# v2.2.0

## Release Changelog

### v2.2.3

This release rolls up hotfixes on top of v2.2.2.

#### Release Availability Date

2-OCT-2026

#### Recommended Versions

- **CLI/SDK**: 1.7.0.10
- **Remote Executor**: v2.2.3-cloud, v2.2.2-cloud, v2.2.1-cloud, v2.2.0-cloud, v2.1.5-cloud, v2.1.4-cloud, v2.1.3-cloud, v2.1.2-cloud, v2.1.1-cloud, v2.1.0-cloud, v2.0.4-cloud, v2.0.3-cloud, v2.0.2-cloud, v2.0.1-cloud
- **On-Prem Versions**:
  - **Helm**: 2.0.35
  - **API Gateway**: v0.7.3

#### Product

- **Snowflake description removals now propagate** — deleting a column or table description in DataHub now clears the matching comment in Snowflake (`COMMENT ''`). Previously a removal was silently dropped, so the old comment stayed in Snowflake indefinitely while setting and editing descriptions worked. Only an explicit description removal clears the comment; an aspect that simply arrives with an empty description is still ignored, so DataHub never erases warehouse comments it did not write.
- **Ask DataHub hidden in the data source builder when disabled** — the create/edit data source flow now respects `showAskDataHub`. With Ask DataHub turned off, the embedded chat and its floating button are no longer shown, and the builder renders full-width.

#### AI / Ask DataHub

- **Full column descriptions for targeted schema lookups** — when Ask DataHub or an MCP client asks for specific columns (`get_entities` with `schema_columns`, or a `list_schema_fields` keyword match), the full column description, edited description, and deprecation note are now returned instead of a 120-character fragment. This fixes Ask DataHub reporting documented columns as undocumented. Whole-schema browsing keeps the 120-character preview, now cut on a word boundary with a `[+N chars]` marker so the agent knows to request the column for the full text.

#### Bug Fixes

- Fixed deleted DataHub descriptions not clearing the corresponding Snowflake table or column comment.
- Fixed the Ask DataHub chat staying visible in the data source builder when `showAskDataHub` is disabled.
- Fixed MCP schema tools truncating descriptions of explicitly requested columns to 120 characters.

### v2.2.2

This release rolls up hotfixes on top of v2.2.1.

#### Release Availability Date

18-SEP-2026

#### Recommended Versions

- **CLI/SDK**: 1.7.0.10
- **Remote Executor**: v2.2.2-cloud, v2.2.1-cloud, v2.2.0-cloud, v2.1.5-cloud, v2.1.4-cloud, v2.1.3-cloud, v2.1.2-cloud, v2.1.1-cloud, v2.1.0-cloud, v2.0.4-cloud, v2.0.3-cloud, v2.0.2-cloud, v2.0.1-cloud
- **On-Prem Versions**:
  - **Helm**: 2.0.35
  - **API Gateway**: v0.7.3

#### Product

- **Snowflake comment propagation on mixed-case columns** — column-level comment propagation now quotes the resolved column identifier, so a column whose real name is not all upper case no longer fails with `000904 invalid identifier`. Snowflake folds bare identifiers to upper case before lookup; the column name is already resolved from `INFORMATION_SCHEMA`, so it carries Snowflake's real casing and only needed quoting. Catalog, database, and table identifiers are deliberately left unquoted — they come from DataHub URNs in lower case and rely on that same folding to match.
- **Column edits no longer overwrite the table or view comment** — `editableSchemaMetadata` is a whole-aspect snapshot, so editing a column description could propagate as a change to the parent table or view comment. A column edit now propagates only that column's comment.

