DataHub Release Notes

Released on 2026-09-25 by @david-leifker.

DataHub v1.6.0.3

Patch release for the v1.6.0 LTS line. Focus is security and authorization hardening, plus a few ingestion and platform fixes.

Full diff: https://github.com/datahub-project/datahub/compare/v1.6.0.2...v1.6.0.3

---

Operator notes

• Python 3.11 is required on this hotfix line (ingestion CLI/images and related packages). Python 3.10 is no longer supported for v1.6.0.x (#19703).
• SecretService caller guard defaults to ENFORCE. Secret encrypt/decrypt now requires an OperationContext; misconfigured callers fail closed instead of silently succeeding (#17995).
• Opt-in frontend security headers. Set DATAHUB_SECURITY_HEADERS_FRAME_OPTIONS, DATAHUB_SECURITY_HEADERS_CONTENT_TYPE_OPTIONS, and/or DATAHUB_SECURITY_HEADERS_REFERRER_POLICY to emit X-Frame-Options, X-Content-Type-Options, and Referrer-Policy. Unset vars omit those headers (#19848).

---

Security

Dependency floors and library bumps, including:

Area	Fix
Snowflake connector	Floor raised to 4.7.3 (CVE-2026-15925, plus 4.7.1/4.7.2 TLS SAN regression for account locators with _)
aiohttp	3.14.3 (CVE-2026-69244 / 59881 / 69243)
pip	26.2+ (CVE-2026-13346)

Released on 2026-09-03 by @david-leifker.

DataHub v1.7.0.1 🖖

Patch release for the v1.7.0 line: authorization tightening, CVE dependency bumps, entity-graph-cache and lineage correctness fixes, optional optimistic locking for aspect writes, and the remainder of the custom-assertion stack.

Requirements

• CLI / Python SDK: 1.7.0.9
• Helm Chart: 1.1.0

Full upgrade guidance, including every breaking change and migration step: Updating DataHub — v1.7.0.1.

Upgrade path

• From v1.7.0: drop-in image bump. No ZDU or Helm chart change is required. System-update runs a resumable backfill that copies embedded assertion notes to the new assertionNote aspect (tunable with SYSTEM_UPDATE_ASSERTION_NOTE_MIGRATION_ENABLED, _BATCH_SIZE, _DELAY_MS, _LIMIT).
• From pre-1.7.0: the v1.7.0 path still applies — you must upgrade to v1.6.0 first (Helm chart 1.0.3, let system-update complete), then upgrade to v1.7.0.1 with Helm chart 1.1.0. Do not skip 1.6.0.

Model changes: additive only. The assertionNote aspect is now registered on the assertion entity so ingestion can fully upsert assertionInfo without clobbering user-authored notes. Assertion URNs and run history are unchanged.

---

Action required before upgrading

| Area | What changed | Who is affected | | --- | --- | --- | …

Released on 2026-09-01 by @david-leifker.

What's Changed

• fix(sec): backport security fixes and CVE dependency bumps to v1.6.0 by @supersingh05 in https://github.com/datahub-project/datahub/pull/19414
• fix(policies): apply validator level aspect edit controls for user and group aspects (#19360) by @RyanHolstien in https://github.com/datahub-project/datahub/pull/19438
• fix(sec): backport GMS /auth helper gate and timeseries view privileges to v1.6.0 by @david-leifker in https://github.com/datahub-project/datahub/pull/19529

Full Changelog: https://github.com/datahub-project/datahub/compare/v1.6.0.1...v1.6.0.2

Released on 2026-08-13 by @david-leifker.

What's Changed

• fix(security): backport security fixes to v1.6.0 by @supersingh05 in https://github.com/datahub-project/datahub/pull/18613
• fix(release): backport v1.6.0 platform bugfixes from master by @david-leifker in https://github.com/datahub-project/datahub/pull/18683
• fix(deps): bump lz4-java to 1.11.1 and jackson to 2.21.5 (security, v1.6.0) by @supersingh05 in https://github.com/datahub-project/datahub/pull/18741
• fix(backport): v1.6.0 — transaction retry backoff/conflict API, PostgreSQL lock ordering, Spring 7.0.8 by @supersingh05 in https://github.com/datahub-project/datahub/pull/18798
• fix(sec): bump wire-runtime 5.2.0 → 6.3.0 for CVE-2026-45799 by @supersingh05 in https://github.com/datahub-project/datahub/pull/19100
• fix(sec): backport security dependency bumps to v1.6.0 by @supersingh05 in https://github.com/datahub-project/datahub/pull/19179
• fix(deps): bump Apache Parquet stack to 1.18.0 for shaded Jackson CVEs by @david-leifker in https://github.com/datahub-project/datahub/pull/19191 …

Released on 2026-08-04 by @david-leifker.

DataHub v1.7.0

Requirements

• CLI / Python SDK: 1.7.0
• Helm Chart: 1.1.0

Full upgrade guidance, including every breaking change and migration step: Updating DataHub — v1.7.0.

Upgrade path / ZDU: You must upgrade to v1.6.0 before upgrading to v1.7.0 — do not skip 1.6.0. Deploy v1.6.0 with Helm chart 1.0.3, let system-update complete, then upgrade to v1.7.0 with Helm chart 1.1.0. Enable Elasticsearch/OpenSearch ZDU (global.datahub.systemUpdate.zdu) with the 1.1.0 chart on a subsequent OpenSearch/Elasticsearch version bump — not during the v1.6.0 install.

---

Feature highlights

UI and experience …