2.1.0-rc2-release

Fixes #35913: remove tags a resolved TagUpdate leaves out (#36008) (#…

2.0.8-release

Changelog

OpenMetadata 2.0.8 is a maintenance release that expands connector coverage and improves lineage accuracy. It strengthens Data Quality and governance workflows. It also strengthens Model Context Protocol (MCP) authentication and access controls. The release improves search, Resource Description Framework (RDF) storage operations, and upgrades. It also improves user interface (UI) reliability. Security updates cover the server, ingestion, and Airflow. They also cover MCP and frontend dependencies.

🔌 Connectors and Ingestion

This release includes the following connector and ingestion improvements:

• Deleting an ingestion pipeline could fail and leave its directed acyclic graph in Airflow #36267: Pipeline deletion now uses Airflow's supported cleanup path. It removes graph versions and cleans runs and task instances in dependency order.
• Glue Test Connection could fail on databases excluded by the pipeline filters #36574: Connection tests now probe only the databases and tables that ingestion is configured to read.
• Hex links were broken, and projects lacked detailed models and lineage #36420, #36388, #36856: Hex ingestion now builds working source links and creates data models with SQL-cell column lineage. It also ingests components, run history, and application views.
• Hex source tables linked to dashboards instead of their data models #37166: Table and column lineage now terminates at the Hex data model, including models created from query-history-only tables.
• Power BI retained stale dashboards and data models after a confirmed empty listing #36921: A complete, successful empty listing can now soft-delete entities that no longer exist while failed or incomplete listings remain protected.
• SSIS packages stored in Azure Blob Storage couldn't be configured #36917: SSIS connections now accept an Azure Data Lake Storage container in addition to Amazon S3 and local paths.
• BigQuery date-sharded tables appeared as separate physical assets #37002: An optional grouping mode now represents daily shards as one logical table while recording the physical table used for profiling and samples. Lineage and quality results also retain the physical execution source.
• Athena required a workgroup and rendered invalid table names in rule SQL #37038, #37438: The workgroup is now optional, and rule-library expressions omit the placeholder database segment from Athena table names.
• dbt tests and sources could produce incorrect results #37199, #37644: Warning results now ingest as failures. Source metadata and filtering use the physical identifier when it differs from the logical name. Tests and lineage use it as well.
• Recursive CSV imports could drop constraints, column properties, and foreign-key edges #37244: Imports at the service, database, or schema level now retain table constraints and custom properties. They also rebuild foreign-key relationships.
• Malformed quoted CSV values caused server errors #37214: Synchronous and asynchronous imports now return an aborted result with the affected line and corrective guidance.
• Sigma ingestion omitted workbook metadata, data models, and accurate lineage #37449: Nine connector improvements add data models, certification tags, and lifecycle dates. They also add workspace projects and version properties. Lineage, owner matching, and column matching are now more reliable.
• Usage ingestion could attach queries and daily counts to the wrong table identity #37492: Query lookup now uses the service hash and safely retries concurrent query creation.
• Snowflake stored-procedure scans could run without a lower bound or stop other ingestion work #37614: Procedure history is now bounded at both ends, canceled scans are split, and failures are isolated from other ingestion stages.
• MySQL-compatible connections didn't verify certificates supplied through sslConfig #37633: MySQL, Doris, and StarRocks now pass certificate files correctly to PyMySQL. Invalid SSL configurations are rejected before ingestion starts.

📊 Data Quality and Data Insights

This release includes the following Data Quality and Data Insights fixes:

• Data Insights could omit earlier snapshot days after version history was exhausted #36273: Snapshot repair now fills eligible uncovered days from the oldest retained entity version and creation evidence.
• Incident menus offered invalid transitions, and listings could fail or ignore the latest-only filter #36538, #36872: Menus now show only allowed workflow transitions. Time-series listings also preserve latest-only partitioning and correctly scope deleted test cases.
• Column tests couldn't be attached to nested fields #36874: Test cases, dimensions, and inherited tags now resolve dotted paths through nested column children.
• Data contract validation results erased owners and reviewers #37009: Result updates now reload and preserve the stored contract fields before recording the latest result.
• Restoring or recursively deleting test cases with incident history could fail or leave stale rows #37086, #37003: Restore skips time-series children that use a separate repository, while hard deletion cleans incident history after the owning transaction succeeds.
• Datetime quality bounds could be rejected or scaled incorrectly #37427: Signed values, leading zeroes, and fractional seconds now parse consistently. ISO dates and timezone offsets also parse consistently while preserving microseconds.
• Profiler columns beginning with __ or _sa_ could be omitted #37295: The profiler now maps reserved-looking names to safe, unique Python attributes without changing the source column names.

🛡️ Data Governance and Workflows

This release includes the following governance and workflow fixes:

• Negated tag rules matched assets that had a different tag and excluded untagged assets #36263: Is Not, Not In, and Is Not Set now represent the intended whole-list condition. The editor also displays negated rules saved through the API.
• Tasks could fail on deeply nested assets or stop following assets after a rename #36262: Task and domain hashes now support deeper fully qualified names, and task references follow supported renames and moves.
• Approved tasks didn't consistently behave like direct edits #36694, #36987: Applied changes now produce asset events for alerts and audit history. Resolutions also enforce the same entity and field permissions as direct changes. Tag and reassignment permissions are enforced as well.
• Task alerts configured for Owners missed the task creator and asset owners #36693: Owner recipients now include the human creator and the direct or inherited owners of the affected asset.
• Data product port selection and imports could target invalid assets or the wrong product #36984, #37019: Port pickers exclude conflicting assets and show rejection reasons. Product-page imports now validate the YAML productID instead of the display name.
• Data product updates could leave orphaned or stale relationships #37107, #37109: Asset writers lock data products before adding relationships. Validation now recognizes inherited domains, and the 2.0.8 migration repairs incorrect containment links.
• Approval workflows could open unnecessarily or remain open after all eligible votes #37068, #37650: Triggers now ignore no-op updates, show the initiating change, and cap approval or rejection thresholds at the number of eligible user assignees.
• **Non-approved glossary terms c...

