> ## Documentation Index
> Fetch the complete documentation index at: https://docs.open-metadata.org/llms.txt
> Use this file to discover all available pages before exploring further.
# 2.0 Release | OpenMetadata
> Explore all OpenMetadata releases with detailed changelogs, new features, bug fixes, and upgrade guides. Stay updated with the latest versions and improvements.
# 2.0 Release Notes
The OpenMetadata community is on a monthly release cadence. At every 4-5 weeks
we will be releasing a new version.
Learn how to upgrade your OpenMetadata instance to 2.0.2!
You can find the GitHub release [here](https://github.com/open-metadata/OpenMetadata/releases/tag/2.0.2-release).
## Changelog
OpenMetadata 2.0.2 is a maintenance release focused on connector reliability across Oracle, Databricks, Snowflake, BigQuery, Clickhouse, KafkaConnect, Grafana, and StarRocks, MCP tool consolidation and hardening, a governance rollout that restricts direct team membership to Group teams, several XSS and access-control fixes, and a broad security dependency cleanup.
### 🔌 Connectors & Ingestion
* **REST/OpenAPI: array properties with an inline object schema emitted a synthetic `item: UNKNOWN` child** [#32007](https://github.com/open-metadata/OpenMetadata/pull/32007): Expands the item's properties with their OpenMetadata types and descriptions instead.
* **REST/OpenAPI: API collections and endpoints could ingest out of order** [#31852](https://github.com/open-metadata/OpenMetadata/pull/31852): Persists all API collections before ingesting endpoints, so endpoints no longer reference a collection that hasn't been committed yet.
* **KafkaConnect: topic-namespace membership was emitted as lineage** [#32207](https://github.com/open-metadata/OpenMetadata/pull/32207): Topic-namespace membership is no longer misreported as a lineage edge.
* **KafkaConnect: Confluent Cloud managed connectors resolved no topics, and telemetry credential failures logged the same line whatever the cause** [#32512](https://github.com/open-metadata/OpenMetadata/pull/32512), [#32999](https://github.com/open-metadata/OpenMetadata/pull/32999): Topics are now resolved from Confluent's Telemetry API, and the warning distinguishes a 401 from a 403 with Confluent's own error detail.
* **`pygtrie` 2.6 broke `import airflow` on Python 3.10** [#32378](https://github.com/open-metadata/OpenMetadata/pull/32378): Caps `pygtrie` below 2.6 so ingestion imports Airflow correctly.
* **Databricks: SQL-defined DLT pipelines had no lineage extracted** [#31654](https://github.com/open-metadata/OpenMetadata/pull/31654): Lineage is now extracted from SQL-defined DLT pipelines.
* **Databricks: Unity Catalog access rows incorrectly linked a table to itself** [#32214](https://github.com/open-metadata/OpenMetadata/pull/32214): Legitimate access-not-derivation rows (a streaming or CDC write touching its own target table) no longer create a self-referencing lineage edge.
* **Databricks: large workspaces failed to ingest all jobs** [#33204](https://github.com/open-metadata/OpenMetadata/pull/33204): Jobs are now paginated by token, so large workspaces ingest in full.
* **Clickhouse: materialized views had no downstream lineage** [#32314](https://github.com/open-metadata/OpenMetadata/pull/32314): Downstream lineage is now created for materialized views.
* **Oracle: query history failed with `ORA-00933` on Oracle 11g** [#32310](https://github.com/open-metadata/OpenMetadata/pull/32310): Query history now works against Oracle 11g.
* **Oracle: CHAR length semantics were lost in the reflected column type** [#32306](https://github.com/open-metadata/OpenMetadata/pull/32306): CHAR length semantics are now preserved during reflection.
* **Athena: assume-role credentials were never refreshed** [#32853](https://github.com/open-metadata/OpenMetadata/pull/32853): Assume-role credentials now refresh correctly.
* **Snowflake: query tags mutated the configured connection arguments** [#32481](https://github.com/open-metadata/OpenMetadata/pull/32481): `QUERY_TAG` is now applied through the driver session parameters at connection creation.
* **BigQuery: multi-project ingestion with ADC or a credentials file always connected to the first project** [#32846](https://github.com/open-metadata/OpenMetadata/pull/32846): Each database iteration is now scoped to the project it is ingesting.
* **Doris: identifiers in generated SQL were unquoted** [#32443](https://github.com/open-metadata/OpenMetadata/pull/32443): Doris identifiers are now quoted.
* **Grafana: panels nested inside collapsed rows were skipped** [#32825](https://github.com/open-metadata/OpenMetadata/pull/32825): Collapsed-row panels are flattened before chart and lineage ingestion.
* **Airflow: dynamically mapped tasks produced no lineage** [#32818](https://github.com/open-metadata/OpenMetadata/pull/32818): `inlets`/`outlets` serialized inside `partial_kwargs` are now read when the top-level keys are empty.
* **Protobuf schemas whose message didn't match the topic name failed to parse** [#32449](https://github.com/open-metadata/OpenMetadata/pull/32449): Parsing falls back to the sole top-level message, keeps ambiguous schemas unresolved, and supports well-known imports.
* **Domo and Astra connection fields diverged from the password-field conventions** [#32545](https://github.com/open-metadata/OpenMetadata/pull/32545): Both are aligned, and stored connection values are restored on update.
* **Kubernetes ingestion pipelines couldn't decrypt the ingestion-bot JWT token** [#32708](https://github.com/open-metadata/OpenMetadata/pull/32708): The token is now correctly deserialized and decrypted.
* **A bad `SERVICE_TYPE_REF` lookup result went unvalidated** [#32739](https://github.com/open-metadata/OpenMetadata/pull/32739): The result is now validated in `get_reference_type_from_service_type`.
* **The Kubernetes exit handler could match its own pod as the main pod** [#32743](https://github.com/open-metadata/OpenMetadata/pull/32743): The exit handler no longer matches itself.
* **Looker: data-model lineage failed on the first run** [#32367](https://github.com/open-metadata/OpenMetadata/pull/32367): The sink's bulk buffer is now flushed before anything looks up a data model.
* **Tableau: auto-titled mirror columns were ingested as duplicates** [#32301](https://github.com/open-metadata/OpenMetadata/pull/32301): Mirror columns are now collapsed.
