1.12.13-release

🔍 Search & Performance

• Fix OpenSearch alias swap failure on fresh installations #29723: Removed an unsupported must_exist field from the remove_index alias action that caused OpenSearch to reject alias swaps with HTTP 400 on fresh installs.
• Stop falsely abandoning healthy reindex jobs that hold a live lock #29547: Reindex jobs with a stale timestamp but a live coordinator lock are no longer incorrectly marked as abandoned.
• Stop time-series field propagation to child entities #29485: Parent entity updates no longer overwrite time-series entities such as test case incidents in the search index.
• Skip stale-dimension vectors when migrating embeddings #29410: Embedding migration now validates vector dimensions before copying, avoiding silent rejection of mismatched vectors that left entities without embeddings.

🔐 Authentication

• Bypass domain enforcement for internally-issued tokens #29433: Personal Access Tokens and other OM-generated tokens no longer fail domain validation due to missing @Domain suffix in the preferred_username claim.

🛡️ Data Governance & Quality

• Pagination missing on Data Quality tab with many test cases #29512: Fixed missing pagination on the Data Quality tab when test cases exceed the page size (15 items).

⚙️ Apps & Ingestion

• Expose Trigger permission and require EditAll to kill ingestion pipelines #29530: Trigger is now grantable via the policy editor, and killing a pipeline now requires EditAll permission.
• Fix JSON truncation in SSE streams containing multi-byte characters #29532: Forced UTF-8 decoding in the SSE client to prevent emojis and other multi-byte characters from being mis-decoded into line breaks that truncated JSON payloads.
• Fix slow, memory-bound Data Retention entity relationship cleanup #29363: Replaced per-row hydrated reads and full in-memory buffering with batched existence checks and keyset pagination, eliminating multi-day runtimes and OOM errors on large catalogs.

🎛️ UI

• Hide disabled Tiers from Tier selection dropdown #29484: Disabled tier tags are now filtered out of the Tier selection dropdown.
• System default persona fallback on persona removal #29451: Removing a persona now correctly clears the default persona tag and selection state.
• Block editor link modal frozen inside focus-trapping drawers #29374: Fixed the link modal freezing when the block editor is used inside a focus-trapping drawer.

🔌 Connectors

• Metabase: strip optional clause blocks before lineage parsing #29390: Metabase's [[...]] optional clause syntax is now stripped before SQL parsing, preventing lineage extraction failures.

1.13.1-release

🔒 Security

• Netty CVE-2026-44249 #28880: Bumped netty-bom to 4.1.135.Final.
• Jackson-databind CVE-2026-54512/513/514 #29389: Bumped jackson-databind from 2.18.7 to 2.18.8.
• Spring, Micrometer & OpenTelemetry CVE patches #29111: Spring 6.2.18 → 6.2.19, Micrometer upgraded, and OpenTelemetry pinned to patch reported CVEs.
• ws CVE-2026-48779 #29122: Bumped ws to 8.21.0.
• handlebars CVE-2026-55760 #29221: Bumped handlebars to 4.5.2 to patch a path-traversal vulnerability.
• sudo CVE-2026-35535 #29343: Upgraded sudo in the ingestion Docker image.
• UI dependency vulnerability fixes #29223 #29241: Bumped undici 6.25.0 → 6.27.0, form-data, dompurify, markdown-it, and js-yaml.
• form-data bumped #29349: Updated the form-data package to address reported vulnerabilities.

🤖 MCP (Model Context Protocol)

• MCP Registry publishing #27982: Added server.json for publishing openmetadata-mcp to the official MCP Registry, enabling discovery across aggregators like PulseMCP.
• MCP tool usage analytics #28352: MCP tool calls now track usage metrics including per-tool latency percentiles, ok/fail counts, and client classification (VS Code, Claude CLI, etc.) with reservoir sampling.
• Cap search_metadata response size #28383: Capped search_metadata response size to prevent LLM context overflow and guides LLM clients to use smaller page sizes.
• Map MCP error responses to correct HTTP status codes #28622: MCP tool error responses now return the correct HTTP status codes instead of generic errors.
• Slim get_entity_lineage payload #28618: Optimized get_entity_lineage MCP tool payload with a slim transform to reduce response size.
• Compact create tool responses #28633: create_metric, create_test_case, and create_glossary_term tools now return compact entity representations.
• Slim root_cause_analysis payload #28632: Slimmed the root_cause_analysis tool payload to fit within LLM context limits.
• Return similarityScore in search_metadata #28512: search_metadata results now include _score as similarityScore for relevance ranking.
• Fix entityType filtering in search_metadata #28698: Resolved index routing by entityType to prevent cross-type result leaks and hardened parameter validation.
• Search test cases and test suites via search_metadata #28743: search_metadata now supports searching test cases and test suites.
• Shared trim util and global response size-budget #28764: Introduced shared response-trim utilities and a global size-budget net across all MCP tools.
• Trim wide-table payload in get_entity_details #28776: get_entity_details now trims wide-table payloads (column descriptions, schema/model SQL) to stay within size budgets.
• MCP OAuth login fix #29228: Fixed /mcp/callback handling of the active-session shortcut and implicit-flow id_token returned in the URL fragment by SSO.
• Fix OAuth state double-encoding #28952: OAuth state is now echoed without double-encoding in the redirect URI.