#### Platform

- **AWS IRSA credential providers (GMS)** — GMS now owns a single process-wide `DefaultCredentialsProvider`, constructed with `builder().build()` and closed on shutdown, and binds JDBC IAM, Iceberg STS vending, and MSK IAM callbacks to it. Extra per-call chains pinned `StsAssumeRoleWithWebIdentityCredentialsProvider` instances on the SDK cache scheduler, so live providers grew by thousands per hour on IRSA tenants until the instance became unresponsive. MSK IAM `awsDebugCreds=true` is forced off, because that path left an unclosed `StsClient`. AWS SDK for Java v2 is pinned to **2.54.16**, `aws-advanced-jdbc-wrapper` to **4.4.0**, and `aws-msk-iam-auth` to **2.3.8**. **Action:** none. After deploying, `jcmd GC.class_histogram` on an IRSA tenant should stay flat for that class rather than growing. See [datahub-project/datahub#19747](https://github.com/datahub-project/datahub/pull/19747).
- **Reindex stall retries** — stall detection no longer starts a second `_reindex` into the same destination while the current Elasticsearch task is still `RUNNING` or its status lookup failed. Stacking reindexes exhausted the retry budget, marked the index FAILED, and deleted a fully copied destination, so the next system-update pod recopied from scratch. A completed-but-short reindex still retries, preserving zero-downtime-upgrade catch-up. Controlled by `ELASTICSEARCH_BUILD_INDICES_WAIT_FOR_UNRESOLVED_REINDEX_TASK` (default `true`). See [datahub-project/datahub#19741](https://github.com/datahub-project/datahub/pull/19741).

#### Ingestion

**Executor:**

- Default managed CLI/SDK is **1.7.0.10**.
- `pycurl` is built against the system OpenSSL in a dedicated image stage, resolving an SSL backend mismatch in the executor images.

#### Security / Dependencies

- **nltk**: 3.10.0 → 3.10.3 across the executor image variants, resolving CVE-2026-62384, CVE-2026-71513, CVE-2026-72818, CVE-2026-78680, CVE-2026-78681, CVE-2026-78682, CVE-2026-79657, CVE-2026-79674, CVE-2026-79675, CVE-2026-79676, and CVE-2026-80206.

#### Bug Fixes

- Fixed Snowflake column-comment propagation failing with `invalid identifier` on columns whose names are not all upper case.
- Fixed a column description edit propagating as a change to the parent table or view comment.
- Fixed GMS accumulating IRSA STS credential providers until the instance became unresponsive.
- Fixed system-update stacking concurrent reindexes into the same destination index and recopying a completed index from scratch.

#### Environment Variables

- **`ELASTICSEARCH_BUILD_INDICES_WAIT_FOR_UNRESOLVED_REINDEX_TASK` (default `true`)** — when a reindex stall is detected, skip the retry while the existing Elasticsearch task is still running or its status cannot be read, instead of starting a second reindex into the same destination. Set to `false` to restore the previous behavior.

### v2.2.1

This release rolls up hotfixes on top of v2.2.0.

#### Release Availability Date

11-SEP-2026

#### Recommended Versions

- **CLI/SDK**: 1.7.0.5
- **Remote Executor**: v2.2.1-cloud, v2.2.0-cloud, v2.1.5-cloud, v2.1.4-cloud, v2.1.3-cloud, v2.1.2-cloud, v2.1.1-cloud, v2.1.0-cloud, v2.0.4-cloud, v2.0.3-cloud, v2.0.2-cloud, v2.0.1-cloud
- **On-Prem Versions**:
  - **Helm**: 2.0.35
  - **API Gateway**: v0.7.3

#### Product

- **Ontology Explorer** — empty states, relationship-type filter fixes, and faster graph materialization when expanding glossary relationships. Defining a structured property as a relationship is now gated (see Platform and Breaking Changes).
- **Data Product search filter** — Data Products are a first-class search filter and facet on their member assets, so you can combine a Data Product with other filters. Membership stays authoritative on the Data Product (`dataProductProperties.assets`); an asset-side `dataProducts` aspect is kept in sync. Existing memberships are populated by the MigrateAspects / ZDU sweep. Set `REPROCESS_DATA_PRODUCT_ASSETS=true` if you need to force a resync. See [datahub-project/datahub#18554](https://github.com/datahub-project/datahub/pull/18554).
- **Microsoft Teams personal connect** — Settings → My Notifications → Connect to Teams reads the tenant ID from Teams integration status, so a configured tenant no longer shows a false "not configured" toast.

