Skip to main content

DataHub Releases

Summary​

VersionRelease DateLinks
v1.7.0.12026-09-03Release Notes, View on GitHub
v1.6.0.22026-09-01Release Notes, View on GitHub
v1.6.0.12026-08-13Release Notes, View on GitHub
v1.7.02026-08-04Release Notes, View on GitHub
v1.6.02026-05-21View on GitHub
v1.5.0.72026-05-19View on GitHub
v1.5.0.62026-05-11View on GitHub
v1.5.0.52026-05-07View on GitHub
v1.5.0.42026-05-06View on GitHub
v1.5.0.32026-04-25View on GitHub

v1.7.0.1​

Released on 2026-09-03 by @david-leifker.

DataHub v1.7.0.1​

Patch release for the v1.7.0 line: authorization tightening, CVE dependency bumps, entity-graph-cache and lineage correctness fixes, optional optimistic locking for aspect writes, and the remainder of the custom-assertion stack.

Requirements

  • CLI / Python SDK: 1.7.0.9
  • Helm Chart: 1.1.0

Full upgrade guidance, including every breaking change and migration step: Updating DataHub — v1.7.0.1.

Upgrade path

  • From v1.7.0: drop-in image bump. No ZDU or Helm chart change is required. System-update runs a resumable backfill that copies embedded assertion notes to the new assertionNote aspect (tunable with SYSTEM_UPDATE_ASSERTION_NOTE_MIGRATION_ENABLED, _BATCH_SIZE, _DELAY_MS, _LIMIT).
  • From pre-1.7.0: the v1.7.0 path still applies — you must upgrade to v1.6.0 first (Helm chart 1.0.3, let system-update complete), then upgrade to v1.7.0.1 with Helm chart 1.1.0. Do not skip 1.6.0.

Model changes: additive only. The assertionNote aspect is now registered on the assertion entity so ingestion can fully upsert assertionInfo without clobbering user-authored notes. Assertion URNs and run history are unchanged.

Action required before upgrading​

AreaWhat changedWho is affected
System client secretThe hardcoded systemClientSecret default (JohnSnowKnowsNothing) is removed from the server configs (#18886)Set DATAHUB_SYSTEM_CLIENT_SECRET on GMS, MAE/MCE/PE consumers, the frontend, and Actions before upgrading if you still rely on the built-in default
Timeseries readsDataset profile / usage / operations timeseries (and dashboard usage stats) now require the matching View Dataset Profile / Usage / Operations privileges on Rest.li and OpenAPI as well as GraphQL (#19508)API clients that previously read these aspects with only entity GET — grant the privileges or rely on the default view-dataset-sensitive policy
Role & group membership writesroleMembership requires Manage Policies; groupMembership / nativeGroupMembership requires Edit Group Members; corpGroup ownership requires Edit Owners — checked at the aspect layer across GraphQL, OpenAPI, and Rest.li (#19360)Automation writing membership outside the UI. Only additions are checked; removals, unchanged re-ingestion, and system writes pass. Toggle with metadataChangeProposal.validation.aspectAuthorization.privilegeGrant.enabled (default true)
View authorization (VBAC)container and schemaField are view-restricted by default; schema-field View Entity Page inherits from the parent dataset (#19212)Deployments with VIEW_AUTHORIZATION_ENABLED=true — ensure View Entity Page policies cover containers and parent datasets

Security and authorization​

  • Default self policy (#19297) — limited to VIEW_ENTITY_PAGE and GET_ENTITY on the actor's own entity.
  • GMS /auth helpers (#19316) — signUp, resetNativeUserCredentials, verifyNativeUserCredentials, and getSsoSettings now require system client credentials, matching generateSessionTokenForUser. Frontend login, signup, password reset, and SSO are unchanged.
  • System-write identification (#19384) — aspect authorization no longer treats client-supplied appSource as proof of a system write.
  • Schema-field incidents (#19405) — authorized against the parent entity.
  • Lineage scroll (#19463) — unauthorized OpenAPI lineage scroll endpoints are redacted as restricted.
  • UI sanitization (#19298, #19299, #19300) — query and incident descriptions, documentation PDF preview iframe src, and embed renderUrl schemes.
  • Ingestion secret masking (#19515, #19526, #19561, #19332) — masking is unified, idempotent, and fail-closed (mask before truncation; install once per process). Recorded HTTP cassettes are scrubbed.
  • AWS credentials (#19483) — OpenSearch IAM signing, Bedrock embeddings, STS, and object storage share a process-wide credential provider and client lifecycle.