🔍 Search & Reindexing

• Vectorize testSuite/testCase for hybrid search #28669: Test suites and test cases are now vectorized, enabling hybrid (keyword + semantic) search over data quality entities.
• Make users and admins searchable by email #28800: Users and admins are now searchable by their email address.
• Recreate all indexes on major/minor version upgrade #28885: All search indexes are now recreated on major or minor version upgrades to pick up mapping changes.
• Reindex-drift and index health checks #28856: Added reindex-drift detection and index health checks in /system/validate.
• Fix reindex OOM on wide tables #28888: Switched to a covering cursor query and added entity name indexes to prevent out-of-sort-memory errors during reindex.
• Re-add --recreate-indexes flag #29087: Restored the --recreate-indexes flag to the reindex CLI for backward compatibility.
• Staged-index rescue uses index_total #29108: Uses index_total instead of docs.count for staged-index rescue so a failed reindex doesn't delete a populated index.
• Never apply refresh_interval=-1 as live serving value #29153: Prevents refresh_interval=-1 from being applied as a live serving value on index promote.
• Cap oversized dataModel column tree at index time #29212: Containers/tables with pathologically large dataModel schemas now have nested column children stripped at index time to prevent OOM.
• Regenerate embeddings on dimension change #29437: Embeddings are regenerated when vector dimensions change instead of reusing stale vectors.
• Backfill name indexes for distributed reindex pagination #29361: Name indexes are backfilled to support distributed reindex pagination.
• Bound column-index fan-out #29377: Bounded table column-index fan-out to prevent reindex OOM on wide tables.
• Surface exact/prefix matches first in QuickFilter #29231: QuickFilter aggregations now surface exact and prefix matches first.
• Extend best-match ordering to sourceFields/topHits #29296: Extended the best-match ordering logic to sourceFields and topHits requests.
• My Data defaults to dataAsset index #29209: Changed the My Data page from the all index to dataAsset for more relevant results.
• Stop time-series field propagation #29499: Stopped time-series field propagation to prevent stale data in downstream indexes.

🔌 Connectors & Ingestion

• PowerBI datamarts support #28896: Added support for Power BI datamarts.
• Fivetran improvements #27270: Various improvements to the Fivetran connector.
• Athena: pass catalogId for S3 Tables enumeration #28929: Passes catalogId to get_tables for Athena S3 Tables enumeration.
• Athena: ingest Iceberg table properties #27715: Ingests Iceberg table properties from the $properties metatable.
• Athena: remove Trino stats #29446: Removed Trino-specific stats from the Athena table profiler.
• MySQL: refresh RDS IAM auth token per connection #28730: IAM auth tokens are now refreshed per connection instead of reusing stale tokens.
• MySQL: default stored-procedure language to SQL #28898: Unknown stored-procedure languages now default to SQL instead of None.
• MySQL: parameterize routines query #29077: Parameterized the MySQL routines query to avoid SQL string interpolation.
• Metabase: StarRocks SQL dialect for lineage #29033: StarRocks connections now route to the StarRocks SQL dialect so StarRocks-specific syntax parses correctly for lineage.
• Metabase: strip optional clause blocks #29390: Strips [[...]] optional clause blocks before lineage parsing.
• Datalake: parse array type nested structures in JSON #27798: Fixed parsing of array type nested structure fields inside JSON files.
• Iceberg/Delta: ingest metadata.json with real table columns [#28422](https:...

1.12.12-release

🔒 Security

• sudo upgraded for CVE-2026-35535 #29343: Upgraded sudo in the ingestion image to patch CVE-2026-35535.
• Spring, Micrometer & OpenTelemetry CVE patches #29111: Spring 6.2.18 → 6.2.19 (CVE-2026-41850, CVE-2026-41851), Micrometer 1.14.5 → 1.15.12, and pinned OpenTelemetry to patch reported CVEs.
• ws bumped for CVE-2026-48779 #29122: Updated ws to 8.21.0.
• handlebars bumped for CVE-2026-55760 #29221: Updated handlebars to 4.5.2 to patch a path-traversal vulnerability.
• form-data bumped #29349: Updated the form-data package to address reported vulnerabilities.
• markdown-it bumped #29057: markdown-it 14.1.1 → 14.2.0.
• UI dependency vulnerability fixes #29223: Addressed assorted UI vulnerabilities, including undici 6.25.0 → 6.27.0 and form-data updates.

🔍 Search & Performance

• Cap oversized dataModel column trees at index time #29212: Containers/tables with pathologically large dataModel schemas (hundreds of thousands of columns) produced multi-hundred-MB search documents that could OOM the server on read/reindex. The oversized-doc guard now also strips nested column children and derived columnNames/columnNamesFuzzy once a doc is still over the cap after lineage stripping. Top-level columns and the full schema (via the entity API) are preserved.
• Column tag filtering in advanced search #28871: Added column-tag filtering to advanced search.
• Defer row fetch in audit logs list query #28850: Avoids a full-row scan when listing audit logs.
• AuditLogConsumer dropping events on offset gaps #29252: change_event.offset is AUTO_INCREMENT/SERIAL and only visible at commit, so under concurrent writes a lower offset can become visible after a higher one. The consumer no longer skips audit events across these offset gaps.

🧬 Lineage

• Render traced edges and nodes #29195: Lineage now visually renders traced edges and nodes.
• Restore edges in lineage PNG export #29124: Edges are restored after canvas re-render in the lineage PNG export.
• Fix selector for export lineage 5b4fe8c: Fixed the selector used for lineage export.
• Correct nodeDepth for fetched nodes #27477: Updates nodeDepth on fetched nodes using the base nodeDepth (Issue #25388).

📖 Glossary

• Approve/reject buttons missing after Expand All #29292: The Expand-All tree fetch omitted the reviewers field, so nested In-Review terms lost their approve/reject buttons. Reviewers are now requested so the buttons remain for nested terms.
• Approval re-triggers on approved-term rename 1755135: Renaming an already-approved term now records name/parent on the change description so the approval workflow re-triggers correctly.
• Keep approvals valid after move #29234: Approvals remain valid after a glossary term is moved.
• Cascade glossary rename to child terms in search index #29134: Renaming a glossary now updates the denormalized glossary.name / glossary.fullyQualifiedName on every child term's search-index doc.

