Product Updates

📋Changelog

OpenMetadata 1.13.4 is a maintenance release focused on connector reliability, search and lineage correctness, governance and MCP fixes, and a broad security cleanup across ingestion and platform dependencies.

🔌 Connectors & Ingestion

• Hive: test connection failed when no metastore was selected #30380: The metastore step is optional again, restoring the pre-1.13 behaviour for Hive services that don't front a metastore.
• Oracle: view definitions truncated by bulk LONG fetch #30319: Falls back to a per-view fetch when the bulk LONG read truncates, recovering full view DDL for downstream lineage.
• BigQuery: dataset and table object caches collide across schemas #30973: Caches are keyed per schema, preventing cross-schema object collisions on large projects.
• Fivetran: lineage lost when service names are unset; Table → Topic edges missing #31265: Falls back cleanly when service names are missing and adds Table → Topic lineage support.
• KafkaConnect: Debezium lineage broken on single-database services #31280: Debezium source lineage now resolves against single-database KafkaConnect services.
• BurstIQ: invalid system wallet failing silently #29727: Test connection surfaces an invalid system wallet with an actionable error.
• Table-owner extraction using the inspector instead of the dialect #31479: The owner extractor now dispatches on the SQL dialect, matching how the rest of the connector routes queries.
• Lineage parser: rows without a table name reaching the DB #31523: Parsed table references with no table name are skipped rather than persisted as broken rows.

🔍 Search & Discovery

• Inherited domain lost on descendants when an asset is moved #30678: Moving an asset now propagates the inherited domain to all descendants in search.
• Search connection pool starvation #31658: Bounds httpclient5 connection-request timeouts so the search client stops starving under load.

🛡️ Data Governance & Quality

• Read authorization depending on the requested fields projection #29835: Read authorization is now independent of the fields query parameter, closing a projection-based bypass.
• Orphan test case 404s the whole test case listing #31379: A single stale test case no longer breaks paginated test-case listings.
• Any-language recognizer normalization #28883: Recognizers behave consistently regardless of source language.

🤖 MCP Server

• CORS headers, unused capability, and OAuth iss parameter #30673: Fixes MCP CORS headers, removes the unused resources capability, and populates the OAuth iss parameter.
• Null protected_resource_metadata in the discovery response #30642: Omits the field entirely when unset instead of returning null.

⚙️ Platform

• /metadata/types/customProperties returning non-custom properties #31171: The endpoint returns only custom properties, matching its name.
• Container re-parenting via PATCH #24294: Containers can be re-parented through PATCH like other hierarchical assets.
• Data Product reference indexing #30387: Search stays consistent after linked-entity updates on Data Products.

🎛️ UI

• Related terms +N badge not expandable #31009: The +N badge on glossary related terms is clickable to reveal the full list.
• Query Tab: UI backend integration #30688: UI-side backend calls for the Query Tab align with the current API surface.
• Queries tab: badge count skeleton while loading #31688: The Queries tab shows a skeleton in the badge while the count fetches, instead of flashing 0.

🔒 Security

• netty → 4.1.137.Final for CVE-2026-59903 #31792.
• c3p0 0.12.0 → 0.14.1 for CVE-2026-55223 #31458.
• httpcore5 pinned to 5.4.3 for CVE-2026-54399 #31513.