Skip to main content

v2.2.0

Release Changelog​

v2.2.2​

This release rolls up hotfixes on top of v2.2.1.

Release Availability Date​

18-SEP-2026

  • CLI/SDK: 1.7.0.10
  • Remote Executor: v2.2.2-cloud, v2.2.1-cloud, v2.2.0-cloud, v2.1.5-cloud, v2.1.4-cloud, v2.1.3-cloud, v2.1.2-cloud, v2.1.1-cloud, v2.1.0-cloud, v2.0.4-cloud, v2.0.3-cloud, v2.0.2-cloud, v2.0.1-cloud
  • On-Prem Versions:
    • Helm: 2.0.35
    • API Gateway: v0.7.3

Product​

  • Snowflake comment propagation on mixed-case columns — column-level comment propagation now quotes the resolved column identifier, so a column whose real name is not all upper case no longer fails with 000904 invalid identifier. Snowflake folds bare identifiers to upper case before lookup; the column name is already resolved from INFORMATION_SCHEMA, so it carries Snowflake's real casing and only needed quoting. Catalog, database, and table identifiers are deliberately left unquoted — they come from DataHub URNs in lower case and rely on that same folding to match.
  • Column edits no longer overwrite the table or view comment — editableSchemaMetadata is a whole-aspect snapshot, so editing a column description could propagate as a change to the parent table or view comment. A column edit now propagates only that column's comment.

Platform​

  • AWS IRSA credential providers (GMS) — GMS now owns a single process-wide DefaultCredentialsProvider, constructed with builder().build() and closed on shutdown, and binds JDBC IAM, Iceberg STS vending, and MSK IAM callbacks to it. Extra per-call chains pinned StsAssumeRoleWithWebIdentityCredentialsProvider instances on the SDK cache scheduler, so live providers grew by thousands per hour on IRSA tenants until the instance became unresponsive. MSK IAM awsDebugCreds=true is forced off, because that path left an unclosed StsClient. AWS SDK for Java v2 is pinned to 2.54.16, aws-advanced-jdbc-wrapper to 4.4.0, and aws-msk-iam-auth to 2.3.8. Action: none. After deploying, jcmd GC.class_histogram on an IRSA tenant should stay flat for that class rather than growing. See datahub-project/datahub#19747.
  • Reindex stall retries — stall detection no longer starts a second _reindex into the same destination while the current Elasticsearch task is still RUNNING or its status lookup failed. Stacking reindexes exhausted the retry budget, marked the index FAILED, and deleted a fully copied destination, so the next system-update pod recopied from scratch. A completed-but-short reindex still retries, preserving zero-downtime-upgrade catch-up. Controlled by ELASTICSEARCH_BUILD_INDICES_WAIT_FOR_UNRESOLVED_REINDEX_TASK (default true). See datahub-project/datahub#19741.

Ingestion​

Executor:

  • Default managed CLI/SDK is 1.7.0.10.
  • pycurl is built against the system OpenSSL in a dedicated image stage, resolving an SSL backend mismatch in the executor images.

Security / Dependencies​

  • nltk: 3.10.0 → 3.10.3 across the executor image variants, resolving CVE-2026-62384, CVE-2026-71513, CVE-2026-72818, CVE-2026-78680, CVE-2026-78681, CVE-2026-78682, CVE-2026-79657, CVE-2026-79674, CVE-2026-79675, CVE-2026-79676, and CVE-2026-80206.

Bug Fixes​

  • Fixed Snowflake column-comment propagation failing with invalid identifier on columns whose names are not all upper case.
  • Fixed a column description edit propagating as a change to the parent table or view comment.
  • Fixed GMS accumulating IRSA STS credential providers until the instance became unresponsive.
  • Fixed system-update stacking concurrent reindexes into the same destination index and recopying a completed index from scratch.

Environment Variables​

  • ELASTICSEARCH_BUILD_INDICES_WAIT_FOR_UNRESOLVED_REINDEX_TASK (default true) — when a reindex stall is detected, skip the retry while the existing Elasticsearch task is still running or its status cannot be read, instead of starting a second reindex into the same destination. Set to false to restore the previous behavior.

v2.2.1​

This release rolls up hotfixes on top of v2.2.0.

