2026 Release Notes for Customer-Managed Alation Releases

Customer Managed Applies to customer-managed instances of Alation

Note

The release notes on this page track releases for customer-managed instances (deployed on customer premises).

RELEASE 2026.7.0.0

build 24.4.0.48

Released August 10, 2026

Note

This release is for customer-managed (on-premise) instances.

New Features and Enhancements

Platform

  • AL-249967: Upgraded PostgreSQL from version 16.13 to version 16.14 to take advantage of improvements, bug fixes, and security enhancements.

  • AL-240179: The Amazon Corretto JDK used internally has been upgraded from version 11.0.30.x.x to 11.0.31.x.x to enhance application security.

  • AL-237062: Upgraded the Django framework used internally to version 5.2 LTS to take advantage of improvements, bug fixes, and security enhancements.

Authentication

  • AL-250176: When changing the SCIM identity provider (for example, switching from Okta to Azure AD) in Admin Settings > Authentication > User and Group Sync, a confirmation dialog now warns that all previously synced users will be suspended and their groups deleted before the switch takes effect. Confirming the change performs this cleanup atomically: if the change would delete all Server Admin groups, it’s blocked to prevent admin lockout, and the operation rolls back entirely if any step fails. On success, a message shows the number of suspended users and deleted groups. This replaces the previous process, which required Alation Support to run a backend script. Selecting an identity provider for the first time, when none was previously configured, saves directly without the confirmation dialog.

  • AL-249942: Server Admins can now manage SCIM authentication credentials directly from Admin Settings > Authentication > User and Group Sync choosing between Basic Authentication and Bearer Token instead of using shell commands. For Basic Authentication, select Basic Auth, enter a username and password of at least 16 characters with a mix of letters, numbers, and at least one special character, and save. For Bearer Token, select Bearer Token and generate a token; the token is displayed once with a copy-to-clipboard option and an expiry date (valid for six months), and can be regenerated as needed. The UI indicates whether credentials are currently configured, and all credential changes are audit-logged. This feature is available only when SCIM sync is enabled and requires the Server Admin role.

Alation Analytics

  • AL-183793: Added an opt-in cleanup mode for Alation Analytics V2 that removes dimension columns and otype_customfield_map entries for custom fields that have been detached from every template for an object type. The cleanup is controlled by the new alation.feature_flags.aa_cleanup_detached_custom_fields feature flag (default False). When enabled, the cleanup runs on the next ETL. With the flag off, Alation Analytics continues to retain columns as long as values exist.

Catalog Content and Customization

  • AL-249704: On schema pages in the Classic UI, the table list column previously labeled Rows is now Sampled Rows and displays - for tables that have never been sampled, instead of a misleading 0. Profiled tables with zero rows continue to show 0, so you can distinguish empty tables from unsampled ones at a glance.

  • AL-248399: Improved performance of the backreference field endpoint, especially on catalog objects referenced by many other objects. Permission checks are now grouped at the field level for more efficient evaluation, and template-to-field mappings are cached with automatic invalidation. Catalog pages with extensive cross-references load noticeably faster.

  • AL-246064: The Metadata Extraction job history in the Classic UI now provides clearer visibility into extraction results. Jobs that completed but skipped some objects display an informational icon next to the status, with a tooltip explaining the skip reasons. The Errors column has been renamed to Extraction Notes and shows both error and skipped-object counts. The job details modal uses updated labels (Job notes, Generate Extraction Report) to reflect that not all notes are errors. The Analyze troubleshooting button now appears for jobs with skipped objects, letting you investigate skip causes directly.

  • AL-244845: Server Admins can now run a real SAML round-trip against their IdP from inside Alation, without affecting any user records or sessions. The Test Connection diagnostic surfaces issues across seven layers: from metadata parse and signature verification all the way to a dry-run of the user-creation pipeline, so Server Admins can fix IdP-side misconfigurations before users encounter broken logins.

  • AL-244778: Custom field deletion now uses a more efficient strategy, improving performance. The optimization is enabled by default.

  • AL-243713: The Top Users widget on catalog pages can now be configured to exclude system users, service accounts, and other non-human accounts, so it shows only real catalog users. To set this up, contact Alation Support with the list of user IDs you want to exclude. Alation Support adds these IDs to the alation.catalog.top_users.excluded_user_ids setting, which removes technical accounts, such as those used for query log ingestion (QLI) and bot users, from the Top Users display.

  • AL-238064: Changed source comments on catalog pages to render as Markdown by default. This behavior can be disabled via the flag disable_markdown_source_comments if needed.

  • AL-237392: Custom templates now support object types with names longer than 25 characters, removing the previous length restriction.

  • AL-209743: Previously, when a user updated a rich-text field with content exceeding 1 MB, the value was saved to the internal database but silently failed to write to DynamoDB, which services the user interface (UI), creating a data discrepancy between the catalog page UI and Alation Analytics v2, and neither the UI nor the API surfaced any error. Alation now validates rich-text field content size and blocks updates that exceed 1 MB for user-defined rich-text fields and built-in description fields on object types, such as document hubs, BI objects, policy objects, and dataflows. When an update is rejected, the UI displays the error: Content size limit exceeded. Rich-text field value exceeds the maximum allowed size of 1 MB. Please reduce the content size and try again. The same error is returned by the public API. Built-in description fields on object types, such as RDBMS objects, functions, queries, and catalog sets, continue to accept content over 1 MB. This validation is enabled by default and controlled by the alation.feature_flags.enable_rtf_1mb_limit feature flag. Disabling it restores the previous behavior but may reintroduce data discrepancies between the UI and Alation Analytics. Pre-existing field values over 1 MB are not modified, but may still show discrepancies: you can resolve these by splitting content across multiple fields or storing it externally and linking to it.

Domains and Document Hubs

  • AL-234763: Document Hub pages now support a rich text description field with full version history. Server Admins and Catalog Admins can edit the description; Stewards, Composers, Source Admins, Viewers, and Explorers can view it.

Data Sources

  • AL-202061: Deletion of an Asset Source now removes all related data from LMS, curation, and Alation Analytics, ensuring a complete cleanup.

Lineage

  • AL-250959: The default row limit for bulk lineage uploads has been increased from 200 to 1,000 rows. You can now upload a manual lineage mapping spreadsheet with up to 1,000 rows in a single file without splitting it.

