is verified against
+real engine behavior before being enabled -- see `BaseEngineSpec` for the
+rationale. `PostgresBaseEngineSpec`/`PostgresEngineSpec`/`MySQLEngineSpec`
+subclasses that share SQL dialect helpers with Postgres/MySQL but run a
+materially different query engine (a proprietary appliance, a distributed
+SQL engine, or an OLAP engine) must not silently inherit that dict: each
+verified engine spec opts in explicitly, everything else stays unsupported
+until someone verifies it against a live instance.
+"""
+
+from typing import Type
+
+import pytest
+
+from superset.db_engine_specs.base import BaseEngineSpec
+from superset.db_engine_specs.cockroachdb import CockroachDbEngineSpec
+from superset.db_engine_specs.doris import DorisEngineSpec
+from superset.db_engine_specs.greenplum import GreenplumEngineSpec
+from superset.db_engine_specs.hana import HanaEngineSpec
+from superset.db_engine_specs.hologres import HologresEngineSpec
+from superset.db_engine_specs.netezza import NetezzaEngineSpec
+from superset.db_engine_specs.oceanbase import OceanBaseEngineSpec
+from superset.db_engine_specs.risingwave import RisingWaveDbEngineSpec
+from superset.db_engine_specs.snowflake import SnowflakeEngineSpec
+from superset.db_engine_specs.starrocks import StarRocksEngineSpec
+from superset.db_engine_specs.vertica import VerticaEngineSpec
+from superset.db_engine_specs.yugabytedb import YugabyteDBEngineSpec
+
+
+@pytest.mark.parametrize(
+    "spec_cls",
+    [
+        VerticaEngineSpec,
+        NetezzaEngineSpec,
+        HanaEngineSpec,
+        SnowflakeEngineSpec,
+        CockroachDbEngineSpec,
+        GreenplumEngineSpec,
+        RisingWaveDbEngineSpec,
+        YugabyteDBEngineSpec,
+        HologresEngineSpec,
+        DorisEngineSpec,
+        StarRocksEngineSpec,
+        OceanBaseEngineSpec,
+    ],
+)
+@pytest.mark.parametrize("aggregate", ["MEDIAN", "STDDEV_SAMP", "VAR_SAMP"])
+def test_unverified_postgres_and_mysql_family_specs_reject_extended_aggregations(
+    spec_cls: Type[BaseEngineSpec], aggregate: str
+) -> None:
+    assert spec_cls.get_extended_aggregation_func(aggregate) is None
diff --git a/tests/unit_tests/db_engine_specs/test_mariadb.py b/tests/unit_tests/db_engine_specs/test_mariadb.py
new file mode 100644
index 000000000000..d4ff0ffef504
--- /dev/null
+++ b/tests/unit_tests/db_engine_specs/test_mariadb.py
@@ -0,0 +1,35 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+from superset.db_engine_specs.mariadb import MariaDBEngineSpec
+from superset.db_engine_specs.mysql import MySQLEngineSpec
+
+
+def test_mariadb_inherits_from_mysql() -> None:
+    assert issubclass(MariaDBEngineSpec, MySQLEngineSpec)
+
+
+def test_mariadb_inherits_extended_aggregations() -> None:
+    """
+    MariaDB is a MySQL fork implementing the same aggregate functions, not a
+    materially different query engine, so it inherits `_extended_aggregations`
+    from `MySQLEngineSpec` unmodified -- see the comment above that dict.
+    """
+    assert MariaDBEngineSpec.get_extended_aggregation_func("STDDEV_SAMP") is not None
+    assert MariaDBEngineSpec.get_extended_aggregation_func("VAR_SAMP") is not None
+    # Same as MySQL, MEDIAN is not supported.
+    assert MariaDBEngineSpec.get_extended_aggregation_func("MEDIAN") is None
diff --git a/tests/unit_tests/db_engine_specs/test_mysql.py b/tests/unit_tests/db_engine_specs/test_mysql.py
index e95663351102..001a4b46f4e0 100644
--- a/tests/unit_tests/db_engine_specs/test_mysql.py
+++ b/tests/unit_tests/db_engine_specs/test_mysql.py
@@ -401,3 +401,39 @@ def test_identifier_quote_uses_backticks() -> None:
         "end": "`",
         "escape_by_doubling": True,
     }
+
+
+def test_extended_aggregation_func_stddev_var_sample() -> None:
+    """
+    Verified against a live mysql:8.0 instance, including under GROUP BY ...
