fix: Validate query timezone against IANA zones - #11575

Merged

ovr merged 21 commits into

Aug 19, 2026

Commits on Aug 17, 2026

fix: Validate query timezone against IANA zones
ovr
committed
4338e67
fix(api-gateway): normalize query timezone to canonical IANA name
ovr
committed
47516ce
fix: apply timezone normalization across all API entry points
ovr
committed
6141a98
Update packages/cubejs-api-gateway/src/query.js

ovr
and
claude[bot]
authored
5f5d081
Update packages/cubejs-server-core/src/core/optionsValidate.ts

ovr
and
claude[bot]
authored
654610b
fix: fail fast on misconfigured timezone env vars
ovr
committed
ebec8d0
docs: drop timezone canonicalization notes from the env var reference

ovr
and
claude
committed
eaf58eb
fix: tolerate empty entries in CUBEJS_SCHEDULED_REFRESH_TIMEZONES
ovr
committed
062b0e7
fix: use the sanitized options object returned by validateOptions

ovr
and
claude
committed
12d107d
refactor: rename OptsHandler.assertOptions to validateOptions

ovr
and
claude
committed
3a5784b
refactor: rename OptsHandler.validateOptions to sanitizeOptions

ovr
and
claude
committed
c82de0b

Commits on Aug 19, 2026

refactor(shared): make canonicalTimezone strict about argument types
ovr
committed
bf6d42a
refactor(api-gateway): drop normalizeTimezone in favour of timezoneSchema
ovr
committed
c08ded8
feat(api-gateway): validate the whole /v1/cubesql body with a schema
ovr
committed
35f969f
refactor(shared): check for an empty timezone explicitly
ovr
committed
eef56da
refactor(shared): reject an empty timezone instead of returning null
ovr
committed
3393f95
docs: trim timezone comments that restate the code
ovr
committed
3b59610
docs: document CUBEJS_SCHEDULED_REFRESH_TIMEZONES validation
ovr
committed
d60aa38
docs: drop the empty-entries note from CUBEJS_SCHEDULED_REFRESH_TIMEZONES
ovr
committed
7005ea1
fix(schema-compiler): canonicalize the query timezone in BaseQuery
ovr
committed
79b1c43
test(schema-compiler): drop the non-string timezone cases

ovr
and
claude
committed
b4d5ef6