🔐 Authentication

• MCP OAuth login fails with 400 on id_token fragment #29228: Fixed /mcp/callback handling of the active-session shortcut and implicit-flow id_token returned in the URL fragment by SSO.
• OIDC/SAML self-signup persists mapped email claim #29189: Self-signup now persists the mapped email claim from OIDC/SAML.

🛡️ Data Governance & Quality

• Preserve data products across domain deletes #29138: When a data product's domain was changed and the original domain was then recursively hard-deleted, the data product was incorrectly deleted via a stale domain→dataProduct relationship. The stale relationship is now removed so data products are preserved.
• Delete orphaned test cases + guard test-definition deletion #29081: Orphaned test cases (whose testDefinition relationship was removed) can now be hard-deleted, and test-definition deletion is guarded against the missing relationship.

⚙️ Apps & Ingestion

• Sync IngestionPipeline scheduleInterval on app schedule changes #28702: When an external app's schedule changes (scheduled→manual or a cron edit), the backing IngestionPipeline scheduleInterval is now synced so K8s/Argo/Hybrid runners pick up the new schedule.
• Skip CSV consolidation without a previous version #29088: Avoids CSV consolidation when there is no previous version to consolidate against.

🎛️ UI

• Scope "between" operator fix to numeric custom properties #29334: The between operator now correctly sends the upper bound for numeric custom properties only (Issue #27482).

🔌 Connectors

• Snowflake: create Query entities in ACCESS_HISTORY lineage #29125: The opt-in ACCESS_HISTORY lineage path now emits a CreateQueryRequest per edge so the originating SQL surfaces as Query entities, and fixes a probe issue.
• Snowflake: forward-port ACCESS_HISTORY lineage + cache fixes #29036: Forward-ports the opt-in ACCESS_HISTORY lineage path and cache fixes.
• Metabase: StarRocks SQL dialect for lineage #29033: StarRocks connections now route to the StarRocks SQL dialect so StarRocks-specific syntax in Metabase native queries (e.g. to_bitmap(), bitmap_union_count()) parses correctly for lineage (Issue #28934).

1.12.11-release

OpenMetadata 1.12.11 is a maintenance release delivering security patches, MCP improvements, AI enhancements, search fixes, UI enhancements, ingestion stability improvements, and connector updates.

🔒 Security

• React-router-dom security upgrade #28677: Snyk security upgrade of react-router-dom from 6.30.3 to 6.30.4 to address reported vulnerabilities.
• Netty-bom bumped for CVE-2026-44249 #28880: Updated netty-bom to 4.1.135.Final to resolve CVE-2026-44249.

🔌 MCP (Model Context Protocol) Fixes

• Compact entity responses from create tools #28633: MCP create metric, test-case, and glossary tools now return a compact entity representation to reduce payload size.
• Compact entity response from create_article tool: The create_article MCP tool now returns a compact entity representation, consistent with other create tools.
• Slim root_cause_analysis payload #28632: Reduced root_cause_analysis tool payload size to fit within LLM context limits.
• Return similarity score in search_metadata tool #28512: The search_metadata MCP tool now returns _score as similarityScore in results.
• Fix entityType filtering in search_metadata tool #28698: Resolved incorrect entity type filtering behavior in the search_metadata MCP tool.
• Fix OAuth state double-encoding in redirect URI #28953: Corrected OAuth state encoding to prevent double-encoding in MCP redirect URIs.

🛠 API & Backend Fixes

• Fix duplicate query error in bulk APIs #25890: Resolved an error caused by duplicate queries being submitted through bulk API operations.
• Write server audit entries to audit.log #28782: Server audit events are now properly written to the audit.log file for observability and compliance.
• Fix SSE multi-line data field concatenation #28945: Multi-line SSE data fields are now correctly concatenated instead of being overwritten.
• Allow bare references to approved functions in SpEL conditions #28946: Policy engine now correctly evaluates bare function references in SpEL-based policy conditions.
• Drop unsupported om-event-layout from console appender: Removed the unsupported om-event-layout configuration from the console appender to prevent startup warnings and misconfigurations.

🔍 Search & Indexing Fixes

• Fix missing search aliases after reindex #28667: Resolved an issue where search aliases were missing after reindexing by atomically deleting the concrete index within the alias swap.
• Make users and admins searchable by email #28800: Users and admins can now be found via search using their email address.
• Re-derive tag fields on live tag-mutating updates #28900: Fixed an issue where glossaryTags, classificationTags, and tier were not re-derived correctly during live tag updates.
• Fix search preview inconsistent behavior #28589: Resolved inconsistent behavior in the entity search preview panel.

🎨 UI & UX Fixes

• Restore import/export buttons for conditional EditAll policies #27488: Users with Data Producer roles using conditional policies (isOwner(), hasDomain(), matchTeam()) can now correctly see Import/Export options in the Glossary manage menu.
• Fix bulk-ops column grid showing soft-deleted entities #28653: Soft-deleted entities are now excluded from the bulk operations column grid.
• Brand name environment variable support #28624: UI now uses a BRAND_NAME environment variable in place of hardcoded "OpenMetadata" references for easier white-labeling.
• Fix Global Domain Filter translation #25982: Corrected translation for the Global Domain Filter UI element.
• Fix mixed language display when browser language differs from user setting #25962: Resolved an issue where UI displayed mixed languages when the browser language differed from the user's selected language.
• Fix SSO documentation format: Corrected the format of SSO configuration documentation displayed in the UI.

