Skip to main content

v2.4.0

Release Changelog​

v2.4.0​

Release Availability Date​

4-NOV-2026

  • CLI/SDK: 1.7.0.19
  • Remote Executor:
    • Image: v2.4.0-cloud, v2.3.6-cloud, v2.3.5-cloud, v2.3.4-cloud, v2.3.3-cloud, v2.3.2-cloud, v2.3.1-cloud, v2.3.0-cloud, v2.2.3-cloud, v2.2.2-cloud, v2.2.1-cloud, v2.2.0-cloud, v2.1.5-cloud, v2.1.4-cloud, v2.1.3-cloud, v2.1.2-cloud, v2.1.1-cloud, v2.1.0-cloud
    • Helm chart: 0.0.77
  • On-Prem Versions:
    • Helm: 2.0.115 (acryl-datahub from https://helm.acryl.io)
    • API Gateway: v0.7.3

New Feature Highlights​

  • Lineage "Group by" lens and lineage filters (Beta): collapse lineage by platform, domain or glossary term, filter it by any search facet, save lenses, and share grouped views by URL, with matching MCP tools. Lineage "Group by" and lineage filters are currently in Beta. Expect ongoing improvements.

  • Ask DataHub workspaces and sharing: organize chats into workspaces with their own instructions and memory, and share chats by link as read-only.

  • More dynamic Ask DataHub answers: streamed answers, inline agent steps, interactive lineage, and approvals you can grant for the rest of a chat.

  • New MCP tools: proposal review tools, lineage group tools, grep_entities, get_catalog_inventory, and support for WITHIN filters for Domains and Containers, with Ask DataHub and skills on the default MCP server.

  • Proposal review page with Refine with Agent: a full-page diff for reviewing and editing description proposals, and agent-assisted refinement.

  • Remote Executor observability: detailed status and a resources & settings report on the Executors page.

  • Ingestion Agent: the Ingestion Agent now covers the full ingestion lifecycle: creation, monitoring, and troubleshooting. Probe support for 20+ connectors, with more coming soon. Probes let the agent interact directly with your source through gated methods, so it can diagnose issues with real context.

  • Note Breaking Changes: https://datahubproject.io/docs/how/breaking-changes/

Product​

  • Lineage "Group by" lens (Beta): Lineage "Group by" and lineage filters are currently in Beta. Expect ongoing improvements. The lineage graph's "Group by" selector collapses consecutive assets that share a platform, domain or glossary term into one node with a member count, a members sidebar and shareable URLs (?group_by=PLATFORM). Admins with the new Manage Lineage Lenses privilege can save their own lenses (attribute, values to consider, how to group multi-valued assets, and a label for the rest). Assets a user can't view form restricted groups that show only a count.
  • Repository lineage for pipelines and tasks: pipelines and tasks can link to the Repository that holds their source code, shown in lineage, and the manual lineage picker offers Repository as an upstream.
  • Lineage: a DataFlow's Lineage tab shows the flow's own lineage.
  • Proposal review page: description proposals (including column descriptions) and proposals to create glossary terms, glossary nodes, domains and data products open on a full page from the inbox, with a diff of the current and proposed text. Reviewers can edit the proposal before accepting it, or click Refine with Agent to work on it with Ask DataHub.
  • Glossary term lifecycle: a glossary term's ⋮ menu offers Change stage / Propose stage change. Users with Edit Entity or Edit Lifecycle Stage change the stage directly; grant only Propose Lifecycle Stage to require approval. Stage proposals send email, Slack and Teams notifications, and stage changes appear in the term's change history.
  • Glossary term versions: with entity versioning on, New version in a term's menu creates a draft pre-filled from the current term, with its domain, owners, tags, links, related terms and structured properties. The current version stays live until the draft is published. Also available as createGlossaryTermVersion and the create_glossary_term_version MCP tool.
  • Multi-approver access requests: an approver who has already approved a multi-approval step still sees the request while it waits for the other approvers for Access Workflows Private Beta feature.
  • API entities: API entities get a UI page, and an API's input and output schema can point at existing Dataset entities, which then appear in lineage and on the API's Signature tab.
  • Views with nested conditions: View filters support nested AND / OR / NOT conditions.
  • Restricted containers: with view authorization on, users can open an asset whose parent container they cannot view. The container shows as restricted instead of breaking the page.
  • Metadata Tests: the test builder adds a Data Products property for data assets, and supports the agent registry entity types (Application, Repository, Service, API, Agent Skill, AI Agent) with tag, glossary term, owner, domain, structured property, deprecation and data product actions and their own properties.
  • Descriptions: a description a user cleared stays blank everywhere instead of falling back to the ingested text. Only AI-generated documentation shows over a cleared description.
  • Snowflake Metadata Sync: a new Sync descriptions from logical models option syncs descriptions propagated from a logical model to Snowflake tables and columns as comments, unless the asset has its own description edited in DataHub. It is off by default; when on, Initialize back-fills these assets and replaces their existing comments.
  • Usage & Billing dashboard: loads in a few seconds instead of about 20, shows readable names for AI modules, and keeps the 90-day average label when grouping by instance.
  • Faster first load behind proxies: the home page loads far fewer scripts before first paint, which speeds up first load for users who reach DataHub over HTTP/1.1 corporate proxies.
  • Metrics on by default: Metrics are enabled by default, with a Beta badge in navigation.