#### AI / Ask DataHub

- **Agents in chat and on the home page** — agents with **Show in Ask DataHub Chat** enabled are visible to any user who can view metadata, not only users with Manage Agents. Creating, editing, and deleting agents still requires Manage Agents. Unconfigured and Draft agents stay on the management page.
- **Observation-cluster proposals hidden by default** — Remediation / observation-cluster proposals stay created in the background but are excluded from the Task Center, inbox badge, and review page unless `SHOW_OBSERVATION_CLUSTER_PROPOSALS=true`.
- **Metadata Gap Reporting Tool** — Settings → AI can disable the `note_metadata_observation` MCP tool at runtime (`mcpSettings.observationToolEnabled`). When off, the tool is omitted from MCP `tools/list`, stale clients record nothing, and chat agents drop gap-reporting instructions. The integrations-service `NOTE_METADATA_OBSERVATION_TOOL` env var remains a deploy-level kill switch ANDed with this setting.
- **Legacy observation proposals cleaned up on upgrade** — a one-time system-update step (`SYSTEM_UPDATE_REMOVE_LEGACY_OBSERVATION_PROPOSALS_ENABLED`, default on) hard-deletes still-pending ANNOTATE proposals from the retired per-observation path and marks still-pending POST_ATTACHMENT proposals COMPLETED. Human-created document proposals are not touched.

#### Platform

- **AWS IRSA credential providers** — shared S3, STS, and SQS clients no longer fall through to the AWS SDK default chain when only a region is set, which allocated a new IRSA STS provider per builder. GMS, MAE, and system-update reuse the shared credentials bean or skip construction. **Action:** none on IRSA tenants that already set `AWS_REGION`.
- **Usage analytics on Elasticsearch 8** — usage-event range queries send numeric epoch-millis so date-mapped `timestamp` fields accept WAU/MAU aggregations. See [datahub-project/datahub#19676](https://github.com/datahub-project/datahub/pull/19676).
- **Entity-consistency system-update** — non-blocking entity-consistency scans log progress and an ETA instead of appearing stuck. See [datahub-project/datahub#19388](https://github.com/datahub-project/datahub/pull/19388).
- **Data Product membership writes** — large `dataProductProperties` replacements no longer time out on graph unset side effects; asset comparison is by destination URN and graph scrolls are batched. See [datahub-project/datahub#19465](https://github.com/datahub-project/datahub/pull/19465).
- **Search indexing** — analyzed-text keyword surfaces use a byte-safe `ignore_above` (8191 characters) so multi-byte values no longer drop the entire search document. Applied as an in-place mapping update; no reindex required.
- **Edit Domain privilege** — ingest-time domain writes on existing entities now accept **Edit Domain** or **Edit Entity**, matching GraphQL. Creating a new entity still requires Create/Edit Entity; a domains PATCH on a missing entity cannot be used with Edit Domain alone. See [datahub-project/datahub#19719](https://github.com/datahub-project/datahub/pull/19719).
- **Structured-property mapping merge** — `ESIndexBuilder` no longer mutates caller-supplied mappings in place, so system-update BuildIndices no longer fails with "No index builder found" when semantic search is enabled.
- **OpenTelemetry resource attributes** — `OTEL_RESOURCE_ATTRIBUTES` (for example `k8s.namespace.name`, `service.namespace`) are preserved on the factory `TracerProvider`; `service.name` is merged instead of replacing the autoconfigured resource.

#### Ingestion

**Executor:**

- Default managed CLI/SDK is **1.7.0.9** and Remote Executor **0.3.20**.

#### Breaking Changes

- **Defining custom relationships requires `STRUCTURED_PROPERTY_GRAPH_EDGES_ENABLED=true`.** Previously the flag only controlled whether graph edges were materialized from URN-valued structured-property assignments, so a property could be marked "treat as relationship" while the flag was off and produce no edges. With the flag off (the default), the UI hides that toggle, and writes that set `structuredPropertySettings.isRelationship` or create a `relationshipType` entity are rejected on every API. Properties that are already relationships stay fully editable. Turn the flag on to define new relationships.

#### Security / Dependencies

- **CLI 1.7.0.9 / Remote Executor 0.3.20** — executor-managed ingestion reports no longer persist secrets on disk. No operator action beyond the version bump.
- **transformers**: bumped to 5.17.0 to address CVE-2026-9856.

#### Bug Fixes

- Fixed home / usage highlights returning an empty list on Elasticsearch 8.
- Fixed personal Microsoft Teams connect showing "not configured" when the tenant was already set.
- Fixed non-admins seeing an empty Ask DataHub agent picker and home Agents module for published agents.
- Fixed domain assignment/clear denied at ingest time for principals who have **Edit Domain** but not **Edit Entity**.
- Fixed system-update BuildIndices failing when merging structured-property mappings into semantic-search indexes.