* **Spark services offered a Metadata Agent that cannot work** [#32834](https://github.com/open-metadata/OpenMetadata/pull/32834): Spark metadata is pushed by the Spark Agent, so pull-based extraction is now marked unsupported.
* **StarRocks: lineage builds produced unresolvable FQNs** [#32543](https://github.com/open-metadata/OpenMetadata/pull/32543): FQNs now resolve correctly during lineage builds.
### 📊 Data Quality
* **Databricks profiler: remaining SQL failures** [#32441](https://github.com/open-metadata/OpenMetadata/pull/32441): Resolves the remaining SQL failures in the Databricks profiler.
* **The test case picker didn't handle request failures** [#32514](https://github.com/open-metadata/OpenMetadata/pull/32514): Request failures in the test case picker are now handled gracefully.
* **No way to soft delete and restore test cases** [#32349](https://github.com/open-metadata/OpenMetadata/pull/32349): Adds UI support for soft deleting and restoring test cases.
* **BigQuery: STRUCT profiler columns weren't attached** [#32549](https://github.com/open-metadata/OpenMetadata/pull/32549): STRUCT profiler columns are now attached correctly.
* **Doris: profiler datetime partition filters weren't Doris-compatible** [#32788](https://github.com/open-metadata/OpenMetadata/pull/32788): Adds Doris dialect compilation for `DatetimeAddFn` and `TimestampAddFn`.
* **Data Insights showed wrong numbers with no error, and one chart path returned a 500** [#32115](https://github.com/open-metadata/OpenMetadata/pull/32115): Declares each data asset type once instead of in three separate places, fixing four silently-wrong metrics and the 500.
* **Sample-data validation timeout wasn't forwarded across `docker exec`** [#31710](https://github.com/open-metadata/OpenMetadata/pull/31710): The configured timeout now propagates correctly.
* **Contracts: `qualityScore` came back `NaN` when every referenced test was soft-deleted** [#32750](https://github.com/open-metadata/OpenMetadata/pull/32750): `qualityScore` no longer breaks when referenced tests are soft-deleted.
* **The contract status badge didn't reflect the actual status** [#32964](https://github.com/open-metadata/OpenMetadata/pull/32964): The badge is now driven off the actual contract status.
* **`TestSuiteDetailsPage` showed no error state on fetch failure** [#32746](https://github.com/open-metadata/OpenMetadata/pull/32746): A fetch failure now renders an error state instead of a blank page.
* **Profiler partitioning was built from stale form state** [#33117](https://github.com/open-metadata/OpenMetadata/pull/33117): Partitioning is now built from the current form values.
* **Auto-classification did nothing when sample data was disabled** [#32607](https://github.com/open-metadata/OpenMetadata/pull/32607): With no sampled fields, metadata leaf columns are now traversed so column-name recognizers still run.
* **Test Cases pagination wasn't reset when search or filters changed** [#33335](https://github.com/open-metadata/OpenMetadata/pull/33335): Pagination now resets to page one on search or filter changes.
### 🔍 Search & Discovery
* **`name.keyword` wasn't exposed, and removed search fields couldn't be re-added** [#32369](https://github.com/open-metadata/OpenMetadata/pull/32369): `name.keyword` is now exposed, and removed search fields can be re-added.
* **Embedding token usage was discarded instead of reported** [#32552](https://github.com/open-metadata/OpenMetadata/pull/32552): Embedding token usage is now reported.
* **Semantic search embedded ElasticSearch queries as documents instead of queries** [#32553](https://github.com/open-metadata/OpenMetadata/pull/32553): Queries are now embedded as queries, improving semantic search relevance.
* **A single-writer reindex pipeline was needed for RDF** [#33098](https://github.com/open-metadata/OpenMetadata/pull/33098): Backports a single-writer RDF reindex pipeline to prevent concurrent-write conflicts.
* **Ranking could throw an NPE on Lucene 10 when a segment had zero matches** [#33292](https://github.com/open-metadata/OpenMetadata/pull/33292): `script_score` now guards against zero-match segments.
### 🛡️ Data Governance & Quality
* **Governance workflow edge conditions and node references were interpolated unchecked into Flowable expressions** [#32370](https://github.com/open-metadata/OpenMetadata/pull/32370): Conditional-edge conditions and source nodes are now validated at the create/update boundary.
* **Direct users could be assigned to non-Group teams through the API or the team dropdown, then couldn't be removed, added through the UI, or exported** [#32372](https://github.com/open-metadata/OpenMetadata/pull/32372), [#32915](https://github.com/open-metadata/OpenMetadata/pull/32915): Direct memberships are now rejected for Department, Division, and BusinessUnit teams, and team dropdowns offer only Group teams.
* **Migration: existing direct-user memberships on non-Group teams from before the fix above stayed invalid** [#33352](https://github.com/open-metadata/OpenMetadata/pull/33352): A 2.0.2 migration cleans up the pre-existing invalid memberships automatically.
* **Non-Group team Users tabs showed no members after direct membership was restricted** [#33354](https://github.com/open-metadata/OpenMetadata/pull/33354): The Users tab now rolls up members from sub-groups instead.
* **Bot list responses omitted the required `botUser` relationship** [#32398](https://github.com/open-metadata/OpenMetadata/pull/32398): The relationship is now batch-loaded for list responses, so SDK `list_all_entities` calls can deserialize `Bot` entities.
* **App endpoint permission checks didn't match the platform RBAC model** [#32427](https://github.com/open-metadata/OpenMetadata/pull/32427): App endpoints now align with platform RBAC, and App patch is authorized before the entity lookup.
* **Broken access control on the glossary-term bulk asset endpoints** [#32539](https://github.com/open-metadata/OpenMetadata/pull/32539): `assets/add` and `assets/remove` now authorize `EDIT_GLOSSARY_TERMS` on each target asset instead of bypassing the authorizer.
* **Cross-user follower changes were unrestricted** [#32322](https://github.com/open-metadata/OpenMetadata/pull/32322): Follower endpoints now reject a null `userId`, compare against the authenticated subject, and require admin authorization for cross-user mutations.
* **OpenMetadata accepted a URL without an http(s) scheme** [#32542](https://github.com/open-metadata/OpenMetadata/pull/32542): URLs without an http(s) scheme are now rejected.
* **Pub/Sub credentials weren't masked correctly** [#32135](https://github.com/open-metadata/OpenMetadata/pull/32135): Converts persisted Pub/Sub credentials to their generated schema classes before masking and unmasking, so they're consistently protected.