+    WITH ROLLUP: these produce the correct database-wide sample statistic, and
+    match the same-input results from postgres/duckdb exactly.
+    """
+    from superset.db_engine_specs.mysql import MySQLEngineSpec as spec  # noqa: N813
+
+    col = column("sales")
+
+    stddev_expr = spec.get_extended_aggregation_func("STDDEV_SAMP")
+    assert stddev_expr is not None
+    assert (
+        str(stddev_expr(col).compile(compile_kwargs={"literal_binds": True}))
+        == "stddev_samp(sales)"
+    )
+
+    var_expr = spec.get_extended_aggregation_func("VAR_SAMP")
+    assert var_expr is not None
+    assert (
+        str(var_expr(col).compile(compile_kwargs={"literal_binds": True}))
+        == "var_samp(sales)"
+    )
+
+
+def test_extended_aggregation_func_median_unsupported() -> None:
+    """
+    MySQL has neither a MEDIAN function nor PERCENTILE_CONT (confirmed against
+    a live mysql:8.0 instance: both error). Must not silently fall back to
+    a guessed expression.
+    """
+    from superset.db_engine_specs.mysql import MySQLEngineSpec as spec  # noqa: N813
+
+    assert spec.get_extended_aggregation_func("MEDIAN") is None
diff --git a/tests/unit_tests/db_engine_specs/test_postgres.py b/tests/unit_tests/db_engine_specs/test_postgres.py
index 56e2815549eb..2cb5126c5194 100644
--- a/tests/unit_tests/db_engine_specs/test_postgres.py
+++ b/tests/unit_tests/db_engine_specs/test_postgres.py
@@ -501,3 +501,30 @@ def test_get_schema_names_excludes_only_actual_system_schemas(
         "pgstats",
         "information_schema",
     }
+
+
+@pytest.mark.parametrize(
+    ("aggregate", "expected_sql"),
+    [
+        ("MEDIAN", "percentile_cont(0.5) WITHIN GROUP (ORDER BY sales)"),
+        ("STDDEV_SAMP", "stddev_samp(sales)"),
+        ("VAR_SAMP", "var_samp(sales)"),
+    ],
+)
+def test_extended_aggregation_func_compiles_expected_sql(
+    aggregate: str, expected_sql: str
+) -> None:
+    """
+    Verified against a live postgres:16 instance (including under GROUPING
+    SETS): these expressions compute the correct database-wide statistic, not
+    an aggregate-of-per-group-aggregates.
+    """
+    func = spec.get_extended_aggregation_func(aggregate)
+    assert func is not None
+
+    compiled = str(
+        func(column("sales")).compile(
+            dialect=postgresql.dialect(), compile_kwargs={"literal_binds": True}
+        )
+    )
+    assert compiled == expected_sql
diff --git a/tests/unit_tests/db_engine_specs/test_redshift.py b/tests/unit_tests/db_engine_specs/test_redshift.py
index d733767503fd..e9bfe7f76ca8 100644
--- a/tests/unit_tests/db_engine_specs/test_redshift.py
+++ b/tests/unit_tests/db_engine_specs/test_redshift.py
@@ -79,3 +79,33 @@ def test_normalize_table_name_for_upload(
 
     assert normalized_table == expected_table
     assert normalized_schema == expected_schema
+
+
+def test_extended_aggregation_func_inherited_from_postgres() -> None:
+    """
+    Redshift is a Postgres fork and inherits STDDEV_SAMP/VAR_SAMP from
+    `PostgresBaseEngineSpec` -- its documented SQL function reference matches
+    Postgres for these functions, though this has not been separately
+    verified against a live Redshift instance (see the SIP doc for caveats).