Reliability and performance​

  • Entity-graph cache (#19498, #19288, #19301, #19412) — relationships are no longer silently dropped; indexed search fields are fetched for the cache; null relationship endpoints are skipped; hierarchy graph fallback batches frontier scrolls.
  • Container contents (#19489) — Container.relationships(types: [IsPartOf], direction: INCOMING) again returns all contained entities from the live graph.
  • Lineage traversal (#19413) — scrollAcrossLineage is bounded to prevent GMS OOM on wide graphs.
  • Case-insensitive relatedEntityTypes (#19268).
  • Hot-path caching and batching (#19404, #19476, #18266) — corpGroup roleMembership cached via SystemEntityClient, per-request CorpUserFlags served from a cached aspect, and Dashboard usageStats buckets and metrics batch-loaded across a page.
  • Optional optimistic locking for aspect writes (#19249) — OPTIMISTIC_LOCKING_ENABLED replaces SELECT FOR UPDATE with compare-and-set on SystemMetadata.version for Ebean storage. SCOPED_RETRY_ENABLED retries only the conflicted URN's branch, and ENTITY_WRITE_LOCK_BACKEND=hazelcast serializes same-(urn, aspect) writers off the DB connection pool. PostgreSQL aspect writes also take row locks in consistent primary-key order. All of these default off.

Assertions​

  • Custom-assertion stack completed on the 1.7 line (#18882) — API/SDK, UI, the assertionNote aspect, and the dbt / Great Expectations / YAML data-contract writers. Those writers emit AssertionType.CUSTOM instead of the deprecated DATASET shape on the next run; assertion URNs are unchanged and run history is preserved. Assertions that are never re-ingested keep their stored DATASET aspects and continue to render. See Custom Assertions.

Ingestion​

  • nltk 3.10.1 excluded (#18889) — that version silently breaks document chunking.
  • GitPython floor raised to 3.1.58 (#19506).
  • Bundled default CLI / Python SDK is 1.7.0.9 (#19605).

Dependency CVE bumps​

  • Java: httpclient5 5.6.3 (CVE-2026-64607), Spring Boot / Spring Kafka 4.0.7 (CVE-2026-41001), OpenTelemetry Java agent 2.28.0 (CVE-2026-54704), mariadb-java-client 2.7.14 (CVE-2026-55856 / 55857 / 55858), Logback 1.5.38 (CVE-2026-9828, CVE-2026-10532), Log4j 2.25.5 (CVE-2026-49844), Netty 4.2.17.Final (CVE-2026-59902), libthrift 0.23.0 (CVE-2026-43869), Jetty 12.1.10 (CVE-2026-10050), httpcore5 5.4.3 (CVE-2026-54399), micrometer-core 1.16.6 (CVE-2026-40983, CVE-2026-40984), wire-runtime 6.3.0 (CVE-2026-45799), reactor-netty-core 1.3.6, netty-reactive-streams 3.0.9.
  • Apache Parquet 1.18.0, which refreshes its shaded Jackson to jackson-databind 2.22.1 (CVE-2026-54512, CVE-2026-54513).
  • Python / images: nltk 3.10.3 (CVE-2026-12075); the datahub-actions image python layer is cache-busted so a stale cached layer stops shipping setuptools 70.3.0 (CVE-2025-47273).

Quickstart​

datahub docker quickstart (and --version v1.7.0) resolves to the v1.7.0.1 images once the version mapping update lands.

What's Changed​

Full Changelog: https://github.com/datahub-project/datahub/compare/v1.7.0...v1.7.0.1

v1.6.0.2​

Released on 2026-09-01 by @david-leifker.

What's Changed​

Full Changelog: https://github.com/datahub-project/datahub/compare/v1.6.0.1...v1.6.0.2

v1.6.0.1​

Released on 2026-08-13 by @david-leifker.

What's Changed​

Full Changelog: https://github.com/datahub-project/datahub/compare/v1.6.0...v1.6.0.1

v1.7.0​

Released on 2026-08-04 by @david-leifker.

DataHub v1.7.0​

Requirements

  • CLI / Python SDK: 1.7.0
  • Helm Chart: 1.1.0

Full upgrade guidance, including every breaking change and migration step: Updating DataHub — v1.7.0.