✈️ Ingestion Fixes

• Fix DagContext autoregister race in Airflow build_dag #28744: Resolved a race condition caused by DagContext autoregistration during DAG construction in Airflow APIs.
• Comprehensive diagnostics for Airflow connection check #28516: Added detailed diagnostic output to the Airflow connection check to help debug connectivity issues.
• Fix Iceberg/Delta metadata.json ingestion #28845: Corrected ingestion of Iceberg and Delta table metadata.json files to properly include real table columns.

🔌 Connectors

• SSIS: optional databaseConnection for file-only mode #28708: The databaseConnection field is now optional in SSIS connector configuration, enabling file-only ingestion mode.
• Athena: catalogId support for S3 Tables and cross-account Glue catalogs #28956: Added catalogId support to Athena connection configuration for S3 Tables and cross-account Glue catalog access.
• SSIS: SQL Command, Execute SQL Task, Lookup task, and column-level lineage: Extended SSIS connector with support for SQL Command tasks, Execute SQL Task, Lookup transformations, and column-level lineage extraction.

🤖 AI Enhancements

• Documentation Agent sample data for descriptions: The Documentation Agent now uses sample data when generating descriptions, improving the quality and relevance of AI-generated entity documentation.

🐛 General Bug Fixes

• Fix tag FQN rewrite on entity rename #28725: Implemented boundary-aware idempotent tag FQN rewriting during entity rename operations to prevent incorrect partial matches.
• Preserve secret: prefix in Python SDK serialization #28625: Fixed Python SDK to preserve the secret: prefix during object serialization.
• Lineage: dedup queries and handle conflicts as warnings #28757: Lineage query deduplication is now applied, and already-present query conflicts are treated as warnings rather than errors.
• Fix data insights service filter on terms aggregation rebuild #28716: Data insights now correctly preserves the service filter when rebuilding terms aggregations.
• Fix alerts Entity FQN filter to match descendants #28833: Alert Entity FQN filters now correctly match against an entity and all of its descendants.
• Fix metadata-exporter credential decryption on re-dispatch: Resolved an issue where the metadata exporter failed to decrypt credentials when re-dispatching export jobs.
• Fix notification template <br> line break preservation: Corrected notification templates to properly preserve <br> line breaks instead of stripping them.

1.13.0-release

Features

MCP Services

MCP (Model Context Protocol) is now a first-class service category with service entities, server entities, execution logs, test-connection support, REST resources, and UI pages.

• Usage analytics expose summary, history, tool breakdown, user breakdown, and current-user usage
• MCP OAuth now supports SAML SSO authentication
• Client secrets are not issued to public clients
• get_entity_details now surfaces custom properties in responses

Knowledge Graph and RDF

Requires Apache Jena. Run the RDF Knowledge Graph Index App after upgrade for first-time users.

• Distributed RDF indexing with state tables for jobs, partitions, locks, and server stats
• Glossary membership scoping, relation cleanup, distributed mode, and compaction
• Revamped graph with custom nodes, relation details, and distributed indexing status

Search Index Performance and Live Indexing

• Tunable settings: refresh interval, replica count, translog durability, sync interval, and per-entity overrides
• Per-stage reindex timing metrics for reader, process, sink, and vector stages
• Live indexing retries on failure with a dead-letter queue for failed items
• Search results can be exported to CSV from the Explore page under Tools
• Search Index App schedule has moved to weekly — review before upgrading

Ontology Explorer

New first-class governance page at /governance/ontology with graph filters, layout controls, side-panel entity details, and export controls.

Typed Glossary Term Relations

New relation types: relatedTo, synonym, antonym, broader, narrower, partOf, hasPart, calculatedFrom, usedToCalculate, seeAlso

• New governance settings page to manage relation types
• Relation badges, filters, and graph views throughout Glossary UI
• Concept mappings for external IRIs and SKOS-style relation types
• APIs for relation usage counts, asset counts, batch fetch, add/remove, and relation graph

Data Marketplace

• New sidebar and routes at /data-marketplace, /data-marketplace/domains, /data-marketplace/data-products
• Customizable landing page with widgets for domains, data products, announcements, and search

AI and Hybrid Search

• Google Gemini embedding provider with configurable dimensions and endpoint override
• OpenAI NLQ: modelId, request timeouts, max tokens, and temperature now configurable
• Hybrid search tuning: keyword/semantic weights, RRF settings, semantic score threshold, highlight fragment size
• textToLLMContext and vector body-text extension hooks

Data Quality and Profiler

• Dynamic and static sampling via profileSampleConfig
• Explicit metrics selection per profiler run
• Top-dimension controls for dimensional test cases
• Bulk add and select-all for logical and bundle test suites
• Dashboard widgets and filters: data products, certification, incident status, tiers, entity health
• Storage auto-classification for containers with language-aware recognizer selection
• Deterministic MySQL median behavior

Governance and Workflows

• Data-contract references across data assets and service entities
• Workflow triggers extended: data product, data contract, glossary terms, input ports, output ports
• Approval tasks show proposed changes with clickable entity links, domain stamped on creation
• Self-approval prevention for workflow change requests
• New Archived entity status

New Connectors

• Google Drive — ingestion connector and example workflow
• Pub/Sub — messaging connector with test-connection support
• QuestDB — database connector
• IOMETE — database connector
• SAP SuccessFactors — database connector
• SAP S/4HANA — dashboard connector
• Matillion Data Cloud — pipeline connector (Collate Only)
• Airflow 3.x — API-based connector; constraints upgraded to 3.2.1

Connector Improvements

• Snowflake — opt-in ACCESS_HISTORY lineage path; queries chunked by day to avoid timeouts
• Unity Catalog — incremental metadata extraction, only fetching changed entities since last run
• SSRS — report-to-dataset lineage
• Metabase — chart-level lineage extraction
• OpenLineage — Glue, Kusto, Cosmos DB naming; symlinks facet for Iceberg; pipeline node for single-sided lineage
• Storage — compressed archive ingestion (ZIP, tar, gzip) in S3, ADLS, GCS; Redis caching for container ancestors
• MySQL — queryHistoryTable option; GCP Cloud SQL IAM support
• Athena — catalogId for S3 Tables and cross-account Glue
• Oracle — preserveIdentifierCase and useDBATable options
• S3, ADLS, GCS — profiling capability flags; REST connector S3 and SSL config