+
+    MEDIAN is overridden rather than inherited (see
+    `RedshiftEngineSpec._extended_aggregations`): unlike Postgres, Redshift
+    documents a native `MEDIAN(x)` function, so Redshift emits that directly
+    instead of Postgres's `percentile_cont(0.5) WITHIN GROUP (ORDER BY col)`
+    spelling -- which also sidesteps Redshift's documented restriction
+    against more than one sort-based aggregate with a different ORDER BY in
+    the same query, e.g. `MEDIAN(sales)` alongside `MEDIAN(margin)`.
+    """
+    from sqlalchemy import column
+
+    col = column("sales")
+
+    median_func = RedshiftEngineSpec.get_extended_aggregation_func("MEDIAN")
+    assert median_func is not None
+    assert (
+        str(median_func(col).compile(compile_kwargs={"literal_binds": True}))
+        == "median(sales)"
+    )
+
+    for aggregate in ("STDDEV_SAMP", "VAR_SAMP"):
+        assert RedshiftEngineSpec.get_extended_aggregation_func(aggregate) is not None
diff --git a/tests/unit_tests/db_engine_specs/test_timescaledb.py b/tests/unit_tests/db_engine_specs/test_timescaledb.py
new file mode 100644
index 000000000000..34245136367b
--- /dev/null
+++ b/tests/unit_tests/db_engine_specs/test_timescaledb.py
@@ -0,0 +1,37 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+from superset.db_engine_specs.postgres import PostgresBaseEngineSpec
+from superset.db_engine_specs.timescaledb import TimescaleDBEngineSpec
+
+
+def test_timescaledb_inherits_from_postgres_base() -> None:
+    assert issubclass(TimescaleDBEngineSpec, PostgresBaseEngineSpec)
+
+
+def test_timescaledb_inherits_extended_aggregations() -> None:
+    """
+    TimescaleDB is a Postgres extension, not a forked query engine -- it runs
+    unmodified Postgres aggregate execution -- so it inherits
+    `_extended_aggregations` from `PostgresBaseEngineSpec` unmodified -- see
+    the comment above that dict.
+    """
+    assert TimescaleDBEngineSpec.get_extended_aggregation_func("MEDIAN") is not None
+    assert (
+        TimescaleDBEngineSpec.get_extended_aggregation_func("STDDEV_SAMP") is not None
+    )
+    assert TimescaleDBEngineSpec.get_extended_aggregation_func("VAR_SAMP") is not None
diff --git a/tests/unit_tests/mcp_service/chart/test_chart_utils.py b/tests/unit_tests/mcp_service/chart/test_chart_utils.py
index 1b2416698689..80844c63d318 100644
--- a/tests/unit_tests/mcp_service/chart/test_chart_utils.py
+++ b/tests/unit_tests/mcp_service/chart/test_chart_utils.py
@@ -89,6 +89,24 @@ def test_create_metric_object_with_aggregate(self) -> None:
         assert result["optionName"] == "metric_revenue"
         assert result["expressionType"] == "SIMPLE"
 
+    def test_create_metric_object_normalizes_stddev_var_shorthand(self) -> None:
+        """
+        Pre-SIP "STDDEV"/"VAR" shorthand is normalized to the real,
+        unambiguous aggregate names ("STDDEV_SAMP"/"VAR_SAMP") this chart
+        can actually query -- see docs/sip/median-stddev-variance-aggregates.md.
+        Before this, a chart built with "STDDEV"/"VAR" always errored at
+        query time, since that name was never a real Superset aggregate.
+        """
+        stddev_col = ColumnRef(name="price", aggregate="STDDEV", label="Std Dev")
+        result = create_metric_object(stddev_col)
+        assert isinstance(result, dict)
+        assert result["aggregate"] == "STDDEV_SAMP"
+
+        var_col = ColumnRef(name="price", aggregate="VAR", label="Variance")
+        result = create_metric_object(var_col)
+        assert isinstance(result, dict)
+        assert result["aggregate"] == "VAR_SAMP"
+
     def test_create_metric_object_default_aggregate(self) -> None:
         """Test creating metric object with default aggregate"""
         col = ColumnRef(name="orders")
diff --git a/tests/unit_tests/models/helpers_test.py b/tests/unit_tests/models/helpers_test.py
index e41b20313806..ca89ad7e6222 100644
--- a/tests/unit_tests/models/helpers_test.py
+++ b/tests/unit_tests/models/helpers_test.py
@@ -2130,6 +2130,76 @@ def test_adhoc_metric_to_sqla_invalid_simple_aggregate_raises_validation_error(
         table.adhoc_metric_to_sqla(metric, {})
 
 
+@pytest.mark.parametrize(
+    "aggregate,expected_substring",
+    [
+        ("MEDIAN", "percentile_cont"),
+        ("STDDEV_SAMP", "stddev_samp"),
+        ("VAR_SAMP", "var_samp"),
+    ],
+)
+def test_adhoc_metric_to_sqla_extended_aggregate_on_supported_engine(
+    aggregate: str,
+    expected_substring: str,
+) -> None:
+    """
+    MEDIAN/STDDEV_SAMP/VAR_SAMP compile correctly end-to-end on an engine that
+    supports them (Postgres), via the same `adhoc_metric_to_sqla` path every
+    other aggregate uses -- no pivot-table-specific code involved.