#### Environment Variables

- **`STRUCTURED_PROPERTY_GRAPH_EDGES_ENABLED` (default `false`)** — also gates _defining_ relationships (UI toggle, `isRelationship` writes, and `relationshipType` create). Existing relationship properties remain editable when the flag is off.
- **`MCP_SIDE_EFFECTS_DATA_PRODUCT_ASSETS_ENABLED` (default `true`)**, **`MCP_SIDE_EFFECTS_DATA_PRODUCT_ASSETS_MAX_FANOUT` (default `500`)**, **`REPROCESS_DATA_PRODUCT_ASSETS` (default `false`)**, **`BOOTSTRAP_SYSTEM_UPDATE_DATA_PRODUCT_ASSETS_BATCH_SIZE` (default `1000`)** — control asset-side Data Product membership sync used by the new search filter.
- **`SHOW_OBSERVATION_CLUSTER_PROPOSALS` (default `false`)** — when `false`, observation-cluster (Remediation) proposals are hidden from the Task Center, type facets, totals, inbox badge, and review page. The clustering job still runs.
- **`SYSTEM_UPDATE_REMOVE_LEGACY_OBSERVATION_PROPOSALS_ENABLED` (default `true`)** — one-time cleanup of retired per-observation ANNOTATE / POST_ATTACHMENT proposals. Set `SYSTEM_UPDATE_REMOVE_LEGACY_OBSERVATION_PROPOSALS_REPROCESS=true` to force a re-run.

### v2.2.0

#### Release Availability Date

3-Sep-2026

#### Recommended Versions

- **CLI/SDK**: 1.7.0.5
- **Remote Executor**: v2.2.0-cloud, v2.1.5-cloud, v2.1.4-cloud, v2.1.3-cloud, v2.1.2-cloud, v2.1.1-cloud, v2.1.0-cloud, v2.0.4-cloud, v2.0.3-cloud, v2.0.2-cloud, v2.0.1-cloud
- **On-Prem Versions**:
  - **Helm**: 2.0.30
  - **API Gateway**: v0.7.3

#### Release Highlights

DataHub Cloud v2.2.0 is packed with exciting updates, including:

- **Agents (Private Beta)** — Build purpose-built AI assistants for every data persona, publish them to Ask DataHub chat in one click, and schedule tasks that automatically enrich documentation, tags, and ownership, so your catalog stays current without the manual upkeep. Learn more [here](/docs/features/feature-guides/agents).
- **Agentic Ingestion Configuration** — Root-causes failed runs by reading the connector's actual code. Grounds every answer in the exact configuration schema for your connector. Finds your ingestion source's recent runs automatically. Routes connector questions to the right specialist automatically. Version-aware diagnosis — knows the exact CLI version a run used.
- **One-Click Slack App Install** — App Config & Refresh Tokens are no longer required to install the DataHub Slack App. Simply click 'Connect to Slack' on the Integrations > Slack page to install. Existing installations using App Config, Refresh, and Bot tokens will continue to be supported.
- **Data Discovery & Ontology** — DataHub supports more complex querying of its metadata graph, with new relationship traversal and SPARQL query endpoints. New MCP tools let agents walk the metadata graph without hard-coding relationship types. And the new Ontology Explorer supports viewing how your glossary terms relate to each other. The basic APIs and explorer will be available in 2.2.1, while the SPARQL engine and custom relationships are in private beta; talk to your DataHub representative to enable them.

#### Notable Breaking Changes

Full technical remediation lives in [Updating DataHub](../../how/updating-datahub.md). Source-specific breaking changes appear inline under [Metadata Ingestion](#metadata-ingestion).