* **Overriding metadata merged tags instead of replacing them** [#32496](https://github.com/open-metadata/OpenMetadata/pull/32496): A bot bulk PUT that explicitly supplies tags now replaces existing tags when `overrideMetadata` is set, instead of merging them.
* **No way to export classification and tag-level data** [#31938](https://github.com/open-metadata/OpenMetadata/pull/31938): Adds export support for classification and tag level.
* **Bot searches didn't apply the caller's policies** [#32460](https://github.com/open-metadata/OpenMetadata/pull/32460): Bot searches now apply the caller's policies.
* **The search dropdown option label was set through `dangerouslySetInnerHTML`** [#32572](https://github.com/open-metadata/OpenMetadata/pull/32572): The highlighted label is parsed into React nodes from a sanitized string instead.
* **`stringToHTML` rendered stored user content unsanitized** [#32951](https://github.com/open-metadata/OpenMetadata/pull/32951): The helper now routes through `DOMPurify.sanitize()`.
* **A DOMPurify bypass in math equations, and an XSS in the mention dropdown** [#32896](https://github.com/open-metadata/OpenMetadata/pull/32896): Both are closed.
* **Airflow API responses leaked internal diagnostics** [#32850](https://github.com/open-metadata/OpenMetadata/pull/32850): Responses are now generic. Diagnostics remain in the logs.
### 🔗 Lineage
* **Impact Analysis pagination wasn't reset when search or quick-filters changed** [#32699](https://github.com/open-metadata/OpenMetadata/pull/32699): Pagination now resets to page one.
* **Changing the Upstream/Downstream Depth in the lineage settings modal did nothing** [#33299](https://github.com/open-metadata/OpenMetadata/pull/33299): The setting now writes to the shared lineage store, so changing it correctly refetches the graph.
### 🤖 MCP Server / Automations
* **The MCP tool surface had 24 overlapping tools** [#32072](https://github.com/open-metadata/OpenMetadata/pull/32072): Merges overlapping tools down to 15.
* **MCP Knowledge Page creation was broken** [#32209](https://github.com/open-metadata/OpenMetadata/pull/32209): Knowledge Page creation now works through MCP.
* **MCP mishandled unknown methods and initialized notifications** [#32147](https://github.com/open-metadata/OpenMetadata/pull/32147): Both are now handled per the MCP protocol.
* **MCP tools bypassed lineage authorization** [#32437](https://github.com/open-metadata/OpenMetadata/pull/32437): Lineage authorization is now enforced in MCP tools.
* **MCP entity patch requests mishandled the entity lifecycle** [#32226](https://github.com/open-metadata/OpenMetadata/pull/32226): MCP entity patch lifecycle handling is fixed.
* **The MCP connector used an unsupported ingestion transport** [#32342](https://github.com/open-metadata/OpenMetadata/pull/32342): The MCP connector now uses HTTP transport.
* **An owner could be rejected with a 403 reading their own private memory** [#32858](https://github.com/open-metadata/OpenMetadata/pull/32858): The owners relationship is now hydrated before the private-memory visibility check runs, even when the request didn't project `owners`.
* **AI context trust signals and MCP context-memory visibility were missing** [#32261](https://github.com/open-metadata/OpenMetadata/pull/32261), [#32465](https://github.com/open-metadata/OpenMetadata/pull/32465): Both are added.
### 🔐 Authentication
* **SSO role changes at the identity provider weren't reflected in OpenMetadata** [#32961](https://github.com/open-metadata/OpenMetadata/pull/32961): SSO roles now sync from the provider's `id_token` at the OIDC callback.
* **OIDC login could issue a zero-lifetime token** [#33251](https://github.com/open-metadata/OpenMetadata/pull/33251): Zero-lifetime OIDC login tokens are now prevented.
### ⚙️ Platform
* **`catalog.log` duplicated every rotated `openmetadata.log` line** [#32366](https://github.com/open-metadata/OpenMetadata/pull/32366): Log rotation no longer duplicates lines into `catalog.log`.
* **Logs failed to render on Kubernetes 1.36+** [#32504](https://github.com/open-metadata/OpenMetadata/pull/32504): Logs now render correctly on Kubernetes 1.36 and later.
### 🎛️ UI
* **The Queries tab showed the parent table's description provenance instead of its own** [#32292](https://github.com/open-metadata/OpenMetadata/pull/32292): The Queries tab now shows the correct provenance.
* **A second domain tag update returned a 400** [#32358](https://github.com/open-metadata/OpenMetadata/pull/32358): A second update to a domain tag no longer fails.
* **No pagination for large glossaries** [#32223](https://github.com/open-metadata/OpenMetadata/pull/32223): Adds cursor-based Prev/Next pagination and paged expand-all for glossary terms.
* **Math equations were silently stripped on save** [#32313](https://github.com/open-metadata/OpenMetadata/pull/32313): Preserves `` nodes through both the frontend and backend sanitizers.
* **The metric version page crashed into the error boundary** [#32794](https://github.com/open-metadata/OpenMetadata/pull/32794): `UnitOfMeasurement` was a type-only import, so it was erased at build time and threw at runtime. It's now imported as a value.
* **The Data Product "Add Assets" picker ignored the Domain Validation rule** [#32336](https://github.com/open-metadata/OpenMetadata/pull/32336): The picker lists assets across all domains when the rule is disabled, and stays domain-scoped when it's enabled.
* **The glossary term-not-found state used an inconsistent placeholder** [#32865](https://github.com/open-metadata/OpenMetadata/pull/32865): The term-not-found state now uses the shared `NoDataPlaceholder` component.
* **No way to filter team assets by entity type, and quick-filter removal was broken** [#32807](https://github.com/open-metadata/OpenMetadata/pull/32807): Adds an Entity Type filter to team assets and fixes quick-filter removal.
* **The Data Product Reviewers field showed in OSS** [#32914](https://github.com/open-metadata/OpenMetadata/pull/32914): The field is now hidden in OSS, since it's a Collate-only capability.
* **The Data Product grid card had no Description field** [#32948](https://github.com/open-metadata/OpenMetadata/pull/32948): Adds a Description field to the grid card and restyles its labels.
* **The Glossary Terms zero-result state ignored active filters** [#32857](https://github.com/open-metadata/OpenMetadata/pull/32857): The empty state is now filter-aware.