  • AL-250204: RDBMS-to-RDBMS Cross-System Lineage configured via Lineage Settings is now generally available and enabled by default. When upstream RDBMS data sources are configured in the Lineage Settings UI, Alation automatically resolves unresolved references in the QLI pipeline against upstream data sources before falling back to candidate data sources, and matches target tables and columns against upstream data sources during metadata extraction to create direct cross-system lineage edges.

  • AL-248273: Added support for filtering lineage generated by query log ingestion (QLI) by a selected time range for all users. Administrators can configure a default time range for lineage graphs and control whether users can override it:

    • By default, lineage graphs display full history until a default time range is configured.

    • Time-based filtering applies only to lineage generated from QLI. Lineage from metadata extraction, APIs, manual entry, and direct lineage is always displayed.

  • AL-248221: BI cross-system lineage now uses cross-source lineage host/port mappings as a fallback when the BI connection host or port does not directly match a cataloged data source. This improves lineage resolution for BI sources whose connection metadata uses different host or port conventions than the underlying data source.

  • AL-244643: BI lineage now supports file-based data sources (for example, Excel and CSV files). Previously, FILES-type connections in BI tools such as Tableau were ignored during lineage extraction. Lineage is now recorded from file sources to BI sources, improving lineage completeness for customers that use file-based data in their BI environments.

  • AL-243254: Added a new alation.query_ingestion.enable_session_variable_substitution feature flag that enables the resolution of SET session variables in QLI queries. When enabled, queries that reference parameterized table names through session variables have their variables resolved before parsing, allowing lineage to be extracted from these queries. The feature is available for Snowflake data sources.

  • AL-240162: Increased the default maximum parsed statement length (alation.stmt_parsing.max_stmt_length) from 50,000 to 200,000 characters, allowing longer SQL statements to be parsed successfully.

  • AL-236824: Impact Analysis and Upstream Audit now resolve lineage correctly across intermediate temporary objects. Previously, lineage paths that passed through temp objects could be incomplete in these views.

  • AL-197262: Added versioning support for dbt-related lineage, preventing duplicate dataflows from being created instead of updating existing ones when the dbt Gen2 connector re-syncs. This behavior is gated by the lineage-service.mt_lineage.versioning.read feature flag; contact Alation Support to enable it.

  • AL-186123: Improved column identification in column-level Impact Analysis and Upstream Audit. Previously, it was difficult to identify which table a column belonged to, both in the report user interface and in CSV exports. Table names are now prepended to column names in Impact Analysis and Upstream Audit views, making it easier to identify and distinguish columns at a glance. No configuration is required.

    CSV exports now include two additional columns for richer context:

    • Parent: The parent object the column belongs to (for example, a table, BI report, or BI source).

    • Parent Type: The type of the parent (table, bi_report, or bi_datasource), so same-named parents across object types are distinguishable.

    To enable these CSV export columns, set alation_conf lineage-service.bulk_export.include_parent_metadata -s true. On Alation Cloud Service tenants, contact Alation Support to enable this configuration.

Compose

  • AL-240663: The Connection Settings modal now clarifies the URI source when Compose is disabled, making it easier to understand which connection details are in effect.

  • AL-234703: When scheduling a query in Compose, Alation now warns you if other queries on the same data source are already scheduled to run within a narrow time window. Previously, overlapping schedules could cause resource contention and cascading query failures with no advance notice. The warning appears automatically in the Schedule Settings dialog and on the Scheduled Query Settings page when a conflict is detected. It is informational and does not block you from saving the schedule.

  • AL-234702: Compose now displays clear, actionable error messages when queries fail because of data source connection issues, timeouts, credential errors, or service outages. Previously, you saw cryptic internal messages such as UNAVAILABLE. The new messages help you diagnose and resolve the underlying issue quickly.

Admin Settings

  • AL-249899: API token lifespans are now configurable from the Admin UI. Server Admins can manage API access token lifetime and API refresh token lifetime under Admin Settings > Feature Configuration, without needing alation_conf shell access. Access token lifetime is bounded between 1 and 72 hours (default 24), and refresh token lifetime is bounded between 1 and 180 days (default 90). The default refresh token lifetime has increased from 60 to 90 days for new installs and tenants without an explicit override. Existing custom values are preserved. These limits apply only to V1 API tokens, not to OAuth 2.0 tokens issued by Alation’s OAuth server. Attempts to save a value outside the allowed range via the user interface or the PUT /api/setting/{key}/ API endpoint will return HTTP 400. Existing tokens are not affected.

  • AL-249118: Server Admins can now toggle the Bypass Identity Provider Authentication for Troubleshooting flag (alation.feature_flags.bypass_idp_auth_for_troubleshooting) directly from Feature Configuration in Admin Settings, without requiring a Support ticket. When enabled, the flag allows local-credential login via the built-in form, bypassing SAML, OIDC, or LDAP, intended for recovery scenarios where an identity provider misconfiguration locks users out. The flag is disabled by default. Admins should re-disable it immediately after troubleshooting is complete, as it permits logins that bypass the configured identity provider.

  • AL-246426: Job Trace logs now include additional context to improve troubleshooting and observability of background jobs.

  • AL-244387: Added a new Capture Alation-specific network events for HAR file diagnostics setting in Admin Settings > Feature Configuration, enabled by default. These network diagnostics are referenced during support case creation to help identify the root cause of issues more quickly.

  • AL-243708: Admins can now set homepage preferences for individual users by user ID, without needing to create dedicated groups. The existing bulk homepage preference endpoint (PUT /integration/v1/home/<id>/user/preference) now accepts user_id query parameters in addition to group_id. When the admin-assigned homepage feature flag is enabled, per-user assignments take priority over group-level assignments, and users cannot override their admin-assigned homepage.

  • AL-242765: A new Enable Table-Level Privacy toggle is now available in Admin Settings > Feature Configuration, allowing Server Admins to enable granular table-level privacy controls directly from the UI without backend access or Support tickets. Once enabled, individual table objects gain a Settings page where you can configure privacy modes (Public, Editing Restricted, or Private) and permission levels (Admin, Editor, Viewer) for specific users and groups. This feature builds on Advanced Access Controls. Use it alongside Enable Editor Role and Schema Permissions for complete granular permissions across the Data Source > Schema > Table hierarchy. The toggle can be turned on and off as needed, no service restart is required, and if the configuration fails to apply, the setting is automatically reverted with an error message.