Platform, Cache, and Operability

• Read-bundle prefetch and cache warmup for tags, certifications, relationships, containers, ancestors
• Redis: cache metrics, distributed warmup, per-command timeout defaulting to 300ms
• Deadlock retry handling and reduced write deadlocks
• JSON log format via LOG_FORMAT=json, streamable logs, non-blocking handlers
• QoS request admission enabled by default via QOS_* settings
• CSP nonce handling and web security headers: COEP, CORP, COOP
• Regenerate-bot-tokens for JWT key rotation
• db-tune ops subcommand and production RDS runbook
• Diagnostics v2 framework — legacy ExecutionTimeTracker removed

Columns as Independent Entities

Columns are now indexed as independent entities. They appear in asset counts and are the default entity shown in Explore when selecting a database service. Previously tables were shown. This is a behavioral change.

Breaking Changes

Connector and Ingestion Changes

• Iceberg connector removed — services migrated to CustomDatabase, pipelines hard-deleted. Update any YAML or automation referencing serviceType Iceberg
• Databricks/Unity Catalog scheme changed from databricks+connector to databricks. Stored configs migrated; external YAMLs must be updated
• Profiler sampling changed to profileSampleConfig. Old fields profileSample, profileSampleType, samplingMethodType, and computeMetrics are removed
• randomizedSample defaults now explicitly false in migrated configs
• Python ingestion targets 3.10, 3.11, 3.12. Key deps: SQLAlchemy 2.x, pandas 2.1.x, pyodbc 5.3.x, Airflow 3.2.1, Databricks SQLAlchemy 2.x
• Storage manifest partitionColumns uses a smaller partition-column shape

API and Schema Changes

• Feed APIs no longer accept from in createThread or createPost — remove it from client payloads
• Search payloads removed the semanticSearch boolean
• Application schemas renamed preview to enabled with inverted meaning — custom app manifests must use enabled
• Webhook moved from secretKey to authType object (no auth / bearer / OAuth2)
• Custom property names must start alphanumeric and cannot contain / or ~
• Glossary relatedTerms changed to typed TermRelation objects — existing data migrated to relatedTo
• entity_relationship primary key now includes relationType
• Logical-suite add endpoint deprecated — use PUT /api/v1/dataQuality/testCases/logicalTestCases/bulk
• Bulk Assets dryRun now enforced for tag, glossary, dataProduct, and team removes
• New Archived entity status — update any hard-coded status enums

Operational Notes

• Quartz tables cleared during migration — stop all instances before upgrading
• Postgres fqnHash text_pattern_ops indexes added or replaced — runbook included in migration file if build is interrupted
• New tables for MCP services, servers, executions, RDF indexing jobs, partitions, locks, and server stats
• SERVER_CHANGE_LOG historical gaps backfilled — missing entries caused data-insights timeline holes
• Profiler pipeline cleanup force-executed on upgrade to clear stuck pre-1.13 state
• LOG_FORMAT=json now supported — review any custom Dropwizard logging config
• QoS admission enabled by default — check QOS_* settings if adjustment needed
• Redis per-command timeout defaults to 300ms — tune for slow Redis deployments

Changelog

Search and Reindexing

• Fixed nested children causing Elasticsearch/OpenSearch mapping-depth failures
• Fixed stale file-extension aggregation on v1.13.0 upgrade causing 500 errors on file search
• Fixed stale flattened-children highlight field on v1.13.0 upgrade causing 500 errors on container search
• Fixed search_after silently dropping entities when sort value contains a comma
• Fixed query, worksheet, and file reindexing missing relationship fields
• Fixed search-index alias resolution for entity-specific and OpenSearch cluster prefixes
• Fixed batch-prefetch of upstream lineage leaking Hikari connections during bulk reindex
• Fixed soft-delete propagation to time-series child aliases
• Fixed clean reindex jobs incorrectly marked failed when only warnings existed
• Fixed text-field sorting and aggregation .keyword resolution
• Fixed user index searches on nested owners queries
• Fixed advanced-search Contains and Not Contains operators for description field

Glossary, Tags, and Governance

• Fixed glossary relation rendering for multiple relation types between the same term pair
• Fixed related-term tooltip sanitization and relation badge colors and icons
• Fixed tag rename and relationship cache invalidation
• Fixed TagLabel server fields lost when saving tags
• Fixed certification tags leaking into regular tags and missing appliedBy audit trail
• Fixed soft-deleted users appearing in experts and reviewers selectors
• Fixed hyperlink workflow rules and Tags/Tier field ambiguity

Data Quality and Profiler

• Fixed test-case suite search membership preservation
• Fixed tier and certification filter queries in Data Quality dashboard
• Fixed incident manager status and severity chip behavior
• Fixed TableColumnCountToBeBetween API responses
• Fixed column profile percentages showing 0% for zero proportions
• Fixed tableCustomSQLQuery ignoring computePassedFailedRowCount flag
• Fixed orphan test ca...

1.12.10-release

Changelog

OpenMetadata 1.12.10 is a maintenance release delivering critical security patches, MCP enhancements, and targeted bug fixes across migrations, search, UI, and ingestion runtime.

