From d6aa564743e6085a5d8699a4ae8ebd2c72887783 Mon Sep 17 00:00:00 2001 From: Igor Lukanin Date: Fri, 24 Jul 2026 23:28:22 +0200 Subject: [PATCH 1/4] docs: clarify conditional formatting behavior under column pivots (CUB-3058) (#11323) --- docs-mintlify/docs/explore-analyze/charts/chart-types/table.mdx | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs-mintlify/docs/explore-analyze/charts/chart-types/table.mdx b/docs-mintlify/docs/explore-analyze/charts/chart-types/table.mdx index 2190e0d1c0e45..3e58d95af5b35 100644 --- a/docs-mintlify/docs/explore-analyze/charts/chart-types/table.mdx +++ b/docs-mintlify/docs/explore-analyze/charts/chart-types/table.mdx @@ -273,6 +273,8 @@ The **Conditional formatting** tab applies cell or row styling based on conditio To make a background transparent, open the color picker and clear the hex value. +A rule can apply to just its source column, to selected columns, or to the entire row. Under a column pivot, a row spans several values of the same measure (one per pivot combination), so a row-spanning rule (**Entire row** or **Selected columns**) styles each measure cell by its own combination's value. Cells with no single value to test — row headers, row dimensions, and any rule whose source dimension has been pivoted into columns — are left unstyled. + {/* TODO screenshot: conditional formatting panel with a condition configured (hidden — replace this comment with when image is ready) */} ### Color scale From 29590f4e8cd80ca5344f06cf6b6e63a76537ef70 Mon Sep 17 00:00:00 2001 From: Maxim Date: Fri, 24 Jul 2026 15:50:26 -0700 Subject: [PATCH 2/4] docs: call out Chrome local network access on AWS private API connectivity (#11350) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When Cube's data APIs are reachable only on a private address, Chromium-based browsers block the calls the Cube UI makes to them: the UI is served from the public cubecloud.dev origin, so those fetches are local network requests and need the Local network access permission (Private Network Access before Chrome 142). This surfaces as a "Network Error" banner in the UI while curl from the same laptop succeeds, and it is by far the most common support escalation for BYOC and private-API tenants. Document the cause and both fixes — the per-user permission prompt / site setting, and the LocalNetworkAccessAllowedForUrls enterprise policy for managed fleets — including why the policy silently does not apply to unmanaged Chrome profiles, which is why the same page works for one colleague and fails for another on the same VPN. Wire the new section into the existing "Network Error" troubleshooting steps. The equivalent Azure and GCP pages are tracked separately. Co-authored-by: Claude Opus 5 (1M context) --- .../aws/private-api-connectivity.mdx | 58 +++++++++++++++++++ 1 file changed, 58 insertions(+) diff --git a/docs-mintlify/admin/deployment/dedicated/aws/private-api-connectivity.mdx b/docs-mintlify/admin/deployment/dedicated/aws/private-api-connectivity.mdx index babf9ac0e6232..3181e3415fd4b 100644 --- a/docs-mintlify/admin/deployment/dedicated/aws/private-api-connectivity.mdx +++ b/docs-mintlify/admin/deployment/dedicated/aws/private-api-connectivity.mdx @@ -382,6 +382,54 @@ below for steps to isolate the failure. +## Chrome local network access permission + + + +Chromium-based browsers block requests from a page served over the public +internet to a host that resolves to a **private** address, unless the site has +the **Local network access** permission. The Cube UI is served from the public +`https://.cubecloud.dev` origin while your private API hostname +resolves to an RFC 1918 address over the VPN — so every browser that loads the +Cube UI needs this permission before charts, the Semantic Model IDE, the +playground, and any other data-driven view will render. + + + +This is a browser policy that Cube cannot grant on your behalf, and it applies +to both TLS options above: the browser decides from the **resolved IP address**, +not the hostname, so reusing `.cubecloudapp.dev` does not avoid it. +Non-browser clients — `curl`, `psql`, your application servers, BI gateways — are +unaffected, which is why `curl` from a laptop can succeed while the Cube UI on +the same laptop shows **"Network Error"**. + +Chrome enforces this as [Local Network Access][chrome-lna] from Chrome 142 +onwards; earlier versions enforced its predecessor, +[Private Network Access][chrome-pna]. A blocked call appears in DevTools as a +failed request with `ERR_BLOCKED_BY_PRIVATE_NETWORK_ACCESS_CHECKS`, or as a +CORS-style console error naming a private or local target address