* **The entity-type trigger didn't receive focus before its listbox opened** [#32969](https://github.com/open-metadata/OpenMetadata/pull/32969): Focus now moves to the trigger first.
* **Context Center: the article Data Products panel and domain save had bugs** [#33081](https://github.com/open-metadata/OpenMetadata/pull/33081): Both are fixed.
* **Advanced Search lowercased tag-like option casing** [#33220](https://github.com/open-metadata/OpenMetadata/pull/33220): Tag-like options now show their original casing.
* **The entity hover card could outlive its trigger, and a 403 looked identical to an empty result** [#33205](https://github.com/open-metadata/OpenMetadata/pull/33205): The hover card now closes when its trigger is gone, and a 403 is now told apart from a genuinely empty response.
* **The Topic page showed nothing on sustained fetch failures** [#32736](https://github.com/open-metadata/OpenMetadata/pull/32736): The Topic page now shows an error placeholder.
* **`TierCard`'s selected tier wasn't reset on close** [#33115](https://github.com/open-metadata/OpenMetadata/pull/33115): Closing the card now resets `selectedTier`, preventing stale radio state.
* **The table-type custom property editor lost user data when a column was named `id`** [#32741](https://github.com/open-metadata/OpenMetadata/pull/32741): User data is now preserved regardless of column name.
* **Clicks on Domain and Data Product listing rows could be intercepted by a nested link or an overlay** [#33267](https://github.com/open-metadata/OpenMetadata/pull/33267), [#33022](https://github.com/open-metadata/OpenMetadata/pull/33022): Row clicks and the pointer cursor now work correctly, and overlays no longer swallow clicks meant for the row.
### 🔒 Security
* **`@humanfs/node` → 0.16.8** [#32561](https://github.com/open-metadata/OpenMetadata/pull/32561).
* **Jackson** for CVE-2026-83557 and CVE-2026-19032 [#32813](https://github.com/open-metadata/OpenMetadata/pull/32813).
* **`fast-uri` → 3.1.7** [#32870](https://github.com/open-metadata/OpenMetadata/pull/32870).
* **`js-yaml` → 5.4.1** [#32913](https://github.com/open-metadata/OpenMetadata/pull/32913).
* **Jetty → 12.1.12** [#33026](https://github.com/open-metadata/OpenMetadata/pull/33026).
* **`@tiptap/*` → 2.27.3** for a `mergeAttributes` prototype-pollution vulnerability [#33035](https://github.com/open-metadata/OpenMetadata/pull/33035).
* **Vulnerable Debian packages upgraded** in ingestion images [#33321](https://github.com/open-metadata/OpenMetadata/pull/33321).
* **Netty → 4.2.18.Final and Freemarker → 2.3.35** for CVE-2026-89044 and CVE-2026-84939 [#33327](https://github.com/open-metadata/OpenMetadata/pull/33327).
### 📣 Notifications
* **Bulk entity updates wrote no change event, so `Get Schema Changes` alerts never fired on metadata ingestion** [#32350](https://github.com/open-metadata/OpenMetadata/pull/32350): The bulk path now captures the incremental change description, so bulk updates both alert and audit.
* **A `Pipeline` alert filtered to `Failed` re-notified forever and backfilled on creation** [#32181](https://github.com/open-metadata/OpenMetadata/pull/32181): Re-ingested and historical runs no longer emit change events.
* **A single unevaluable event discarded its whole change-event batch** [#32953](https://github.com/open-metadata/OpenMetadata/pull/32953): One bad event no longer takes down the rest of the batch.
You can find the GitHub release [here](https://github.com/open-metadata/OpenMetadata/releases/tag/2.0.1-release).
## Changelog
OpenMetadata 2.0.1 is a maintenance release focused on connector reliability, UI polish across Context Center and Explore, data governance and quality correctness, search and lineage fixes, MCP hardening, and a broad security dependency cleanup.
### 🔌 Connectors & Ingestion
* **MLflow: Unity Catalog model version resolution and search were broken** [#30856](https://github.com/open-metadata/OpenMetadata/pull/30856), [#31387](https://github.com/open-metadata/OpenMetadata/pull/31387): Model versions now resolve correctly, and the search filter is properly escaped.
* **MLflow 3.x model signatures were not extracted and the registry listing was unpaginated** [#32093](https://github.com/open-metadata/OpenMetadata/pull/32093): Extracts 3.x model signatures and paginates the registry listing.
* **BigQuery: GCP service account impersonation not applied to policy tag reads** [#31249](https://github.com/open-metadata/OpenMetadata/pull/31249): Policy tag reads now honour the configured impersonation, matching the rest of the connector.
* **Tableau: mirrored upstream columns duplicated in data models** [#30928](https://github.com/open-metadata/OpenMetadata/pull/30928): Mirrored upstream columns are collapsed instead of appearing twice.
* **DB2: sqlalchemy-ibmi dialect incompatible with SQLAlchemy 2.0** [#30731](https://github.com/open-metadata/OpenMetadata/pull/30731): Adapts the dialect so DB2 ingestion works on SQLAlchemy 2.0.
* **DB2: CLI driver reinitialized on every query** [#32151](https://github.com/open-metadata/OpenMetadata/pull/32151): The driver now initializes once per process.
* **Trino: unnamed and quoted ROW fields mishandled during reflection** [#31402](https://github.com/open-metadata/OpenMetadata/pull/31402): Reflection now correctly handles unnamed and quoted ROW fields.
* **REST API: array-root schemas failed to parse** [#31698](https://github.com/open-metadata/OpenMetadata/pull/31698): Schemas with an array at the root now parse correctly.
* **Glue: duplicate columns caused partition keys to drop the whole table** [#32105](https://github.com/open-metadata/OpenMetadata/pull/32105): Columns are deduplicated so partition keys no longer cause a full table drop.
* **Glue: a custom databaseName dropped every schema** [#32399](https://github.com/open-metadata/OpenMetadata/pull/32399): Custom `databaseName` values no longer wipe out schema ingestion.
* **OpenLineage: Kafka SSL and password handling was missing on 2.0** [#32089](https://github.com/open-metadata/OpenMetadata/pull/32089): Backports SSL and password handling for Kafka-backed OpenLineage events.