AI & Context​

  • Ask DataHub workspaces: group chats into workspaces in the Ask DataHub sidebar. Each workspace has its own home page, instructions and memory, which Ask DataHub applies to every chat in it. Drag chats between workspaces, and search sidebar chats by title.
  • Share Ask DataHub chats: share a chat or workspace with a link. Anyone signed in can open it read-only. The owner can see who opened the link, block one person, or turn the link off. Chats and workspaces shared with you are listed in the sidebar.
  • More responsive answers in the web UI: answers stream as the model writes them, and each turn shows its steps in order: inline text, "Thought for N seconds" rows, one expandable row per tool call with its input and result, and background work. Reloaded conversations show the same steps. Slack, Teams and MCP are unchanged.
  • Interactive lineage in chat: Ask DataHub can render an explorable lineage graph inline, alongside its existing cards, tables and charts.
  • Tool approvals: approval cards fit on one line, and the agent's reason and the tool inputs are behind a caret. Allow for this chat approves a tool for the rest of the conversation, limited to the same resource. Calls that ran under "Always allow" are listed, and the chat shows what each approval and turn did.
  • New MCP tools:
    • grep_entities (on by default) searches every aspect of an entity and returns only the matching snippets.
    • get_lineage_groups, get_lineage_group_members and list_lineage_lenses summarize lineage by lens.
    • Proposal tools for tags, terms, owners, domains, descriptions, structured properties and lifecycle stage, plus get_proposal and update_proposal.
  • MCP search: search and search_documents support WITHIN filters for nested domains, containers and documents, and return each result's last-modified date.
  • MCP: entity tools return custom properties for Query and twelve more entity types.
  • MCP and siblings: get_entities and list_schema_fields merge descriptions, documentation, tags and glossary terms from a dataset's siblings, as the UI does, so a warehouse table's columns show the docs written on its dbt model.
  • MCP and Metrics: get_entities and get_lineage return Metric and Semantic Model details, and a semantic model dataset's columns include their field logic (role, aggregation, expressions and time dimension). search results include metric names and descriptions.
  • Ask DataHub on the default MCP server: the default /mcp server exposes Ask DataHub as the ask_agent__ask_datahub tool.

Platform​

  • Lineage API: new GraphQL queries lineageGroups, lineageGroupMembers and lineageLenses. Grouped lineage can be filtered by any search facet.
  • Authorization hardening:
    • Reading global settings over REST requires Manage Global Settings.
    • Running metadata tests through GraphQL requires Manage Tests.
    • Reading OAuth clients, sessions and connections through the generic entity APIs requires Manage All Access Tokens or Manage Connections.
    • Credential and invite-token reads and writes require Manage User Credentials.
    • A new View Entity Queries privilege covers datasets, charts and data jobs.
    • Tag and structured-property privilege constraints are enforced on PATCH writes, and version-set, upsertCustomAssertion, patchEntity and logicalParent writes are properly authorized.
    • Every integrations service /private route requires a credential.
  • Search ranking for users and groups: a user's or group's display name (and a user's full name) is treated as its name in search, so an exact display name ranks the person first and partial first names match.
  • Search engine version override: set ELASTICSEARCH_SHIM_ENGINE_VERSION to skip the cluster version probe when the search user lacks cluster:monitor/main, so ranked semantic passages work on such clusters.
  • Conditional writes on generic patches: If-Version-Match / If-Modified-Since headers are honored on generic JSON patches. See Breaking Changes.