Release Availability Date​

11-SEP-2026

  • CLI/SDK: 1.7.0.5
  • Remote Executor: v2.2.1-cloud, v2.2.0-cloud, v2.1.5-cloud, v2.1.4-cloud, v2.1.3-cloud, v2.1.2-cloud, v2.1.1-cloud, v2.1.0-cloud, v2.0.4-cloud, v2.0.3-cloud, v2.0.2-cloud, v2.0.1-cloud
  • On-Prem Versions:
    • Helm: 2.0.35
    • API Gateway: v0.7.3

Product​

  • Ontology Explorer — empty states, relationship-type filter fixes, and faster graph materialization when expanding glossary relationships. Defining a structured property as a relationship is now gated (see Platform and Breaking Changes).
  • Data Product search filter — Data Products are a first-class search filter and facet on their member assets, so you can combine a Data Product with other filters. Membership stays authoritative on the Data Product (dataProductProperties.assets); an asset-side dataProducts aspect is kept in sync. Existing memberships are populated by the MigrateAspects / ZDU sweep. Set REPROCESS_DATA_PRODUCT_ASSETS=true if you need to force a resync. See datahub-project/datahub#18554.
  • Microsoft Teams personal connect — Settings → My Notifications → Connect to Teams reads the tenant ID from Teams integration status, so a configured tenant no longer shows a false "not configured" toast.

AI / Ask DataHub​

  • Agents in chat and on the home page — agents with Show in Ask DataHub Chat enabled are visible to any user who can view metadata, not only users with Manage Agents. Creating, editing, and deleting agents still requires Manage Agents. Unconfigured and Draft agents stay on the management page.
  • Observation-cluster proposals hidden by default — Remediation / observation-cluster proposals stay created in the background but are excluded from the Task Center, inbox badge, and review page unless SHOW_OBSERVATION_CLUSTER_PROPOSALS=true.
  • Metadata Gap Reporting Tool — Settings → AI can disable the note_metadata_observation MCP tool at runtime (mcpSettings.observationToolEnabled). When off, the tool is omitted from MCP tools/list, stale clients record nothing, and chat agents drop gap-reporting instructions. The integrations-service NOTE_METADATA_OBSERVATION_TOOL env var remains a deploy-level kill switch ANDed with this setting.
  • Legacy observation proposals cleaned up on upgrade — a one-time system-update step (SYSTEM_UPDATE_REMOVE_LEGACY_OBSERVATION_PROPOSALS_ENABLED, default on) hard-deletes still-pending ANNOTATE proposals from the retired per-observation path and marks still-pending POST_ATTACHMENT proposals COMPLETED. Human-created document proposals are not touched.

Platform​

  • AWS IRSA credential providers — shared S3, STS, and SQS clients no longer fall through to the AWS SDK default chain when only a region is set, which allocated a new IRSA STS provider per builder. GMS, MAE, and system-update reuse the shared credentials bean or skip construction. Action: none on IRSA tenants that already set AWS_REGION.
  • Usage analytics on Elasticsearch 8 — usage-event range queries send numeric epoch-millis so date-mapped timestamp fields accept WAU/MAU aggregations. See datahub-project/datahub#19676.
  • Entity-consistency system-update — non-blocking entity-consistency scans log progress and an ETA instead of appearing stuck. See datahub-project/datahub#19388.
  • Data Product membership writes — large dataProductProperties replacements no longer time out on graph unset side effects; asset comparison is by destination URN and graph scrolls are batched. See datahub-project/datahub#19465.
  • Search indexing — analyzed-text keyword surfaces use a byte-safe ignore_above (8191 characters) so multi-byte values no longer drop the entire search document. Applied as an in-place mapping update; no reindex required.
  • Edit Domain privilege — ingest-time domain writes on existing entities now accept Edit Domain or Edit Entity, matching GraphQL. Creating a new entity still requires Create/Edit Entity; a domains PATCH on a missing entity cannot be used with Edit Domain alone. See datahub-project/datahub#19719.
  • Structured-property mapping merge — ESIndexBuilder no longer mutates caller-supplied mappings in place, so system-update BuildIndices no longer fails with "No index builder found" when semantic search is enabled.
  • OpenTelemetry resource attributes — OTEL_RESOURCE_ATTRIBUTES (for example k8s.namespace.name, service.namespace) are preserved on the factory TracerProvider; service.name is merged instead of replacing the autoconfigured resource.