🔒 Security

• Snyk high/critical dependency patches in ingestion #28623: High and critical Snyk findings patched across ingestion dependencies to address multiple CVEs.
• Jackson-core and CloudFront Snyk high patches #28614: Resolved Snyk high-severity vulnerabilities in jackson-core 3.0.2 and cloudfront 2.30.19.
• Axios version bump for Retire.js vulnerabilities #28582: Frontend dependency updated to address reported Retire.js vulnerabilities.
• XSS security fix with explicit jsonify #28574: Made jsonify explicit at route level to break XSS taint chains.
• CVE fixes in ingestion images #28534: Closed gnutls, libcap, openssh, and rsync CVEs in ingestion container images.
• mlflow-skinny and jsonify security bumps #28501: Updated mlflow-skinny and surface jsonify in trigger route for security.
• Presidio utils XSS false positives fix #28535: Dropped **kwargs Any from presidio_utils factories to clear XSS false positives.

🔌 MCP (Model Context Protocol) Enhancements

• MCP tool error responses mapped to correct HTTP status codes #28644: Tool errors now properly map to their corresponding HTTP status codes.
• New MCP tools added #28586: Extended MCP tool capabilities with new tools for enhanced functionality.
• Optimize get_entity_lineage MCP tool payload #28618: Reduced payload size of get_entity_lineage tool with slim transform optimization.
• MCP custom properties in get_entity_details #28570: Surface custom extension properties in get_entity_details tool responses.
• MCP SAML SSO support in OAuth flow #28548: Added SAML SSO support for MCP OAuth authentication flow.
• MCP client secret handling for public clients #28552: Fixed to not issue client secret to public clients.
• MCP prefer application/json over SSE #28558: MCP now prefers application/json response format when client accepts both JSON and SSE.
• MCP Tool Usage improvements #28352: Enhanced MCP tool usage tracking and execution capabilities.

🛠 API & Migration Fixes

• Migration heal stuck PG certification #28635: Fixed migration to heal stuck PostgreSQL certification records stranded by v1125 update.
• Migration cast :metadata to json on PG tag_usage #28504: Corrected metadata field casting in PostgreSQL tag_usage insert statements.

🔍 Search & Indexing Fixes

• Fix search by nested field names for topics and API endpoints #28610: Resolved issue where nested field name searches failed for topics and API endpoints.
• Scrub stale file extension aggregation on upgrade #28565: Prevented file search 500 errors by cleaning up stale file extension aggregation data during upgrade.
• Backport immense-term children mapping fix #28572: Applied fix for deeply nested children fields that were causing search mapping issues.
• Stop orphan test cases from breaking search indexing #28159: Prevented orphaned test cases from causing search index failures.

🎨 UI & UX Fixes

• Fix entity type filter update button click #28573: Corrected entity type filter interaction where update button click was not being registered.
• Translation fixes for ru-ru and ko-kr locales #28584: Corrected translation values for Russian and Korean language packs.
• Test suite pre-select every test case already in suite #28400: Fixed test case selection logic to pre-select all test cases already added to a suite.

🐛 General Bug Fixes

• Fixed classification visit method #28636: Corrected the visit method for classification entity traversal.
• Fix flaky domain & data product rename #28580: Improved stability of domain and data product rename operations by handling search version conflicts.
• Fix fasturi dependency #28139: Updated fasturi dependency to resolve compatibility issues.

📦 Dependencies & Infrastructure

• Kubernetes client pinned below 36.0.0 (from v1.12.9): Maintained compatibility by capping Kubernetes Python client to avoid breaking API changes.

---

Full Changelog: Commits between 1.12.9 and 1.12.10

1.12.9-release

Changelog

OpenMetadata 1.12.9 is a maintenance release delivering new connector capabilities, performance improvements for workflow execution, and targeted bug fixes across search, ingestion, UI, and the OpenMetadata Python client.

✨ New Features

• Unity Catalog — incremental metadata extraction #28380: Unity Catalog connector now detects changed tables via information_schema.tables.last_altered and only re-ingests modified entities. Delete detection uses exact catalog matching (preventing wildcard misfires on catalog names containing underscores). Catalog names are validated against an allowlist before SQL interpolation.
• Task domains backfilled + stamped on approval #28402: Approval task threads now inherit the domain of the entity being approved, and a migration backfills domains on existing tasks.
• Workflow entity extended fields #28398: Workflow entities now support inputPorts, outputPorts, and glossaryTerms fields, bringing them to parity with pipeline and data-flow entities.
• MySQL — custom queryHistoryTable #28388: MySQL connector accepts a configurable queryHistoryTable for usage and lineage extraction, enabling use-cases where query history is stored in a non-default location.

🔒 Security

• Test-connection workflow authorization #28414: Test-connection workflow triggers now require proper authorization, closing an unauthenticated execution path.
• Snyk high/critical dependency patches in ingestion #28340: High and critical Snyk findings patched in ingestion dependencies and code paths.
• brace-expansion lockfile bump to 5.0.6 #28244: Resolves a ReDoS advisory in the transitive brace-expansion package.
• js-cookie bumped #28315: Frontend dependency bumped to address a Dependabot advisory.
• WebSocket Dependabot vulnerability in UI #28320: Dependency update for a reported WebSocket vulnerability in the UI bundle.

🎨 UI Changes

Improvements

• Data Quality — column selection dropdowns are searchable #28376: Column selectors in test case forms now include a search box, making it practical to navigate wide tables.

