What metabase/metabase shipped
Written by FoxPlug from the repository's own releases; not affiliated with Metabase. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/metabase/metabase; Metabase did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- Unsubscribe links in emails now require confirmation, so link scanners can no longer unsubscribe recipients by loading the page. Pull request #86552
- Currency labels can now be placed before or after amounts, as an instance default and as per-column overrides, in visualizations, notifications and exports. Pull request #85764
- The admin databases list is now a grid of cards, each showing the database engine's logo with a fallback to the database icon. Pull request #86412
- The data reference no longer crashes for questions with aggregations; it lists the columns returned for the table or question query. Pull request #86467
- The unused
collection_previewbackend code paths were removed. Pull request #85641 - Anonymous reach of a database is now computed and served, as the first step of a stack covering anonymous access grants and public links. Pull request #84768
- The flaky DuckDB cases were removed from the SQL check test, which sometimes failed in CI with a recursion depth error. Pull request #86581
- The transform-test runner now reads the entity under test through a subject-plan multimethod instead of the transform directly. Pull request #86599
- The workspaces backend removed earlier was restored without any UI. Pull request #86563
- TableId is now a plain number, with virtual table ids and their handling dropped. Pull request #86567
Why it matters
This week brings two changes people will notice in use: unsubscribing from an email link now asks for confirmation, and currency labels can be placed before or after amounts as a default or per column. The admin databases page also moves to a card grid with engine logos. Behind that, a long series of changes reduces reliance on virtual card tables in the frontend, and the data reference crash for questions with aggregations is fixed.
Changelog entry
- Require confirmation before unsubscribing from email links, so link scanners cannot unsubscribe recipients. Pull request #86552
- Allow currency labels before or after amounts with an instance default and per-column overrides. Pull request #85764
- Restyle the admin databases list as a grid of engine cards. Pull request #86412
- Fix data reference crash for questions with aggregations. Pull request #86467
- Remove unused
collection_previewcodepaths from the backend. Pull request #85641 - Remove flaky DuckDB cases from the SQL check test. Pull request #86581
- Genericize the transform-test runner with a subject-plan multimethod. Pull request #86599
- Restore the workspaces backend without UI. Pull request #86563
- Make TableId a plain number and drop virtual table ids. Pull request #86567
- Stop creating virtual card tables and drop saved questions browsing. Pull request #86545
- Show model details from card metadata. Pull request #86541
- Docs: drop dashboards from the Library in Data Studio and restore synced collections docs. Pull request #86586
This week: unsubscribe links now ask for confirmation, currency labels can go before or after amounts as a default or per column, the admin databases page is a grid of engine cards, and the data reference no longer crashes on questions with aggregations.
Changes this week in Metabase: unsubscribe links in emails now require confirmation, so automated link scanners can no longer unsubscribe recipients. Currency labels can be placed before or after amounts, set as an instance default or per column, across visualizations, notifications and exports. The admin databases page is now a grid of cards showing each engine's logo. The data reference no longer crashes for questions with aggregations. The unused collection preview backend code paths were removed, and a flaky DuckDB test case was taken out of the SQL check tests.
Week of October 26, 2026
What shipped
- Data app definition generation now validates each definition on its own, so invalid definitions return a 400 instead of being silently stripped, and export name collisions are rejected. Pull request #86020
- Added slug-less endpoints that turn data app TypeScript definitions into repository files without changing the instance, including a schema endpoint for Library tables and metrics. Pull request #85977
- A live data app now changes only through a remote-sync import; the create, bundle replace, delete and typed schema endpoints were removed and PUT now accepts only the enabled field. Pull request #85978
- Data app requests are now checked by mode, with dev previews validated against the app named in their manifest without needing an app on the instance. Pull request #85976
- Generated metabase.schema.ts now gives each table field a required slug, and actions key their parameters by that slug instead of a lowercased name. Pull request #86021
- Data app content is now held to rules its own rows show, constraining what cards in a data-apps collection may reference. Pull request #85975
- Dashboard write responses now include a parameter's default and value source after
add_parameterorupdate_parameter. Pull request #85801 - The SDK's data-app support now sends the dev header in dev preview, runs table queries ad hoc, executes actions through the action execute endpoint, and resolves entity IDs in production. Pull request #85979
- Removed the native subquery end-to-end spec, since its behaviors are now covered by unit tests that need no backend or browser. Pull request #85843
- Moved card template tag normalization coverage from an end-to-end spec down to unit tests and deleted the spec. Pull request #85829
Why it matters
This week focuses on data apps: generation and editing now go through a narrower, validated path, and live apps change only via remote-sync import. Invalid definitions fail with a clear error instead of being silently dropped, and parameters are keyed by column slug, which changes how generated schema files and actions line up. Several patches also landed across release branches, and more end-to-end browser tests moved down to fast unit tests.
Changelog entry
- Refuse invalid data app definitions in generate endpoints with a 400. Pull request #86020
- Add slug-less data app generation endpoints for schema and repository files. Pull request #85977
- Live data apps change only through remote-sync import; editing endpoints removed. Pull request #85978
- Check data app requests by mode, including dev previews against the manifest app. Pull request #85976
- Key data app action parameters by column slug in generated schema. Pull request #86021
- Improve data app content checks against the app's own rows. Pull request #85975
- Show a parameter's default and value source in dashboard write responses. Pull request #85801
- Wire SDK data-app support into the dev preview and production flow. Pull request #85979
- Move native subquery coverage from end-to-end spec to unit tests. Pull request #85843
- Move card template tag normalization coverage to unit tests. Pull request #85829
- Do not set a statement timeout for ClickHouse. Pull request #85964
- Bump the Embedding SDK version on release-x.65.x to 0.65.2. Pull request #86024
Data apps got tighter this week: generation validates each definition and returns 400 on bad input, live apps change only through remote-sync import, and action parameters are keyed by column slug. Schema generation endpoints landed too.