- **MCP server: `?token=` query parameter removed to encourage best practices.** Send the access token in `Authorization: Bearer <token>` only. Clients that cannot set headers can use `mcp-remote` with `--header "Authorization: Bearer <token>"`. See [MCP → Connecting & Authenticating](/docs/features/feature-guides/mcp#connecting--authenticating).
- **`getSecretValues` now requires system authentication.** Human users and PATs with `MANAGE_SECRETS` can no longer decrypt secrets via GraphQL; migrate executor, actions, and integrations-service callers to system credentials.
- **Never-expiring access tokens disabled by default.** Set `ACCESS_TOKEN_ALLOW_NO_EXPIRY=true` to restore. Existing tokens are unaffected.
- **Great Expectations SQL profiler removed.** Remove `profiling.method` and the `profiling-ge` extra from recipes; SQLAlchemy is now the only SQL profiler.
- **`semanticModelInfo.datasets` deprecated.** After upgrade, this field no longer writes graph or search edges, and GraphQL `SemanticModelInfo.datasets` returns empty. Metric-to-dataset lineage is missing until you re-ingest. **Action:** Re-ingest Semantic Models so `metricUpstreams` is populated. If you use Snowflake Semantic Views, run `datahub migrate snowflake-semantic-views` first. Customers who do not use Semantic Models can ignore this.
- **Lineage scroll API contract changed.** `POST /openapi/v3/lineage/scroll` now takes a single `urns` list and `direction` of `UPSTREAM` / `DOWNSTREAM`.
- **Subscriptions inherit notification defaults.** Omitting `notificationSettings` uses the actor's current defaults at delivery time; send `sinkTypes: []` explicitly for no-sink subscriptions.
- **APAC Bedrock cross-region prefix.** Sonnet 4.5+ models require the `au` or `jp` prefix, not legacy `apac`, for APAC deployments.
- **Observe: Anomaly detection assertions require 14 days of history** before alerting; existing predictions are preserved during temporary retraining-data shortages. This gives the assertion more time to detect daily and weekly patterns and avoid noisy false alarms.
- **OpenAPI v2 entity APIs deprecated.** Plan migration to `/openapi/v3/entity` and `/openapi/v3/relationship`.
- You can no longer, through the UI, create legacy propagation automations (Tag Propagation, Glossary Term Propagation, and Column Documentation Propagation). These are replaced by the new Lineage Propagation automation. You can still run and edit pre-existing automations via the UI, and create legacy ones via API.

#### User Experience

This release includes significant improvements to the user interface and user experience.

##### Data Product Marketplace & Hierarchical Data Products

DataHub v2.2.0 introduces a dedicated Data Products experience for managing **Data Products** and first-class support for **parent–child taxonomies**. Together, these changes make it easier to model and discover data products.

Both capabilities are enabled by default after upgrade.

- **Dedicated browse experience** at `/dataProducts` with a left-nav **Data Products** entry (Govern section).
- **Hierarchical sidebar** to expand/collapse root and child Data Products, with infinite scroll, Domain filter, and in-sidebar autocomplete search.

##### Domain and Data Product proposals

Stewards can now propose creating Domains and Data Products through the existing accept/reject workflow, with a new `Propose Create Domain` platform privilege and steward inbox rendering. This matches the glossary-term propose flow that shipped earlier and gives governance leads an audit trail for structural additions to the catalog.

##### Ontology Explorer

Explore your business glossary's relationships with the new Ontology Explorer. Similar to the lineage graph, the explorer lets you visualize how your glossary terms relate to one another, via built-in and custom relationships. Supports search, filtering by relationship type, and expanding to see further related glossary terms. Available globally in 2.2.1, via the navigation sidebar and on the new Relationships tab of the glossary term entity page.

##### Semantic Model container lineage

Semantic Models now render as grouping containers in the lineage explorer rather than as intermediate hops on the lineage path. Datasets and metrics belonging to a model appear inside a bounding box (similar to Data Products), while metric lineage flows directly through the logical datasets a metric reads from: **Metric → Semantic Model Dataset → Physical Dataset**.

**Note:** Existing semantic-model metadata may need a re-ingest or migration run so metric lineage is populated in the new shape. See **Notable Breaking Changes** above.

##### Volume assertion accuracy

Greatly improved anomaly detection reliability. Predictions align better with sub-daily seasonality, remain more stable over time, and use practical sensitivity bounds to avoid false positives.

