2.0.8-release

Changelog

OpenMetadata 2.0.8 is a maintenance release that expands connector coverage and improves lineage accuracy. It strengthens Data Quality and governance workflows. It also strengthens Model Context Protocol (MCP) authentication and access controls. The release improves search, Resource Description Framework (RDF) storage operations, and upgrades. It also improves user interface (UI) reliability. Security updates cover the server, ingestion, and Airflow. They also cover MCP and frontend dependencies.

🔌 Connectors and Ingestion

This release includes the following connector and ingestion improvements:

• Deleting an ingestion pipeline could fail and leave its directed acyclic graph in Airflow #36267: Pipeline deletion now uses Airflow's supported cleanup path. It removes graph versions and cleans runs and task instances in dependency order.
• Glue Test Connection could fail on databases excluded by the pipeline filters #36574: Connection tests now probe only the databases and tables that ingestion is configured to read.
• Hex links were broken, and projects lacked detailed models and lineage #36420, #36388, #36856: Hex ingestion now builds working source links and creates data models with SQL-cell column lineage. It also ingests components, run history, and application views.
• Hex source tables linked to dashboards instead of their data models #37166: Table and column lineage now terminates at the Hex data model, including models created from query-history-only tables.
• Power BI retained stale dashboards and data models after a confirmed empty listing #36921: A complete, successful empty listing can now soft-delete entities that no longer exist while failed or incomplete listings remain protected.
• SSIS packages stored in Azure Blob Storage couldn't be configured #36917: SSIS connections now accept an Azure Data Lake Storage container in addition to Amazon S3 and local paths.
• BigQuery date-sharded tables appeared as separate physical assets #37002: An optional grouping mode now represents daily shards as one logical table while recording the physical table used for profiling and samples. Lineage and quality results also retain the physical execution source.
• Athena required a workgroup and rendered invalid table names in rule SQL #37038, #37438: The workgroup is now optional, and rule-library expressions omit the placeholder database segment from Athena table names.
• dbt tests and sources could produce incorrect results #37199, #37644: Warning results now ingest as failures. Source metadata and filtering use the physical identifier when it differs from the logical name. Tests and lineage use it as well.
• Recursive CSV imports could drop constraints, column properties, and foreign-key edges #37244: Imports at the service, database, or schema level now retain table constraints and custom properties. They also rebuild foreign-key relationships.
• Malformed quoted CSV values caused server errors #37214: Synchronous and asynchronous imports now return an aborted result with the affected line and corrective guidance.
• Sigma ingestion omitted workbook metadata, data models, and accurate lineage #37449: Nine connector improvements add data models, certification tags, and lifecycle dates. They also add workspace projects and version properties. Lineage, owner matching, and column matching are now more reliable.
• Usage ingestion could attach queries and daily counts to the wrong table identity #37492: Query lookup now uses the service hash and safely retries concurrent query creation.
• Snowflake stored-procedure scans could run without a lower bound or stop other ingestion work #37614: Procedure history is now bounded at both ends, canceled scans are split, and failures are isolated from other ingestion stages.
• MySQL-compatible connections didn't verify certificates supplied through sslConfig #37633: MySQL, Doris, and StarRocks now pass certificate files correctly to PyMySQL. Invalid SSL configurations are rejected before ingestion starts.

📊 Data Quality and Data Insights

This release includes the following Data Quality and Data Insights fixes:

• Data Insights could omit earlier snapshot days after version history was exhausted #36273: Snapshot repair now fills eligible uncovered days from the oldest retained entity version and creation evidence.
• Incident menus offered invalid transitions, and listings could fail or ignore the latest-only filter #36538, #36872: Menus now show only allowed workflow transitions. Time-series listings also preserve latest-only partitioning and correctly scope deleted test cases.
• Column tests couldn't be attached to nested fields #36874: Test cases, dimensions, and inherited tags now resolve dotted paths through nested column children.
• Data contract validation results erased owners and reviewers #37009: Result updates now reload and preserve the stored contract fields before recording the latest result.
• Restoring or recursively deleting test cases with incident history could fail or leave stale rows #37086, #37003: Restore skips time-series children that use a separate repository, while hard deletion cleans incident history after the owning transaction succeeds.
• Datetime quality bounds could be rejected or scaled incorrectly #37427: Signed values, leading zeroes, and fractional seconds now parse consistently. ISO dates and timezone offsets also parse consistently while preserving microseconds.
• Profiler columns beginning with __ or _sa_ could be omitted #37295: The profiler now maps reserved-looking names to safe, unique Python attributes without changing the source column names.

