Create SECURITY.md

Point README.md to SECURITY.md to avoid duplicated information, and
removed the explicit version table in SECURITY.md to make it easier to
keep up to date.

* try overwriting formatting action entry

* add a guard and clean up some unrelated conditionals

* fix click action update

* flow undefined check

Co-authored-by: Paul Rosenzweig <paul.a.rosenzweig@gmail.com>

* Run each test in isolation

* Add repro for #14124

The bug was fixed in #14096

Reported failing in Postgres, Redshift and BigQuery.

* change default Total color to blue

* change gray in color picker to text-dark

* whoops I meant text-dark

* Add aria roles to our custom checkbox

https://developer.mozilla.org/en-US/docs/Web/Accessibility/ARIA/Roles/checkbox_role

* Enable keyboard interactions on checkbox

https://developer.mozilla.org/en-US/docs/Web/Accessibility/ARIA/Roles/checkbox_role#Keyboard_interactions

* Make checkbox's own events work within `FilterOptions.jsx`

Note: Checkbox's own `onClick()` is enabled ONLY if there is `onChange()` prop.

* Update unit snapshots

* add new dashboard icons

* update snapshots

* slightly larger ellipsis icon

#14122 Repro: Sub-collections under Personal collection should be available in save/move modals [ci skip] (#14143)

#14114 Repro: Cannot see child collection in sidebar when access has been revoked to its parent [ci skip] (#14137)

* Remove related unit tests

* Remove new user onboarding modal and related component

* Remove greeting function

* Infer source_metadata when saving/updating a Card

* Test fixes 

The real solution is to switch it based on their existence or not

This reverts commit 30e5948d.

The casting is done in the query processor, so when we fingerprint, we
are already dealing with dates, not the underlying integral
values. This change actually broke what was working with an error of
"cannot cast <some datetime type> to long

* change pulse sent to email sent

* remove transition from Card.jsx

* tweak lineheight for email and slack boxes

* emailAttachmentPicker styling

* add caveat about charts looking different

* recipient token styling

* prettier

* remove anchor link to appease ci

* update snapshots

* dogs living with cats and urls don't need file extensions anymore it seems

* re-add nav + menu

* de-emphasize other user' personal colletions

* remove entity menu for create collection

* update tests

* fix description

* style column drag wrappers

* use label

* test fixup

* always visible handle

* add step to validate Liquibase migrations to CI

* addColumn should only allow one column.

* Only allow one column added per addColumn change

* Add strict-mode for change sets

* Check that migrations are in order/IDs are unique

* Fix CI

* Tests for the linter!!

* Require remarks when adding new Tables

* Fix CI

* fix issue where single row was hidden

* add another unit test extracting subtotals

* extract test data to constant

* Remove -Xverify:none since it has no effect anymore with Java >= 13

https://bugs.openjdk.java.net/browse/JDK-8214731

* Send crash reports to stderr so we can see them in CI

probably (?) want to remove this before merging

* Revert "Send crash reports to stderr so we can see them in CI"

This reverts commit 4c15d94a95ac4a75d8c4886e857d59160cd834fc.

* Use deftype not defrecord to prevent invalid bytecode

The interface org.quart.JobExecutionContext has a put method on it
https://www.quartz-scheduler.org/api/2.1.7/org/quartz/JobExecutionContext.html#put(java.lang.Object,%20java.lang.Object)
and defrecord emits a put method as well and we end up with invalid
bytecode.

https://ask.clojure.org/index.php/9943/defrecord-can-emit-invalid-bytecode



the above link will most probably result in a jira issue which would
be nice to track here but it doesn't exist yet.

Co-authored-by: dan sutton <dan@dpsutton.com>

Merge release x.37.x 2020-12-15

* Refactor common checks
* Verify the stack bars
* Ensure color options exist

The implicit "source" table alias should be a string instead of a keyword,
as the schema requires strings there. This will allow a custom expression
to work with an aggregation again.

Resolves metabase/metabase#14080

Co-authored-by: Nemanja Glumac <31325167+nemanjaglumac@users.noreply.github.com>

* Use openOrdersTable