##### Other Improvements

- **Slack bot service-account mappings** — map a Slack `bot_id` to a corp user so automated `@DataHub` mentions from approved bots are answered instead of refused.
- **Support OAuth login** — support staff can authenticate via the support OIDC provider with ticket-bound one-hour tokens (no refresh tokens).
- **Japanese i18n locale (Beta)** — Japanese translations can be enabled when internationalization is turned on for the instance (`I18N_ENABLED=true`).
- **Parent Data Products** — nested data-product taxonomies via `dataProductProperties.parentDataProduct`.
- **Glossary Term AI throttling** — opt-in caps on concurrent term-classification pipelines and per-run / per-minute batch sizes prevent integrations-service overload when many automations run together.
- **AI agent ownership** — AI agent entities can be assigned as owners on assets in the UI and GraphQL APIs.
- Fixed lineage graphs for view-restricted users rendering Restricted nodes instead of failing when neighbors are unviewable.
- Fixed container filter expansion on equality conditions breaking search filters.
- Fixed Custom SQL Assertion UI now correctly displays floats in condition inputs.
- Fixed Ask DataHub send button hidden on smaller screens.
- **Observe**
  - Skip freshness assertion queries until due — Freshness Anomaly detection was polling warehouses for updates too frequently (minimum once per hour). Queries are now delayed until the next predicted update, with more frequent polling after staleness is detected.
  - Assertion notification emails have a refreshed layout. Footer labels renamed to `Alert ID`, `Assertion URN`, and `Dataset URN`. **If you match on the old footer for deduplication in your email integrations (e.g. PagerDuty), update your regexes.**
  - Fixed issue where assertion backfill jobs would get stuck forever.
  - Assertions created by Monitoring Rules no longer error at midnight.
  - The UI for Custom SQL Assertions now correctly display floats for conditions.

#### Metadata Ingestion

We're continuously improving our integrations to add new capabilities and squash bugs.

##### New Sources

- **S3 and GCS CLI version matrix sources** — ingestion sources backed by object-store version matrices for CLI release tracking ([datahub-project/datahub#18202](https://github.com/datahub-project/datahub/pull/18202)).
- **Alias Aspect creation on GMS side** for new ingestion and backfill for older entries (needed as a prerequisite for the URN Casing feature) ([datahub-project/datahub#18679](https://github.com/datahub-project/datahub/pull/18679), [datahub-project/datahub#19138](https://github.com/datahub-project/datahub/pull/19138), [datahub-project/datahub#18639](https://github.com/datahub-project/datahub/pull/18639)).

##### Existing Sources

- **Kafka / Kafka Connect:**
  - Confluent Cloud Stream Catalog metadata support ([datahub-project/datahub#18764](https://github.com/datahub-project/datahub/pull/18764)).
  - Kafka Connect: SQL Server treated as three-level (`database.schema.table`); Oracle JDBC sink URNs emit `schema.table`. **See source-specific breaking changes below.**
- **Glue:** Cross-account platform instances and Lake Formation resource-link lineage ([datahub-project/datahub#17963](https://github.com/datahub-project/datahub/pull/17963)).
- **Power BI:** Elasticsearch ODBC sources resolve to the `elasticsearch` platform ([datahub-project/datahub#18716](https://github.com/datahub-project/datahub/pull/18716)).
- **ODCS:** Import contracts from S3, GCS, HTTP, and Git, plus a UI form for the source ([datahub-project/datahub#18477](https://github.com/datahub-project/datahub/pull/18477), [datahub-project/datahub#18474](https://github.com/datahub-project/datahub/pull/18474)).
- **Snowflake:**
  - Semantic views preserve logical-table casing.
  - New opt-in `preserve_column_case` for quoted mixed-case columns.
  - Profile field paths align with schema paths.
- **Snowflake / Oracle SQL profiling:** Case-colliding quoted columns no longer silently dropped during reflection; warnings surface when statistics cannot attach to distinct fields.
- **Elasticsearch source:** Uses `opensearch-py` and supports both Elasticsearch and OpenSearch clusters.
- **Document sources:** `min_text_length` now defaults to `0` for `datahub_documents`, Notion, and Confluence so short documents embed by default ([datahub-project/datahub#19103](https://github.com/datahub-project/datahub/pull/19103)).
- **Ingestion log GC (opt-in)** — `DATAHUB_EXECUTOR_LOG_GC_ENABLED` deletes aged per-execution log directories with retention and size-cap tunables (default off). See [Remote Executor best practices](/docs/managed-datahub/remote-executor/best-practices#storage).
- **Executor:**
  - Stop per-run uv cache duplication of acryl-datahub.
  - Fix cancelled zombie processes bug.

##### Source-specific breaking changes

- **Kafka Connect** — SQL Server / Oracle URN shape changes. Set `schema.name` when warnings appear.
- **Semantic-anchor `output_dir` removed** — remove from recipes and rely on the executor-provided `INGESTION_ARTIFACT_DIR`.
- **Snowflake:**
  - New opt-in `preserve_column_case` for quoted mixed-case columns.
- **Remote executor** defaults to use hardlinking for uv cache. For read-only filesystems, see [best practices](/docs/managed-datahub/remote-executor/best-practices#read-only-root-filesystem).