* **dbt: results with a null message failed to ingest** [#31138](https://github.com/open-metadata/OpenMetadata/pull/31138): Null-message results now ingest, and compile-only stubs no longer shadow executed results.
* **Doris: unofficial driver caused ingestion issues** [#32163](https://github.com/open-metadata/OpenMetadata/pull/32163): Ingestion now uses the official pydoris driver.
* **Looker: trailing slash in hostPort broke SDK URL concatenation** [#31761](https://github.com/open-metadata/OpenMetadata/pull/31761): The trailing slash is stripped before the SDK builds request URLs.
* **Ingestion pipeline deploys re-parsed the whole DAG folder every time** [#32101](https://github.com/open-metadata/OpenMetadata/pull/32101): Stops the full re-parse on every deploy and scales the deploy-pipelines deadline accordingly.
### 📊 Data Quality
* **Migration: tableDiff `supportedServices` migrated on upgrade** [#31715](https://github.com/open-metadata/OpenMetadata/pull/31715): Existing tableDiff test definitions carry their supported services forward automatically.
* **BigQuery `uniqueCount` emitted invalid SQL for nested STRUCT subfield columns** [#31501](https://github.com/open-metadata/OpenMetadata/pull/31501): The metric now generates valid SQL for nested STRUCT subfields.
* **Column values compared against `''` even when the column type couldn't hold it** [#31130](https://github.com/open-metadata/OpenMetadata/pull/31130): The empty-string comparison only runs when the column type supports it.
* **Profiler data survived table hard deletes, and the orphan sweep deleted live column profiles** [#31556](https://github.com/open-metadata/OpenMetadata/pull/31556): Profiler data is now purged on hard delete, and the orphan sweep no longer touches live profiles.
* **Time-series data was destroyed on every delete, not just hard deletes** [#31842](https://github.com/open-metadata/OpenMetadata/pull/31842): Time-series destruction is now bound specifically to hard delete.
* **Dynamic Assertion control shown where it doesn't apply** [#31996](https://github.com/open-metadata/OpenMetadata/pull/31996): OpenMetadata now hides the control, since it's a Collate-only feature.
* **No way to search within test suite details** [#32176](https://github.com/open-metadata/OpenMetadata/pull/32176): Adds search to the test suite details view.
### 🔍 Search & Discovery
* **Domain tree search failures rejected the request instead of surfacing the error** [#31823](https://github.com/open-metadata/OpenMetadata/pull/31823): Search failures in the domain tree are now surfaced instead of silently rejected.
* **No way to filter Explore by Data Product** [#31940](https://github.com/open-metadata/OpenMetadata/pull/31940): Adds Data Product as a top-level Explore filter.
* **Reindex jobs reported success even when the search cluster was degraded** [#32001](https://github.com/open-metadata/OpenMetadata/pull/32001): Reindex status now fails when the cluster is degraded.
* **`columnDescriptionStatus` ignored nested columns** [#32203](https://github.com/open-metadata/OpenMetadata/pull/32203): The status now recurses into nested columns.
* **Natural-language search bypassed RBAC and query filters** [#31727](https://github.com/open-metadata/OpenMetadata/pull/31727): Applies RBAC, `queryFilter`, and `deleted` to the NLQ happy path.
* **Hybrid search defaulted keyword and semantic weighting incorrectly** [#32300](https://github.com/open-metadata/OpenMetadata/pull/32300): Swaps the default hybrid-search weighting for keyword vs. semantic.
* **AI Governance Studio assets were not searchable via vector search** [#31738](https://github.com/open-metadata/OpenMetadata/pull/31738): AI Governance Studio assets are now vector-searchable.
### 🛡️ Data Governance & Quality
* **Glossary: system-defined relation types could be edited through the generic settings PUT** [#31944](https://github.com/open-metadata/OpenMetadata/pull/31944): Field edits to system-defined relation types are now rejected.
* **ODCS (Open Data Contract Standard) passthrough was stripped by non-ODCS updates, and element attributes weren't round-tripped** [#31145](https://github.com/open-metadata/OpenMetadata/pull/31145): Preserves the ODCS passthrough on unrelated updates and round-trips element attributes correctly.
* **Data Products couldn't be assigned across domains from the UI** [#32220](https://github.com/open-metadata/OpenMetadata/pull/32220): Assigning a Data Product across domains now works from the UI.
* **Context Center pages ignored the requested entity status on creation** [#31728](https://github.com/open-metadata/OpenMetadata/pull/31728): The requested `entityStatus` now carries onto the created page.
* **PII scanner missed separated Aadhaar numbers** [#31900](https://github.com/open-metadata/OpenMetadata/pull/31900): Recognizes Aadhaar numbers written with separators.
* **PII scanner ties among equally weighted classifications were unresolved** [#31961](https://github.com/open-metadata/OpenMetadata/pull/31961): The NER (named entity recognition) scanner now breaks weighted-score ties by confidence.
* **Incident Manager listing didn't enforce caller policies** [#32017](https://github.com/open-metadata/OpenMetadata/pull/32017): The listing now enforces the caller's policies.
* **Masked secrets were overwritten during configuration updates** [#31989](https://github.com/open-metadata/OpenMetadata/pull/31989): Masked secrets are now preserved when a configuration is updated.
* **User patch requests bypassed the expected permission checks** [#32323](https://github.com/open-metadata/OpenMetadata/pull/32323): Fixes user patch permission enforcement.
* **Ingestion pipeline actions bypassed permission checks** [#32321](https://github.com/open-metadata/OpenMetadata/pull/32321): Ingestion pipeline actions now enforce the expected permissions.
### 🔗 Lineage
* **Lineage canvas scrolling broke when the filters panel was expanded** [#32036](https://github.com/open-metadata/OpenMetadata/pull/32036): Scrolling on the lineage canvas now works correctly with the filters panel open.
* **Impact analysis table content was clipped instead of scrolling** [#32201](https://github.com/open-metadata/OpenMetadata/pull/32201): The lineage card now uses a flex layout with a scrollable content region.
### 🤖 MCP Server / Automations
* **MCP tool surface was expensive to call and unclear about what it returned** [#32019](https://github.com/open-metadata/OpenMetadata/pull/32019): Makes the MCP tool surface cheaper to call and more explicit about its return values.
* **MCP error responses leaked a full Java stack trace on unauthenticated requests** [#31875](https://github.com/open-metadata/OpenMetadata/pull/31875): A 401 from an unauthenticated MCP call no longer serializes the underlying exception's stack trace.
