> ## Documentation Index > Fetch the complete documentation index at: https://openmetadata-docs-release-watchers.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Latest Release Notes | OpenMetadata > Discover the latest OpenMetadata releases, new features, bug fixes, and updates. Stay current with release notes and upgrade information. # Latest Release Notes You can find the GitHub release [here](https://github.com/open-metadata/OpenMetadata/releases/tag/1.13.6-release). ## Changelog OpenMetadata 1.13.6 is a maintenance release focused on connector reliability across Kafka Connect, Tableau, Snowflake, BigQuery, Athena, Airflow, Looker, Grafana, Mode, and Doris. It also fixes change events and alerting for ingestion-driven updates. The release includes access-control fixes for follower and glossary bulk-asset endpoints and a repair for Data Insights data-asset charts. SQL Server synonym ingestion and server audit logging are also restored. ### 🔌 Connectors & Ingestion * **SQL Server synonyms were not ingested** [#31829](https://github.com/open-metadata/OpenMetadata/pull/31829): Synonyms are now ingested as `Table.aliases`, indexed for search, resolved to their canonical table when building lineage, and shown in a read-only Aliases widget. * **The ingestion bot blanked a user-curated `displayName`** [#32955](https://github.com/open-metadata/OpenMetadata/pull/32955): A bot PUT carrying `displayName=null` cleared a name curated in the UI because the deny rule never fired. `updateDisplayName()` is now policy-aware. * **KafkaConnect: Confluent Cloud managed connectors resolved no topics** [#32512](https://github.com/open-metadata/OpenMetadata/pull/32512): Topics are now resolved from Confluent's Telemetry API, falling back to the configured names on any failure. * **KafkaConnect: telemetry credential failures logged the same line whatever the cause** [#32999](https://github.com/open-metadata/OpenMetadata/pull/32999): The warning now distinguishes a 401 (the key must change) from a 403 (a role is missing) and carries Confluent's own error detail. * **Tableau: source tables hidden from the ingestion account produced silently empty lineage** [#31441](https://github.com/open-metadata/OpenMetadata/pull/31441): A `GetSourceTables` test-connection step now reports withheld source tables before an ingestion is run. * **Tableau: auto-titled mirror columns were ingested as duplicates** [#32301](https://github.com/open-metadata/OpenMetadata/pull/32301): Mirror columns are now collapsed. * **Looker: data-model lineage failed on the first run** [#32367](https://github.com/open-metadata/OpenMetadata/pull/32367): Data models are read back before the sink's bulk buffer has flushed. The stage now commits every data model before anything looks it up. * **Mode: report query metadata wasn't ingested** [#32533](https://github.com/open-metadata/OpenMetadata/pull/32533): Mode report queries are now ingested as data model metadata. * **Grafana: panels nested inside collapsed rows were skipped** [#31611](https://github.com/open-metadata/OpenMetadata/pull/31611): Collapsed-row panels are flattened before chart and lineage ingestion. * **Snowflake: query tags mutated the configured connection arguments** [#32481](https://github.com/open-metadata/OpenMetadata/pull/32481): `QUERY_TAG` is now applied through the driver session parameters at connection creation. * **BigQuery: multi-project ingestion with ADC (Application Default Credentials) or a credentials file always connected to the first project** [#32484](https://github.com/open-metadata/OpenMetadata/pull/32484): Each database iteration is now scoped to the project it is ingesting. * **Athena: assume-role credentials were never refreshed** [#31392](https://github.com/open-metadata/OpenMetadata/pull/31392): The Boto3 session is now refreshable, and conflicting session arguments are rejected. * **Doris: identifiers in generated SQL were unquoted** [#32443](https://github.com/open-metadata/OpenMetadata/pull/32443): Doris identifiers are now quoted. * **Airflow: dynamically mapped tasks produced no lineage** [#32578](https://github.com/open-metadata/OpenMetadata/pull/32578): `inlets`/`outlets` serialized inside `partial_kwargs` are now read when the top-level keys are empty. * **Airflow: one extra database query per DAG to read pause state** [#31990](https://github.com/open-metadata/OpenMetadata/pull/31990): `DagModel.is_paused` is now part of the paginated serialized-DAG query. * **Protobuf schemas whose message didn't match the topic name failed to parse** [#32449](https://github.com/open-metadata/OpenMetadata/pull/32449): Parsing falls back to the sole top-level message, keeps ambiguous schemas unresolved, and supports well-known imports. * **Spark services offered a Metadata Agent that cannot work** [#32478](https://github.com/open-metadata/OpenMetadata/pull/32478): Spark metadata is pushed by the Spark Agent, so pull-based extraction is now marked unsupported. * **Domo and Astra connection fields diverged from the password-field conventions** [#32545](https://github.com/open-metadata/OpenMetadata/pull/32545): Both are aligned, and stored connection values are restored on update. * **Column tags were dropped when a column's `dataType` changed** [#32810](https://github.com/open-metadata/OpenMetadata/pull/32810): Tags are now carried forward across a `dataType` change. ### 📊 Data Quality * **Migration: Data Insights summary cards counted test case results, so the card ran ahead of the breakdown beneath it** [#31759](https://github.com/open-metadata/OpenMetadata/pull/31759), [#33049](https://github.com/open-metadata/OpenMetadata/pull/33049): Test case documents carry no `entityType`, inflating the card and depressing the description, owner and tier percentages. The filter now