2.1.0-rc1-release

Settings modal dark mode: muted cards, tables and form hints (#36311)…

2.0.7-release

Changelog

OpenMetadata 2.0.7 is a maintenance release that improves connector reliability and search consistency. It also strengthens governance workflows and access controls. The release fixes user interface (UI) issues across activity feeds, bulk editing, lineage, and intake forms. It also includes security updates for server, ingestion, and frontend dependencies.

🔌 Connectors and Ingestion

This release includes the following connector and ingestion fixes:

• Google Cloud Pub/Sub test connections ignored service account impersonation #35831: Publisher, subscriber, and schema clients now use the configured impersonated identity instead of falling back to application default credentials.
• Microsoft SQL Server connection tests could time out on large schemas #35906: Table and view checks now use limited catalog probes instead of sorting the entire catalog.
• Unity Catalog lineage dropped upstream tables ingested under another service #35919: Cross-database lineage now searches configured services in order and reports unresolved upstream assets as warnings.
• Hex lineage appeared as manually created lineage #35946: Hex table-to-dashboard edges now record DashboardLineage as their source.
• dbt Cloud test results were missing when dbt test wasn't the final run step #35947: Ingestion now reads run_results.json from every run step and keeps the latest result for each test.
• Power BI reports were ingested without their pages #36062: Each report page is now ingested as a chart under its report without requiring an additional API request.
• Tableau ingestion could delete data models while the Metadata API was rebuilding #36067: Runs that reconcile data models now stop safely during a Tableau backfill instead of treating partial results as deleted data.
• Power BI BigQuery lineage failed when SQL contained comment markers inside strings #36232: Native-query extraction now preserves SQL literals, line breaks, and comments for accurate parsing.
• IOMETE and Teradata installations could resolve incompatible drivers #36243: Dependency ranges now select compatible Apache Arrow Database Connectivity (ADBC) versions by Python version and updated Teradata drivers.
• Auto-classification could fail while loading the English language model #36177: Ingestion now avoids the preshed release that causes tokenizer hash overflows.
• Doris operator images included unused MariaDB libraries with known vulnerabilities #36052: Doris now uses PyMySQL, allowing unused native libraries to be removed from operator images.

🛡️ Data Governance and Access Control

This release includes the following governance and access-control fixes:

• Domain-scoped policies allowed assets to be moved into unauthorized domains #35798: Domain changes now validate access to the destination domain and reject unauthorized moves with a clear 403 response.
• Users could assign domains to themselves without administrator approval #35846: Only administrators can now add or change a user's domains.
• Soft-deleting a user permanently removed their metadata tasks #35964: Soft deletion now preserves tasks so they remain available if the user is restored.
• The Updated by workflow rule saved display names and never matched entities #36056: The rule now displays a person's display name while saving the account name used by entity updates.
• Governance workflow history could become slow and grow without a retention limit #36059: Indexed lookups improve run-history reads, and a configurable retention period removes eligible completed runs while preserving active and latest runs.
• Bulk glossary term creation skipped per-term authorization #36071: Every term is now checked for limits and CREATE permission before any terms are written.
• Automation updates could overwrite their original execution inputs #36212: PUT and PATCH updates now preserve the saved request and workflow type while continuing to update status, response, and description.

🔍 Search and Discovery

This release includes the following search fixes:

• OpenSearch vector indexes could fail with already_closed_exception while the cluster appeared healthy #36208: Recreated indexes now store vectors in _source, avoiding closed derived-source readers during searches and embedding updates.
• Search results could retain stale metadata after entity changes #36255: Entity writes and recursive operations now refresh affected search documents. Renames and moves also refresh copied tags, labels, references, and team memberships.

🔗 MCP Server and Authentication

This release includes the following Model Context Protocol (MCP) server and authentication fixes:

• MCP claim mappings failed when a source claim name contained a colon #36213: OAuth claim mappings now parse colon-containing claim names without silently dropping them.
• MCP OAuth failed when OpenMetadata used a non-root BASE_PATH #36224: MCP routes and login forms now respect the configured context path. Base URLs and OpenID discovery use the same path.
• Requests outside Jersey could reuse cached identity state from an earlier request #36222: A request cleanup filter now clears entity and security contexts before and after MCP, WebSocket, and single sign-on requests.
• Impersonated requests could reach credential endpoints through alternate URL forms #36233: Restrictions now bind to the routed resource method and block impersonated credential creation or privilege grants.

⚙️ Platform and Operations

This release includes the following platform fixes:

• Profiler settings could be overwritten when the saved configuration failed to load #36091: The Save action now remains unavailable until the stored configuration loads successfully.
• Pipeline summary filters could expose unauthorized results or mishandle quoted values #36133: Summary endpoints now enforce view permissions and bind filter values instead of interpolating them into SQL.