### ⚙️ Platform
* **Migration: AutoPilotWorkflow BPMN (Business Process Model and Notation) redeploy and task supersede fallback for 2.0** [#32162](https://github.com/open-metadata/OpenMetadata/pull/32162): Adds the v2.0.1 migration that redeploys the AutoPilotWorkflow BPMN definition and adds a task supersede fallback.
* **OIDC login handler and MCP callback auth relied on an EOL pac4j line** [#32380](https://github.com/open-metadata/OpenMetadata/pull/32380): Upgrades pac4j from 5.7.10 to 6.5.6 and adapts `AuthenticationCodeFlowHandler` and the MCP callback servlet to its API changes.
* **Alerts offered event types a resource can't actually deliver** [#30587](https://github.com/open-metadata/OpenMetadata/pull/30587): Alerts now only offer the event types each resource can deliver.
### 🎛️ UI
* **A URL with no tab segment didn't render the tab already on screen** [#31448](https://github.com/open-metadata/OpenMetadata/pull/31448): The current tab renders correctly when the URL omits the tab segment.
* **Selected persona reset to the default on page refresh** [#32201](https://github.com/open-metadata/OpenMetadata/pull/32201): The active persona now persists across a refresh via sessionStorage.
* **Domain and Data Product rows were only partly clickable** [#31876](https://github.com/open-metadata/OpenMetadata/pull/31876): The whole row is now clickable.
* **Persona customization pages crashed when a page was null** [#32034](https://github.com/open-metadata/OpenMetadata/pull/32034): Null persona customization pages are now handled gracefully.
* **Explore filter typography regressed** [#32141](https://github.com/open-metadata/OpenMetadata/pull/32141): Restores the expected Explore filter typography.
* **Modals and the right panel reopened immediately after being closed** [#32124](https://github.com/open-metadata/OpenMetadata/pull/32124): Closing a modal or right panel now stays closed.
* **Sample Data tab crashed when a column was named `children`** [#31500](https://github.com/open-metadata/OpenMetadata/pull/31500): The Sample Data tab no longer crashes on a column literally named `children`.
* **Dialog content clipped instead of scrolling when it overflowed** [#32224](https://github.com/open-metadata/OpenMetadata/pull/32224): Dialog content now scrolls instead of being clipped.
* **`/my-data` redirect instead of rendering at `/`** [#32229](https://github.com/open-metadata/OpenMetadata/pull/32229): MyData renders at `/` directly instead of redirecting.
* **Severity translations used hardcoded strings instead of generic i18n keys** [#32194](https://github.com/open-metadata/OpenMetadata/pull/32194): Severity labels now use generic translations.
* **Icons and images rendered based on regex pre-validation instead of the real load outcome, with a cached-image race and misapplied icon classes** [#31982](https://github.com/open-metadata/OpenMetadata/pull/31982), [#32067](https://github.com/open-metadata/OpenMetadata/pull/32067), [#32110](https://github.com/open-metadata/OpenMetadata/pull/32110): Icon rendering now reflects the actual load outcome across tags, classification, and certification pages.
* **Context Center "Dashboard" renamed to "Overview"** [#32125](https://github.com/open-metadata/OpenMetadata/pull/32125): Updates the surface name and route for consistency.
* **AI-memory prompt used an inconsistent translation key** [#32140](https://github.com/open-metadata/OpenMetadata/pull/32140): Renames the key so the "what should AI remember" prompt translates correctly.
* **ER diagram drawer wasn't full width, and the column panel could double-close** [#32337](https://github.com/open-metadata/OpenMetadata/pull/32337): The drawer now renders full width, and the column panel no longer double-closes.
* **Login video gradient was hardcoded** [#32388](https://github.com/open-metadata/OpenMetadata/pull/32388): The login video gradient is now driven from `LoginClassBase`, so it can be customized.
### 🔒 Security
#### JVM / Backend
* **`micrometer` → 1.16.7** for CVE-2026-59296 [#31927](https://github.com/open-metadata/OpenMetadata/pull/31927).
* **Spring → 7.0.9** for CVE-2026-47886, CVE-2026-59282, and CVE-2026-59283 [#32222](https://github.com/open-metadata/OpenMetadata/pull/32222).
* **`httpclient5` → 5.6.4** and **`jsoup` → 1.23.2** [#32293](https://github.com/open-metadata/OpenMetadata/pull/32293).
* **Apache Jena and Fuseki → 6.2.0** for CVE-2026-61372 [#32274](https://github.com/open-metadata/OpenMetadata/pull/32274).
* **Reactor moved to the 2026.0 train** to clear reactor-core/netty CVEs [#32393](https://github.com/open-metadata/OpenMetadata/pull/32393).
#### UI
* **`fast-uri` → 3.1.6** [#32139](https://github.com/open-metadata/OpenMetadata/pull/32139).
#### Ingestion Images
* **Airflow → 3.3.1** (CVE-2026-67587 / CVE-2026-54183) and **`expat` → 2.8.3** (CVE-2026-72522) [#31890](https://github.com/open-metadata/OpenMetadata/pull/31890).
* **OpenSSL refreshed** [#32215](https://github.com/open-metadata/OpenMetadata/pull/32215).
* **`pyathena` → 3.35.4** [#32167](https://github.com/open-metadata/OpenMetadata/pull/32167).
* **`linux-libc-dev` upgraded** to clear kernel CVE scan findings [#32169](https://github.com/open-metadata/OpenMetadata/pull/32169).
* **CVE-2026-68082 cleared** in the trixie images [#32259](https://github.com/open-metadata/OpenMetadata/pull/32259).
You can find the GitHub release [here](https://github.com/open-metadata/OpenMetadata/releases/tag/2.0.0-release).
## Features
### Data Quality Revamp
* **Dynamic Sampling by default**: The Profiler now defaults to Dynamic Sampling instead of scanning 100% of rows, significantly reducing query cost and execution time on large tables.
* **Cardinality distribution removed from defaults**: Cardinality metrics are no longer collected on every run. If your workflows depend on distinct-value counts (classification, tagging, custom rules), explicitly add cardinality distribution to the relevant profiler configuration.
* Existing profiler configs are preserved — only pipelines using the default agent config are affected.