  • AL-234362: Added comprehensive audit logging for feature flag configuration changes across all Alation API endpoints. The audit trail captures user information, client IP, and change details for every feature flag modification made through the Admin Settings > Feature Configuration page or the public /integration/v1/setting/value/ API. Two new audit actions distinguish the workflow used to change a flag:

    • setting_updated_via_ui: logged when settings are changed through the Alation UI.

    • setting_updated_via_public_api: logged when settings are changed through the public integration API.

  • AL-229046: Server logs downloaded from the Logging page in Admin Settings and connector agent logs downloaded from the Manage Connector page are no longer encrypted by default. Logs are now provided as plain .tar.gz files that can be opened directly, without a decryption key. This makes it easier to share logs with Alation Support for troubleshooting. To go back to the previous default behavior (logs are encrypted by default), contact Alation Support to set the alation.feature_flags.DEV_enable_encrypted_log_on_prem_download feature flag to True and to restart the necessary services.

Sampling and Profiling

  • AL-244009: Profiling V2 is now the default profiling method for tables and columns. Column profiling now includes additional statistics and the Value Distribution chart.

Branding

  • AL-252141: Alation’s visual identity has been refreshed with a new logo. The updated wordmark now appears across the Alation platform.

Open Connector Framework

  • AL-249207: Improved performance of the BI source Selective Extraction Settings page when working with large numbers of folders or projects. Lists now virtualize rendering for 100 or more items, include inline filtering and bulk removal, and display item counts, significantly reducing page lag for customers with many BI folders.

Public APIs

  • AL-251062: Added a PATCH method to the Custom Field public API (/integration/v2/custom_field/{id}/), enabling partial updates to custom field properties (name, tooltip, options, backref) without recreating the field. Requires Catalog Admin or Server Admin role.

  • AL-250622: The Get Dataflow Objects API (GET /integration/v2/dataflow/) now supports filtering by external_id using the lookup parameters external_id__iexact, external_id__contains, external_id__icontains, external_id__startswith, external_id__istartswith, external_id__endswith, and external_id__iendswith. Use these parameters to retrieve dataflows for a specific data source, BI server, or API namespace (for example, ?external_id__startswith=sql/3_) without fetching the entire catalog. The new parameters are optional and can be combined with existing filters; behavior is unchanged when they are not supplied.

  • AL-245117: Stewards, Composers, and Source Admins can now create, update, and delete documents through the Document API (/integration/v2/document/). These roles previously required Server Admin or Catalog Admin permissions to use the API. You now only need EDIT permission on the target folder (for creates) or document (for updates and deletes), aligning API behavior with the in-product permission model.

  • AL-243382: Added a new POST /integration/v2/asset/<type>/batch-delete/ endpoint for bulk deletion of multiple catalog objects in a single API call. The endpoint supports schema, table, attribute, file, directory, and file_attribute types, with a maximum of 500 objects per request. Deletion is asynchronous and recursive: deleting a schema also removes all of its child tables and columns.

  • AL-242881: You can now move a domain (and its subdomains) to a new parent through the API. Search results and domain memberships are automatically updated to reflect the new location.

  • AL-241511: Added a status field to the GET /integration/v2/user/{id}/ API response.

  • AL-241408: Added a new public API endpoint, POST /integration/v1/datasource/<pk>/purge_profile/, that initiates and monitors deletion of all stored profiling and sampling data for a data source. This allows you to self-service purge sampled and profiled data without contacting Alation Support.

  • AL-241407: Added a new public API endpoint that hard-deletes soft-deleted schemas, along with their child tables and attributes, from an active data source without deleting the data source itself. This enables self-service cleanup of soft-deleted RDBMS assets that previously required Alation Support assistance.

  • AL-240952: Propagated deprecation and warning flags from deleted catalog objects are now automatically hidden from the flags list API. Previously, when a root object that caused flag propagation was deleted, the propagated flags it created remained visible, producing confusing messages such as this table is deprecated because of Data Source X even though Data Source X no longer existed.

  • AL-235897: Added a new public V2 API (/integration/v2/file/) for incremental file and directory metadata ingestion on file system data sources. The endpoint supports bulk create, update, list, and delete operations with filtering, enabling efficient programmatic management of file and directory metadata at scale.

  • AL-235439: Connector management API endpoints now support Admin API token authentication in addition to session-based authentication. This enables programmatic access to connector install, create, and job status operations through API tokens. Admin-only access enforcement remains in place. Non-admin users cannot call these endpoints.

  • AL-234704: All public API endpoints that return a 403 Forbidden response now include a descriptive error message explaining why access was denied, instead of returning an empty response body. This helps API integrators and administrators self-diagnose permission and token-scope issues without contacting support.

  • AL-234514: Added excludeTemp, excludeGone, and direction query parameters to GET /integration/v2/lineage/ and excludeTemp, excludeGone to GET /integration/v2/dataflow/. The public lineage API previously returned all nodes including temp (not present in the catalog) and gone (soft-deleted) placeholders, which cluttered API responses. The lineage Exploratory View already filters those out. This update brings the public API to parity.

Bug Fixes

  • AL-253358: Fixed an issue where bulk CSV user-profile uploads on SAML- or LDAP-enabled instances could silently skip existing users whose stored email address had different letter casing than the uploaded file, even when no email change was intended. Role and other field updates for these users now apply correctly.

  • AL-252665: Fixed a regression introduced in 2026.6.1.1 where the Lexicon Job History page returned an HTTP 500 error on instances with more than one page of Lexicon jobs. The page now loads correctly regardless of how many Lexicon jobs exist.

  • AL-252555: Applied security patches to third-party dependencies in the authentication service to address security vulnerabilities. No functional or configuration changes are required.

  • AL-252191: Fixed an issue where RDBMS extraction jobs were incorrectly marked as crashed.

  • AL-252172: Fixed an issue where opening a shared link to a private or restricted catalog asset (for example, a data source, schema, or table) as a user without view access would inflate the asset’s view count and leave the page stuck retrying in the background. Views are now recorded only for users who have permission to view the asset, and users without permission see a clear access-denied message instead.

  • AL-251011: Fixed incorrect tooltips for users who cannot access Compose due to their role. Previously, a user blocked from Compose by their role was told that Compose had been disabled for the data source, which was misleading. The tooltip now states the actual reason: role-blocked users are directed to contact their Server Admin to add Compose access, while users on a data source with Compose turned off are pointed to the data source settings.