🎛️ UI and Lineage

This release includes the following UI and lineage fixes:

• Activity feed items hid the column and field that a conversation referenced #35859: Feed cards now show a field path after the entity name, including nested columns.
• Map fields in agent forms were difficult to read and could submit untouched rows #35895: Map entries now appear as aligned key-value rows with accessible labels, and unused rows are removed on submission.
• Bulk edit interactions were unreliable #36116: The grid now supports selecting text and copying or pasting tags. Search also finds values consistently.
• Temporary table lineage nodes showed empty breadcrumbs and uneven spacing #36239: Temporary nodes now omit empty breadcrumbs and center their labels.
• Intake form table headings didn't align with their fields #36304: Header widths now apply to the correct layout elements so every heading lines up with its column.

🔒 Security

This release includes the following security updates:

• Frontend networking and Markdown dependencies contained known vulnerabilities #35873: qs and fast-uri move to patched versions. follow-redirects and markdown-it are also updated.
• Server dependencies contained authentication and configuration vulnerabilities #35885: Jetty moves to 12.1.14 and Logback to 1.5.38. Avatica moves to 1.29.0.
• UI build and runtime dependencies contained known vulnerabilities #35976, #36110, #36201: Vite, PostCSS Selector Parser, and Storybook receive patched versions. DOMPurify, Undici, and Serialize JavaScript are also updated.
• Ingestion Python packages required security and compatibility updates [#36078](https://github.com/open-m...

2.0.6-release

Changelog

OpenMetadata 2.0.6 is a maintenance release that makes metadata ingestion more accurate, upgrades safer, and Data Quality results easier to trust. It improves search, lineage, governance workflows, sign-in and role synchronization, while fixing several navigation and product-tour issues in the user interface (UI). The release also strengthens multi-pod deployments and addresses security vulnerabilities in application dependencies and content handling.

🔌 Connectors and Ingestion

This release includes the following connector and ingestion fixes:

• CockroachDB partition details could be incomplete or duplicated #34894: Tables with multiple partition columns now show the correct columns, without duplicates or values accidentally taken from a similarly named table in another database.
• Some dbt snapshot lineage links were missing #34930: Ingestion now keeps the upstream table it already found and uses that exact table when creating lineage, avoiding failed second lookups.
• Omni dashboards could be ingested without their owners or lineage #35259: Omni ingestion now connects dashboards to the correct owners and upstream data assets.
• Teradata query usage and lineage were missing #35258: The connector now reads Teradata's database query log (DBQL) to show which tables are used and how data moves between them.
• Auto-classification ignored sample budgets above 50 rows #35492: SQL and NoSQL samplers now honor configured budgets up to 1,000 rows while continuing to store at most 50 sample rows.
• dbt manifest catalogs didn't match their OpenMetadata databases #35599: A new catalogMapping option resolves tables and compiled-SQL lineage when engine catalogs and ingested database names differ.
• MySQL and MariaDB views disappeared when the ingestion user lacked SELECT #35619: View columns fall back to information_schema when DESCRIBE is denied, allowing metadata-only ingestion with SHOW VIEW and REFERENCES privileges.
• Athena views were duplicated or ingested when includeViews was disabled #35600: Athena now emits each view once and respects the view-ingestion setting.
• Athena could mix unrelated query history or lose Iceberg type details #35699: Query history is now limited to the right catalog and workgroup, lineage is rebuilt from the correct statements, and Iceberg column types are preserved.
• AWS Glue could omit view definitions and external-table lineage #35607: Glue ingestion now captures view SQL, Iceberg columns, decimal precision, and lineage from external tables accurately.
• Test Connection hid the invalid configuration field behind a generic conversion error #35708: Validation errors now identify the field that needs correction.
• Force sync didn't refresh custom properties supplied by a connector #35707: A force-sync run can now replace connector-managed custom-property values.

📊 Data Quality

This release includes the following data quality fixes:

• Data Quality runs could report success even when tests never completed #34848: Tests aborted by connection failures, unsupported SQL, or calculation errors now count as execution failures, making the workflow status and success percentage trustworthy.
• Quality rules imported with an Open Data Contract were saved but never run #34176: Supported Open Data Contract Standard (ODCS) rules now create linked OpenMetadata test cases that run during contract validation and remain intact across imports and exports.
• Range and boolean checks could report the wrong number of failed rows #35276: Data Quality tests now evaluate open-ended ranges and true/false value sets correctly, and clearly abort when the configured column no longer exists.

🛡️ Data Governance and Quality

This release includes the following governance and data quality fixes:

• Automatically detected sensitive-data tags could show the wrong reason #35206: Each tag now identifies the detector that produced the strongest match and shows only the patterns that detector matched.
• The Mentions task view could fail with a server error #35216: Mention filtering now reads the correct task reference and works for usernames containing dots on MySQL and PostgreSQL.
• Glossary searches lost matching terms whose parents didn't match #35287: Search results now retain the parent hierarchy for every matching glossary term.
• Nested glossary search matches stayed collapsed in the term picker #34955: The picker now expands the hierarchy needed to reveal matched terms.
• Glossary import help failed to load, and some valid approvals left terms stuck in review #35302: The import page now shows the correct CSV guidance, and approvals from authorized administrators or owners update the term while direct edits still require reviewer permission.
• Data contracts were difficult to find and didn't fully appear on their assets #35709: Contract links now open the owning asset, tables inherit approved contracts from their schema, and contract changes appear in the asset's activity feed and notifications.
• Glossary CSV re-import failed when related terms were in the same file #35739: Dry runs and imports now resolve new and existing related terms without looking up unpersisted placeholder identifiers.