Ingestion​

Executor:

  • Default managed CLI/SDK is 1.7.0.9 and Remote Executor 0.3.20.

Breaking Changes​

  • Defining custom relationships requires STRUCTURED_PROPERTY_GRAPH_EDGES_ENABLED=true. Previously the flag only controlled whether graph edges were materialized from URN-valued structured-property assignments, so a property could be marked "treat as relationship" while the flag was off and produce no edges. With the flag off (the default), the UI hides that toggle, and writes that set structuredPropertySettings.isRelationship or create a relationshipType entity are rejected on every API. Properties that are already relationships stay fully editable. Turn the flag on to define new relationships.

Security / Dependencies​

  • CLI 1.7.0.9 / Remote Executor 0.3.20 — executor-managed ingestion reports no longer persist secrets on disk. No operator action beyond the version bump.
  • transformers: bumped to 5.17.0 to address CVE-2026-9856.

Bug Fixes​

  • Fixed home / usage highlights returning an empty list on Elasticsearch 8.
  • Fixed personal Microsoft Teams connect showing "not configured" when the tenant was already set.
  • Fixed non-admins seeing an empty Ask DataHub agent picker and home Agents module for published agents.
  • Fixed domain assignment/clear denied at ingest time for principals who have Edit Domain but not Edit Entity.
  • Fixed system-update BuildIndices failing when merging structured-property mappings into semantic-search indexes.

Environment Variables​

  • STRUCTURED_PROPERTY_GRAPH_EDGES_ENABLED (default false) — also gates defining relationships (UI toggle, isRelationship writes, and relationshipType create). Existing relationship properties remain editable when the flag is off.
  • MCP_SIDE_EFFECTS_DATA_PRODUCT_ASSETS_ENABLED (default true), MCP_SIDE_EFFECTS_DATA_PRODUCT_ASSETS_MAX_FANOUT (default 500), REPROCESS_DATA_PRODUCT_ASSETS (default false), BOOTSTRAP_SYSTEM_UPDATE_DATA_PRODUCT_ASSETS_BATCH_SIZE (default 1000) — control asset-side Data Product membership sync used by the new search filter.
  • SHOW_OBSERVATION_CLUSTER_PROPOSALS (default false) — when false, observation-cluster (Remediation) proposals are hidden from the Task Center, type facets, totals, inbox badge, and review page. The clustering job still runs.
  • SYSTEM_UPDATE_REMOVE_LEGACY_OBSERVATION_PROPOSALS_ENABLED (default true) — one-time cleanup of retired per-observation ANNOTATE / POST_ATTACHMENT proposals. Set SYSTEM_UPDATE_REMOVE_LEGACY_OBSERVATION_PROPOSALS_REPROCESS=true to force a re-run.

v2.2.0​

Release Availability Date​

3-Sep-2026

  • CLI/SDK: 1.7.0.5
  • Remote Executor: v2.2.0-cloud, v2.1.5-cloud, v2.1.4-cloud, v2.1.3-cloud, v2.1.2-cloud, v2.1.1-cloud, v2.1.0-cloud, v2.0.4-cloud, v2.0.3-cloud, v2.0.2-cloud, v2.0.1-cloud
  • On-Prem Versions:
    • Helm: 2.0.30
    • API Gateway: v0.7.3

Release Highlights​

DataHub Cloud v2.2.0 is packed with exciting updates, including:

  • Agents (Private Beta) — Build purpose-built AI assistants for every data persona, publish them to Ask DataHub chat in one click, and schedule tasks that automatically enrich documentation, tags, and ownership, so your catalog stays current without the manual upkeep. Learn more here.
  • Agentic Ingestion Configuration — Root-causes failed runs by reading the connector's actual code. Grounds every answer in the exact configuration schema for your connector. Finds your ingestion source's recent runs automatically. Routes connector questions to the right specialist automatically. Version-aware diagnosis — knows the exact CLI version a run used.
  • One-Click Slack App Install — App Config & Refresh Tokens are no longer required to install the DataHub Slack App. Simply click 'Connect to Slack' on the Integrations > Slack page to install. Existing installations using App Config, Refresh, and Bot tokens will continue to be supported.
  • Data Discovery & Ontology — DataHub supports more complex querying of its metadata graph, with new relationship traversal and SPARQL query endpoints. New MCP tools let agents walk the metadata graph without hard-coding relationship types. And the new Ontology Explorer supports viewing how your glossary terms relate to each other. The basic APIs and explorer will be available in 2.2.1, while the SPARQL engine and custom relationships are in private beta; talk to your DataHub representative to enable them.

Notable Breaking Changes​

Full technical remediation lives in Updating DataHub. Source-specific breaking changes appear inline under Metadata Ingestion.

  • MCP server: ?token= query parameter removed to encourage best practices. Send the access token in Authorization: Bearer <token> only. Clients that cannot set headers can use mcp-remote with --header "Authorization: Bearer <token>". See MCP → Connecting & Authenticating.
  • getSecretValues now requires system authentication. Human users and PATs with MANAGE_SECRETS can no longer decrypt secrets via GraphQL; migrate executor, actions, and integrations-service callers to system credentials.
  • Never-expiring access tokens disabled by default. Set ACCESS_TOKEN_ALLOW_NO_EXPIRY=true to restore. Existing tokens are unaffected.
  • Great Expectations SQL profiler removed. Remove profiling.method and the profiling-ge extra from recipes; SQLAlchemy is now the only SQL profiler.
  • semanticModelInfo.datasets deprecated. After upgrade, this field no longer writes graph or search edges, and GraphQL SemanticModelInfo.datasets returns empty. Metric-to-dataset lineage is missing until you re-ingest. Action: Re-ingest Semantic Models so metricUpstreams is populated. If you use Snowflake Semantic Views, run datahub migrate snowflake-semantic-views first. Customers who do not use Semantic Models can ignore this.
  • Lineage scroll API contract changed. POST /openapi/v3/lineage/scroll now takes a single urns list and direction of UPSTREAM / DOWNSTREAM.
  • Subscriptions inherit notification defaults. Omitting notificationSettings uses the actor's current defaults at delivery time; send sinkTypes: [] explicitly for no-sink subscriptions.
  • APAC Bedrock cross-region prefix. Sonnet 4.5+ models require the au or jp prefix, not legacy apac, for APAC deployments.
  • Observe: Anomaly detection assertions require 14 days of history before alerting; existing predictions are preserved during temporary retraining-data shortages. This gives the assertion more time to detect daily and weekly patterns and avoid noisy false alarms.
  • OpenAPI v2 entity APIs deprecated. Plan migration to /openapi/v3/entity and /openapi/v3/relationship.
  • You can no longer, through the UI, create legacy propagation automations (Tag Propagation, Glossary Term Propagation, and Column Documentation Propagation). These are replaced by the new Lineage Propagation automation. You can still run and edit pre-existing automations via the UI, and create legacy ones via API.

User Experience​

This release includes significant improvements to the user interface and user experience.

Data Product Marketplace & Hierarchical Data Products​

DataHub v2.2.0 introduces a dedicated Data Products experience for managing Data Products and first-class support for parent–child taxonomies. Together, these changes make it easier to model and discover data products.

Both capabilities are enabled by default after upgrade.

  • Dedicated browse experience at /dataProducts with a left-nav Data Products entry (Govern section).
  • Hierarchical sidebar to expand/collapse root and child Data Products, with infinite scroll, Domain filter, and in-sidebar autocomplete search.
Domain and Data Product proposals​

Stewards can now propose creating Domains and Data Products through the existing accept/reject workflow, with a new Propose Create Domain platform privilege and steward inbox rendering. This matches the glossary-term propose flow that shipped earlier and gives governance leads an audit trail for structural additions to the catalog.

Ontology Explorer​

Explore your business glossary's relationships with the new Ontology Explorer. Similar to the lineage graph, the explorer lets you visualize how your glossary terms relate to one another, via built-in and custom relationships. Supports search, filtering by relationship type, and expanding to see further related glossary terms. Available globally in 2.2.1, via the navigation sidebar and on the new Relationships tab of the glossary term entity page.