Ingestion​

New ingestion sources:

  • Google Drive (Alpha): ingests Google Docs from chosen folders and shared drives as Document entities, so they are searchable (including semantic search) and usable as context.

Connector improvements:

  • Aerospike: socket_timeout is now honored on queries. (#17584)
  • Airflow plugin: object-storage datasets from OpenLineage get the same URNs as the S3, GCS and Azure Blob Storage sources and the Spark agent; worker scratch files and BigQuery temp datasets are skipped by default; new inlet/outlet filter; no longer re-runs OpenLineage facet extraction when the OpenLineage provider is also enabled. See Breaking Changes. (#20284, #19910)
  • Azure Blob Storage: platform metadata and logo are registered, so ABS datasets show their platform correctly; reserved characters in object paths are encoded in dataset URNs. (#19416, #20220)
  • Azure Data Factory: new databricks_default_catalog and databricks_catalog_map options fully qualify Databricks lineage, and cross-platform lineage resolves real database/catalog names and platform instances; static lineage for SQL Server, Synapse, MySQL, PostgreSQL, MongoDB and Oracle linked services includes the database from the connection; activities nested in ForEach / IfCondition / Until / Switch now produce lineage; probe support. (#19494, #20120, #20625)
  • BigQuery: row count and size for materialized views; opt-in capture_job_labels_as_query_properties links queries back to the Airflow DAG/task that ran them; date-suffixed tables next to an un-suffixed table of the same name are no longer treated as shards that overwrite the real table's schema and profile; require_partition_filter read from the table-level field; jobs with temp UDFs or trailing semicolons no longer lose lineage; linked datasets emit lineage in lineage-only recipes and when schema metadata is off. (#19514, #20145, #19430, #19524, #20021, #19836)
  • Cassandra / ScyllaDB: tables and views with populated extensions no longer fail to ingest. (#19863)
  • ClickHouse: much faster query-log lineage and usage; query-log usage uses the tables and columns ClickHouse resolved and removes repeated query shapes, so usage totals can change; new include_config_file_dictionaries option ingests dictionaries defined in server config files; lineage covers all typed dictGet* functions. (#19955, #20222, #20274)
  • Databricks / Unity Catalog: probe support; usage is written only for tables the recipe ingests and resolves tables locally; hive_metastore tables joined with Unity Catalog tables now get usage; column-level lineage matches mixed-case columns; fixed parameterized system-table queries failing on SQL warehouses. (#20125, #20282, #20439, #20367, #20194)
  • DataHub Documents (semantic chunking): SYSTEM documents and documents hidden from global search are embedded; documents are re-embedded once after semantic search is turned on or the embedding model changes; very large documents no longer fail the run; orphaned index entries no longer fail the run. (#20143, #20164, #19797, #20215, #19944)
  • Dataplex: glossary term associations now work end to end, including on containers; probe support. (#17553, #20127)
  • dbt / dbt Cloud: manifest_path accepts glob patterns for multi-project ingestion; a new emit_semantic_model_entities setting emits dbt semantic models and metrics as Semantic Model and Metric entities on DataHub Cloud, and semantic models are no longer modeled as warehouse tables; tests given their own name use it as the assertion title, and a test's description becomes the assertion note; skipped tests are no longer reported as failures; unchanged lineage and assertions are no longer re-stamped every run; duplicate owners deduplicated; freshness assertions attach to the right platform instance; sibling entities the warehouse connector skipped now sit in their real database and schema folder; dbt Cloud reports a failure when auto-discovery finds no jobs. See Breaking Changes. (#19473, #19987, #19988, #20544, #20064, #20333, #20240, #20343, #19547, #19973, #20313)
  • Dremio: container paths follow the emitted parents, so mixed-case catalog listings no longer create orphan containers. (#20635)
  • Fabric OneLake: probe support. (#20127)
  • Fivetran: probe support. (#20120)
  • Glue: tables shared through Lake Formation database-level resource links get upstream lineage and consistent URNs; probe support. (#20315, #20130)
  • Hex: queriedTables lineage resolves table casing against ingested schemas, fixing broken Snowflake upstreams. (#19162)
  • Hive / Presto: the unmaintained PyHive driver is replaced by impyla (Hive, Spark Thrift) and presto-python-client (Presto). (#20350)