🔍 Search and Discovery

This release includes the following search fixes:

• A reindex stop request could be lost before the job started #35186: Reindex jobs now honor stop requests that arrive during startup.
• Hybrid search could appear healthy without successfully running a query #35325: The health check now runs an actual search instead of only inspecting the saved configuration.
• Negative search pagination reached the engine and returned a server error #35302: Search endpoints reject negative offsets and sizes with a clear 400 response, and the UI no longer sends them.
• Malformed search input surfaced as a server error #35440: Invalid queries are now handled as client errors instead of internal failures.
• Searches against unmanaged indexes returned an internal error #35517: Requests for indexes outside OpenMetadata's index set now return a clear 400 response.

🔀 Lineage

This release includes the following lineage fixes:

• Deleting a pipeline made its lineage edges unwritable #35315: Lineage edges remain editable after their associated pipeline is deleted.

🔐 Authentication

This release includes the following authentication fixes:

• Single sign-on failed when an identity provider used a custom username claim #34968: OpenMetadata session tokens now include the mapped username and email values, preventing repeated 401 Invalid JWT token responses after sign-in.
• Removing a user's final identity-provider role didn't remove their OpenMetadata access #35353: A fresh sign-in now removes roles and administrator access that the provider no longer grants, while accounts explicitly configured as administrators remain protected.
• Redis Cluster deployments could fail during sign-in or cache updates #35673: Session and cache operations now group keys in a Redis-compatible way, preventing CROSSSLOT errors in clustered environments.

⚙️ Platform

This release includes the following platform fixes:

• Upgrades could run pending migration steps in the wrong order #34943: Migrations now follow one version sequence and inspect only the connected database, making upgrades more predictable in environments with multiple databases.
• The packaged operations script wasn't executable #34999: Distributions now ship bootstrap/openmetadata-ops.sh with executable permissions.
• Git workflow failures could leave a run without a clear failed status #35239: Workflow runs now report unhandled Git sink errors, recover failed batches more safely, reject invalid Git triggers, ...

2.0.5-release

Changelog

OpenMetadata 2.0.5 is a maintenance release focused on connector and lineage reliability. It restores metadata affected by 2.0 ingestion regressions and protects user-managed metadata during bot ingestion. It also improves several user interface (UI) paths and updates Jackson dependencies for two security vulnerabilities.

🔌 Connectors and Ingestion

This release includes the following connector and ingestion fixes:

• Redshift datashare databases on consumer clusters weren't ingested #34381: The connector now identifies non-local databases and reads their schemas and tables through Redshift's cross-database catalog views. It also reads their columns and descriptions.
• Oracle foreign-key constraints disappeared when identifier casing differed #34415: Referred table names now keep the database's original casing, so OpenMetadata can resolve and ingest the constraints.
• Mode report queries omitted columns, column lineage, and owners #34733: Mode ingestion now extracts query columns, builds column-level lineage, and assigns report creators as owners when their email matches an OpenMetadata user.

🔀 Lineage

This release includes the following lineage fixes:

• Databricks dropped lineage through jobs when reads and writes appeared in separate records #34732: Databricks now preserves lineage when a job reads and writes tables in separate query-history records.
• Entity-relationship diagrams reversed foreign-key cardinality #34812: The diagrams now show the correct one-to-many relationship for foreign keys after reindexing.

🛡️ Data Governance and Quality

This release includes the following governance and data quality fixes:

• Upgrading from OpenMetadata 2.0 could remove ingestion-managed metadata #34836: The 2.0.5 migration restores affected descriptions, display names, and retention periods. It also restores table constraints and tags. Ingestion bots now preserve existing descriptions when a source provides an empty value.
• Bot ingestion overwrote user-managed tags, owners, and retention periods #34792: Bot ingestion now preserves user-managed tags that aren't supplied by the source. It also keeps user-assigned owners and retention periods unless an explicit override reassigns the owners.

🎛️ UI

This release includes the following UI fixes:

• The sign-in page loaded its decorative video before the application loaded #34801: The video now starts after the application loads and remains disabled for people who prefer reduced motion.
• Long glossary term names were clipped in the picker #34887: Picker rows now fit the dropdown width and show the full term name in a tooltip when truncated.
• Custom properties with one entity reference didn't render #34891: The UI now renders these custom properties when the application programming interface (API) returns one entity reference as an object instead of a list.

🔒 Security

Jackson dependencies contained resource-exhaustion vulnerabilities #34004: OpenMetadata updates Jackson 2.x to 2.18.11 and Jackson 3.x to 3.1.7 to address CVE-2026-89425 and CVE-2026-91777.

Full Changelog: 2.0.4...2.0.5

2.0.4-release

Changelog

OpenMetadata 2.0.4 is a maintenance release focused on connector reliability across AWS Glue, Snowflake, SQL Server, and Datalake, correctness fixes in search scoping and Explore counts, data quality and profiler fixes, and a safer bot bulk-import path.

🔌 Connectors & Ingestion

• AWS Glue: table parameters weren't captured #34269: Glue table parameters are now ingested as custom properties.
• SQL Server: table synonyms weren't ingested #33415: SQL Server synonyms are now ingested as table aliases and allowed through the entity patch.
• Snowflake: the overflow retry skipped subclassed sum, mean, and standard-deviation metrics #34396: The overflow-retry fallback now keeps subclassed Sum, Mean, and StdDev metrics instead of dropping them.
• Datalake: MF4 file reads failed after a canmatrix update #34419: Pins canmatrix below 1.3 so asammdf imports again and MF4 reads work.
• Ingestion could break under SQLAlchemy 2.1 #34259: Caps SQLAlchemy below 2.1 to keep ingestion working.