Fixes

• Notification links — plural alerts path and Query href #27918: Notification alert links now route to the correct plural /alerts path; Query entity hrefs in notifications are also corrected.
• Data Asset Header — permission fix #27967: Resolved a permission check issue in the Data Asset Header component that prevented certain actions for non-admin users.
• Bot name search on Bots page #27365: Fixed search not returning results when searching for bots by name on the Bots management page.
• Column bulk-ops filters use displayName #28390: Service, database, and schema filter dropdowns in the column bulk-operations flow now display displayName instead of raw FQN fragments.
• Bulk-asset operations enforce dryRun #28395: Tag, glossary, and data-product bulk operations now correctly honour the dryRun flag, preventing accidental mutations during preview runs.
• Table / dataModel — inline column.extension persisted #28392: Custom extension data attached inline to columns is now saved correctly through POST/PUT calls.
• ServicesPage tab accepts ServiceCategory enum values #28375: The :tab route parameter now accepts both the label string and the raw ServiceCategory enum value, fixing deep-links that used enum values.
• Unknown service category returns 404 #28372: Navigating to an unrecognised service category now returns a proper 404 page instead of an empty fallback.
• KPI widget date format #28370: Added missing space between day and month values in the KPI widget's X-axis date labels.
• Bug fix (#27433) #28266: Backported fix for entity display regression.

🔌 Connectors

Databases

• Databricks / Unity Catalog — valueless tags ingested #28294: Tags set without an explicit value (valueless) are now ingested correctly from Databricks and Unity Catalog sources.
• Snowflake — discovered databases logged with filter reasons #28385: During schema discovery the Snowflake connector now logs each discovered database alongside the reason when it is filtered out, improving debuggability.

Pipelines / Dashboards

• Bulk sink — charts and dataModels created before dashboards #28371: Fixed a bulk sink ordering bug where a Dashboard entity could be flushed before its referenced Charts or DashboardDataModels, causing HTTP 400 rejections from the server. Each topology stage now encodes its position so referenced entities are always created first.
• Power BI — sink buffer flushed before lineage resolution #28308: Ensures all Power BI entities are persisted before lineage resolution begins, preventing reference errors during lineage extraction.
• Power BI — TSQL dialect for Sql.Database M-query lineage #28380: The Power BI connector now parses Sql.Database M-query expressions using the TSQL dialect, fixing lineage extraction failures on SQL Server-backed datasets.

OpenLineage

• Resolve table identity from symlinks facet #28360: OpenLineage events that include a symlinks facet now resolve the true table identity from the symlink, fixing entity matching for Hive/Iceberg tables exposed under alternate names.
• Pipeline as node for single-sided lineage #28350: OpenLineage pipelines can now appear as a standalone node in the lineage graph when only one side (input or output) is present, instead of being dropped.

Ingestion Runtime

• Kubernetes client capped below 36.0.0 #28331: Pins the Kubernetes Python client to <36.0.0 to avoid a breaking API change introduced in that release.
• Ingestion-pipeline status preserved during queued-stage failures #28382: When a queued-stage task fails, the overall pipeline status remains accurate instead of being overwritten with a misleading value.

🛠 API (Backend)

Improvements

• Workflow field fetches scoped #28391: Wildcard field fetches in workflow-related queries replaced with scoped field requests, reducing payload size and improving performance.
• Data Insights enricher — per-step failure isolation #28379: Enricher step failures are now isolated per-step with individual error tracking, preventing one bad enricher from aborting the entire Data Insights run.

Fixes

• Search search_after with special characters in sort values #28386: search_after pagination no longer drops entities whose sort-field value contains special characters.
• Search — nested children flattened to avoid ES mapping depth limit #28387: Deeply nested children fields are now flattened before indexing to prevent Elasticsearch/OpenSearch from rejecting documents that exceed the default mapping depth limit.
• Table certification cascaded to child search documents #28229: A PATCH to a Table's certification tag is now propagated to all child search documents, keeping certification state consistent across the search index.
• Search-index reindex jobs no longer marked failed on clean completion #28381: Fixed a status-tracking bug that incorrectly recorded clean reindex jobs as failed in the job history.
• PDTS duplicate preemption and invalid index-mapping recovery #28373: Migration now preempts duplicate PDTS (Profiler Data Time Series) rows and recovers from invalid search index mappings rather than failing.
• MCP — search_metadata response capped #28383: The MCP search_metadata tool response is now capped in size to prevent LLM context overflow when the result set is large.
• Alert filter functions use strict literal matching [#28393](https://github.com/open-metadata/OpenMetadata...

1.12.8-release

Changelog

OpenMetadata 1.12.8 is a maintenance release focused on hardening the platform against newly disclosed CVEs, eliminating long-standing database hotspots in the search and tag pipelines, and tightening connector behavior across Databricks, Unity Catalog, Athena, Datalake, and OpenLineage. The release also lands several quality-of-life UI fixes around governance approvals, advanced search, and custom properties.

⚠️ Backward Incompatible / Notable Behavior Changes

• Notification alerts — Location source removed #27683: The deprecated Location entity has been removed from the list of supported sources in notification alerts. Domain and Data Product are now first-class sources. Existing alerts configured against Location will need to be re-created against a supported source.
• ContainerResource default fields trimmed (#27894 follow-up): children is no longer returned by default on GET /v1/containers list responses; clients that depended on the implicit inclusion must request it explicitly via the fields query parameter. This restores the documented behavior and unblocks the batched data-model column tag retrieval below.
• Soft-deleted users excluded from Experts/Reviewers #27120: Users marked deleted no longer appear in the Experts/Reviewers selector across entities. Workflows that relied on soft-deleted users remaining visible (for example, restoring an entity to its previous reviewer) must restore the user first.

🔒 Security (Vulnerability Remediation)

This release addresses the May 8 2026 Snyk scan against the 1.12.7 branch and additional CVEs picked up by AWS Inspector. Nine of the highest-severity findings are resolved through direct version bumps; one (libthrift) is force-pinned because upstream Jena has not yet rebased.