  • Iceberg: probe support. (#20113)
  • Kafka Connect: probe support. (#20120)
  • Looker / LookML: probe support; cross-project imported views keep their project, restoring explore lineage; transport_options.headers is optional; remote_dependency and local_dependency entries in manifest.lkml are read, so the executor clones remote dependencies over https or SSH and constants from local projects resolve. Set remote_dependency_domain_pattern to the hosts you expect, and restrict executor egress. (#20126, #19306, #19659, #19715)
  • Mode: charts are ingested again, restoring report-to-query lineage. (#19941)
  • MySQL: the mysql extra installs cryptography, needed for MySQL 8 caching_sha2_password authentication. (#20036)
  • ODCS (Open Data Contract Standard): contracts are emitted as native DataHub data contracts (shown on the Contract tab), and contract datasets can be added to their Data Product as output ports. (#18480, #18723)
  • OpenAPI: typed get_token config with credential-leak hardening, stricter malformed-input handling, and a working acryl-datahub[openapi] extra. (#19905, #19906, #20059)
  • Power BI: lineage to Trino / Starburst from M-Query; probe support. (#19974, #20119)
  • Redshift: dedicated probe provider replacing the generic SQLAlchemy probe. (#20129)
  • S3 / GCS / Azure Blob Storage (data lakes): new enable_schema_inference flag to skip schema inference; unsupported file types are skipped; file names with dots in the stem resolve their format correctly; faster S3 runs; probe support for S3 and GCS. (#17613, #19516, #17595, #19496, #20130)
  • S3 lineage URNs: S3 and Azure Blob Storage URNs built by the Snowflake, Glue, Athena, Unity Catalog and SageMaker connectors encode (, ) and ,, as the S3 source does. A path with these characters no longer makes a Snowflake run lose all its lineage.
  • SAP Analytics Cloud: localized public root folders are merged into one tree; models get a real browse path; opt-in ingestion of non-public content; correct upstream for repeated SAP Datasphere links; model platform instance emitted as a proper URN. (#19880, #19881, #19890, #20484, #20490)
  • SAP Datasphere: views and analytic models not exposed for consumption are discovered by default, closing dangling lineage; large spaces are paginated safely and labels go to descriptions; projection column aliases resolve their types; lineage to space-local SAP.TIME.* / SAP.CURRENCY.* objects joins the ingested datasets; a space the ingestion user can see but is not a member of now fails the run instead of soft-deleting its objects. (#20124, #20483, #20615, #20643)
  • Sigma: chart column lineage resolves formulas over other columns of the same chart, Data Model joins and loaded Data Model elements, and only to columns that exist; failed API calls are reported and a failed listing fails the run instead of soft-deleting live entities. (#20017, #20000, #19970, #19786, #19899)
  • Snowflake: new workload identity federation authentication (AWS, Azure, GCP), with no stored password or key; Streamlit apps without a title use their app name; profiling uses a fixed-size sample when the row count is unknown. (#19889, #19916, #20041)
  • Spark: OpenLineage upgraded to 1.53.0. (#19573)
  • SQL profiling (all SQL sources): fewer queries and round trips per table; new options to cap combined batch size (max_queries_to_combine) and statement runtime; profiling no longer aborts on dialects without connection pooling. (#20206, #20209, #20210, #20211, #18803)
  • SQL Server: with include_query_lineage: true, every query in the time window (not only writes) is emitted as a Query entity with execution counts, table usage statistics are filled in, and query history respects the recipe's database, schema and table patterns; new query_history_source attributes queries and usage to users via the audit log or Extended Events; temp tables resolve across statements; stored-procedure EXEC calls are split and resolved correctly; manual job lineage is preserved with incremental_lineage; dedicated probe provider. (#20246, #20249, #20559, #19929, #20165, #19930, #20129)
  • Tableau: Snowflake column lineage matches the ingested schema instead of assuming lowercase; workbooks missing from the bulk listing are resolved instead of dropped; null custom SQL column names no longer abort the run; probe support. (#19206, #20245, #20074, #20119)
  • Trino: Oracle and StarRocks catalogs link to their native datasets with sibling and column-level lineage. (#17678)
  • Vertex AI: multi-region projects no longer reuse the first region's datasets and endpoints. (#18910)