📊 Data Quality

• A test case's status followed the last result written or deleted, not the newest one #34285: A late older result, or deleting the newest result, could overwrite the status and even auto-resolve a newer failure's incident. Status now always reflects the newest result.
• The Test Definition "Supported Services" picker listed the Dbt and QueryLog pseudo-types #34624: These have no connection schema, so a test definition restricted to one silently vanished from the Add Test Case picker. Both are now filtered out.
• Setting a 0% profile sample silently discarded the Profiler Settings config #34625: A 0% or 0-row sample saved nothing while still showing a success toast, and a stored 0 would force a full-table scan. A non-zero sample is now required.

🔀 Lineage

• Upstream data quality failures were missed once an instance had more than 100 test cases #34286: The upstream-failure check kept only the 100 busiest test cases before filtering, dropping failing upstream tables. It now uses one exact, batched lookup on the test case index.

🔍 Search & Discovery

• Searches ran against the whole cluster instead of the tenant's alias #33893: Search requests now scope to the cluster alias, so a search role confined to its own <clusterAlias>* prefix is no longer denied with a 403.
• Plain-text natural-language query (NLQ) and aggregate searches were slow and over-broad #34393: The NLQ keyword fallback and aggregate text now go through the search builder with a field list, instead of an unscoped query_string across every index field.
• Explore tab counts didn't match the result rows #34398: Counts could include fuzzy-only matches absent from the rows. They now use the same authorized, configured matching as each tab, and each tab renders as soon as its own request finishes.
• Data Marketplace list search was off-centre and keyword-only #34252: The Data Marketplace list search is now centred and supports natural-language search.

📈 Data Insights

• Data Insights summary cards and asset charts counted test case results #33415: Summary cards no longer count test case results, and the data asset charts are re-scoped in SQL.

🛡️ Data Governance & Quality

• Approving a tier change left an asset with two mutually exclusive tiers #34288: A tier approval now replaces the existing tier through the normal entity patch, increments the version, and records the tag change.

🎛️ UI

• Personas had no default landing page #34312: Adds persona General Preferences with a configurable default landing page.
• What's New showed a raw version, and opening an asset from an Assets tab card lost the breadcrumb #34685: What's New now shows a human-readable version and release date, and the full breadcrumb is kept when opening an asset from an Assets tab card.

📣 Alerts & Events

• Testing an alert with only unconfigured destinations returned a 400 error #34626: Clicking Test Destinations when every external destination is unconfigured now skips the request instead of sending an empty destination list.

⚙️ Platform & Operations

• Data Retention deleted charts that no dashboard used #34105: Data Retention no longer removes charts that aren't referenced by any dashboard.
• Elasticsearch request compression wasn't configurable #34635: Adds a requestCompressionEnabled setting on the Elasticsearch configuration.
• Bot bulk imports blanked fields the source didn't send #34671: With overrideMetadata=true, a bot bulk PUT no longer blanks a stored description or displayName it doesn't send, and tableConstraints are preserved when the bot sends none.

Full Changelog: 2.0.3...2.0.4

2.0.3-release

Changelog

OpenMetadata 2.0.3 is a maintenance release focused on connector reliability across Snowflake, BigQuery, MSSQL, Tableau, Looker, and DynamoDB, two data-integrity migrations, several security fixes including a certificate-verification bypass and a SQL-injection fix, and correctness fixes across search, lineage, and data quality.

🔌 Connectors & Ingestion

• Airflow: pipelines showed a stale run instead of the latest one #33153: Pipeline status now selects the latest run correctly.
• Unity Catalog: reading lineage and its SQL required two separate queries #33141: Native lineage and its SQL are now read together in one streamed query.
• Unity Catalog: path-based lineage to external tables didn't resolve #32565: Path-based lineage to external tables now resolves correctly.
• Mode: report discovery pagination could stop before reaching the last page #33189: Fixes the pagination termination condition, so reports past the first page are no longer missed.
• Looker: lineage and project filtering were incomplete #32531: Improves both lineage resolution and project filtering.
• REST: OpenAPI Path Item fields weren't handled #32958: Path Item-level fields are now parsed correctly.
• DynamoDB: no way to see a table's primary key #33207: Extracts the partition key and sort key as the primary key.
• PostgreSQL and Greenplum: materialized views weren't ingested #31549: Materialized views are now included.
• dbt: 1.12+ inline metric specs failed to ingest #33535: Falls back to type_params.expr for dbt 1.12+ inline metric specs.
• MSSQL: descriptions were read from the wrong database, encryption wasn't honored per driver, and query timeouts were unbounded #32574: All three are fixed.
• Snowflake: the semantic catalog cache collided across databases sharing a schema name #33926: The cache is now keyed by database, not schema alone.
• BigQuery: auto-detected partition windows could silently return empty samples #33221: Widens the auto-detected partition window to avoid silent empty samples.
• Tableau: filtered-out workbooks still triggered API calls, and some workbooks threw null dataLength errors #33609: Filtered workbooks are now skipped before the API call, and the null dataLength errors are fixed.
• Snowflake: procedure bodies and quoted tag values weren't read correctly #34146: Reads the DESC PROCEDURE body property and skips quoted tag values.
• A batch of deferred foreign keys targeting the same table could overwrite each other #34099: Deferred FKs are now grouped by target table before being applied.