🛡️ Data Governance and Workflows

This release includes the following governance and workflow fixes:

• Negated tag rules matched assets that had a different tag and excluded untagged assets #36263: Is Not, Not In, and Is Not Set now represent the intended whole-list condition. The editor also displays negated rules saved through the API.
• Tasks could fail on deeply nested assets or stop following assets after a rename #36262: Task and domain hashes now support deeper fully qualified names, and task references follow supported renames and moves.
• Approved tasks didn't consistently behave like direct edits #36694, #36987: Applied changes now produce asset events for alerts and audit history. Resolutions also enforce the same entity and field permissions as direct changes. Tag and reassignment permissions are enforced as well.
• Task alerts configured for Owners missed the task creator and asset owners #36693: Owner recipients now include the human creator and the direct or inherited owners of the affected asset.
• Data product port selection and imports could target invalid assets or the wrong product #36984, #37019: Port pickers exclude conflicting assets and show rejection reasons. Product-page imports now validate the YAML productID instead of the display name.
• Data product updates could leave orphaned or stale relationships #37107, #37109: Asset writers lock data products before adding relationships. Validation now recognizes inherited domains, and the 2.0.8 migration repairs incorrect containment links.
• Approval workflows could open unnecessarily or remain open after all eligible votes #37068, #37650: Triggers now ignore no-op updates, show the initiating change, and cap approval or rejection thresholds at the number of eligible user assignees.
• Non-approved glossary terms could be applied through the API #37689: New tag assignments now reject glossary terms that aren't in Approved status while preserving terms already attached to an asset.
• Fresh installations showed fictional AI Governance detections as real assets #37414: Demo applications, models, and services now load only through the optional sample-data recipe. Demo lineage uses the same opt-in path. Existing demo entities aren't removed automatically.

🔗 AI Context and MCP Server

This release includes the following AI Context and MCP fixes:

• AI Context could expose knowledge through incomplete principal checks #36378, #36774: Results now authorize every knowledge item. Memory sharing also matches stored principal identifiers so a username can't inherit access from a same-named team or domain.
• Context search returned no knowledge on Elasticsearch #37041: Context tools now use the search-backend-neutral vector service for both Elasticsearch and OpenSearch.
• prompts/get rejected valid MCP tokens #36533: Prompt retrieval now reads the bearer token from the Authorization header.
• Revoked MCP access tokens remained usable #36778: Issued access tokens are now stored, bound to their client, and rejected after direct revocation or refresh-token revocation.
• MCP single sign-on callbacks could use stale credentials or accept a callback without state #36781, #36782: Callbacks now use credentials from the validated request and require the state of a pending sign-in.
• MCP login kept using an outdated authenticator after security settings changed #36780, #37206: Login and token validation now reload the current authentication provider without a server restart.
• Deleting users could deadlock MCP token cleanup on MySQL #37171: User deletion and token refresh now take locks in a consistent order.
• Large MCP requests and registration URLs had no explicit limits #37205: Registration bodies are capped at 64 KiB, MCP messages at 4 MiB after decompression, and redirect URIs at 2,048 characters.
• MCP SSO authorized registered clients without user confirmation #37674: Sign-in now presents a single-use consent page that identifies the client, account, and redirect host before issuing a code.

🔍 Search and Discovery

This release includes the following search and discovery fixes:

• Reindexing could fail with an open circuit while the search cluster remained healthy #36542: Bulk concurrency is now capped by the search connection pool, and an open circuit pauses pending batches instead of dropping them.
• Semantic search could miss topic fields or reuse stale embeddings #37642, #37679: Vector chunks now include topic schema fields. Reindexing reuses a stored vector only when its text fingerprint still matches.