+    """
+    from superset.connectors.sqla.models import SqlaTable, TableColumn
+    from superset.models.core import Database
+
+    pg_database = Database(database_name="pg", sqlalchemy_uri="postgresql://u:p@h/d")
+    table = SqlaTable(
+        database=pg_database,
+        schema=None,
+        table_name="t",
+        columns=[TableColumn(column_name="sales")],
+    )
+    metric: AdhocMetric = {
+        "expressionType": "SIMPLE",
+        "column": {"column_name": "sales"},
+        "aggregate": aggregate,
+        "label": f"{aggregate} sales",
+    }
+
+    sqla_metric = table.adhoc_metric_to_sqla(metric, {})
+
+    assert expected_substring in str(sqla_metric).lower()
+
+
+def test_adhoc_metric_to_sqla_extended_aggregate_on_unsupported_engine_raises_specific_error(  # noqa: E501
+    database: Database,
+) -> None:
+    """
+    A recognized extended aggregate (MEDIAN) that this engine (SQLite, via the
+    `database` fixture) has no verified expression for raises a specific
+    "not supported on this database" error, distinct from the generic
+    "invalid aggregate" error a bogus aggregate name gets -- callers should be
+    able to tell "this isn't a real thing" from "this engine can't do it"
+    without emitting unverified SQL either way.
+    """
+    from superset.connectors.sqla.models import SqlaTable, TableColumn
+    from superset.exceptions import QueryObjectValidationError
+
+    table = SqlaTable(
+        database=database,
+        schema=None,
+        table_name="t",
+        columns=[TableColumn(column_name="a")],
+    )
+    metric: AdhocMetric = {
+        "expressionType": "SIMPLE",
+        "column": {"column_name": "a"},
+        "aggregate": "MEDIAN",
+        "label": "Median a",
+    }
+
+    with pytest.raises(QueryObjectValidationError, match="not supported"):
+        table.adhoc_metric_to_sqla(metric, {})
+
+
 @pytest.mark.parametrize("sql_expression", [None, "", "   "])
 def test_adhoc_metric_to_sqla_invalid_sql_expression_raises_validation_error(
     database: Database,
diff --git a/tests/unit_tests/utils/map_type_tests.py b/tests/unit_tests/utils/map_type_tests.py
index b1d770672ec1..0f14f3ce3a2b 100644
--- a/tests/unit_tests/utils/map_type_tests.py
+++ b/tests/unit_tests/utils/map_type_tests.py
@@ -38,6 +38,21 @@ def test_column_with_valid_operation():
     assert (get_metric_type_from_column(column, datasource)) == "floating"
 
 
+@pytest.mark.parametrize(
+    "expression",
+    [
+        "stddev_samp(my_column)",
+        "STDDEV_SAMP (my_column)",
+        "StdDev_Samp(my_column)",
+    ],
+)
+def test_column_with_lowercase_or_whitespaced_operation(expression):
+    metric = SqlMetric(metric_name="my_column", expression=expression)
+    datasource = MagicMock(metrics=[metric])
+    column = "my_column"
+    assert (get_metric_type_from_column(column, datasource)) == "floating"
+
+
 def test_column_with_invalid_operation():
     metric = SqlMetric(metric_name="my_column", expression="INVALID(my_column)")
     datasource = MagicMock(metrics=[metric])