requires `exists(entityType)`, re-shipped as guarded 1.13.6 SQL because the 1.13.5 data migration never ran. * **MSSQL: table diffs couldn't authenticate a domain account** [#32583](https://github.com/open-metadata/OpenMetadata/pull/32583): Table diffs are routed through the driver that can authenticate domain accounts. * **Doris: profiler datetime partition filters weren't Doris-compatible** [#32788](https://github.com/open-metadata/OpenMetadata/pull/32788): Adds Doris dialect compilation for `DatetimeAddFn` and `TimestampAddFn`. * **Auto-classification did nothing when sample data was disabled** [#32607](https://github.com/open-metadata/OpenMetadata/pull/32607): With no sampled fields, metadata leaf columns are now traversed so column-name recognizers still run. ### 🛡️ Data Governance & Quality * **Direct users could be assigned to non-Group teams, then couldn't be removed, added through the UI, or exported** [#32208](https://github.com/open-metadata/OpenMetadata/pull/32208): Direct memberships are now rejected for Department, Division and BusinessUnit teams. Existing invalid memberships need a one-off cleanup. * **Governance workflow edge conditions and node references were interpolated unchecked into Flowable expressions** [#32326](https://github.com/open-metadata/OpenMetadata/pull/32326): Conditional-edge conditions and source nodes are validated at the create/update boundary. Valid workflows are unaffected and need no redeploy. * **App endpoint permission checks didn't match the platform RBAC (role-based access control) model** [#32427](https://github.com/open-metadata/OpenMetadata/pull/32427): App endpoints align with platform RBAC, and App patch is authorized before the entity lookup. * **Bot list responses omitted the required `botUser` relationship** [#32398](https://github.com/open-metadata/OpenMetadata/pull/32398): The relationship is batch-loaded for list responses, so SDK `list_all_entities` calls can deserialize `Bot` entities. * **Cross-user follower changes were unrestricted** [#32322](https://github.com/open-metadata/OpenMetadata/pull/32322): Follower endpoints now reject a null `userId`, compare against the authenticated subject, and require admin authorization for cross-user mutations. * **Broken access control on the glossary-term bulk asset endpoints** [#32539](https://github.com/open-metadata/OpenMetadata/pull/32539): `assets/add` and `assets/remove` now authorize `EDIT_GLOSSARY_TERMS` on each target asset instead of bypassing the authorizer. * **`stringToHTML` rendered stored user content unsanitized** [#32949](https://github.com/open-metadata/OpenMetadata/pull/32949): The helper now routes through `DOMPurify.sanitize()`, preserving the highlight and version-diff markup callers rely on. * **The search dropdown option label was set through `dangerouslySetInnerHTML`** [#32573](https://github.com/open-metadata/OpenMetadata/pull/32573): The highlighted label is parsed into React nodes from a sanitized string instead. * **Airflow API responses leaked internal diagnostics** [#32849](https://github.com/open-metadata/OpenMetadata/pull/32849): Responses are now generic. Diagnostics remain in the logs. * **Server audit logging to `audit.log` had been silently broken** [#28771](https://github.com/open-metadata/OpenMetadata/pull/28771): Audit entries are re-emitted through the `AUDIT`-marked logger, restoring `audit.log` output. ### 🎛️ UI * **Explore filters reverted to their previous configuration on backward navigation** [#31632](https://github.com/open-metadata/OpenMetadata/pull/31632): Under react-router v7 the pathname-less `navigate({ search })` calls pushed stale search params over the fresh URL. All Explore navigations now pass an explicit pathname. * **The metric version page crashed into the error boundary** [#32794](https://github.com/open-metadata/OpenMetadata/pull/32794): `UnitOfMeasurement` was a type-only import, so it was erased at build time and threw at runtime. It's now imported as a value. * **The edit icon disappeared when a custom property value overflowed** [#32550](https://github.com/open-metadata/OpenMetadata/pull/32550): The icon now sits outside the value container instead of being clipped by `overflow: hidden`. * **Masked password fields couldn't be cleared, and didn't show that a secret was stored** [#32945](https://github.com/open-metadata/OpenMetadata/pull/32945): The masked value now renders as password dots, and clearing an optional field emits a JSON Patch `remove` instead of overwriting the secret with an empty string. * **The Data Product "Add Assets" picker ignored the Domain Validation rule** [#32336](https://github.com/open-metadata/OpenMetadata/pull/32336): The picker lists assets across all domains when the rule is disabled, and stays domain-scoped (failing closed) when it's enabled. ### 📣 Notifications * **Bulk entity updates wrote no change event, so `Get Schema Changes` alerts never fired on metadata ingestion** [#32350](https://github.com/open-metadata/OpenMetadata/pull/32350): The bulk path now captures the incremental change description, so bulk updates both alert and audit. * **A `Pipeline` alert filtered to `Failed` re-notified forever and backfilled on creation** [#32181](https://github.com/open-metadata/OpenMetadata/pull/32181): Re-ingested and historical runs no longer emit change events, and a failure that isn't the newest run in a `PUT /status/bulk` batch now alerts. ### 🔒 Security * **Jackson → 2.18.10 / 3.1.6** for CVE-2026-83557 and CVE-2026-19032 [#32798](https://github.com/open-metadata/OpenMetadata/pull/32798). * **Jetty → 12.1.12** for CVE-2026-19203 and CVE-2026-19204 [#33015](https://github.com/open-metadata/OpenMetadata/pull/33015). * **`@humanfs/node` → 0.16.8** [#32503](https://github.com/open-metadata/OpenMetadata/pull/32503).