🔀 Lineage

This release includes the following lineage fixes:

• Updating a table could scramble multi-column foreign-key pairings #37154: Constraint updates now preserve the ordered relationship between local and referenced columns.
• Column lineage could disappear for case differences or nested structured fields #37159, #37666: SQL lineage now preserves case-insensitive mappings and follows nested fields in STRUCT and ARRAY<STRUCT> columns.
• Lineage PNG exports were empty, page titles were generic, and saving preferences dropped unrelated settings #37168: Export now uses the active graph, titles include the entity name, and preference updates preserve the complete lineage configuration.

🔐 Authentication and Access Control

This release includes the following authentication and access-control fixes:

• Personal access tokens and bot tokens could be used to open an interactive UI session #36438: The UI now accepts only tokens from an interactive login flow and signs out API-only tokens.
• Impersonated requests could change security settings or create and restore users #36593: Security configuration, user import, and restore now reject impersonation. SCIM creation and creation of missing users reject it as well.
• Test Connection workflows could be created for services the caller couldn't edit #37016: Registered-service tests now require EditAll on the resolved service.
• User updates erased last-login and last-activity timestamps #36937: PATCH, PUT, and soft deletion now preserve both activity fields.
• Persona layouts silently fell back to defaults for users without Document access #36859: Assigned users can now read their persona's layout document without gaining access to other documents.
• SAML configuration checks couldn't validate identity providers that require signed requests #37437: Validation now signs the request when configured and surfaces the identity provider's rejection reason.

📣 Alerts and Events

This release includes the following alert fixes:

• Notify Downstream alerts didn't reach downstream owners for data-asset events #37290: Alerts now traverse lineage from the changed asset when it has no parent container.

⚙️ Platform and Operations

This release includes the following platform and operations fixes:

• Ingestion pipeline patches could deploy against a different service than the stored relationship #36910: Pipeline updates now preserve the original service before redeployment.
• Kubernetes pipeline resources ignored configured labels and annotations #37047: Ingestion, application, and automation resources now receive podLabels and podAnnotations while protecting controller identity labels.
• RDF storage could grow until the Fuseki volume filled #36660, #36661: Scheduled and low-space compaction now pause writes safely and expose storage status. They reserve configurable free space and return clear maintenance responses.
• A rolling upgrade from 1.12 could leave Quartz tables in a partially purged state #36818: The 1.13.0 migration now clears scheduler tables atomically and can repair a previously interrupted purge.

🎛️ UI

This release includes the following UI fixes:

• Block-editor suggestions could crash, and large table pages could block the main thread #37130: Suggestion updates now tolerate out-of-order callbacks, while description editors and height calculations avoid unnecessary work.
• Data Product asset cards could flicker continuously #37518: Breadcrumb auto-collapse no longer enters a resize loop in wrapping card headers.

🔒 Security

This release includes the following security updates:

• Airflow and backend authorization paths needed additional hardening #36337, #36656, #37162: Airflow 3 plugin routes now authenticate and authorize every declared action. Backend updates strengthen identity-provider validation, credentials, and sessions. Policy changes, input limits, and deletion cleanup receive additional protections.
• External and learning-resource URLs could use unsafe schemes #36815, #36934: Summary links, quick links, and Markdown output now accept only safe HTTP(S) destinations. Videos, stories, and articles apply the same restriction.
• Jackson libraries contained a critical deserialization vulnerability #36525: Jackson Databind moves to 2.18.12 and Tools Jackson to 3.1.8 for CVE-2026-110879.
• Frontend networking dependencies contained known vulnerabilities #36422, #36637: qs moves to 6.16.2, and follow-redirects moves to 1.16.2.
• The SSO dependency tree included a vulnerable JSON parser #36953: json-smart moves to 2.6.1 for CVE-2026-113602.
• The block editor used a vulnerable Tiptap major version #37042: All Tiptap packages move to 3.32.2 to address GHSA-cp6q-959q-f8rh.
• MCP dependencies required security updates #36330: MCP Core moves to 1.1.5.
• Operator images included unused PostgreSQL server and XML packages #37615: The images now retain only the PostgreSQL client library needed by ingestion and remove the unused server, client tools, and libxml2 dependency.

Full Changelog: 2.0.7...2.0.8