1.13.6-release

Changelog

OpenMetadata 1.13.6 is a maintenance release focused on connector reliability across Kafka Connect, Tableau, Snowflake, BigQuery, Athena, Airflow, Looker, Grafana, Mode and Doris, correct change events and alerting for ingestion-driven updates, access-control fixes on the follower and glossary bulk-asset endpoints, and a repair of the Data Insights data-asset charts. It also adds SQL Server synonym ingestion.

🔌 Connectors & Ingestion

• SQL Server synonyms were not ingested #31829: Synonyms are now ingested as Table.aliases, indexed for search, resolved to their canonical table when building lineage, and shown in a read-only Aliases widget.
• The ingestion bot blanked a user-curated displayName #32955: A bot PUT carrying displayName=null cleared a name curated in the UI because the deny rule never fired; updateDisplayName() is now policy-aware.
• KafkaConnect: Confluent Cloud managed connectors resolved no topics #32512: Topics are now resolved from Confluent's Telemetry API, falling back to the configured names on any failure.
• KafkaConnect: telemetry credential failures logged the same line whatever the cause #32999: The warning now distinguishes a 401 (the key must change) from a 403 (a role is missing) and carries Confluent's own error detail.
• Tableau: source tables hidden from the ingestion account produced silently empty lineage #31441: A GetSourceTables test-connection step now reports withheld source tables before an ingestion is run.
• Tableau: auto-titled mirror columns were ingested as duplicates #32301: Mirror columns are now collapsed.
• Looker: data-model lineage failed on the first run #32367: Data models are read back before the sink's bulk buffer has flushed; the stage now commits every data model before anything looks it up.
• Mode: report query metadata wasn't ingested #32533: Mode report queries are now ingested as data model metadata.
• Grafana: panels nested inside collapsed rows were skipped #31611: Collapsed-row panels are flattened before chart and lineage ingestion.
• Snowflake: query tags mutated the configured connection arguments #32481: QUERY_TAG is now applied through the driver session parameters at connection creation.
• BigQuery: multi-project ingestion with ADC or a credentials file always connected to the first project #32484: Each database iteration is now scoped to the project it is ingesting.
• Athena: assume-role credentials were never refreshed #31392: The Boto3 session is now refreshable, and conflicting session arguments are rejected.
• Doris: identifiers in generated SQL were unquoted #32443: Doris identifiers are now quoted.
• Airflow: dynamically mapped tasks produced no lineage #32578: inlets/outlets serialized inside partial_kwargs are now read when the top-level keys are empty.
• Airflow: one extra database query per DAG to read pause state #31990: DagModel.is_paused is now part of the paginated serialized-DAG query.
• Protobuf schemas whose message didn't match the topic name failed to parse #32449: Parsing falls back to the sole top-level message, keeps ambiguous schemas unresolved, and supports well-known imports.
• Spark services offered a Metadata Agent that cannot work #32478: Spark metadata is pushed by the Spark Agent, so pull-based extraction is now marked unsupported.
• Domo and Astra connection fields diverged from the password-field conventions #32545: Both are aligned, and stored connection values are restored on update.
• Column tags were dropped when a column's dataType changed #32810: Tags are now carried forward across a dataType change.

🔔 Alerts & Change Events

• Bulk entity updates wrote no change event, so Get Schema Changes alerts never fired on metadata ingestion #32350: The bulk path now captures the incremental change description, so bulk updates both alert and audit.
• A Pipeline alert filtered to Failed re-notified forever and backfilled on creation #32181: Re-ingested and historical runs no longer emit change events, and a failure that isn't the newest run in a PUT /status/bulk batch now alerts.

📊 Data Insights & Data Quality

• Data Insights summary cards counted test case results, so the card ran ahead of the breakdown beneath it #31759, #33049: Test case documents carry no entityType, inflating the card and depressing the description, owner and tier percentages; the filter now requires exists(entityType), re-shipped as guarded 1.13.6 SQL because the 1.13.5 data migration never ran.
• MSSQL: table diffs couldn't authenticate a domain account #32583: Table diffs are routed through the driver that can authenticate domain accounts.
• Doris: profiler datetime partition filters weren't Doris-compatible #32788: Adds Doris dialect compilation for DatetimeAddFn and TimestampAddFn.
• Auto-classification did nothing when sample data was disabled #32607: With no sampled fields, metadata leaf columns are now traversed so column-name recognizers still run.

🛡️ Data Governance & Access Control

• Direct users could be assigned to non-Group teams, then couldn't be removed, added through the UI, or exported #32208: Direct memberships are now rejected for Department, Division and BusinessUnit teams. Existing invalid memberships need a one-off cleanup.
• Governance workflow edge conditions and node references were interpolated unchecked into Flowable expressions #32326: Conditional-edge conditions and source nodes are validated at the create/update boundary; valid workflows are unaffected and need no redeploy.
• App endpoint permission checks didn't match the platform RBAC model #32427: App endpoints align with platform RBAC, and App patch is authorized before the entity lookup.
• Bot list responses omitted the required botUser relationship #32398: The relationship is batch-loaded for list responses, so SDK list_all_entities calls can deserialize Bot entities.

🎛️ UI

• Explore filters reverted to their previous configuration on backward navigation #31632: Under react-router v7 the pathname-less navigate({ search }) calls pushed stale search params over the fresh URL; all Explore navigations now pass an explicit pathname.
• The metric version page crashed into the error boundary #32794: UnitOfMeasurement was a type-only import, so it was erased at build time and threw at runtime; it's now imported as a value.
• The edit icon disappeared when a custom property value overflowed #32550: The icon now sits outside the value container instead of being clipped by overflow: hidden.
• Masked password fields couldn't be cleared, and didn't show that a secret was stored #32945: The masked value now renders as password dots, and clearing an optional field emits a JSON Patch remove instead of overwriting the secret with an empty string.
• The Data Product "Add Assets" picker ignored the Domain Validation rule #32336: The picker lists assets across all domains when the rule is disabled, and stays domain-scoped (failing closed) when it's enabled.

🔒 Security

• Cross-user follower changes were unrestricted #32322: Follower endpoints now reject a null userId, compare against the authenticated subject, and require admin authorization for cross-user mutations.
• Broken access control on the glossary-term bulk asset endpoints #32539: assets/add and assets/remove now authorize EDIT_GLOSSARY_TERMS on each target asset instead of bypassing the authorizer.
• stringToHTML rendered stored user content unsanitized #32949: The helper now routes through DOMPurify.sanitize(), preserving the highlight and version-diff markup callers rely on.
• The search dropdown option label was set through dangerouslySetInnerHTML #32573: The highlighted label is parsed into React nodes from a sanitized string.
• Airflow API responses leaked internal diagnostics #32849: Responses are now generic; diagnostics remain in the logs.
• Jackson → 2.18.10 / 3.1.6 for CVE-2026-83557 and CVE-2026-19032 #32798.
• Jetty → 12.1.12 for CVE-2026-19203 and CVE-2026-19204 #33015.
• @humanfs/node → 0.16.8 #32503.

Full Changelog: 1.13.5-release...1.13.6-release