  • AL-250451: Fixed an issue where the Catalog search filter displayed a blank, unlabeled option for objects from single-tier data sources. Previously, an empty Catalog value could be applied as a no-op filter. The blank option is no longer shown.

  • AL-250396: Fixed an issue where the user profile page and Compose query lists displayed fewer queries than expected when granular query permissions were enabled. Queries with multiple permission edges (viewers, runners, collaborators) caused duplicate rows in the API response, consuming pagination slots and hiding real queries from view. Query lists now show the full expected set of queries.

  • AL-250230: Fixed an issue in Impact Analysis where hiding temporary objects could inflate the calculated distance of downstream tables reached through temporary tables. On lineage graphs with multiple parallel paths between two tables, the inflated distance could push the most distant tables beyond the displayed depth limit, causing them to be omitted from Impact Analysis results. Impact Analysis distances are now consistent whether or not temporary objects are shown.

  • AL-249713: Fixed a partial-write inconsistency in Data Dictionary uploads (through both the UI and the public API) and Bulk Management updates. Each batch is now scanned for conflicting duplicate records before any row in the batch is written. When two rows in the same batch assign different values to the same object-field pair, both rows are marked FAILED in the commit report and all other rows proceed unchanged. Identical duplicates continue to be accepted transparently.

  • AL-249646: Fixed an issue where the Status Message column on the Bulk Lineage Upload Process History page was always empty. The column now correctly displays the job result message for each upload.

  • AL-249544: Fixed an issue preventing concurrent saving after editing custom templates.

  • AL-249437: Fixed a performance issue where the PATCH /integration/v2/column/ API (relational column integration update) reported inflated upserted-object counts and ran significantly slower than expected for large batches. Previously, a request containing N columns caused the API to repeatedly re-feed columns into the ingestion bucket within a single job, producing job logs with counts roughly N²/2 times larger than the actual input. Customers using this endpoint to update column metadata in batches will now see correct counts in job results and substantially faster completion times.

  • AL-249335: Fixed an issue where a missing BI connection record could cause column-level lineage (CLL) generation to fail completely. Lineage generation now skips affected entries and continues processing instead of failing for the entire batch.

  • AL-249311: Alation Analytics v2 (AAv2) ETL runs that complete with some failed batches are now reported as Partial Success instead of being masked as Completed. Each job in the ETL Status dashboard and the etl_checkpoint table now includes a per-job failed-batch count, giving customers clear visibility into partial data-load failures. Watermark and freshness readers have been updated to recognize Partial Success runs, ensuring that subsequent ETL cycles correctly pick up where the previous run left off rather than re-processing or skipping data.

  • AL-249162: Fixed a validation gap in the visual_config PUT API endpoints that could allow the layout_otype field of core catalog templates to be corrupted. The endpoints now reject updates that would change layout_otype on built-in templates.

  • AL-248868: Fixed a validation gap in the custom_template PUT API endpoint that could allow the layout_otype field of core catalog templates to be corrupted. The endpoint now rejects updates that would change layout_otype on built-in templates.

  • AL-248716: Extended the Compose query-run health check to recover query results that became inaccessible when the Compose sandbox was destroyed mid-query (for example, due to a user idle timeout or sandbox sweep). Previously, the corresponding ExecutionResult could remain IN_PROGRESS indefinitely, making the result inaccessible through the Query API. The health check (controlled by alation.query_exec.health_check_interval, default 15 minutes) now finalizes these results so they become accessible again.

  • AL-248494: Fixed a display issue in Compose’s Version History where query titles containing special characters (such as &, <, >) appeared as raw HTML entities (for example, &amp;) instead of their readable form. Titles now display correctly as intended.

  • AL-247965: Fixed an issue in the Stewardship Workbench where bulk-replacing a selected Steward with a different Steward did not update all selected records.

  • AL-247756: Fixed an issue where multipart schema names were not preserved correctly in the fully qualified names (FQN) of tables and attributes, which could cause incorrect hierarchy paths. Indexing now preserves the full multipart schema name. To apply the correction on affected data sources, run an index update.

  • AL-246136: Fixed an issue where the document count on the folder-level Terms table (including the Document Hub Documents table) could change as you paged through results on large folders. The count is now stable across pages.

  • AL-246062: The Metadata Extraction (MDE) status message now displays “SUCCESS” with an informational tooltip icon instead of “PARTIAL SUCCESS” when the extraction completes with only non-actionable items (such as expected exclusions). Previously, the “PARTIAL SUCCESS” label caused unnecessary confusion for users who interpreted it as a failure requiring investigation.

  • AL-245990: Fixed an issue on Alation tenants with IAM authentication and SCIM-driven user provisioning where the catalog and the IAM service could become silently desynchronized when the identity provider issued a SCIM PATCH request that renamed a user or updated their email, first name, or last name. The IAM service is now notified of all SCIM updates, so user data stays consistent across both systems.

  • AL-245548: Fixed an issue where users with local passwords on instances configured with LDAP or SAML authentication were incorrectly told that their password was managed externally and could not change it. Alation now correctly identifies whether each user has a local password, regardless of the instance-wide authentication setting.

  • AL-244544: Fixed an inconsistency where the Steward, People Set custom field, and Object Set custom field columns in schema, data source, and table children listings continued to display suspended users, even though detail pages correctly hid them. These listings now consistently filter suspended users from current values, matching the behavior of detail pages.

  • AL-244175: Fixed a bug where custom field backreferences would not display on catalog objects with more than 10,000 associated data objects when multi-template targeting was enabled. This affected documents that were referenced by a large number of other catalog objects.

  • AL-244038: Fixed an issue on query forms where the Zero Data banner appeared unconditionally on non-Zero Data data sources. The banner is now displayed only when the data source is configured for Zero Data, including the case where a data source was previously configured as Zero Data and later updated to a non-Zero Data type.

  • AL-243620: Fixed an issue where the Navigation Links property on Documents displayed a maximum of 24 folders, even when more were associated with the document. All navigation link folders are now shown in both the properties panel and the navigation links edit dialog.

  • AL-243531: Fixed an issue where document and folder titles in Document Hubs displayed HTML-escaped characters such as &#x27; (single quote) or &amp; (ampersand) instead of the original character. Titles are now correctly unescaped during retrieval, so quotes and ampersands appear as entered.