Ingestion infrastructure:

  • datahub recipe probe: a read-only CLI (usable by people and AI agents) that asks a live source what it contains and whether a recipe's filters would keep a given object, before you ingest. Supported sources advertise a new Probe capability in the docs and connector registry. (#19655, #20111, #20243)
  • SQLAlchemy 2.0: the ingestion framework now runs on SQLAlchemy 2.0. (#17982)
  • datahub migrate schema-field-case: re-attaches column-level metadata (descriptions, tags, terms, lineage) after a connector changes column casing. (#19795)
  • datahub init --oauth: access tokens are refreshed on each request, so long-running processes (such as MCP servers) no longer start failing with 401s. (#20081)
  • Ingestion rollback: a hard rollback no longer deletes an entity the run created if something else has written to it since. See Breaking Changes. (#20335)
  • Large lineage patches: oversized upstreamLineage patches sent with incremental_lineage are truncated instead of failing the run. (#20437)
  • Transformers: OVERWRITE-mode transformers never write duplicate entries. (#20239)
  • SQL parsing: table functions (for example s3(), generate_series()) no longer create phantom datasets or drop a statement's lineage. (#20061)
  • DataHub Lite: storage engine is pluggable; SQLite is the new default, so the extra installs without a DuckDB wheel. (#19898)
  • Python SDK: zero-valued and empty assertion parameters are preserved; auto_resolve_lineage_urns no longer requires sqlglot; the pkg_resources shim supports iter_entry_points for setuptools 82+. (#20171, #19882, #19896)
  • DataHub Actions: the Kafka event source honors KAFKA_PROPERTIES_* environment variables set by the Helm chart (SASL/SSL/MSK IAM); Kafka connection and auth failures are surfaced instead of reporting the pipeline as running; container stops shut down cleanly on SIGTERM. (#20104, #20105, #19402)

Executor:

  • Detailed status: Remote Executor heartbeats report what the executor is doing (whether it can take new work, task slots, active tasks, and why it can't get work), shown under See more on the Executors page, so a busy executor can be told apart from a stuck one (DATAHUB_EXECUTOR_STATUS_DETAILS_ENABLED, default on).
  • Runtime report: about every 10 minutes the Remote Executor reports memory, CPU, disk, deployment type and key settings, shown on a Resources & settings tab (DATAHUB_EXECUTOR_REPORT_RUNTIME, default on). Both reports need GMS 2.4.0 or later.
  • Personal access token from a file: the executor can authenticate with a PAT read from a mounted file, re-read on each refresh so rotated secrets are picked up. (#20070)
  • Kafka worker pools: every worker now receives work, and source probe requests from the Ingestion Agent run on Kafka pools.
  • Automations on a Remote Executor: keep running through integrations service deploys and restarts. To stop one, deactivate it.
  • Scheduling: scheduled ingestion and monitor jobs are no longer occasionally skipped when the schedule refreshes near their fire time.
  • Entity-change triggers: tasks triggered by entity change events fire again on Kafka-based executors.
  • Time-bucketed assertions: DATE (and BigQuery DATETIME) columns get type-aware bucketing SQL, fixing BigQuery errors and off-by-one-day buckets on Snowflake, Redshift and Databricks.
  • Image hygiene: lockfiles for packages that are not installed are no longer shipped, removing false-positive CVE scanner findings; the SQL Server ODBC driver's OpenSSL 3 dependency is declared explicitly.

