DataHub v1.6.0.3
Patch release for the v1.6.0 LTS line. Focus is security and authorization hardening, plus a few ingestion and platform fixes.
Full diff: v1.6.0.2...v1.6.0.3
Operator notes
- Python 3.11 is required on this hotfix line (ingestion CLI/images and related packages). Python 3.10 is no longer supported for v1.6.0.x (#19703).
- SecretService caller guard defaults to
ENFORCE. Secret encrypt/decrypt now requires anOperationContext; misconfigured callers fail closed instead of silently succeeding (#17995). - Opt-in frontend security headers. Set
DATAHUB_SECURITY_HEADERS_FRAME_OPTIONS,DATAHUB_SECURITY_HEADERS_CONTENT_TYPE_OPTIONS, and/orDATAHUB_SECURITY_HEADERS_REFERRER_POLICYto emitX-Frame-Options,X-Content-Type-Options, andReferrer-Policy. Unset vars omit those headers (#19848).
Security
Dependency floors and library bumps, including:
| Area | Fix |
|---|---|
| Snowflake connector | Floor raised to 4.7.3 (CVE-2026-15925, plus 4.7.1/4.7.2 TLS SAN regression for account locators with _)
|
| aiohttp | 3.14.3 (CVE-2026-69244 / 59881 / 69243) |
| pip | 26.2+ (CVE-2026-13346) |
| click | ≥8.3.3 (CVE-2026-7246) |
| deepdiff | ≥8.6.2 (CVE-2026-33155) |
| unstructured | 0.24.1 (CVE-2026-71428) |
| libthrift | 0.24.0 (CVE-2026-48586) |
| MariaDB Connector/J | 2.7.14+ (CVE-2026-55856/557/558) |
| Bouncy Castle | 1.86 |
| Wolfi actions image | WOLFI_PKG_REFRESH bump (CVE-2026-85091 / zlib)
|
| Java stack | Spring Framework 7.0.9, Boot 4.0.8, Security 7.0.7; Jackson 2.22.x; Parquet 1.18.1; JJWT 0.13.0; httpclient5, OTel, GitPython, cryptography / pyOpenSSL, anyio, soupsieve |
Also: setuptools ≥83 is allowed so consumers can take CVE-2026-59890 (#19601).
Authorization and secrets
patchEntity/patchEntitiesauthorize against the URN’s entity type, not the client-suppliedentityTypeargument (#19872).- Manage User Credentials is required to write
corpUserCredentials(GraphQL, OpenAPI, Rest.li) (#19967). - Asset settings, compliance form assignment, and raw analytics search require the intended privileges (#19750).
getSecretValuesno longer fails the whole batch when one secret cannot be decrypted (#19539).
Features
semanticTextaspect — optional curated text used as the embedding source for semantic search, instead of the entity’s full body (#18654).
Ingestion
- confluent-kafka raised to 2.15.1.
- urllib3 2.x (needed by unstructured 0.24.1); vcrpy ≥8.2.0 for aiohttp 3.14 compatibility.
Full Changelog: v1.6.0.2...v1.6.0.3