  • AL-243408: Fixed an issue where OCF connector installation and upgrade returned a 415 Unsupported Media Type error in the Admin UI after a recent DRF migration. Connector upload endpoints now support the application/octet-stream content type while maintaining full backwards compatibility with existing upload methods, so connector management operations work correctly again.

  • AL-243406: Fixed an issue where the Tasks page in Inbox failed to load with a 500 error when orphaned workflow step execution records existed in the database. The page now loads correctly in this scenario.

  • AL-243207: Fixed an issue where the GET /integration/v2/custom_field_value/ API returned a 400 error when multiple object types were specified in a single request. The endpoint now correctly handles requests that include multiple object types.

  • AL-240836: Fixed an issue where the GET /integration/v2/column/ and GET /integration/v2/table/ API endpoints returned a 500 Internal Server Error when a source tag name matched a built-in Object Set custom field name (for example, Steward). These endpoints now correctly handle such field values without crashing.

  • AL-240701: Fixed an issue where Data Dictionary CSV upload failed with a malformed header error when custom field names contained emoji characters or other special Unicode symbols. Previously, downloading a Data Dictionary and re-uploading it without changes would fail if any custom field name contained these characters. Special characters in custom field names are now handled correctly during CSV export, and existing custom fields with emoji names continue to work automatically after upgrade.

  • AL-240591: Fixed an issue where changing a domain’s parent through PATCH /integration/v2/domain/<id>/ did not update the domain’s updated_at timestamp. The timestamp now advances correctly on each parent change, restoring change-detection for downstream analytics and ETL consumers that rely on it.

  • AL-240518: Fixed an issue where the Bulk Management Keep Existing + Fill Empty mode did not apply tags and domains to glossary objects. The operation now applies these fields correctly instead of returning commit status: not_attempted for all rows.

  • AL-240413: Fixed an issue where Celery jobs that crashed abnormally (for example, due to out-of-memory errors, worker restarts, or pod evictions) could remain in the RUNNING state indefinitely instead of being marked FAILED. Affected jobs now receive failure notifications reliably without requiring a user to visit the Job History UI to start status reconciliation.

  • AL-240142: Fixed an issue where column samples for non-integer data types disappeared after a page refresh when using Data Sampling. Samples now render reliably across page reloads on all connectors. The next Data Sampling job also clears the bad state. No administrator action is required.

  • AL-240103: Fixed an issue where the Relational integration v2 API for columns extracted columns for soft-deleted tables. Orphaned objects are now excluded from RDBMS integration API GET responses when their parent is soft-deleted.

  • AL-239918: Fixed an issue in Compose where the results grid did not resize when you adjusted the split-pane divider, leaving a large blank area below the table. The results table now correctly fills the available pane height after resizing.

  • AL-239840: Fixed an issue where the term or document count displayed in glossary folder headings did not update correctly when search filters were applied. The count now accurately reflects the filtered result set instead of showing stale or unrelated numbers.

  • AL-239514: Fixed an issue where Snowflake role-based URI overrides in Chat with Your Data could fail authentication with Azure AD or Microsoft Entra identity providers. The role specified in the connection URI is now correctly applied at connection time.

  • AL-239435: Fixed an issue where the Alation Analytics V2 ETL crashed with a malformed array literal error when multi-select picker custom field values contained special characters such as commas, curly braces, quotes, or backslashes. Affected tables, for example, rdbms_tables now update correctly during ETL runs.

  • AL-238922: Fixed an issue where lineage for BI objects (for example, Tableau) could fail to resolve correctly when host-port identifiers in BI connections used different symbol conventions, such as hyphens versus underscores. Host-port values are now matched against canonical forms regardless of symbol differences, improving BI lineage resolution.

  • AL-238913: Applied security patches that address several vulnerabilities in third-party JavaScript dependencies.

  • AL-238376: Fixed an issue where YouTube iframe embeds in document rich text fields could fail with a Video player configuration error (Error 153) when inserted through Code View or Insert Video (Embedded Code). The default iframe sandbox permissions now include allow-popups, along with appropriate allow and referrerpolicy attributes, so embedded YouTube videos play correctly.

  • AL-237624: Fixed an issue where the BI Resource API returned incorrect objects on paginated calls. The public BI GET endpoints now apply a default ordering by ID, returning consistent results across paginated requests.

  • AL-237491: Fixed an issue where a failed OCF connector upgrade, for example, due to a gRPC DEADLINE_EXCEEDED error while contacting the agent, could leave the connector disabled and hidden from the Connectors Dashboard. The connector is now automatically re-enabled when an upgrade fails.

  • AL-236917: Fixed an issue where users created via CSV bulk upload could not log in via SAML or OIDC when the Identity Provider returned their email address with different letter casing. The email confirmation check now correctly treats email addresses as case-insensitive, matching standard email-provider behavior.

  • AL-236310: Fixed an issue where Alation Analytics could report inflated tag assignment counts for catalog objects. When a tag was removed and re-applied to the same object multiple times, duplicate entries accumulated in the underlying data, causing analytics to show more tag records than actually existed in the catalog. Duplicate tag-deletion records are now cleaned up automatically when a tag is re-applied, and a one-time data cleanup runs on upgrade to remove existing duplicates from affected instances.

  • AL-235278: Fixed an issue where not all object type filters were displayed in search. Enable the enable_all_otype_filters_on_empty_search feature flag to show all object types when no search query is entered and no filters are applied.

  • AL-234765: Fixed an issue where BI Server redirected incorrectly in RDBMS Lineage Settings.

  • AL-234653: Applied security patches that address a security vulnerability in the rich text editor used for descriptions, articles, and posts. No user action or migration is required.

  • AL-232739: Fixed a performance issue where fresh installations of the MicroStrategy OCF connector incorrectly started a multi-hour curation migration process. Alation now intelligently differentiates between fresh installations and legitimate OCF version upgrades, allowing fresh installations to complete in seconds instead of hours. Existing OCF upgrade scenarios, native-to-OCF migrations, and other connector types are not affected.

  • AL-232735: Fixed an HTTP 504 Gateway Timeout error when viewing the version history of a description that contained many @-mentions in the Classic UI. Pagination has been added to the underlying textlog API (default page size 20), so version history loads successfully even for descriptions with hundreds of mentions.

  • AL-231903: Fixed an issue where qualified name parsing did not strip double-quoted identifiers, which could prevent lineage from resolving correctly for databases that use quoted identifiers (such as Snowflake, PostgreSQL, and Oracle). Quoted identifiers are now stripped during qualified-name parsing, improving lineage resolution for these data sources.