Breaking Changes​

Authorization and APIs:

  • Testing an unsaved notification destination needs Manage Connections or Manage Global Settings. Without those privileges, createNotificationConnectionTest tests only destinations already saved in their own or their groups' notification settings or subscriptions. The test message now names the requester by the ID in their user URN. Action: save a destination before testing it. Grant one of the two privileges to users or service accounts that test destinations typed into a form that isn't saved yet, such as Observe bulk create.
  • Metadata Tests: runTests and runTestDefinition require Manage Tests. They now match the other metadata-test mutations and the OpenAPI and Rest.li evaluate endpoints. Action: grant Manage Tests to any user or service account that calls them directly.
  • View authorization: entities a user can't view now look like entities that don't exist. With view authorization on, a GraphQL lookup of a hidden entity (dataset(urn:), entity(urn:), entities(urns:) and similar) returns the missing-entity result instead of a Restricted placeholder or an unauthorized error. entityExists returns false, and fields resolved on it return their empty result. Lineage through hidden entities is unchanged: they still appear as Restricted nodes.
  • Reading global settings over the REST APIs requires Manage Global Settings. OpenAPI and Rest.li entity endpoints return 403 for urn:li:globalSettings:0 without it, and withhold the globalSettingsInfo aspect even when REST API authorization is off. The UI and the GraphQL globalSettings query are unaffected. Action: scripts or Remote Executors that read this aspect with a personal access token need a token from a user with Manage Global Settings, or the system credentials.
  • Invite tokens require Manage User Credentials on the entity APIs. Creating, reading, updating or deleting inviteToken entities through OpenAPI, Rest.li or GraphQL patchEntity now needs Manage User Credentials. Edit Entity no longer grants it. Redeemed tokens are also checked against their stored encrypted value. Action: grant Manage User Credentials to principals that manage invite tokens this way. If you set SECRET_SERVICE_V1_ALGORITHM_ENABLED=false and old invite links stop working, regenerate them under Settings > Users & Groups.
  • Policies with privilegeConstraints now also restrict structured-property writes. A policy that sets the experimental privilegeConstraints filter on Edit Entity or Edit Entity Properties now applies it to structured-property writes too, which can deny writes that it allowed before. Action: review such policies before upgrading, and add an unconstrained policy for structured properties if needed.
  • Clearer error codes for refused writes. GraphQL writes rejected by an aspect validator return UNAUTHORIZED or BAD_REQUEST instead of SERVER_ERROR. Rest.li ingestProposal returns 403 instead of 422 for authorization failures. Ask DataHub mutations on another user's chat or workspace return extensions.code 403 instead of 500. Action: clients that treated these errors as "not allowed" should check for the new codes.
  • Lifecycle stage changes that break a stage's entry rules now fail. setLifecycleStage, proposeLifecycleStage, the set_lifecycle_stage MCP tool and accepting a stage proposal used to succeed silently while keeping the old stage. They now return BAD_REQUEST, and a proposal whose move is no longer allowed stays open. Writes through ingestion and other APIs are unchanged.
  • Conditional-write headers now apply to generic JSON patches. A PATCH applied as a generic patch (forceGenericPatch or arrayPrimaryKeys) honors If-Version-Match, If-Modified-Since and If-Unmodified-Since, and keeps the request's run ID. Rolling back an ingestion run now also reverts the tag, term, owner, domain, structured property and documentation patches the Python SDK sends. Action: none for clients that send correct versions. A client that relied on these headers being ignored now gets a precondition failure.
  • Hard rollback keeps entities that others have written to. Rolling back an ingestion run with the UI button or datahub ingest rollback --nuke no longer deletes an entity the run created once another run or a user has written to it. Only the run's own aspects are rolled back, and the kept entities are listed as unsafe in the response. Action: to remove such an entity completely, delete it explicitly.

AI and MCP:

  • MCP: last-modified times are dates. search, search_documents, get_entities and get_lineage return when each result last changed as a YYYY-MM-DD (UTC) date instead of an epoch-millisecond {time, actor} object. search_documents no longer returns info.created or the editor. Action: read lastModified as a date string, or query GraphQL for the editor or creation time. LAST_MODIFIED_DATES_ENABLED=false returns no dates at all.
  • MCP: grep_entities returns a flat match list. Results are no longer grouped by aspect, aspectsSearched and truncated are removed, and a call returns up to 20 snippets. Pass next_offset as start_offset for the rest. context_chars now applies in full on each side. Action: refresh cached tool schemas, update parsers, and halve existing context_chars values to keep the same context width.
  • MCP document tools report failures as tool errors. grep_documents, save_document and update_document now fail the call (isError: true) instead of returning an error field or success: false. Action: handle these failures through your client's tool-error handling.