Semantic Model container lineage​

Semantic Models now render as grouping containers in the lineage explorer rather than as intermediate hops on the lineage path. Datasets and metrics belonging to a model appear inside a bounding box (similar to Data Products), while metric lineage flows directly through the logical datasets a metric reads from: Metric → Semantic Model Dataset → Physical Dataset.

Note: Existing semantic-model metadata may need a re-ingest or migration run so metric lineage is populated in the new shape. See Notable Breaking Changes above.

Volume assertion accuracy​

Greatly improved anomaly detection reliability. Predictions align better with sub-daily seasonality, remain more stable over time, and use practical sensitivity bounds to avoid false positives.

Other Improvements​
  • Slack bot service-account mappings — map a Slack bot_id to a corp user so automated @DataHub mentions from approved bots are answered instead of refused.
  • Support OAuth login — support staff can authenticate via the support OIDC provider with ticket-bound one-hour tokens (no refresh tokens).
  • Japanese i18n locale (Beta) — Japanese translations can be enabled when internationalization is turned on for the instance (I18N_ENABLED=true).
  • Parent Data Products — nested data-product taxonomies via dataProductProperties.parentDataProduct.
  • Glossary Term AI throttling — opt-in caps on concurrent term-classification pipelines and per-run / per-minute batch sizes prevent integrations-service overload when many automations run together.
  • AI agent ownership — AI agent entities can be assigned as owners on assets in the UI and GraphQL APIs.
  • Fixed lineage graphs for view-restricted users rendering Restricted nodes instead of failing when neighbors are unviewable.
  • Fixed container filter expansion on equality conditions breaking search filters.
  • Fixed Custom SQL Assertion UI now correctly displays floats in condition inputs.
  • Fixed Ask DataHub send button hidden on smaller screens.
  • Observe
    • Skip freshness assertion queries until due — Freshness Anomaly detection was polling warehouses for updates too frequently (minimum once per hour). Queries are now delayed until the next predicted update, with more frequent polling after staleness is detected.
    • Assertion notification emails have a refreshed layout. Footer labels renamed to Alert ID, Assertion URN, and Dataset URN. If you match on the old footer for deduplication in your email integrations (e.g. PagerDuty), update your regexes.
    • Fixed issue where assertion backfill jobs would get stuck forever.
    • Assertions created by Monitoring Rules no longer error at midnight.
    • The UI for Custom SQL Assertions now correctly display floats for conditions.

Metadata Ingestion​

We're continuously improving our integrations to add new capabilities and squash bugs.

New Sources​
Existing Sources​
  • Kafka / Kafka Connect:
    • Confluent Cloud Stream Catalog metadata support (datahub-project/datahub#18764).
    • Kafka Connect: SQL Server treated as three-level (database.schema.table); Oracle JDBC sink URNs emit schema.table. See source-specific breaking changes below.
  • Glue: Cross-account platform instances and Lake Formation resource-link lineage (datahub-project/datahub#17963).
  • Power BI: Elasticsearch ODBC sources resolve to the elasticsearch platform (datahub-project/datahub#18716).
  • ODCS: Import contracts from S3, GCS, HTTP, and Git, plus a UI form for the source (datahub-project/datahub#18477, datahub-project/datahub#18474).
  • Snowflake:
    • Semantic views preserve logical-table casing.
    • New opt-in preserve_column_case for quoted mixed-case columns.
    • Profile field paths align with schema paths.
  • Snowflake / Oracle SQL profiling: Case-colliding quoted columns no longer silently dropped during reflection; warnings surface when statistics cannot attach to distinct fields.
  • Elasticsearch source: Uses opensearch-py and supports both Elasticsearch and OpenSearch clusters.
  • Document sources: min_text_length now defaults to 0 for datahub_documents, Notion, and Confluence so short documents embed by default (datahub-project/datahub#19103).
  • Ingestion log GC (opt-in) — DATAHUB_EXECUTOR_LOG_GC_ENABLED deletes aged per-execution log directories with retention and size-cap tunables (default off). See Remote Executor best practices.
  • Executor:
    • Stop per-run uv cache duplication of acryl-datahub.
    • Fix cancelled zombie processes bug.
Source-specific breaking changes​
  • Kafka Connect — SQL Server / Oracle URN shape changes. Set schema.name when warnings appear.
  • Semantic-anchor output_dir removed — remove from recipes and rely on the executor-provided INGESTION_ARTIFACT_DIR.
  • Snowflake:
    • New opt-in preserve_column_case for quoted mixed-case columns.
  • Remote executor defaults to use hardlinking for uv cache. For read-only filesystems, see best practices.

