What metabase/metabase shipped
Generated by FoxPlug from public activity — not affiliated with Metabase.
Week of September 14, 2026
What shipped
- Unauthenticated request body sizes are now limited to help protect server memory, while authenticated users remain unaffected. Pull request #82572
- Indexed-entity handling in xrays was improved to avoid using indexed-entry values directly. Pull request #82699
- Development Docker ports, socket REPL, and rspack dev server now bind to loopback only instead of 0.0.0.0 for improved security. Pull request #82707
- Remote sync was made robust against restarts to fix issues where pull operations could get stuck for extended periods. Pull request #82553
- C3p0 pool stats are now read directly from pool objects instead of through JMX to avoid locking issues. Pull request #82760
- Channel write permissions are now required when sending to a channel by ID. Pull request #82608
- Filter widgets set to Input box type now return empty lists from values endpoints since the UI never requests values for that widget type. Pull request #82535
- Slack messages without text fields now contribute their attachments to thread history instead of being dropped. Pull request #82631
- Memory allocation during remote sync statistics collection was improved to reduce OOMKill incidents. Pull request #82625
- Error messages now format blocked table IDs as plain numbers without thousands separators. Pull request #82772
Why it matters
This week focused on stability and security improvements across multiple systems. Server memory protection, permission checking, and robustness against restarts address production reliability concerns that users experience with long-running operations and sync processes.
Changelog entry
- Unauthenticated request body sizes are now limited Pull request #82572
- Improved indexed-entity handling in xrays Pull request #82699
- Development servers now bind to loopback only for security Pull request #82707
- Remote sync is now robust against restarts Pull request #82553
- C3p0 pool stats now read directly from pool objects Pull request #82760
- Channel write permissions required for sending by channel ID Pull request #82608
- Input box filter widgets no longer return values from endpoints Pull request #82535
- Slack attachments preserved in thread history when text is missing Pull request #82631
- Remote sync memory allocation improved Pull request #82625
- Error messages format table IDs as plain numbers Pull request #82772
This week: request body limits for unauthenticated users, improved remote sync robustness, better permission checks, and fixes for xrays and pool stats reading.
Metabase shipped several important improvements this week focused on stability and security. We added request body size limits for unauthenticated requests to protect server memory, made remote sync operations more robust against restarts to fix extended wait times, and improved permission checking for channel operations. We also fixed issues with indexed-entity handling in xrays and optimized how database pool statistics are read to prevent locking problems.