📊 Data Quality

• Data Quality chart widgets showed stale responses #33186: Stale responses are now ignored in favor of the latest request.
• Test Suites pagination wasn't reset when the search or owner filter changed #33467: Pagination now resets to page one on filter changes.
• Test case and data contract scoping filters didn't resolve what they claimed to scope by #33393: The filters now resolve correctly against their stated scope.
• A logical test suite's search docs could be dropped when recreated by upsert #33498: Search docs now stay intact across an upsert-triggered recreate.
• The test-case picker's infinite scroll stalled on scaled displays #33708: Infinite scroll now works correctly at non-default display scaling.
• A test suite pipeline's entityFullyQualifiedName didn't point at its table #33839: The pipeline now points at the correct table.
• "Select all" on a filtered bundle suite added every test, not just the filtered subset #34047: "Select all" now adds only the filtered subset.
• Table diff memory usage was unbounded on large diffs #33985: Table diff now keeps memory usage bounded on large diffs.

🔍 Search & Discovery

• A collection-mutating Painless script could fail on missing fields #33788: The script now guards against missing fields.
• Bulk pipeline status updates dropped relationship fields from the search doc #34046: Relationship fields are now preserved on bulk status updates.
• A lineage operation waited on a global write queue instead of its own edge #33606: The operation now waits on the specific projected edge instead of the global queue.
• Adding or updating lineage could throw a script exception #33449: Fixes the script exception in the add/update lineage path.

🛡️ Data Governance & Quality

• Bot impersonation restrictions had gaps #32353: Hardens impersonation restriction filtering, closing a privilege-escalation path in workflow triggers and user import.
• PII (Personally Identifiable Information) classification averaged recognizer scores across the sample instead of taking the strongest match #32153: Uses the maximum recognizer score instead of a sample-size average.
• PII classification didn't corroborate spaCy's named-entity results #33720: spaCy named entities are now corroborated for more accurate classification.
• Users could be added to a team that disallows joining #33423: The joinable-team check now applies to both user creation and update.
• Data Product ports were keyed by request index instead of entity ID #32939: Ports are now keyed by entity ID, preventing mismatches.
• Incident Manager permissions were coupled to Test Case Edit permissions #32074: The two permission sets are now decoupled.
• Any user could PATCH another user's profile #34095: PATCHing another user now requires EditAll.
• ODPS (Open Data Product Specification) import keyed Data Product identity on display name instead of product ID #34193: Identity is now keyed on productID, preventing duplicate or mismatched imports on rename.
• ODPS import didn't resolve the tag source, so glossary terms failed to attach #34191: The tag source now resolves correctly, so glossary terms attach as expected.
• The Data Completeness field picker didn't send custom properties correctly #33836: Custom properties are now sent as extension.<name>.
• Migration: a stale L1 cache could drop the DataConsumerPolicy CreateTask rule #33763: Repairs the rule where it was dropped.
• hashlib.md5 calls blocked FIPS (Federal Information Processing Standards) mode deployments #33261: Adds usedforsecurity=False to every hashlib.md5 call for FIPS compatibility.
• Task form filter values were interpolated directly into generated SQL #34107: Filter values are now bound as named parameters, separate from the generated SQL.
• verify_ssl=True actually disabled certificate verification in the SDK #34016: verify_ssl=True now enables certificate verification as expected.
• Rule Library SQL expressions executed without a sandbox #34015: SQL expressions now render inside a Jinja sandbox.
• PATCHing a Table could lose schemaDefinition and drop tablePartition #34053: Both are now preserved across a PATCH.

🔐 Authentication

• LDAP (Lightweight Directory Access Protocol) login could wipe a user's team memberships and persona #33733: Loads the full user record on login instead of a partial one, so teams and personas are no longer dropped.
• A regenerated SCIM (System for Cross-domain Identity Management) token's "Created On" date didn't update [#33828](https://git...

2.0.2-release

Changelog

OpenMetadata 2.0.2 is a maintenance release focused on connector reliability across Oracle, Databricks, Snowflake, BigQuery, Clickhouse, KafkaConnect, Grafana, and StarRocks, MCP tool consolidation and hardening, a governance rollout that restricts direct team membership to Group teams, several XSS and access-control fixes, and a broad security dependency cleanup.