  • AL-231186: Fixed a crash in the Document Hubs API and UI when an Object Set custom field referenced objects that no longer existed in the database. Previously, stale references (for example, deleted columns from Metadata Extraction) caused the entire page to fail with an HTTP 500 error. Unresolvable references are now silently skipped and the page loads normally with all valid data displayed.

  • AL-228456: Fixed an issue where the Alation Analytics V2 ETL job could fail when two custom fields had very long or similar names. PostgreSQL limits column names to 63 bytes, and when custom field names exceeded this limit, the database silently shortened them, causing two different fields to end up with the same column name and the ETL job to fail every day. The fix ensures each custom field always gets a unique column name within PostgreSQL’s 63-byte limit, so the Analytics V2 job runs without interruption.

  • AL-227697: Fixed a bug where BI sources from excluded folders remained visible on the data source catalog page after selective extraction. The ingestion pipeline now correctly cascades folder exclusion to child data sources.

  • AL-202651: Fixed an issue where the per-connection query queueing feature shipped in 2024.3 was unreachable. The documented connector.extra_flags JVM-flag recipe had no effect because the connector reads the value only from connector.properties. The fix adds a dedicated alation_conf parameter, alation.connector.managed_execution.use_concurrent_execution_per_connection (default False), and wires it through both Customer Managed and Alation Cloud Service configuration generators. Customers using the legacy flag see no behavior change on upgrade. To enable the feature, request the new parameter through Alation Support on Alation Cloud Service, or set it through alation_conf on Customer Managed.

  • AL-195791: Fixed a bug where the Compose Settings page incorrectly showed a warning that Alation Agent does not support Compose on data sources that do support it, and hid the warning on data sources that do not. The warning is now displayed correctly based on the data source’s actual Compose support. The fix takes effect automatically after upgrade; no action is required.

  • AL-191100: Fixed an issue where switching database connections within a Compose tab or query form failed with a duplicate key error. You can now switch connections mid-session without losing the ability to execute queries.

  • AL-189602: Compose now shows a clearer error message for polling-mode OCF agent timeouts. When a query in Compose uses a data source backed by an Alation Agent in polling mode, a connection timeout is shown as Connection Timeout with a message that explains the polling delay and points to the database-connection-timeout admin setting. Previously this surfaced as a misleading Credentials Incorrect error with a generic database-unresponsive body. Behavior for tunneling agents, classic data sources, and genuine credential failures is unchanged. No migration or configuration change is required.

  • AL-182180: Fixed an issue where the History tab for Object Set, People Set (Stewards), and Reference custom fields did not display a record when field values were cleared through a Data Dictionary upload or Bulk Management upload using the Replace Existing Values - Apply Empty option. Previously, the values were cleared successfully, but the version history showed no indication that a change had occurred. The removal event now displays correctly in the version history, including who cleared the values and when, in both the Classic and New Experience UIs.

  • AL-158872: The Connector Dashboard now displays all installed connectors regardless of count. Previously, installations with more than 100 connectors only showed the first 100 in the dashboard list, and search could not find any connector beyond the 100th. The /api/v1/connector/ endpoint now defaults to returning up to 1000 connectors per request (matching the existing maximum), so admin tools, scripts, and integrations also benefit from the change. Pagination semantics are unchanged; callers can continue to use ?limit= and ?skip= for explicit paging.

  • AL-155186: Fixed a display issue in Compose where the SQL tooltip in query results showed keywords merged together. For example, SELECT *FROM was shown instead of SELECT * FROM. The tooltip now formats SQL correctly, improving readability.

  • AL-139868: Fixed an issue in the lineage Filters tab where empty values appeared in the Used Value dropdown. Only meaningful values are now shown.

  • AL-254977: Fixed an issue where accessing the Bulk Utility page returned an HTTP 500 error for users on version 26.4.0.0 with the Bulk Utility feature flag enabled.

RELEASE 2026.4.0.0

build 23.5.0.133409

Released May 4, 2026

Note

This release is for customer-managed (on-premise) instances.

New Features and Enhancements

Platform

  • AL-237389: Upgraded the Alation Analytics PostgreSQL database from version 16.10 to version 16.13 to take advantage of improvements, bug fixes, and security enhancements.

  • AL-237390: Upgraded the Alation internal PostgreSQL database from version 16.10 to version 16.13 to take advantage of improvements, bug fixes, and security enhancements.

  • AL-228892: Upgraded Elasticsearch version to 8.19.12.

  • AL-230587: Upgraded Jackson to 2.18.6 and refreshed base image packages to address multiple security vulnerabilities.

  • AL-225786: Refreshed the Auth Service base image and dependencies to improve security and stability. Vulnerable libraries have been updated, and dependency rules ensure safe versions remain in effect even when transitive dependencies pull in older versions.

  • AL-220841: The Amazon Corretto JDK used internally has been upgraded from version 11.0.29.x.x to 11.0.30.x.x to enhance application security.

Authentication

  • AL-202855: Added the alation.authentication.saml.create_unknown_user configuration flag to control automatic user creation during SAML login.

    • Default behavior is unchanged. Users are still automatically created on first SAML login (the flag defaults to True).

    • Setting this flag to False restricts SAML login to only users that already exist in Alation (for example, users provisioned via SCIM). Unknown users will see a Login not allowed error page.

    • This is useful for customers who use SAML for authentication and SCIM for user provisioning and want to prevent unauthorized users from being auto-created.

    • Configure via alation_conf and restart Alation. No migration required.

  • AL-236968: Added support for per-user identity propagation in Compose SSO via AWS IAM Identity Center (IDC) for Redshift. Users connecting through Compose are now authenticated under their individual IDC identity (for example, awsidc:user@email.com) instead of a shared service account, enabling proper audit trails and least-privilege access controls on both provisioned clusters and serverless workgroups. The Compose JDBC URI must include authenticator=oauth, Plugin_Name=com.amazon.redshift.plugin.IdpTokenAuthPlugin, and token_type=EXT_JWT.

  • AL-223520: Deprecation notice: User V0 tokens are deprecated. Existing User V0 tokens will continue to function during the deprecation period, but customers are strongly encouraged to migrate to User V1 tokens for continued support and compatibility. Update your integrations and automation workflows to use User V1 tokens, and avoid creating new User V0 tokens. Find more information in this Alation Community update (requires a login).

