open-metadata/OpenMetadata 2.0.6-release

on GitHub

Changelog

OpenMetadata 2.0.6 is a maintenance release that makes metadata ingestion more accurate, upgrades safer, and Data Quality results easier to trust. It improves search, lineage, governance workflows, sign-in and role synchronization, while fixing several navigation and product-tour issues in the user interface (UI). The release also strengthens multi-pod deployments and addresses security vulnerabilities in application dependencies and content handling.

🔌 Connectors and Ingestion

This release includes the following connector and ingestion fixes:

• CockroachDB partition details could be incomplete or duplicated #34894: Tables with multiple partition columns now show the correct columns, without duplicates or values accidentally taken from a similarly named table in another database.
• Some dbt snapshot lineage links were missing #34930: Ingestion now keeps the upstream table it already found and uses that exact table when creating lineage, avoiding failed second lookups.
• Omni dashboards could be ingested without their owners or lineage #35259: Omni ingestion now connects dashboards to the correct owners and upstream data assets.
• Teradata query usage and lineage were missing #35258: The connector now reads Teradata's database query log (DBQL) to show which tables are used and how data moves between them.
• Auto-classification ignored sample budgets above 50 rows #35492: SQL and NoSQL samplers now honor configured budgets up to 1,000 rows while continuing to store at most 50 sample rows.
• dbt manifest catalogs didn't match their OpenMetadata databases #35599: A new catalogMapping option resolves tables and compiled-SQL lineage when engine catalogs and ingested database names differ.
• MySQL and MariaDB views disappeared when the ingestion user lacked SELECT #35619: View columns fall back to information_schema when DESCRIBE is denied, allowing metadata-only ingestion with SHOW VIEW and REFERENCES privileges.
• Athena views were duplicated or ingested when includeViews was disabled #35600: Athena now emits each view once and respects the view-ingestion setting.
• Athena could mix unrelated query history or lose Iceberg type details #35699: Query history is now limited to the right catalog and workgroup, lineage is rebuilt from the correct statements, and Iceberg column types are preserved.
• AWS Glue could omit view definitions and external-table lineage #35607: Glue ingestion now captures view SQL, Iceberg columns, decimal precision, and lineage from external tables accurately.
• Test Connection hid the invalid configuration field behind a generic conversion error #35708: Validation errors now identify the field that needs correction.
• Force sync didn't refresh custom properties supplied by a connector #35707: A force-sync run can now replace connector-managed custom-property values.

📊 Data Quality

This release includes the following data quality fixes:

• Data Quality runs could report success even when tests never completed #34848: Tests aborted by connection failures, unsupported SQL, or calculation errors now count as execution failures, making the workflow status and success percentage trustworthy.
• Quality rules imported with an Open Data Contract were saved but never run #34176: Supported Open Data Contract Standard (ODCS) rules now create linked OpenMetadata test cases that run during contract validation and remain intact across imports and exports.
• Range and boolean checks could report the wrong number of failed rows #35276: Data Quality tests now evaluate open-ended ranges and true/false value sets correctly, and clearly abort when the configured column no longer exists.

🛡️ Data Governance and Quality

This release includes the following governance and data quality fixes:

• Automatically detected sensitive-data tags could show the wrong reason #35206: Each tag now identifies the detector that produced the strongest match and shows only the patterns that detector matched.
• The Mentions task view could fail with a server error #35216: Mention filtering now reads the correct task reference and works for usernames containing dots on MySQL and PostgreSQL.
• Glossary searches lost matching terms whose parents didn't match #35287: Search results now retain the parent hierarchy for every matching glossary term.
• Nested glossary search matches stayed collapsed in the term picker #34955: The picker now expands the hierarchy needed to reveal matched terms.
• Glossary import help failed to load, and some valid approvals left terms stuck in review #35302: The import page now shows the correct CSV guidance, and approvals from authorized administrators or owners update the term while direct edits still require reviewer permission.
• Data contracts were difficult to find and didn't fully appear on their assets #35709: Contract links now open the owning asset, tables inherit approved contracts from their schema, and contract changes appear in the asset's activity feed and notifications.
• Glossary CSV re-import failed when related terms were in the same file #35739: Dry runs and imports now resolve new and existing related terms without looking up unpersisted placeholder identifiers.

🔍 Search and Discovery

This release includes the following search fixes:

• A reindex stop request could be lost before the job started #35186: Reindex jobs now honor stop requests that arrive during startup.
• Hybrid search could appear healthy without successfully running a query #35325: The health check now runs an actual search instead of only inspecting the saved configuration.
• Negative search pagination reached the engine and returned a server error #35302: Search endpoints reject negative offsets and sizes with a clear 400 response, and the UI no longer sends them.
• Malformed search input surfaced as a server error #35440: Invalid queries are now handled as client errors instead of internal failures.
• Searches against unmanaged indexes returned an internal error #35517: Requests for indexes outside OpenMetadata's index set now return a clear 400 response.