CLI and Python SDK:

  • datahub recipe exit codes and recipe variables. probe, test-connection and validate now report more failures by who has to act: 2 your input (including a name the source doesn't list, which used to return an empty result with exit 0), 3 the source, 1 DataHub, the connector or a missing package. A dotted reference such as ${gms.server} no longer reads ~/.datahubenv, and partial references such as ${X:0:8} are refused. Action: use ${DATAHUB_GMS_URL} and ${DATAHUB_GMS_TOKEN}, remove comments from probe sql queries, and update scripts that branch on these exit codes.
  • SQLAlchemy 2.0. The ingestion framework now runs on SQLAlchemy 2.0. Action: update custom sources or plugins that use SQLAlchemy 1.4-only APIs.
  • DataHub Lite defaults to SQLite. New instances use ~/.datahub/lite/datahub.db, and DuckDB moved to its own extra. Action: existing DuckDB users install acryl-datahub[datahub-lite,duckdb]. Users of the datahub-lite sink who relied on the default path should pin type: duckdb and the .duckdb file in the recipe, or migrate with datahub lite export and import.
  • Profiling config classes are renamed. GEProfilingConfig is now ProfilingConfig (and GEProfilingBaseConfig is now ProfilingBaseConfig) in datahub.ingestion.source.profiling.config, and Unity Catalog's UnityCatalogGEProfiler is now UnityCatalogProfiler. Recipe options are unchanged. Action: update imports in custom ingestion sources only.

Deprecations​

  • Gemini 3.7 Flash and Gemini 3.6 Flash are retiring on Vertex AI. Vertex AI tenants now default to gemini-3.8-flash wherever they used gemini-3.7-flash. Google retires Gemini 3.6 Flash on 2026-11-19 and Gemini 3.7 Flash on 2027-01-28; after those dates requests return 404. Action: move any env var override that pins either model before its retirement date.
  • The legacy document publication field. status.lifecycleStage is now the source of truth for whether a document is published, and documentInfo.status.state is kept as a mirror of it. A one-time system-update job backfills and aligns the two. The legacy field will be deprecated in a later release. Action: use setLifecycleStage and status.lifecycleStage in new integrations.
  • Audit stamps that repeat the DataHub write. For incidents, views, ownership types, lifecycle stage types, page templates and modules, files, secrets, posts, documents, APIs, agent skills and AI agents, use systemMetadata.aspectCreated and systemMetadata.aspectModified instead. The old fields remain and are still indexed. Action: don't add new writers that depend on the deprecated fields.

Security / Dependencies​

  • JLine: bumped to 4.3.1 to address CVE-2026-77420, CVE-2026-77421, CVE-2026-77422 and CVE-2026-77423.
  • thrift: bumped to 0.25.0 to address CVE-2026-41608, CVE-2026-43871 and CVE-2026-66053.
  • pillow: bumped to 13.0.0 to address CVE-2026-112395 and related CVEs.
  • oauthlib: bumped to 4.0.0 to address CVE-2026-49264 and CVE-2026-49265.
  • authlib: bumped to 1.9.1 to address CVE-2026-96760.
  • joserfc: bumped to 1.7.7 to address CVE-2026-102946.
  • fsspec: bumped to 2026.9.0 to address CVE-2026-104851.
  • opentelemetry-api: floored at 1.45.1 to address CVE-2026-114603.
  • unstructured-ingest: bumped to 1.4.28 to address CVE-2026-71428.
  • certifi: bumped to 2026.10.19 to address GHSA-6q48-6c7w-9gw2.
  • databricks-sql-connector / SQLAlchemy: the integrations service moves to databricks-sql-connector 4.7.0 and SQLAlchemy 2.0, as required by the thrift fix.
  • pip, glibc and py-spy: pip 26.2.2, glibc 2.43 and py-spy 0.4.2 in the Cloud images, with refreshed Wolfi base packages.
  • Node.js: bumped to 22.23.3 (LTS).
  • Compromised emSign intermediates: grpcio bumped to 1.84.1 (its bundled roots.pem and OpenSSL), google-api-client bumped to 2.9.2 (bundled truststore), botocore floored at 1.43.117, and the executor and actions images point JPype at the system JVM trust store.
  • Python: graphql-core 3.2.13 (CVE-2026-75507, CVE-2026-75508), langgraph-sdk 0.4.10 (CVE-2026-104873), GitPython 3.2.1 (CVE-2026-114145, CVE-2026-100689), mlflow 3.17.2 (CVE-2026-53995).
  • Java: protobuf-java 4.36.2, netty 4.2.19 (CVE-2026-100660 to CVE-2026-100665), reactor-netty 1.3.8 (CVE-2026-62380), vertx 4.5.35 (CVE-2026-102460), hadoop 3.4.2 (CVE-2025-27821), guava 33.7.2 (CVE-2026-102554), snappy-java 1.1.10.12 (CVE-2026-108106, CVE-2026-90559, CVE-2026-93452).