Backend / Java

• CRITICAL — Jetty HTTP Request Smuggling (CVE-2026-2332): org.eclipse.jetty:jetty-http bumped 12.1.6 → 12.1.7 #27996.
• HIGH — Apache Thrift (CVE-2026-43869): libthrift force-pinned to 0.23.0 via dependencyManagement to override the vulnerable transitive shipped by apache-jena-libs #28010 / #28035.
• HIGH — PostgreSQL JDBC SCRAM-SHA-256 DoS (CVE-2026-42198): org.postgresql:postgresql bumped 42.7.7 → 42.7.11 #27996.
• HIGH — BouncyCastle Crypto Signature Bypass + Timing Attack (CVE-2026-5598): bcprov-jdk18on / bcpkix-jdk18on pinned to 1.84, also addressing CVE-2026-0636 and CVE-2026-5588 #27996.
• HIGH — Apache Log4j (CVE-2026-34477, CVE-2026-34478, CVE-2026-34480): log4j bumped 2.25.3 → 2.25.4 #27994.
• MED — Jackson 3.x deserialization CVEs (GHSA-72hv-8253-57qq): jackson-core bumped 2.17.2 → 2.18.7. jsonschema2pojo-core is now declared <scope>provided</scope> in the common module so the Jackson 3.x transitive is excluded from the runtime classpath, since the annotators it powers only run at build time #28010.
• MED — jsonschema2pojo (CVE-2025-3588): jsonschema2pojo bumped 1.2.2 → 1.3.0 (later aligned to 1.3.1 to resolve a maven-plugin classpath issue) #27994.
• MED/LOW — Logback (CVE-2025-11226, CVE-2026-1225): logback-core / logback-classic bumped 1.5.19 → 1.5.25 #27996.
• Netty: netty-bom bumped 4.1.132 → 4.1.133. netty-transport-native-epoll excluded (Linux-only perf optimization flagged by an overly-broad GHSA range, not used at runtime) #27994 / #28010.
• Azure Identity (CVE-2024-35255): azure-identity aligned to 1.15.2 and azure-keyvault bumped to remove vulnerable transitives #27994 / #28010.
• Reactor Netty & Spring: reactor-netty and spring bumped to their current patched lines #27996 / #28010.

Frontend / UI

• axios upgraded to 1.15.2 to clear reported CVEs in the UI bundle.
• postcss pinned to 8.5.10 with a Yarn resolutions override in openmetadata-ui-core-components to resolve the Dependabot advisory #27778.
• postcss bumped in the main UI module as well #27729.

Ingestion / Container Images

• ImageMagick purged from the ingestion image — it was only a transitive of the Airflow base image, was never used by ingestion code, and continued to surface CVEs after Airflow upgrades. Removing it eliminates the surface entirely #27752.

🎨 UI Changes

Improvements

• Approvals show proposed changes inline #27201: Governance approval task threads now render a Proposed Changes section with clickable entity links, so reviewers can see exactly what changed before approving instead of opening the entity in a new tab.
• Description added to Advanced Search query builder #27913: The description field is now a first-class searchable attribute with Contains, Not Contains, Is Null, and Is Not Null operators. The descriptionStatus label was also corrected (previously rendered with the wrong key).
• Service documentation panel: admonitions + code copy button #27732: The in-product service docs now render note/warning/tip admonitions and add a copy button to fenced code blocks.

Fixes

• Clipboard works on non-secure (HTTP) contexts #28003: CodeBlockComponent now uses the useClipboard hook, which falls back to document.execCommand when the modern Clipboard API is unavailable, fixing copy actions for users on self-hosted HTTP deployments.
• Custom properties with dots in their name now display #27390: The UI was treating . in custom-property names as a path separator, hiding the property entirely. Names with dots are now rendered correctly.
• Tier/Certification tag matching uses FQN prefix, not substring #27700: Prevents unrelated tags whose FQN happened to contain a tier or certification tag's FQN from being mis-classified.
• Upvote/Downvote icon retains primary color after blur #27898: The vote indicator no longer reverts to a neutral color when the entity page loses focus.
• AdvancedSearch description option — translations #27961: Missing/incorrect i18n strings on the new description operator filled in across supported locales.
• Rich-text editor migration #26887: Removed @toast-ui/react-editor and migrated remaining usages to the in-house BlockEditor, reducing bundle size and eliminating the transitive CVE surface from the abandoned editor package.
• ContainerPage tab counts now update reactively: Added childrenCount to the useMemo dependency array so tab badges refresh when children load.

🔌 Connectors

Databases

• Databricks — nested column descriptions + SQLAlchemy 2.x #27766: Descriptions on STRUCT/MAP/ARRAY-typed nested columns are now captured during metadata ingestion. The connector is also compatible with sqlalchemy-databricks running on SQLAlchemy 2.x.
• Unity Catalog — missing httpPath #27844: The connector no longer hard-fails when httpPath is omitted; it now produces a clear configuration error instead of an opaque stack trace.
• Athena — Iceberg table properties #27715: Iceberg-on-Athena tables now ingest table properties from the $properties metatable, surfacing Iceberg-specific metadata (format-version, write.target-file-size-bytes, etc.) in OpenMetadata.
• PostgreSQL / MSSQL — mutual TLS #27104: Both connectors now support client-certificate mTLS in addition to server-side SSL, matching enterprise PG/MSSQL hardening requirements.
• PostgreSQL — tag_usage seq-scan eliminated #27824: Backport of #27158. The certification tag query now uses the covering index instead of a sequential scan, removing a multi-second hotspot during Data Insights runs on large catalogs.
• SQLAlchemy 2.x row access #27643: Replaced old-style row indexing that emitted deprecation warnings on SQLAlchemy 2.x.

Datalake / Object Stores

• **Datalake — nested arrays of structs in ...

1.12.7-release

fix(security): pin libthrift, provided jsonschema2pojo, bump azure-kv…

1.13.0-rc1-release

chore(release): Prepare Branch for `1.13.0-rc1`