#### API, SDK, and MCP

##### MCP Tools and Skills

- New tools: **`get_metadata_graph`** and **`get_relationships`** — expose the relationship vocabulary and let agents walk the metadata graph without hard-coding type names. Disabled by default in Private Beta.
- **Ask DataHub Skill loader** — on-demand skill loading via a `Skill` search tool replaces the planner LLM. Currently only supports built-in skills, but will evolve to support user-customizable skills in future versions.
- **External MCP plugin validation** — connecting an AI plugin verifies it exposes tools; zero-tool servers fail connect with actionable guidance; chat disables empty plugins without dropping previously stored credentials.
- **Bug Fix:** Fixed MCP clients sending chunked `initialize` POSTs failing the handshake with HTTP 400.

##### GraphQL & OpenAPI

- **Relationship schema export** — `GET /openapi/v3/relationship/schema` returns the relationship graph as RDF (Turtle default, JSON-LD, N-Triples, RDF/XML).
- **Structured-property search ranking (opt-in)** — properties marked `useAsRankFeature` drive recall and ranking. Requires mapping rollout and `RestoreIndices` backfill for existing assets. Enable with `SEARCH_STRUCTURED_PROPERTY_RANK_FEATURES_ENABLED=true`.
- **Domain-scoped entity create for writers** — domain-separated writers can create entities with proposed domains in-batch without a separate unscoped create policy ([datahub-project/datahub#18944](https://github.com/datahub-project/datahub/pull/18944)).
- **`VIEW_SYSTEM_STATUS` privilege** — read messaging consumer lag, transport, and registered consumers without full system-operations access.

##### Deprecations

- **Grafana operational dashboard (`/admin/dashboard`)** — tombstoned in 2.2, disabled in 2.3, removed in 2.4. Operational signals move to public APIs and Observe. Controlled by `GRAFANA_DASHBOARD_MODE`.
- **OpenAPI v2 entity and relationship APIs** — deprecated in favor of v3. Timeseries, platform ingest, and timeline v2 endpoints are unaffected.
- **`semanticModelInfo.datasets`** — stop populating. Use `semanticModelProperties.semanticModel` and `metricUpstreams` instead.
- **`ENABLE_BEDROCK_OPTIMIZED_LATENCY`** — removed. Was a no-op for current model families while inflating cost estimates.
- **`hideChatBetaLabel`** — removed. Ask DataHub is GA; remove the env var if set.

#### Security Notes

- Bumped **Logback** to 1.5.38 (CVE-2026-9828, CVE-2026-10532), **Log4j** to 2.25.5 (CVE-2026-49844), **Parquet** to 1.18.0 (CVE-2026-54512, CVE-2026-54513), and **libthrift** to 0.23.0 (CVE-2026-43869). No client action required beyond a standard upgrade.
- **Stored XSS fixes** in GraphQL / UI paths ([datahub-project/datahub#19298](https://github.com/datahub-project/datahub/pull/19298), [datahub-project/datahub#19299](https://github.com/datahub-project/datahub/pull/19299), [datahub-project/datahub#19300](https://github.com/datahub-project/datahub/pull/19300)).
- **DuckDB analytics SQL injection hardened** — read-only sandbox, sqlglot allowlist parser, and `canViewForms` authorization on Forms analytics.

#### Known Issues

- **Policy name search after upgrade** — existing policies are invisible to name search until a scoped `RestoreIndices` backfill for `dataHubPolicyInfo` completes.
- **OpenSearch 2.x bridge semantic search** — do not enable semantic search on OpenSearch 2.x builds containing the pre-fix bridge kNN filter regression; hold until a build containing the fix ships, or run Elasticsearch 8.
- **Elasticsearch mapping repair** — indices with dynamically inferred `text` fields where `keyword` was expected require a one-time reindex with `ELASTICSEARCH_INDEX_BUILDER_MAPPINGS_REINDEX=true` on system-update. See [Updating DataHub](../../how/updating-datahub.md).
- **Tableau + Snowflake `preserve_column_case`** — Tableau column-level lineage may not match until Tableau resolves ingested Snowflake casing. Ingest Snowflake before Tableau when enabling the option.