Bug Fixes​

  • Fixed Ask DataHub occasionally dropping messages when two writers saved the same conversation, or when a read replica lagged.
  • Fixed a follow-up Ask DataHub turn not seeing what a stopped turn had already run.
  • Fixed Ask DataHub memory not being saved for some users.
  • Fixed entity links inside code formatting in Ask DataHub not rendering as asset chips.
  • Fixed chat tables ignoring dark mode, code-block ghosting, and the chat input shrinking while an answer streamed.
  • Fixed the Ask DataHub approval flow not streaming through the frontend proxy.
  • Fixed filtered semantic search over documents returning no results.
  • Fixed semantic search returning the best passage per document instead of the ranked passages.
  • Fixed search facet counts for semantic search and for column-name matches.
  • Fixed searches that filter by the latest version of an asset returning older versions.
  • Fixed searches failing when a matching text field was longer than the search engine's highlighting limit of 1,000,000 characters.
  • Fixed documents with no content appearing in search results.
  • Fixed hard deletes overwriting concurrent edits during reference cleanup, and Rest.li hard deletes failing once the entity was already gone.
  • Fixed compliance form prompts writing other structured properties, hiding submit errors, and not reopening when a dataset gains a column.
  • Fixed Role entity profiles and incidents, and showed the Role platform in previews.
  • Fixed the sidebar pencil not opening the description editor.
  • Fixed the data product output ports filter sending no values.
  • Fixed column lineage counts leaving out charts.
  • Fixed page styles being lost after lazily loaded stylesheets.
  • Fixed Slack, GitHub and Teams connections not picking up configuration changes, and remote actions stopping during rolling deploys.
  • Fixed Teams webhooks returning server errors for invalid tokens or a missing Teams setup.
  • Fixed deleted agents remaining in scoped MCP server settings, and MCP servers dropping their tools when settings could not be read.
  • Fixed custom properties disappearing from agents and skills.
  • Fixed turning AI memory on or off failing for users with no saved settings.
  • Fixed document edit proposals losing the proposed text when reads go to a replica.
  • Fixed assertions showing as failing when an older failed run arrived after a newer passing one.
  • Fixed an Application's Assets badge and Summary not counting child Applications.
  • Fixed Data Product and Semantic Model lineage graphs going empty after a time-range change.
  • Fixed the glossary Related Terms tab showing the previous term's relationships.
  • Fixed Ingestion Agent links to ingestion sources and runs leaving the app or doing nothing.
  • Fixed scoped MCP servers set to instructionSize: NONE serving a skills listing.

Known Issues​

  • Hex lineage on case-folding warehouses: for SQL Server, Postgres and Redshift warehouses ingested with their default case-preserving URNs, the Hex source's queriedTables lineage is emitted lowercased and does not connect to the warehouse dataset. Snowflake and BigQuery are unaffected. To align them, re-ingest the warehouse with convert_urns_to_lowercase: true.
  • role search index after upgrade: where the role index already existed, the new browsePathsV2 field can be mapped wrongly, and browse or aggregation queries on roles fail with Text fields are not optimised for operations that require per-document field data. The system-update job rebuilds the index, but it has been seen to leave the MAE and MCE consumers scaled to 0, so check their replica counts after it completes.
  • Glossary term "New version": creating a version takes several writes rather than one transaction. An unexpected server error part-way through can leave the previous term marked as v1 or leave an unlinked draft term, which can be deleted.
  • Files uploaded under a custom asset path prefix: files uploaded before this release with a custom DATAHUB_S3_ASSET_PATH_PREFIX keep a product_assets/... key, so deleting the asset that references one leaves its object in storage. If you changed the prefix after files were uploaded, move the older files to the configured prefix.