LoginSign Up
← Back to all sparks
O

OpenMetadata

ANALYTICS
Velocity6.3

Unified metadata platform for data discovery and governance

open-metadata.org ↗

MCP servers became first-class governed assets in 1.13.0 — and 2.0 is now in release candidate.

data-catalogmcpgovernanceknowledge-graphcve-patchingparallel-release-lines
◆Current state
OpenMetadata maintains two lines at once, 1.12.x and 1.13.x, and has just cut a 2.0.0 release candidate on top of them. The 1.13.0 feature release made MCP a first-class service category with service and server entities, execution logs, test-connection support, REST resources and UI pages, added usage analytics broken down by tool and user, and brought SAML SSO to MCP OAuth. Alongside it landed an RDF knowledge graph built on Apache Jena. Everything since has been maintenance on both lines, weighted heavily toward CVE patching.
◆Where it's heading
The catalog is extending its governance model to cover AI tooling rather than just data assets — MCP servers get the same entity, connection-testing and usage-analytics treatment that databases and dashboards receive, and the RDF layer gives the metadata graph a standard query surface. Running underneath that is an unusually heavy security cadence: nearly every maintenance release in this window is a list of dependency CVEs across Jackson, Netty, Spring, log4j, handlebars, MLflow and PyArrow, patched in parallel on both maintained lines. The 2.0.0-rc1 tag suggests that dual-line burden is about to become a three-way one.
◆Prediction
Expect 2.0.0 to move from rc1 through further release candidates while 1.13.x continues absorbing connector and governance fixes, and for CVE-driven patch releases to keep landing on both lines in near-lockstep.

◆Recent moves

  1. 1d ago

    Snowflake foreign-key collisions and governance workflow fixes

    A maintenance release whose most concrete fix is keying Snowflake foreign-key reflection on constraint name and table name together, so cloned tables reusing a constraint name stop merging into one constraint and failing ingestion. Data contract, alert delivery and UI fixes round it out — the 1.13 line settling after its feature release.

    View source ↗
  2. 1d ago

    2.0.0 enters release candidate, dev and test only

    The first public 2.0.0 candidate, published with no changelog beyond a warning to keep it out of production and report migration issues. It signals that a third line is opening while 1.12.x and 1.13.x are both still receiving patches, but the notes say nothing about what 2.0 actually changes.

    View source ↗
  3. 2d ago

    MCP tool enhancements, log4j CVE patch, reindexing fixes

    Continues the pattern of pairing MCP refinement with dependency patching — log4j moved for a fresh CVE, Jackson, Logback, Postgres and Calcite pins realigned, alongside search and reindexing reliability work. The MCP surface introduced in 1.13.0 is being tuned in every maintenance release since.

    View source ↗
  4. 2d ago

    MLflow, PyArrow and server dependency CVE patches

    A security-dominated release on the older line: MLflow authorization and PyArrow IPC vulnerabilities patched via version floors, plus Jackson, Netty, Jetty, Calcite and PostgreSQL JDBC updates. Evidence of how much of the 1.12 line's remaining life is spent tracking upstream CVEs.

    View source ↗
  5. 22d ago

    MCP becomes a first-class service category with usage analytics

    ⚡ SPARK

    The release that set the direction every maintenance entry after it refines. MCP stops being an integration detail and becomes a governed asset type, and the RDF knowledge graph gives the catalog a standard query surface — the two additions that make this window more than a security-patch stream.

    View source ↗
  6. 25d ago

    OpenSearch alias swap and reindex lock fixes

    Search-layer bug fixes: alias swaps no longer rejected on fresh installs, healthy reindex jobs holding a live lock no longer falsely abandoned, and parent updates no longer overwrite time-series fields on child entities. Correctness work with no change to what the catalog can do.

    View source ↗