Alation Analytics

  • AL-226121: Alation Analytics now tracks schema-level privacy settings. The rdbms_schemas table includes a nullable private column that reflects whether a schema is Private or Public, accounting for both data source-level defaults and schema-level explicit permission overrides. This enables governance reporting on schema access controls.

  • AL-223038: Alation Analytics dashboards now load correctly when a custom Content Security Policy (CSP) is enabled. Previously, enabling nginx.csp_custom_enabled=True would block Alation Analytics dashboards. The Alation Analytics domain (*.aa.alationdata.com) is now included as a default integration in the restrictive CSP, so no additional configuration is needed. Customers who previously added this domain manually to nginx.csp_custom may now remove it.

  • AL-209626: Improved incremental ETL performance in Alation Analytics. The incremental extraction logic now uses hour-level precision for the extraction start time instead of restarting from midnight on each run. Multiple ETL runs on the same day no longer redundantly reprocess data from earlier in the day, resulting in faster ETL run times and reduced compute usage. No customer action is required.

Catalog Content and Customization

  • AL-228228: It’s now possible to programmatically ingest column and attribute metadata for files in file system connectors via the new /integration/v2/file_attribute/ API endpoints. This enables:

    • Automating schema documentation for file-based data sources

    • Bulk creation and updates of file attributes

    • Custom field assignment to file columns

    The following endpoints are available:

    • POST /integration/v2/file_attribute/?fs_id=<id>: Create file attributes

    • GET /integration/v2/file_attribute/?fs_id=<id>: List file attributes

    • PATCH /integration/v2/file_attribute/?fs_id=<id>: Update file attributes

    You must have the Server Admin role or the File System Admin permission for the file system you’re updating to use this API.

  • AL-230881: Added deletion support via the API for file attributes through the asset type framework. File attributes can now be deleted via DELETE /integration/v2/asset/file_attribute/<id>/, which performs a hard delete since file attributes do not support soft deletion. Requires admin permissions.

  • AL-122805: Users can now export and import tag associations for catalog objects using Data Dictionary.

Per-Object Parameters

  • AL-219591: The Admin Settings > Feature Configuration page now has new feature parameters (toggles) to control global defaults for per-object parameters:

    • Default Enable Compose Functionality: Controls whether the Compose functionality is enabled by default when creating new data sources.

    • Default Mark Attributes as Sensitive: Controls whether new attributes (columns) are marked as sensitive by default. When enabled, newly discovered attributes will automatically be flagged as containing sensitive data.

    • Default Maximum Rows to Scan: Sets the default maximum number of rows to scan during profiling for newly created schemas and tables. This controls how many rows the profiler will examine to generate statistics and samples.

    • Default Maximum Sample Rows to Store: Sets the default maximum number of sample rows to store from profiling for newly created schemas and tables. These sample rows are used to provide data previews and examples in the catalog.

    • Default Profiling Sampling Enabled: Controls whether profiling sampling is enabled by default when creating new schemas and tables.

    • Default Skip View Profiling: Controls whether view profiling is skipped by default when creating new schemas.

    • Display Table Names in BI Datasource Fields: When enabled, a new column will appear in BI datasource field tables to show the source table names for each field.

  • AL-229350: New Bulk Per-Object Parameters public API allows administrators to update profiling and catalog parameters (excluded, sensitive, skip profiling) for multiple schemas, tables, and attributes in a single API call via CSV or JSON upload. Changes cascade to child objects automatically, matching existing UI behavior. Upload limits are configurable via alation_conf:

    • Max file size: 10 MB (default). Configure with: alation.api.bulk_per_object_parameters.max_file_size_bytes.

    • Max rows: 10,000 (default). Configure with: alation.api.bulk_per_object_parameters.max_row_count.

  • AL-194932: When Sample? or Skip Views is enabled for a schema, the Run Sample button is now disabled for tables and views in that schema, with a tooltip explaining why. This prevents user confusion when sampling data does not refresh because profiling was skipped.

Domains and Document Hubs

  • AL-122787: Users can now export and import domain memberships for catalog assets using the Data Dictionary:

    • Export — When downloading a Data Dictionary, a new metadata::domains column shows each object’s associated domains.

    • Import — Add or update domain memberships by specifying domains in the metadata::domains column during upload.

    • Supported formats:

      • By ID and name: 123|Marketing Domain

      • By ID only: 123

      • By name only: Marketing Domain

      • Multiple domains: 123|Marketing;456|Sales

    This enables bulk management of domain memberships across many objects at once, streamlining governance workflows.

  • AL-233582: Added a rich-text format Description field to domains’ catalog pages.

Lineage

  • AL-225439: Reduced the default value of the lineage_graph_loading_limit_max_nodes configuration parameter from 2000 to 100. Lineage charts with more than 100 nodes will now default to Incremental Load mode, improving page load performance. Customers who have explicitly configured this parameter are not affected. To restore the previous behavior, set lineage_graph_loading_limit_max_nodes to 2000.

  • AL-221281: Stored procedure names are now automatically applied as titles for dataflows created from stored procedures. Previously, these dataflows appeared as Untitled Dataflow. The enhancement also adds support for updating custom fields during dataflow insertion, with tracking and error handling to ensure reliable updates.

  • AL-231907: Removed the BETA badge from Manage Connections in Lineage Settings.

Other Improvements

  • AL-175569: You can now opt out of file system attribute indexing to reduce Elasticsearch storage usage in environments with large file system catalogs where file attribute search is not commonly used. Request Alation Support to disable the attribute indexing. Updating the flag value requires reindexing of the Search index.

  • AL-222134: The Health tab on BI report catalog pages now follows the alation.feature_flags.enable_data_health feature flag setting.

  • AL-223552: When the Lexicon feature flag (alation.feature_flags.enable_lexicon) is disabled, the Lexicon feature is now fully hidden and cannot be accessed or run from the UI or settings.

Bug Fixes

  • AL-238093: Fixed a 500 Internal Server Error when creating or updating API resources with an empty input or output schema (for example, "input_schema": {}). The error occurred because empty schemas caused the system to incorrectly associate unrelated schema objects with the new resource, leading to a crash on subsequent requests.

  • AL-191966: Strengthened protection against stored XSS in the Customize Homepage feature. JavaScript execution is now blocked in uploaded media files (including SVG files used for homepage customization) when accessed directly through media server URLs, preventing attackers from exploiting malicious embedded scripts.