🔌 Connectors & Ingestion

• REST/OpenAPI: array properties with an inline object schema emitted a synthetic item: UNKNOWN child #32007: Expands the item's properties with their OpenMetadata types and descriptions instead.
• REST/OpenAPI: API collections and endpoints could ingest out of order #31852: Persists all API collections before ingesting endpoints, so endpoints no longer reference a collection that hasn't been committed yet.
• KafkaConnect: topic-namespace membership was emitted as lineage #32207: Topic-namespace membership is no longer misreported as a lineage edge.
• KafkaConnect: Confluent Cloud managed connectors resolved no topics, and telemetry credential failures logged the same line whatever the cause #32512, #32999: Topics are now resolved from Confluent's Telemetry API, and the warning distinguishes a 401 from a 403 with Confluent's own error detail.
• pygtrie 2.6 broke import airflow on Python 3.10 #32378: Caps pygtrie below 2.6 so ingestion imports Airflow correctly.
• Databricks: SQL-defined DLT pipelines had no lineage extracted #31654: Lineage is now extracted from SQL-defined DLT pipelines.
• Databricks: Unity Catalog access rows incorrectly linked a table to itself #32214: Legitimate access-not-derivation rows (a streaming or CDC write touching its own target table) no longer create a self-referencing lineage edge.
• Databricks: large workspaces failed to ingest all jobs #33204: Jobs are now paginated by token, so large workspaces ingest in full.
• Clickhouse: materialized views had no downstream lineage #32314: Downstream lineage is now created for materialized views.
• Oracle: query history failed with ORA-00933 on Oracle 11g #32310: Query history now works against Oracle 11g.
• Oracle: CHAR length semantics were lost in the reflected column type #32306: CHAR length semantics are now preserved during reflection.
• Athena: assume-role credentials were never refreshed #32853: Assume-role credentials now refresh correctly.
• Snowflake: query tags mutated the configured connection arguments #32481: QUERY_TAG is now applied through the driver session parameters at connection creation.
• BigQuery: multi-project ingestion with ADC or a credentials file always connected to the first project #32846: Each database iteration is now scoped to the project it is ingesting.
• Doris: identifiers in generated SQL were unquoted #32443: Doris identifiers are now quoted.
• Grafana: panels nested inside collapsed rows were skipped #32825: Collapsed-row panels are flattened before chart and lineage ingestion.
• Airflow: dynamically mapped tasks produced no lineage #32818: inlets/outlets serialized inside partial_kwargs are now read when the top-level keys are empty.
• Protobuf schemas whose message didn't match the topic name failed to parse #32449: Parsing falls back to the sole top-level message, keeps ambiguous schemas unresolved, and supports well-known imports.
• Domo and Astra connection fields diverged from the password-field conventions #32545: Both are aligned, and stored connection values are restored on update.
• Kubernetes ingestion pipelines couldn't decrypt the ingestion-bot JWT token #32708: The token is now correctly deserialized and decrypted.
• A bad SERVICE_TYPE_REF lookup result went unvalidated #32739: The result is now validated in get_reference_type_from_service_type.
• The Kubernetes exit handler could match its own pod as the main pod #32743: The exit handler no longer matches itself.
• Looker: data-model lineage failed on the first run #32367: The sink's bulk buffer is now flushed before anything looks up a data model.
• Tableau: auto-titled mirror columns were ingested as duplicates #32301: Mirror columns are now collapsed.
• Spark services offered a Metadata Agent that cannot work #32834: Spark metadata is pushed by the Spark Agent, so pull-based extraction is now marked unsupported.
• StarRocks: lineage builds produced unresolvable FQNs #32543: FQNs now resolve correctly during lineage builds.

📊 Data Quality

• Databricks profiler: remaining SQL failures #32441: Resolves the remaining SQL failures in the Databricks profiler.
• The test case picker didn't handle request failures #32514: Request failures in the test case picker are now handled gracefully.
• No way to soft delete and restore test cases #32349: Adds UI support for soft deleting and restoring test cases.
• BigQuery: STRUCT profiler columns weren't attached #32549: STRUCT profiler columns are now attached correctly.
• Doris: profiler datetime partition filters weren't Doris-compatible #32788: Adds Doris dialect compilation for DatetimeAddFn and TimestampAddFn.
• Data Insights showed wrong numbers with no error, and one chart path returned a 500 #32115: Declares each data asset type once instead of in three separate places, fixing four silently-wrong metrics and the 500.
• Sample-data validation timeout wasn't forwarded across docker exec #31710: The configured timeout now propagates correctly.
• Contracts: qualityScore came back NaN when every referenced test was soft-deleted #32750: qualityScore no longer breaks when referenced tests are soft-deleted.
• The contract status badge didn't reflect the actual status #32964: The badge is now driven off the actual contract status.
• TestSuiteDetailsPage showed no error state on fetch failure #32746: A fetch failure now renders an error state instead of a blank page.
• Profiler partitioning was built from stale form state #33117: Partitioning is now built from the current form values.
• Auto-classification did nothing when sample data was disabled #32607: With no sampled fields, metadata leaf columns are now traversed so column-name recognizers still run.
• Test Cases pagination wasn't reset when search or filters changed #33335: Pagination now resets to page one on search or filter changes.

🔍 Search & Discovery

• name.keyword wasn't exposed, and removed search fields couldn't be re-added #32369: name.keyword is now exposed, and removed search fields can be re-added.
• Embedding token usage was discarded instead of reported #32552: Embedding token usage is now reported.
• Semantic search embedded ElasticSearch queries as documents instead of queries #32553: Queries are now embedded as queries, improving semantic search relevance.
• A single-writer reindex pipeline was needed for RDF #33098: Backports a single-writer RDF reindex pipeline to prevent concurrent-write conflicts.
• Ranking could throw an NPE on Lucene 10 when a segment had zero matches #33292: script_score now guards against zero-match segments.

🛡️ Data Governance & Quality

• **Governance work...

1.13.6-release

Changelog

OpenMetadata 1.13.6 is a maintenance release focused on connector reliability across Kafka Connect, Tableau, Snowflake, BigQuery, Athena, Airflow, Looker, Grafana, Mode and Doris, correct change events and alerting for ingestion-driven updates, access-control fixes on the follower and glossary bulk-asset endpoints, and a repair of the Data Insights data-asset charts. It also adds SQL Server synonym ingestion.

