DataHub v1.6.0.5
Patch release for the v1.6.0 LTS line. Focus is security: November CVE dependency bumps, Jackson 2.22.4, and hardening of the datahub-documents source, which now also works without outbound network access.
Full diff: v1.6.0.4...v1.6.0.5
Operator notes
datahub-documentsno longer parses Markdown links or images, and partitioning has a CPU-time limit. Link and image syntax is kept as literal text, which removes the quadratic parsing path behind CVE-2019-25781. Partitioning one document stops afterpartition_timeout_seconds(default 30 s) (#21204, from #21125).- A document that hits the limit is skipped with a warning and counted in
num_documents_partition_timeout. Its hash is still recorded, so it is not retried until its content changes. Embeddings written by an earlier version are left in place.
- A document that hits the limit is skipped with a warning and counted in
- The spaCy model
en_core_web_smis now bundled in the images.unstructuredloads this model the first time it partitions text. Earlier v1.6.0 images did not include it, sodatahub-documents(and otherunstructured-based sources) downloaded it from github.com on first use. Without outbound access, each document failed after a 120 s timeout withFailed to download spaCy model, and the run still reported success with 0 chunks. The model is now installed in the bundled ingestion venvs of thedatahub-actionsimages and in the fulldatahub-ingestionimage (#21210, from #19554).- Documents that failed this way on v1.6.0.4 or earlier are not re-processed automatically. Their hashes were recorded, so they are skipped as unchanged until their content changes. Edit those documents, or reset the source's state, to have them chunked.
- Loading the model raises the memory used by
datahub-documentsruns. The Helm chart's defaultacryl-datahub-actionsmemory limit (512Mi) leaves little headroom, so consider raising it if you use Documents, especially if runs can overlap.
- Fresh installs of
acryl-datahubwork again.sqlglot[c]is pinned to 30.11.0. PyPI no longer servessqlglotcwheels for 30.7.0–30.10.0, so with the previous 30.8.0 pin every fresh install of this line tried to buildsqlglotcfrom source and failed (#21204).
Security
| Area | Fix |
|---|---|
| Jackson | 2.22.4: jackson-dataformat-smile CVE-2026-104895 (GHSA-h3c2-2m49-r49w, unbounded allocation in the async parser) and jackson-dataformat-cbor CVE-2026-106554 (GHSA-cjg7-h3pr-p927) (#21208) |
| Java runtime libraries | org.json 20260814 (CVE-2026-59171), netty-tcnative 2.0.84.Final (CVE-2026-116541), json-smart / accessors-smart 2.6.1 (CVE-2026-113602) (#21204) |
| unstructured / filelock | unstructured 0.27.37 lifts the filelock<4 cap; filelock 4.2.10 (CVE-2026-112940); snowflake-connector-python resolves to 4.8.1 (#21204)
|
| Other Python | pyasn1 ≥0.6.5 (CVE-2026-119194 / 119195 / 119196 / 119197), markdown ≥3.11.3 (#21204) |
markdown 3.11.3 does not fix CVE-2019-25781 by itself. Advisories list 3.0–3.11.2 as affected, so the floor clears scanners, but 3.11.3 still parses unclosed brackets in quadratic time. The datahub-documents change in the operator notes is the actual fix.
Not included:
- Jackson 2.21.2 / 3.1.2 and org.json 20250107 shaded inside
hazelcast-5.7.0.jar. 5.7.0 is the latest Hazelcast OSS release. - Guava CVE-2026-102554 in the copies shaded into graphql-java and Iceberg. The standalone guava is 33.7.2. Since v1.6.0.4, the embedded Hazelcast rejects Guava classes during deserialization.
- json-smart 1.3.2 and older Hadoop / Hive jars in the
datahub-actionsfull image. They come from the bundled PySpark venv; the slim and locked images do not include it.
Full Changelog: v1.6.0.4...v1.6.0.5