### Governance — Custom Intake Forms & OWL Import
* **Custom Intake Forms**: Define custom forms for governance intake workflows — asset certification, ownership assignment, data classification, or any structured intake process. Forms are configurable per entity type and feed into the existing task and workflow system.
* **OWL Import**: Import OWL (Web Ontology Language) files to load existing ontologies and classification taxonomies directly into OpenMetadata, reusing industry-standard or enterprise-specific taxonomy assets.
### Context Center
Knowledge Center has been replaced by **Context Center** — the single destination for reference content in your catalog. Existing pages are automatically migrated as **Articles** on upgrade. New content types include **Documents** (freeform rich-text attached to assets or teams) and a **Dashboard view** for discovering and managing content across your organisation.
### Activity Feed, Tasks, Workflows, and Announcements
Activity Feed, Tasks, Workflows, and Announcements are fully compatible with 2.0 data models. Migrated assets, in-flight tasks, and announcements carry over automatically — no manual action required.
### Ingestion — Connectors
* **Databricks Pipeline**: Authentication updated from a bare `token` field to a structured `authType` object supporting Personal Access Token, DatabricksOAuth, and Azure AD. Stored connection configs are migrated automatically.
* **Python 3.12**: Ingestion images now run on Python 3.12 (`python:3.12-slim-trixie`; Airflow upgraded to `apache/airflow:3.3.0-python3.12`). This change first shipped in 1.13.4 — skip if already on 1.13.4.
* Additional connector stability improvements and bug fixes across the connector library.
### MCP (Model Context Protocol)
OpenMetadata's MCP server exposes catalog metadata to AI assistants and agents through the Model Context Protocol — any MCP-compatible client (Claude, Cursor, IDE plugins) can query your catalog without custom integrations.
* **Enabled by default**: Starts ready on upgrade; no manual activation needed.
* **`nextCursor` pagination**: MCP read tools can return a `nextCursor` value alongside results. Pass it as `cursor` on the next call to continue; cursor behavior varies by tool. Existing `from`/`size` offset parameters continue to work.
### Inbox
Inbox notifications have been updated to reduce noise across 2.0 workflows — task notifications are grouped and filtered consistently, announcements are correctly scoped to relevant entities, and activity items from the 2.0 migration are correctly attributed.
### Landing Page
The landing page has been redesigned with an updated navigation structure and cleaner entry points into asset discovery, lineage, governance, and data quality — reducing the clicks required to reach the most-used workflows.
***
## Breaking Changes
### MCP — Cursor Paging Available (Offset Still Supported)
MCP read tools can return a `nextCursor` value when another page is available. Pass it as `cursor` on the next call to continue. Cursor semantics vary by tool, so do not rely on it for concurrent-write consistency.
The existing `from` and `size` offset parameters **continue to work** — the cursor only takes effect when explicitly passed. No migration is required for existing MCP clients.
***
### Semantic Search — Embedding Configuration Moved
Embedding settings and provider credentials have moved out of `elasticsearch.naturalLanguageSearch`. In 2.0, keep `semanticSearchEnabled` there, select the embedding provider and model under `llmConfiguration.embeddings`, and configure that provider's credentials in the matching `llmConfiguration` provider block.
**Before (1.13):**
```yaml theme={null}
elasticsearch:
naturalLanguageSearch:
semanticSearchEnabled: ${SEMANTIC_SEARCH_ENABLED:-false}
embeddingProvider: ${EMBEDDING_PROVIDER:-bedrock}
maxConcurrentRequests: ${MAX_CONCURRENT_EMBEDDING_REQUESTS:-10}
bedrock:
awsConfig:
enabled: ${BEDROCK_AWS_IAM_AUTH_ENABLED:-false}
region: ${AWS_BEDROCK_REGION:-""}
accessKeyId: ${AWS_BEDROCK_ACCESS_KEY:-""}
secretAccessKey: ${AWS_BEDROCK_SECRET_KEY:-""}
sessionToken: ${AWS_BEDROCK_SESSION_TOKEN:-""}
embeddingModelId: ${AWS_BEDROCK_EMBED_MODEL_ID:-""}
embeddingDimension: ${AWS_BEDROCK_EMBEDDING_DIMENSION:-""}
```
**After (2.0):**
```yaml theme={null}
elasticsearch:
naturalLanguageSearch:
semanticSearchEnabled: ${SEMANTIC_SEARCH_ENABLED:-false}
llmConfiguration:
bedrock:
awsConfig:
enabled: ${BEDROCK_AWS_IAM_AUTH_ENABLED:-true}
region: ${AWS_DEFAULT_REGION:-""}
accessKeyId: ${AWS_ACCESS_KEY_ID:-""}
secretAccessKey: ${AWS_SECRET_ACCESS_KEY:-""}
sessionToken: ${AWS_SESSION_TOKEN:-""}
embeddings:
provider: ${EMBEDDING_PROVIDER:-bedrock}
maxConcurrentRequests: ${MAX_CONCURRENT_EMBEDDING_REQUESTS:-10}
bedrock:
embeddingModelId: ${AWS_BEDROCK_EMBED_MODEL_ID:-"amazon.titan-embed-text-v2:0"}
embeddingDimension: ${AWS_BEDROCK_EMBEDDING_DIMENSION:-512}
```
**Action required:**
1. Remove `embeddingProvider`, `maxConcurrentRequests`, and the provider sub-blocks from `elasticsearch.naturalLanguageSearch`.
2. Move provider credentials to the matching `llmConfiguration` block, and keep the embedding provider and model settings under `llmConfiguration.embeddings`.