API, SDK, and MCP​

MCP Tools and Skills​
  • New tools: get_metadata_graph and get_relationships — expose the relationship vocabulary and let agents walk the metadata graph without hard-coding type names. Disabled by default in Private Beta.
  • Ask DataHub Skill loader — on-demand skill loading via a Skill search tool replaces the planner LLM. Currently only supports built-in skills, but will evolve to support user-customizable skills in future versions.
  • External MCP plugin validation — connecting an AI plugin verifies it exposes tools; zero-tool servers fail connect with actionable guidance; chat disables empty plugins without dropping previously stored credentials.
  • Bug Fix: Fixed MCP clients sending chunked initialize POSTs failing the handshake with HTTP 400.
GraphQL & OpenAPI​
  • Relationship schema export — GET /openapi/v3/relationship/schema returns the relationship graph as RDF (Turtle default, JSON-LD, N-Triples, RDF/XML).
  • Structured-property search ranking (opt-in) — properties marked useAsRankFeature drive recall and ranking. Requires mapping rollout and RestoreIndices backfill for existing assets. Enable with SEARCH_STRUCTURED_PROPERTY_RANK_FEATURES_ENABLED=true.
  • Domain-scoped entity create for writers — domain-separated writers can create entities with proposed domains in-batch without a separate unscoped create policy (datahub-project/datahub#18944).
  • VIEW_SYSTEM_STATUS privilege — read messaging consumer lag, transport, and registered consumers without full system-operations access.
Deprecations​
  • Grafana operational dashboard (/admin/dashboard) — tombstoned in 2.2, disabled in 2.3, removed in 2.4. Operational signals move to public APIs and Observe. Controlled by GRAFANA_DASHBOARD_MODE.
  • OpenAPI v2 entity and relationship APIs — deprecated in favor of v3. Timeseries, platform ingest, and timeline v2 endpoints are unaffected.
  • semanticModelInfo.datasets — stop populating. Use semanticModelProperties.semanticModel and metricUpstreams instead.
  • ENABLE_BEDROCK_OPTIMIZED_LATENCY — removed. Was a no-op for current model families while inflating cost estimates.
  • hideChatBetaLabel — removed. Ask DataHub is GA; remove the env var if set.

Security Notes​

  • Bumped Logback to 1.5.38 (CVE-2026-9828, CVE-2026-10532), Log4j to 2.25.5 (CVE-2026-49844), Parquet to 1.18.0 (CVE-2026-54512, CVE-2026-54513), and libthrift to 0.23.0 (CVE-2026-43869). No client action required beyond a standard upgrade.
  • Stored XSS fixes in GraphQL / UI paths (datahub-project/datahub#19298, datahub-project/datahub#19299, datahub-project/datahub#19300).
  • DuckDB analytics SQL injection hardened — read-only sandbox, sqlglot allowlist parser, and canViewForms authorization on Forms analytics.

Known Issues​

  • Policy name search after upgrade — existing policies are invisible to name search until a scoped RestoreIndices backfill for dataHubPolicyInfo completes.
  • OpenSearch 2.x bridge semantic search — do not enable semantic search on OpenSearch 2.x builds containing the pre-fix bridge kNN filter regression; hold until a build containing the fix ships, or run Elasticsearch 8.
  • Elasticsearch mapping repair — indices with dynamically inferred text fields where keyword was expected require a one-time reindex with ELASTICSEARCH_INDEX_BUILDER_MAPPINGS_REINDEX=true on system-update. See Updating DataHub.
  • Tableau + Snowflake preserve_column_case — Tableau column-level lineage may not match until Tableau resolves ingested Snowflake casing. Ingest Snowflake before Tableau when enabling the option.