DataHub v1.6.0.4
Patch release for the v1.6.0 LTS line. Focus is security: October CVE dependency bumps, an allow-list for Java deserialization in GMS's embedded Hazelcast, and tighter handling of system client credentials in the Python client.
Full diff: v1.6.0.3...v1.6.0.4
Operator notes
- Embedded Hazelcast only deserializes allow-listed classes from its peers. Allowed: JDK types,
com.hazelcast.*,com.linkedin.metadata.*andorg.javatuples.*(search cache keys). Guava classes, including the copies bundled in graphql-java and Iceberg, are always rejected. Before, any process that could reach the cluster port (5701 by default) could triggerreadObjecton anySerializableclass on the GMS classpath (#20783, from #20776).- No action needed for a standard deployment. During a rolling upgrade from an older version, an upgraded GMS may not be able to read search cache keys that older pods wrote. Eviction skips those keys with a warning, and they expire with the cache TTL (
CACHE_TTL_SECONDS, 10 minutes by default). - If an extension stores its own
Serializabletypes in Hazelcast, allow them withSEARCH_SERVICE_HAZELCAST_SERIALIZATION_ALLOWED_CLASSESorSEARCH_SERVICE_HAZELCAST_SERIALIZATION_ALLOWED_PACKAGE_PREFIXES(comma-separated), or register aHazelcastSerializationAllowListContributorbean. Rejected types fail withHazelcastSerializationException("Resolving class ... is not allowed").
- No action needed for a standard deployment. During a rolling upgrade from an older version, an upgraded GMS may not be able to read search cache keys that older pods wrote. Eviction skips those keys with a warning, and they expire with the cache TTL (
- Breaking (Python client): system client credentials are only sent to the configured GMS. A client created without a token (REST emitter,
DataHubGraph,datahub-restsink) now attachesDATAHUB_SYSTEM_CLIENT_ID/DATAHUB_SYSTEM_CLIENT_SECRETonly when its server matchesDATAHUB_GMS_URL(orDATAHUB_GMS_HOST/DATAHUB_GMS_PORT/DATAHUB_GMS_PROTOCOL). Otherwise it connects without credentials and logs a warning. Hosts are compared as written, sohttp://localhost:8080andhttp://127.0.0.1:8080do not match (#20783, from #20717). - Breaking (Python SDK): the
cloudpip extra is removed.pip install 'acryl-datahub[cloud]'no longer installs the cloud package; pip only warns about the missing extra. Installacryl-datahub-clouddirectly; it pins the matchingacryl-datahub(#20676, from #20325). - Default managed-ingestion CLI version is now 1.7.0.17, so UI-triggered ingestion installs a CLI that includes the dependency fixes below (#20676).
Security
| Area | Fix |
|---|---|
| Frontend SSO | pac4j 6.5.8, play-pac4j 13.0.3 (CVE-2026-82461 / 82462 / 82463 / 82464 / 82465); brings nimbus-jose-jwt 10.9.1, oauth2-oidc-sdk 11.38.2, json-smart 2.6.0 |
| Java runtime libraries | netty 4.2.19, vert.x 4.5.35, reactor-netty 1.3.8, guava 33.7.2, snappy-java 1.1.10.12, protobuf 4.36.2, hadoop 3.4.2 (brings avro 1.11.4), google-api-client 2.9.2, lz4-java 1.11.4 (CVE-2026-106451) |
| starlette / fastapi | starlette ≥1.3.1 (CVE-2026-48710 / 48817 / 48818 / 54282 / 54283), fastapi ≥0.133 |
| aiohttp and friends | aiohttp ≥3.14.4 (CVE-2026-111064), multidict ≥6.9.1 (CVE-2026-104874), mako ≥1.4.2 (CVE-2026-102991), fsspec ≥2026.6.0 (CVE-2026-104851) |
| Auth libraries | authlib ≥1.9.0 (CVE-2026-96760), joserfc ≥1.7.4 (CVE-2026-102946), PyJWT ≥2.15.0 |
| pip / certifi / setuptools | pip ≥26.2.2 and certifi ≥2026.10.19 (GHSA-6q48-6c7w-9gw2), setuptools ≥84.1.0 (GHSA-xmj3-9gf7-h52w) |
| Other Python | pypdf ≥6.19.0 (CVE-2026-103000), snowflake-sqlalchemy ≥1.11.0 (CVE-2026-15736), opentelemetry-api ≥1.45.1 (CVE-2026-114603), urllib3 ≥2.8.0 |
| Node.js | 22.23.4 (October 2026 security release) |
| Images | CA trust store refresh and Python floors in the Docker ingestion constraints |
Not included: oauthlib 4.0.0 (CVE-2026-49264 / 49265). This line uses databricks-sql-connector 2.9.6, which caps oauthlib below 4; oauthlib stays at 3.3.1.
Fixes and CI
- The backported
semanticTextdocument tests now match the v1.6.0 source, soci (3.11/3.12, testQuick)passes on this branch again (#20676). - pytest capped below 10 in the Airflow and Prefect plugin setups; Grafana and Prometheus images pinned in the Grafana integration test (#20783).
Full Changelog: v1.6.0.3...v1.6.0.4