3. Set `SEMANTIC_SEARCH_ENABLED=true` to enable semantic search. `LLM_ENABLED` and `LLM_PROVIDER` configure the platform completion client; they do not enable vector embeddings.
| Provider | 1.13 location | 2.0 location |
| --------------------- | ----------------------------------------- | ------------------------------------ |
| Bedrock | `naturalLanguageSearch.bedrock.awsConfig` | `llmConfiguration.bedrock.awsConfig` |
| OpenAI / Azure OpenAI | `naturalLanguageSearch.openai` | `llmConfiguration.openai` |
| Google | `naturalLanguageSearch.google` | `llmConfiguration.google` |
| DJL | `naturalLanguageSearch.djl` | `llmConfiguration.embeddings.djl` |
**Credential environment variables renamed:**
| Old (1.13) | New (2.0) |
| --------------------------- | ------------------------ |
| `AWS_BEDROCK_REGION` | `AWS_DEFAULT_REGION` |
| `AWS_BEDROCK_ACCESS_KEY` | `AWS_ACCESS_KEY_ID` |
| `AWS_BEDROCK_SECRET_KEY` | `AWS_SECRET_ACCESS_KEY` |
| `AWS_BEDROCK_SESSION_TOKEN` | `AWS_SESSION_TOKEN` |
| `OPENAI_API_KEY` | `LLM_OPENAI_API_KEY` |
| `OPENAI_API_ENDPOINT` | `LLM_OPENAI_ENDPOINT` |
| `OPENAI_DEPLOYMENT_NAME` | `LLM_OPENAI_DEPLOYMENT` |
| `OPENAI_API_VERSION` | `LLM_OPENAI_API_VERSION` |
| `GOOGLE_API_KEY` | `LLM_GOOGLE_API_KEY` |
| `GOOGLE_API_ENDPOINT` | *(removed)* |
Environment variables `EMBEDDING_PROVIDER`, `MAX_CONCURRENT_EMBEDDING_REQUESTS`, `DJL_EMBEDDING_MODEL`, and every `*_EMBEDDING_MODEL_ID` / `*_EMBEDDING_DIMENSION` variable are **unchanged**.
***
### Profiler — Default Sampling Change
The Profiler now defaults to **Dynamic Sampling** instead of scanning 100% of rows. Cardinality distribution metrics are **no longer collected by default**.
**Action required:** If any workflows depend on cardinality/distinct-value data — custom rules, classification agents, or analytics built on column-level distinct counts — explicitly add cardinality distribution to the affected profiler configuration.
***
### Connectors — Databricks Pipeline Auth
The `databricksPipelineConnection` schema drops the top-level `token` string in favour of a structured `authType` object (Personal Access Token, DatabricksOAuth, or Azure AD).
**Before (1.13):**
```yaml theme={null}
connection:
config:
type: DatabricksPipeline
hostPort: adb-xxxx.azuredatabricks.net:443
token: dapi...
```
**After (2.0):**
```yaml theme={null}
connection:
config:
type: DatabricksPipeline
hostPort: adb-xxxx.azuredatabricks.net:443
authType:
token: dapi...
```
**Action required:** Stored configs are migrated automatically. External YAML files (CI pipelines, custom configurations) must be updated manually.
***
### Ingestion Images — Python 3.12
Ingestion images have moved from Python 3.10 to **Python 3.12** (`python:3.12-slim-trixie`; Airflow upgraded to `apache/airflow:3.3.0-python3.12`).
**Action required:**
* Rebuild any custom ingestion Docker images against Python 3.12.
* Remove or replace `cp310` binary wheels — they will fail to import on 3.12 images.
* If running a custom Airflow environment, upgrade to the 3.12-based Airflow image.
**Note:** This change first shipped in 1.13.4. If you are upgrading from 1.13.4, no action is needed.
***
### Chrome Plugin — Trusted Redirect URIs
The Chrome plugin now requires trusted redirect URIs to be explicitly declared. Previously the plugin accepted redirects to any origin.
**Action required:** `additionalTrustedRedirectUris` requires the **full redirect URI** — including scheme, host, port, and path. For the Chrome plugin, add the extension's callback URI:
```yaml theme={null}
additionalTrustedRedirectUris: ["https://.chromiumapp.org/auth0"]
```
Replace `` with the actual Chrome extension ID. Setting only the origin will not satisfy the redirect check and the login flow will fail with a redirect mismatch error.
***
### Context Center — Knowledge Center Removed
Knowledge Center no longer exists as a standalone section. All existing pages are automatically migrated to **Articles** inside Context Center on upgrade — no manual content migration is needed.
Any hard-coded links or bookmarks to Knowledge Center URLs (e.g. `/knowledge-center/...`) will break after upgrade, as the URL structure has changed.
**Action required:** Update any internal documentation, wikis, or automation that references Knowledge Center URLs to point to the equivalent Article in Context Center.
***
### Great Expectations 0.x — Support Removed
Support for Great Expectations 0.x has been **removed** in 2.0.
**Action required:** Migrate to Great Expectations `~=1.3` before upgrading. See the [Great Expectations migration guide](https://docs.greatexpectations.io/docs/guides/miscellaneous/migration_guide).
***
### Airflow as Internal Orchestrator — Deprecated in 2.1
Airflow will be deprecated as the **internal** orchestration system in 2.1, in favour of the native Kubernetes Orchestrator introduced in 1.12. External Airflow installations are unaffected. Begin evaluating the Kubernetes Orchestrator now — documentation and migration guides will be published ahead of the 2.1 release.
***
## Upgrade Actions Summary
| Area | Action Required |
| ---------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
| MCP clients | No migration required — pass `cursor` when a tool returns `nextCursor`; `from`/`size` offset still works |
| Semantic search / embeddings | Move provider credentials and embedding config from `naturalLanguageSearch` to the matching `llmConfiguration` blocks; set `SEMANTIC_SEARCH_ENABLED=true` |
| Profiler config | Explicitly add cardinality distribution if downstream features depend on it |
| Databricks YAML | Update `token: dapi...` to `authType: { token: dapi... }` in external pipeline YAMLs |
| Custom ingestion images | Rebuild against `python:3.12-slim-trixie`; remove `cp310` wheels. Skip if upgrading from 1.13.4. |
| Chrome plugin | Set `additionalTrustedRedirectUris` to the full Chrome callback URI (e.g. `https://.chromiumapp.org/auth0`) |
| Knowledge Center links | Update bookmarks and internal links to Context Center → Articles |
| Great Expectations | Migrate from 0.x to `~=1.3` before upgrading |
**[View the full changelog](https://github.com/open-metadata/OpenMetadata/compare/1.13.4-release...2.0.0-release)**
***
## Changelog
### Platform
* SCIM Provisioning configuration has moved to **Settings → Team and Users → Provisioning**. No configuration data is lost; only the navigation path changes.
### Alerts
* Fixed alert filters (Entity FQN, Owner, Domain, Entity Id, Source) not applying correctly to conversations and replies. Previously, an alert scoped to a specific entity received conversation notifications from every entity in the catalog. If an alert goes quiet after upgrading, widen or remove filters that were previously being ignored.