Upgrade path / ZDU: You must upgrade to v1.6.0 before upgrading to v1.7.0 — do not skip 1.6.0. Deploy v1.6.0 with Helm chart 1.0.3, let system-update complete, then upgrade to v1.7.0 with Helm chart 1.1.0. Enable Elasticsearch/OpenSearch ZDU (global.datahub.systemUpdate.zdu) with the 1.1.0 chart on a subsequent OpenSearch/Elasticsearch version bump — not during the v1.6.0 install.

Feature highlights​

UI and experience​
  • Metrics and Semantic Models — first-class metric and semanticModel entities with dedicated pages, a metrics home/sidebar experience, autocomplete, modular summary tabs, and lineage wiring (#18134, #18350–#18407, #18442–#18459, #18462, #18482, #18701, and related).
  • Logical Models UI — create, link, edit, and delete logical models from the UI, in addition to API/SDK paths (#18498).
  • Data Product lineage — data products participate directly in the lineage graph (#18463).
  • Multi-language (i18n) default on — I18N_ENABLED defaults to on in OSS; UI follows the browser locale. New Beta locales include French, Italian, Norwegian Bokmål, Swedish, Hungarian, and Finnish (#18285, #18282, #18221, #18222, #18263, #18265, #18339, #18520).
  • Lineage graph — always the latest lineage experience; LINEAGE_GRAPH_V2 / LINEAGE_GRAPH_V3 flags removed.
Ingestion — new sources​
  • Cube — semantic-layer connector (#17964)
  • AWS Kinesis — Kinesis Data Streams and Amazon Data Firehose (#17592)
  • MicroStrategy — BI connector (#18158)
  • Open Data Contract Standard (ODCS) — contracts from S3, GCS, HTTP, and Git (#17331, #18474, #18477)
  • ThoughtSpot (#17400)
  • SAP Datasphere (#17802)
  • DocumentDB platform — opt-in platform: documentdb on the MongoDB source for AWS DocumentDB (#17443)
Ingestion — major connector improvements​
  • Hex — major in-place upgrade: table- and column-level lineage from Hex APIs, Project → Component links, run history, optional AI context documents; Components ingested as Chart entities (see breaking changes) (#17376).
  • Snowflake — Semantic Views can emit first-class semanticModel / metric / logical-dataset entities (semantic_views.emit_semantic_model_entities; OSS default off / auto-resolve) (#18395, #18509).
  • Databricks Unity Catalog — Lakehouse Federation (foreign catalogs); usage/ops/queries from system.query.history via the shared SQL parsing aggregator; ML model ingestion controls fixed (#18213, #17971, #18220, and related).
  • Matillion — foldered container hierarchy, environment-scoped lineage, run history at pipeline and component levels, corrected console links (#17927).
  • Glue — Lake Formation resource-link schema resolution (default on), column-level LF tags, cross-account platform instances (#17963, #17812).
  • Redshift — multi-line SQL no longer dropped from lineage/usage; per-query popularity stats; table_pattern applied to SQL-parsing path (#18542, #18001, #18065).
  • BigQuery — table stats from INFORMATION_SCHEMA.PARTITIONS (see breaking changes); usage window fields consolidated to top-level (#18367, #18133).
  • Power BI / Mode — column-level lineage preserves original upstream column casing (#18181).
  • Spark — Apache Spark 4.x support (Scala 2.13 agent); OpenLineage 1.50 with full shading for EMR/DataZone coexistence (#14911).
  • S3 / ABS — profile data-lake files without PySpark; optional emit_folders_only for object-store folder cataloging (#18347, #18599, #18437).
  • Airbyte — Public API stream namespace recovery (#18727).
  • Kafka — profiling support (#14367).
  • Great Expectations — GX Core 1.x action path (#18706).
Search, auth, and metadata​
  • View authorization overhaul — entity types restricted by default when VBAC is on; VIEW_UNRESTRICTED_* overlays; documents view-restricted by default; schemaField can inherit VIEW from parent dataset (#18612, #18664, and related).
  • Structured properties — ES field-name collision rejection; keyword max-length validation; type-mismatch reindex detection.
  • Configurable search entity-type defaults — SEARCH_*_ENTITY_TYPES env overlays for GraphQL search/autocomplete/browse defaults.
  • File upload / object storage — config path moved to datahub.objectStorage (see breaking changes); documentation file attach/download guide.
Operations and platform​
  • Secrets caller guard — SECRET_SERVICE_CALLER_GUARD_MODE defaults to ENFORCE; human PATs can no longer decrypt UI secrets via GraphQL.
  • Primary storage read pool — optional Ebean/Cassandra read pool for entity-aspect reads (EBEAN_READ_POOL_* / CASSANDRA_READ_POOL_*).
  • Ebean transaction conflicts — stable retryable 503 / DATABASE_TRANSACTION_CONFLICT instead of opaque 500s on deadlock exhaustion.
  • Docker tags — floating :head removed; coordinated :quickstart and immutable :sha-* tags.
  • Optional Loki log shipping — LOG_AGGREGATOR_ENDPOINT for core services and the frontend.
  • jose4j shipped for Kafka SASL/OAUTHBEARER JWT validation.
  • Airflow plugin — Airflow 2.x dropped; Airflow 3.0+ required. Prefect plugin requires Prefect 3.x.
  • Orchestration plugins — Airflow / Dagster / Prefect / GX default emit mode is ASYNC.
  • Built-in column classifier removed — DataHubClassifier / acryl-datahub-classify no longer shipped.