🔀 Lineage

This release includes the following lineage fixes:

• Deleting a pipeline made its lineage edges unwritable #35315: Lineage edges remain editable after their associated pipeline is deleted.

🔐 Authentication

This release includes the following authentication fixes:

• Single sign-on failed when an identity provider used a custom username claim #34968: OpenMetadata session tokens now include the mapped username and email values, preventing repeated 401 Invalid JWT token responses after sign-in.
• Removing a user's final identity-provider role didn't remove their OpenMetadata access #35353: A fresh sign-in now removes roles and administrator access that the provider no longer grants, while accounts explicitly configured as administrators remain protected.
• Redis Cluster deployments could fail during sign-in or cache updates #35673: Session and cache operations now group keys in a Redis-compatible way, preventing CROSSSLOT errors in clustered environments.

⚙️ Platform

This release includes the following platform fixes:

• Upgrades could run pending migration steps in the wrong order #34943: Migrations now follow one version sequence and inspect only the connected database, making upgrades more predictable in environments with multiple databases.
• The packaged operations script wasn't executable #34999: Distributions now ship bootstrap/openmetadata-ops.sh with executable permissions.
• Git workflow failures could leave a run without a clear failed status #35239: Workflow runs now report unhandled Git sink errors, recover failed batches more safely, reject invalid Git triggers, and can be terminated when they are stuck.
• One deleted service could block every ingestion pipeline from being listed or redeployed #35400: Pipelines belonging to soft-deleted services are now shown safely and skipped during upgrade redeployment instead of failing the entire operation.
• Long-running operations commands inherited the request query timeout #35421: Operations commands now run without the interactive request timeout.
• Imports and exports could appear stuck in multi-pod deployments #34643: A Redis or database-backed relay now delivers completion updates to the pod holding the user's connection, and large import results are downloaded separately to keep notifications reliable.
• Client WebSocket disconnects were logged as server failures #35545: Expected disconnects no longer produce misleading server-error logs.

🎛️ UI

This release includes the following UI fixes:

• The connection editor could trap users when there was nothing to save #34960: Saving an unchanged form or confirming Discard now closes the editor immediately instead of requiring another click or browser-back action.
• The What's New alert left excess space when a release date was absent #35313: The panel now sizes to the content it actually displays.
• Test Connection failures could appear successful or push actions out of view #35331: Failed steps use error styling, structured diagnoses render even without a raw log, and long logs scroll within a bounded area.
• The product tour could fail to start or highlight content outside the visible page #35344: The tour now uses self-contained sample data, opens directly in the guided layout, and keeps each highlighted element visible.
• Opening a column detail panel reset the table to page one #35359: Column pagination remains in the URL when the panel opens or closes, and copying a column link no longer opens the panel.
• Sub-domain names weren't clickable in list view #35758: Clicking a sub-domain name now opens that sub-domain.

🔒 Security

This release includes the following security updates:

• Database, encryption, and collection libraries contained known vulnerabilities #35246: PostgreSQL JDBC moves to 42.7.14, BouncyCastle to 1.86, and Guava to 33.7.2-jre, addressing CVE-2026-107314, CVE-2026-107315, CVE-2026-18036, CVE-2026-71891, and CVE-2026-102554.
• Apache Thrift contained an input-validation vulnerability #35243: The Java libthrift dependency moves to 0.25.0 for CVE-2026-82458.
• Handlebars contained critical template-processing vulnerabilities #35266: Handlebars moves to 4.7.10 to address CVE-2026-33937 and the related own-property-check bypass.
• A crafted mention or hashtag link could bypass unsafe-link filtering #35272: Links are now accepted only when they use HTTP(S), point to a safe path within OpenMetadata, or reference a location on the current page.
• Ingestion images included unused vulnerable compilers and tools #35257, #35289: Runtime and CI images no longer carry unnecessary build tooling.
• Unusual asset names could break or alter SQL generated by connectors #35376, #35410: Databricks, Trino, Athena, Impala, Domo, Hive, MySQL, MariaDB, and Snowflake connectors now safely escape identifiers or reject names that cannot be quoted securely.
• Markdown descriptions displayed encoded characters in API and MCP clients #34562: Plain Markdown now preserves backticks and apostrophes, while descriptions containing HTML continue through the existing security sanitizer.
• Startup logs could expose secrets passed through JAVA_TOOL_OPTIONS #35518: Launchers now pass JVM options through a short-lived file descriptor without echoing their values.
• Hibernate Validator and Java JWT required security updates #35605: The dependencies move to Hibernate Validator 8.0.6.Final and Java JWT 4.6.2; the same backport also retains the patched Guava 33.7.2-jre version.

Full Changelog: 2.0.5...2.0.6