space. + +**Individual users** can accept Chrome's *"wants to look for and connect to any +device on your local network"* prompt, or set **Local network access** to +**Allow** under the padlock icon → **Site settings** on the Cube UI origin. + +**Managed fleets** should pre-grant the permission with a Chrome Enterprise +policy, since the prompt is easy to dismiss and reappears per profile. Set the +policy value to your Cube UI origin (e.g. `https://.cubecloud.dev`): + +| Chrome version | Policy | +| -------------- | ---------------------------------------------------------- | +| 142 and later | [`LocalNetworkAccessAllowedForUrls`][chrome-policy-lna] | +| Before 142 | [`InsecurePrivateNetworkRequestsAllowedForUrls`][chrome-policy-pna] | + +If some users still fail after the policy is rolled out, have them check +`chrome://policy` and confirm the policy is listed with the expected value. A +missing entry means it has not synced to that device or profile — most often +because the user is signed in to Chrome with a personal, unmanaged Google +profile, which enterprise policies do not reach. That is the usual explanation +for the same page working for one colleague and failing for another on the same +VPN. + ## Configuring the private domain Configure the private hostname for each Cube Region from the Cube admin panel, @@ -550,6 +598,12 @@ hop is failing: domain), make sure your proxy is presenting a certificate whose CN/SAN matches the override hostname and is signed by a CA the user's machine trusts. + - **`ERR_BLOCKED_BY_PRIVATE_NETWORK_ACCESS_CHECKS`, or the URL + loads fine in its own tab but still fails from the Cube UI** — + the browser is blocking the call because the private hostname + resolves to a private address and the site lacks Chrome's + **Local network access** permission. See + [Chrome local network access permission](#chrome-local-network-access-permission). - **HTTP 4xx/5xx from Cube** — the network path is fine; the error is on the API itself. Inspect the response body in the new tab to see Cube's error message and proceed as you would for any other @@ -590,3 +644,7 @@ hop is failing: [aws-acm]: https://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html [aws-privatelink-az]: https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html#endpoint-service-availability-zones [aws-route53-phz]: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zones-private.html +[chrome-lna]: https://developer.chrome.com/blog/local-network-access +[chrome-pna]: https://developer.chrome.com/blog/private-network-access-update +[chrome-policy-lna]: https://chromeenterprise.google/policies/local-network-access-allowed-for-urls/ +[chrome-policy-pna]: https://chromeenterprise.google/policies/insecure-private-network-requests-allowed-for-urls/ From 2e5d5ece11d9dcdbf8b3f927957fd210821f21f9 Mon Sep 17 00:00:00 2001 From: Artyom Keydunov Date: Fri, 24 Jul 2026 17:10:30 -0700 Subject: [PATCH 3/4] docs: remove preview warning from Cube CLI page (#11352) Co-authored-by: Claude Opus 5 --- docs-mintlify/reference/cli.mdx | 8 -------- 1 file changed, 8 deletions(-) diff --git a/docs-mintlify/reference/cli.mdx b/docs-mintlify/reference/cli.mdx index c2bf3fe8d778c..e4dc19a0b563a 100644 --- a/docs-mintlify/reference/cli.mdx +++ b/docs-mintlify/reference/cli.mdx @@ -3,14 +3,6 @@ title: Cube CLI description: Command-line interface for managing Cube deployments, data models, and workspace resources. --- - - -The Cube CLI is currently in preview, and commands and flags may still -change. Reach out to the [Cube support team](/admin/account-billing/support) -to activate this feature for your account. - - - The Cube CLI (`cube`) is a single-binary command-line interface for the Cube platform. Use it to create and manage deployments, deploy data model code, work with the data model Git workflow, connect GitHub repositories, tail From 4b8875ecb0743cd35264ab03c23b64767e78ed61 Mon Sep 17 00:00:00 2001 From: Igor Lukanin Date: Sat, 25 Jul 2026 02:13:54 +0200 Subject: [PATCH 4/4] docs: add Claude Opus 5, Opus 4.8, and Sonnet 5 to agent LLM models (#11347) --- docs-mintlify/admin/ai/index.mdx | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs-mintlify/admin/ai/index.mdx b/docs-mintlify/admin/ai/index.mdx index 039005b93b78a..20516d0398fe0 100644 --- a/docs-mintlify/admin/ai/index.mdx +++ b/docs-mintlify/admin/ai/index.mdx @@ -78,6 +78,9 @@ To pin a specific model, set the `llm` property to one of the predefined models: - `claude_4_6_sonnet` - `claude_4_6_opus` - `claude_4_7_opus` +- `claude_4_8_opus` +- `claude_5_sonnet` +- `claude_5_opus` **OpenAI GPT:** - `gpt_4o`