Breaking changes​

Review the full Breaking Changes section in Updating DataHub before upgrading. Summary of items that may require action:

AreaWhat changedWho is affected
Must install v1.6.0 firstDo not skip 1.6.0; ZDU enablement uses Helm 1.1.0 after 1.6.0 + system-updateAll upgraders from pre-1.6.0
Secrets ENFORCEHuman PATs/browser can no longer decrypt UI secrets; use datahub-actions / system client or AUDIT temporarilyAnyone using user PATs for getSecretValues
Airflow 2 droppedPlugin requires Airflow 3.0+Airflow 2.x deployments — pin plugin <= 1.6.0 or upgrade Airflow
Prefect 3 requireddatahub-prefect requires Prefect 3.xPrefect 2.x users
Classifier removedBuilt-in DataHubClassifier gone; recipes with classification.enabled: true fail fastClassification-enabled recipes
Plugin emit ASYNCAirflow/Dagster/Prefect/GX default emit is asyncOperators needing sync/raise-on-reject — set SYNC_PRIMARY
Hex Components → ChartComponent entity type/URNs change; tags/policies may need reapplyHex workspaces with Components
Spark OL 1.50 trimmersPartition dirs stripped from FS/object-store dataset names by defaultSpark lineage without path_spec_list / file_partition_regexp
Power BI / Mode CLL casingUpstream column paths keep source casingRe-ingest; remove lowercase workarounds on SQL sources
BigQuery table statsStats from PARTITIONS; empty/external/views/snapshots lose some timestampsSet use_legacy_table_stats: true to restore
Object storage YAMLdatahub.s3 → datahub.objectStorageCustom YAML overrides (env vars largely unchanged)
View authorizationRestricted-by-default + VIEW_UNRESTRICTED_*; documents restrictedDeployments with VIEW_AUTHORIZATION_ENABLED=true
Lineage graph flagsLINEAGE_GRAPH_V2 / V3 removedAnyone still setting those env vars
Docker :headUse quickstart / immutable sha-* / release tagsCompose and production pin practices
Workunit processorsHelper functions → processor classes; several renamesCustom ingestion code calling old helpers
Relationship edge uniquenessOne aspect per (source, dest, relationship) signature (#18845)Custom / plugin entity registries
Logical parent authEdit Entity required on child and parent when linkingLogical-model operators

Potential downtime: Structured-property Elasticsearch type-mismatch reindex when both system-update flags are on — see Updating DataHub — v1.7.0.

Deprecations: Hex lineage time/page-size recipe fields; BigQuery usage.* window / formatting fields migrated to top-level — see the v1.7.0 Deprecations section in Updating DataHub.

Contributors​

Thank you to everyone who contributed to v1.7.0. For the complete changelog, compare v1.6.0...v1.7.0.

v1.6.0​

Released on 2026-05-21 by @david-leifker.

View the release notes for v1.6.0 on GitHub.

v1.5.0.7​

Released on 2026-05-19 by @david-leifker.

View the release notes for v1.5.0.7 on GitHub.

v1.5.0.6​

Released on 2026-05-11 by @david-leifker.

View the release notes for v1.5.0.6 on GitHub.

v1.5.0.5​

Released on 2026-05-07 by @david-leifker.

View the release notes for v1.5.0.5 on GitHub.

v1.5.0.4​

Released on 2026-05-06 by @david-leifker.

View the release notes for v1.5.0.4 on GitHub.

v1.5.0.3​

Released on 2026-04-25 by @david-leifker.

View the release notes for v1.5.0.3 on GitHub.