  • AL-236406: Fixed search filter facets to display human-readable names instead of raw numeric IDs for Document Hub term types and glossary collections when the underlying custom template or glossary object had been deleted.

  • AL-234368: Fixed an issue where column-level lineage polling had no maximum limit, causing uWSGI threads to be blocked and resulting in outages on customer instances. Polling now has a maximum of 10 retries and a 60-second time limit.

  • AL-234218: Catalog Admin users can now access the lineage and dataflow public APIs (/integration/v2/lineage/, /integration/v3/lineage/, and /integration/v2/dataflow/). Previously, only Server Admin and Source Admin roles had access. This aligns Catalog Admin permissions with the role hierarchy: Catalog Admin should have at least the same API access as Source Admin.

  • AL-232415: Fixed an issue where special characters (such as &) in BI Server Source names were displayed as HTML entities (for example, &amp;) in the source list and settings pages. This fix also applies to other catalog object titles managed by the Logical Metadata System.

  • AL-228925: Resolved an issue where the Details tab in the dataflow editing sidebar would crash with a JavaScript error, preventing users from viewing or editing lineage details. The same fix also addresses the crash that occurred when clicking on endorsement chips in lineage graphs.

  • AL-227826: Fixed an issue where BI report popularity was not being calculated for non-Tableau connectors, including Domo, Power BI, Sigma, and Universal BI.

    Note

    For the Domo connector, users must configure the Popularity Dataset ID setting with their Domo Card Loads DomoStats dataset ID.

  • AL-226942: Fixed an issue where the CSV report generation feature produced incorrect status information for Multi-Picker fields and Rich Text fields containing certain special characters, showing Not Applied – Unknown Failure for field updates that were actually applied successfully. Rich Text fields (descriptions with HTML formatting and @mentions) and Multi-Picker fields are now properly validated. Applied status correctly appears for successful catalog updates, and Not Applied status is reserved for genuine failures requiring attention.

  • AL-225797: Removed the spurious error log for missing object types on certain custom templates when the object type is in the asset type range, as this is expected behavior. This reduces noise in the logs.

  • AL-222819: Improved the display of error messages in Compose execution results. Multi-line error messages now properly preserve line breaks and formatting, making database errors easier to read and troubleshoot. Long error messages wrap appropriately without truncation, providing better visibility into query execution issues.

  • AL-222241: Enhanced the key vault bulk rekey process to support tables with any primary key data type, resolving previous limitations that caused failures with UUID and varchar primary keys. The system now automatically detects the correct primary key data type for each table during rekey operations, providing full support for UUID, varchar, integer, and all other PostgreSQL primary key types. No manual configuration is required.

  • AL-215118: Improved performance for updating the Domain field on more than 1,000,000 records.

  • AL-214933: Fixed an out-of-memory kill (SIGKILL) during Tableau MDE lineage computation on large Tableau instances. Lineage link accumulation has been converted from in-memory lists to streaming Python generators, reducing peak memory usage from 2.5+ GiB to approximately 1.2 GiB. This affects customers with large Tableau deployments (10K+ reports, 500K+ columns).

  • AL-209584: Fixed an issue where running a query in Compose that returns zero rows displayed a red error message (Failed to stream query results: Index: 0, Size: 0) instead of the expected No data available in table message. Compose now correctly handles empty query results across all data source types. The fix applies automatically — no feature flags, configuration changes, or restarts are required. Affects all users running queries in Compose on data sources with result storage restriction enabled (the default for cloud deployments).

  • AL-208989: Fixed an issue where the Compose table preview panel did not appear for tables with external or unknown schema prefixes. Users can now get table preview information when writing cross-database queries or referencing tables in schemas not yet cataloged locally.

  • AL-204715: Fixed a column alignment issue in the Upload Data Import confirmation step that occurred when previewing a CSV file with a small number of columns. Previously, the column headers and data table could appear misaligned during the final confirmation view, with headers positioned on the left while the data table was centered.

  • AL-202732: Fixed two Compose Admin Settings that previously had no effect on query exports:

    • Trim extra spaces for fixed-length char types now correctly trims leading and trailing whitespace from string columns in downloaded and exported CSV files.

    • Wrap fields in quotes for exports and downloads now correctly wraps string values in ="value" format in CSV exports, preventing applications such as Excel from auto-converting values (for example, dates, phone numbers, and IDs stored as text). CSV files use QUOTE_ALL only when this setting is enabled; otherwise minimal quoting is used.

    These settings are controlled by alation.compose.trim_spaces_added_for_char_type (default False) and alation.compose.wrap_text_in_quotes_for_export_and_download (default False), and can be enabled in Admin Settings → Compose.

  • AL-201750: In Compose, when obfuscate literals is enabled on a data source, non-author users now correctly see obfuscated SQL under run history on the query form page. Previously, the raw SQL with literals exposed was visible. In neo, run history also now obfuscates the literals.

  • AL-200379: Fixed an issue when users selected the Run full query and ignore errors option in Compose, where queries could fail with an error even when the option was selected.

  • AL-184089: Improved permission guidance when accessing shared queries via links. Error messages now indicate that users should check both query permissions and data source permissions in the catalog.

  • AL-171062: Enhanced how Compose displays database error messages to make them clearer and more actionable. When queries encounter errors, the system now shows cleaner, more understandable messages that focus on the actual database issue rather than technical details.

  • AL-165519: When scheduled queries fail to run because query scheduling is disabled or not supported by the data source, users now see clear error messages in the query execution history instead of a misleading Running state.

  • AL-207603: Fixed a performance issue causing slow load times for the Published Queries and Query Run History sections on schema and table catalog pages. The root cause was inefficient data retrieval when fetching queries associated with multiple collaborators. The underlying data retrieval has been optimized to eliminate this bottleneck. This fix affects all users who access Published Queries or Query Run History on schema and table catalog pages.

  • AL-225040: Fixed inconsistent custom-field naming across internal search filter APIs so that custom filters (especially those configured with plural display names) reliably appear in the left-side Add More Filters list.

  • AL-227963: Addressed an issue where the Admin Settings > Monitor > Health Checks page appeared empty.

  • AL-236345: Fixed an issue where newly created manual lineages required manual toggling of Show to be visible on the chart, and attempts to publish new lineages failed with a database error related to the updated_at column. Newly created manual lineage will be displayed correctly going forward.