1.13.5-release
Changelog
OpenMetadata 1.13.5 is a maintenance release focused on connector reliability across REST, MLflow, DB2, Glue, and KafkaConnect, search and governance correctness, UI fixes, and a broad security dependency cleanup that also raises the ingestion package's Python floor to 3.10.
🔌 Connectors & Ingestion
- Deploying an ingestion pipeline intermittently returned a 500 or timed out on Airflow 3.x #28744: Fixes a
DagContextautoregister race inbuild_dagthat caused the deploy endpoint to fail intermittently. - REST/OpenAPI: array properties with an inline object schema emitted a synthetic
item: UNKNOWNchild #32007: Expands the item's properties with their OpenMetadata types and descriptions instead. - REST/OpenAPI: API collections and endpoints could ingest out of order #31852: Persists all API collections before ingesting endpoints, so endpoints no longer reference a collection that hasn't been committed yet.
- Sorting the ingestion pipelines list by type returned a MySQL 500 error #31915: Adds server-side
displayNamesort and keyset pagination, resolving the error. - MLflow Unity Catalog model version search broke on values needing escaping #31387: Switches to a single-quoted filter for the search query.
- MLflow 3.x model signatures were not extracted and the registry listing was unpaginated #32091: Extracts 3.x model signatures and paginates the registry listing.
- Athena: missing Lake Formation grants went undetected during test connection #29515: Test connection now detects missing Lake Formation grants.
- BigQuery: table last-modified time wasn't captured #30316: Ingests each table's last-modified timestamp into
lifeCycle.updated, alongside the existing created timestamp. - DB2: sqlalchemy-ibmi dialect incompatible with SQLAlchemy 2.0 #30731: Adapts the dialect so DB2 ingestion works on SQLAlchemy 2.0.
- DB2: concurrent ingestion runs could conflict while installing the CLI driver #32154: Caches a successfully installed driver per process, serializes concurrent installs, and keeps failed installs retryable.
- Airflow: ingestion metadata was lost on API failures #31371: Prevents metadata loss when an Airflow API call fails mid-ingestion.
- Trino: unnamed and quoted ROW fields mishandled during reflection #31402: Reflection now correctly handles unnamed and quoted ROW fields.
- REST API: array-root schemas failed to parse #31698: Schemas with an array at the root now parse correctly.
- OpenLineage: Kafka SSL and password handling was missing on 1.13 #32104: Backports SSL and password handling for Kafka-backed OpenLineage events.
- Doris: unofficial driver caused ingestion issues #32164: Ingestion now uses the official pydoris driver.
- Looker: trailing slash in hostPort broke SDK URL concatenation #31761: The trailing slash is stripped before the SDK builds request URLs.
- Glue: duplicate columns caused partition keys to drop the whole table #32106: Columns are deduplicated so partition keys no longer cause a full table drop.
- Glue: a custom databaseName dropped every schema #32400: Custom
databaseNamevalues no longer wipe out schema ingestion. - Nested column metadata was lost during re-ingestion #32155: Nested column metadata now survives re-ingestion.
- KafkaConnect: topic-namespace membership was emitted as lineage #32420: Topic-namespace membership is no longer misreported as a lineage edge.
pygtrie2.6 brokeimport airflowon Python 3.10 #32431: Capspygtriebelow 2.6 so ingestion imports Airflow correctly.
📊 Data Quality
TestCaseRepository.linkedTablesCachecaused intermittent 500s #32119: Makes the cache static, stopping the intermittent errors.- Databricks profiler: remaining SQL failures #32440: Resolves the remaining SQL failures in the Databricks profiler.
- Migration: TestSuite pipelines on PostgreSQL, or MySQL with a case-sensitive collation, kept the old flat profiler sampling fields #32511: Replays the 1.13.0 migration with the correct casing, so those pipelines get the nested
profileSampleConfiglike every other deployment.
🔍 Search & Discovery
- No way to filter Explore by Data Product #32015: Adds Data Product as a top-level Explore filter.
- Search results could look stale right after a reindex reported complete #32171: A distributed reindex no longer reports success until the new index is fully promoted.
columnDescriptionStatusignored nested columns #32202: The status now recurses into nested columns.- View lineage tore an FQN (fully qualified name) component in half if it contained a dot #31483: The FQN split is now quote-aware, so a schema or table name containing a
.no longer breaks lineage resolution.
🛡️ Data Governance & Quality
- A deleted domain's assets and activity reappeared if a domain of the same name was recreated #31879: Recreating a domain with a previously used name no longer resurfaces the old domain's assets and activity.
- Glossary: system-defined relation types could be edited through the generic settings PUT #31945: Field edits to system-defined relation types are now rejected.
- Incident Manager listing didn't enforce caller policies #31936: The listing now enforces the caller's policies.
- Data Products couldn't be assigned across domains even with domain validation disabled #32237: Cross-domain Data Product assignment now works when the domain validation rule is disabled.
- User patch requests bypassed the expected permission checks #32323: Fixes user patch permission enforcement.
- Pub/Sub credentials weren't masked correctly #32391: Converts persisted Pub/Sub credentials to their generated schema classes before masking and unmasking, so they're consistently protected.
- PII scanner missed separated Aadhaar numbers #31900: Recognizes Aadhaar numbers written with separators.
- PII scanner ties among equally weighted classifications were unresolved #31961: The NER (named entity recognition) scanner now breaks weighted-score ties by confidence.
🔐 Authentication
- OIDC (OpenID Connect) login handler and MCP callback auth relied on an EOL pac4j line #32408: Upgrades pac4j and adapts the login and MCP callback handlers to its API changes.
- A Jetty version mismatch caused a runtime linkage error #32408: Aligns the Jetty dependency management to fix the mismatch.
🎛️ UI
- Some views had no loading fallback while data streamed in #31827: Backports Suspense loader fallbacks to 1.13.
- A URL with no tab segment didn't render the tab already on screen #32029: The current tab renders correctly when the URL omits the tab segment.
- Persona customization pages crashed when a page was null #32037: Null persona customization pages are now handled gracefully.
- Icons occasionally failed to render #32066: Icon rendering now reflects the actual load outcome instead of a regex pre-check.
- Classification tags didn't display configured custom icons #32232: Custom icons configured for classification tags now display correctly.
- Selected persona reset to the default on page refresh #32268: The active persona now persists across a refresh via sessionStorage.
- Math equations were silently stripped on save #32402: Preserves
<block-math-equation>nodes through both the frontend and backend sanitizers.
🔒 Security
micrometer→ 1.16.7 for CVE-2026-59296 #31926.sqlparseCVE remediated via collate-sqllineage 2.1.4 → 2.1.7, raising the ingestion package's Python floor from 3.9 to 3.10 #31896.- OpenSSL refreshed in ingestion images #32216.
pyathena→ 3.35.4 #32166.- Airflow → 3.3.1 (CVE-2026-67587 / CVE-2026-54183) and
expat→ 2.8.3 (CVE-2026-72522) #31890. - Spring → 7.0.9 for CVE-2026-47886, CVE-2026-59282, and CVE-2026-59283 #32408.
- Apache Jena and Fuseki → 6.2.0 for CVE-2026-61372 #32408.
linux-libc-devupgraded to clear kernel CVE scan findings in ingestion images #32168.httpclient5→ 5.6.4 andjsoup→ 1.23.2 #32294.fast-uri→ 3.1.6 #32386.- Reactor moved to the 2026.0 train to clear reactor-core/netty CVEs #32394.