🔌 Connectors & Ingestion

• SQL Server synonyms were not ingested #31829: Synonyms are now ingested as Table.aliases, indexed for search, resolved to their canonical table when building lineage, and shown in a read-only Aliases widget.
• The ingestion bot blanked a user-curated displayName #32955: A bot PUT carrying displayName=null cleared a name curated in the UI because the deny rule never fired; updateDisplayName() is now policy-aware.
• KafkaConnect: Confluent Cloud managed connectors resolved no topics #32512: Topics are now resolved from Confluent's Telemetry API, falling back to the configured names on any failure.
• KafkaConnect: telemetry credential failures logged the same line whatever the cause #32999: The warning now distinguishes a 401 (the key must change) from a 403 (a role is missing) and carries Confluent's own error detail.
• Tableau: source tables hidden from the ingestion account produced silently empty lineage #31441: A GetSourceTables test-connection step now reports withheld source tables before an ingestion is run.
• Tableau: auto-titled mirror columns were ingested as duplicates #32301: Mirror columns are now collapsed.
• Looker: data-model lineage failed on the first run #32367: Data models are read back before the sink's bulk buffer has flushed; the stage now commits every data model before anything looks it up.
• Mode: report query metadata wasn't ingested #32533: Mode report queries are now ingested as data model metadata.
• Grafana: panels nested inside collapsed rows were skipped #31611: Collapsed-row panels are flattened before chart and lineage ingestion.
• Snowflake: query tags mutated the configured connection arguments #32481: QUERY_TAG is now applied through the driver session parameters at connection creation.
• BigQuery: multi-project ingestion with ADC or a credentials file always connected to the first project #32484: Each database iteration is now scoped to the project it is ingesting.
• Athena: assume-role credentials were never refreshed #31392: The Boto3 session is now refreshable, and conflicting session arguments are rejected.
• Doris: identifiers in generated SQL were unquoted #32443: Doris identifiers are now quoted.
• Airflow: dynamically mapped tasks produced no lineage #32578: inlets/outlets serialized inside partial_kwargs are now read when the top-level keys are empty.
• Airflow: one extra database query per DAG to read pause state #31990: DagModel.is_paused is now part of the paginated serialized-DAG query.
• Protobuf schemas whose message didn't match the topic name failed to parse #32449: Parsing falls back to the sole top-level message, keeps ambiguous schemas unresolved, and supports well-known imports.
• Spark services offered a Metadata Agent that cannot work #32478: Spark metadata is pushed by the Spark Agent, so pull-based extraction is now marked unsupported.
• Domo and Astra connection fields diverged from the password-field conventions #32545: Both are aligned, and stored connection values are restored on update.
• Column tags were dropped when a column's dataType changed #32810: Tags are now carried forward across a dataType change.

🔔 Alerts & Change Events

• Bulk entity updates wrote no change event, so Get Schema Changes alerts never fired on metadata ingestion #32350: The bulk path now captures the incremental change description, so bulk updates both alert and audit.
• A Pipeline alert filtered to Failed re-notified forever and backfilled on creation #32181: Re-ingested and historical runs no longer emit change events, and a failure that isn't the newest run in a PUT /status/bulk batch now alerts.

📊 Data Insights & Data Quality

• Data Insights summary cards counted test case results, so the card ran ahead of the breakdown beneath it #31759, #33049: Test case documents carry no entityType, inflating the card and depressing the description, owner and tier percentages; the filter now requires exists(entityType), re-shipped as guarded 1.13.6 SQL because the 1.13.5 data migration never ran.
• MSSQL: table diffs couldn't authenticate a domain account #32583: Table diffs are routed through the driver that can authenticate domain accounts.
• Doris: profiler datetime partition filters weren't Doris-compatible #32788: Adds Doris dialect compilation for DatetimeAddFn and TimestampAddFn.
• Auto-classification did nothing when sample data was disabled #32607: With no sampled fields, metadata leaf columns are now traversed so column-name recognizers still run.

🛡️ Data Governance & Access Control

• Direct users could be assigned to non-Group teams, then couldn't be removed, added through the UI, or exported #32208: Direct memberships are now rejected for Department, Division and BusinessUnit teams. Existing invalid memberships need a one-off cleanup.
• Governance workflow edge conditions and node references were interpolated unchecked into Flowable expressions #32326: Conditional-edge conditions and source nodes are validated at the create/update boundary; valid workflows are unaffected and need no redeploy.
• App endpoint permission checks didn't match the platform RBAC model #32427: App endpoints align with platform RBAC, and App patch is authorized before the entity lookup.
• Bot list responses omitted the required botUser relationship #32398: The relationship is batch-loaded for list responses, so SDK list_all_entities calls can deserialize Bot entities.

🎛️ UI

• Explore filters reverted to their previous configuration on backward navigation #31632: Under react-router v7 the pathname-less navigate({ search }) calls pushed stale search params over the fresh URL; all Explore navigations now pass an explicit pathname.
• The metric version page crashed into the error boundary #32794: UnitOfMeasurement was a type-only import, so it was erased at build time and threw at runtime; it's now imported as a value.
• The edit icon disappeared when a custom property value overflowed #32550: The icon now sits outside the value container instead of being clipped by overflow: hidden.
• Masked password fields couldn't be cleared, and didn't show that a secret was stored #32945: The masked value now renders as password dots, and clearing an optional field emits a JSON Patch remove instead of overwriting the secret with an empty string.
• The Data Product "Add Assets" picker ignored the Domain Validation rule #32336: The picker lists assets across all domains when the rule is disabled, and stays domain-scoped (failing closed) when it's enabled.

🔒 Security

• Cross-user follower changes were unrestricted #32322: Follower endpoints now reject a null userId, compare against the authenticated subject, and require admin authorization for cross-user mutations.
• Broken access control on the glossary-term bulk asset endpoints #32539: assets/add and assets/remove now authorize EDIT_GLOSSARY_TERMS on each target asset instead of bypassing the authorizer.
• stringToHTML rendered stored user content unsanitized #32949: The hel...