This week's work centered on data apps. Definition generation now validates each definition independently, so a bad definition returns a 400 rather than being silently stripped from the request. Slug-less generation endpoints turn TypeScript definitions into repository files without touching the instance. A live data app now changes only through a remote-sync import, with the old editing endpoints removed and PUT accepting only the enabled field. Generated schema files give each table field a required slug, and actions key parameters by it. Elsewhere, dashboard write responses now return a parameter's default and value source, and more end-to-end specs moved down to unit tests.
Week of October 19, 2026
What shipped
- Implicit actions can now store the table without requiring a model. Pull request #85386
- Implicit actions are now allowed on a table without a model. Pull request #85387
- Actions can now be created from a table through the New menu. Pull request #85390
- Saved table actions and their fields can now be shown and edited. Pull request #85391
- ClickHouse tests now run with left joins enabled, with
join_use_nullsset by the driver. Pull request #85372 - Regression tests now check actions-enabled and native permissions against the query's database rather than the declared one. Pull request #82775
- The migration version check script now works with the new Liquibase id style. Pull request #85417
- The dependency graph no longer shows the find and replace button for questions and models in a data app's collection. Pull request #85415
- Table column widths no longer reset when a column is reordered. Pull request #84673
- RLCS is now only removed when a table is not sandboxed, covering a data warehouse and RLCS corner case. Pull request #85450
Why it matters
This week the data action work moved forward so actions can live on a table without a model, from storage through a new table action page and creation from the New menu. Several smaller fixes landed too: ClickHouse joins now return nulls like other drivers, column widths survive reordering, and a dependency graph button is hidden where it did not apply.
Changelog entry
- Store the table of implicit actions without a model. Pull request #85386
- Allow implicit actions without a model, on a table. Pull request #85387
- Add a new table action page. Pull request #85389
- Create actions from a table from the New menu. Pull request #85390
- Show and edit a saved table action and its fields. Pull request #85391
- Enable left join in ClickHouse tests, with the driver setting
join_use_nulls. Pull request #85372 - Check actions-enabled and native permissions against the query's database. Pull request #82775
- Fix check-migration-versions to work with the new Liquibase id style. Pull request #85417
- Hide the find and replace button in the dependency graph for data app questions and models. Pull request #85415
- Fix table column widths resetting on column reorder. Pull request #84673
- Only remove RLCS when a table is not sandboxed. Pull request #85450
- Remove the Graphy team from CODEOWNERS. Pull request #85414
This week: implicit actions can now live on a table without a model, with a new table action page and creation from the New menu. ClickHouse joins now honor nulls. Column widths no longer reset on reorder.
This week the data actions work moved forward: implicit actions can now be stored and used on a table without a model, there is a new table action page, and actions can be created from a table via the New menu. ClickHouse tests now enable left joins with join_use_nulls, so unmatched rows return nulls instead of default values. Column widths no longer reset when reordering a table column, the dependency graph hides find and replace for data app questions in the collection, and the migration version script now works with the new Liquibase id style.
Week of October 12, 2026
What shipped
- Fixed slow Athena syncs for database names with underscores by escaping literal name characters and using the connection's catalog when a specific database is configured. Pull request #84583
- Kept Number and Trend card titles visible on small dashboard cards with a compact size-150 layout and a title/comparison row. Pull request #84567
- Showed every trend comparison on dashcards tall enough for them instead of moving extras into a popover. Pull request #84469
- Applied chain filter constraints behind one-to-many joins as semi-joins to stop the row multiplication reported in dashboards. Pull request #83955
- Migrated the Row Chart component to an Echarts implementation using the Cartesian Chart layout engine with rotated axes. Pull request #83378
- Added metrics to both embedding data pickers, simple and full, so embedding users can start a question from a metric. Pull request #82184
- Removed
data_app.table_idsfrom data apps; permission warnings now walk the dependency graph instead of storing the tables resources read. Pull request #84358 - Made Library dashboard name and description editable inline in Data Studio, following the page's existing write, trash and remote sync rules. Pull request #84612
- Fixed logging so fatal errors such as failing to connect to the app DB include the full stacktrace instead of being swallowed. Pull request #83155
- Included Romanian in the translation sync workflow by removing it from the download exclusions. Pull request #84470
Why it matters
This week brought a mix of dashboard and embedding fixes that people using the product will feel directly, plus performance work on Athena syncs and chain filters behind joins. Backports carried several of these fixes and the stacktrace logging change across the supported release lines, and new migration and permission work landed for data apps and row charts.
Changelog entry
- Fix slow Athena syncs for database names containing underscores. Pull request #84583
- Keep Number and Trend card titles visible on small dashboard cards. Pull request #84567
- Show every trend comparison on dashcards tall enough for them. Pull request #84469
- Apply chain filter constraints behind one-to-many joins as semi-joins to prevent row multiplication. Pull request #83955
- Migrate the Row Chart component to an Echarts implementation. Pull request #83378
- Show metrics in the simple and full embedding data pickers. Pull request #82184
- Remove
table_idsfrom data apps and walk the dependency graph for permission warnings. Pull request #84358 - Allow inline editing of Library dashboard name and description in Data Studio. Pull request #84612
- Log full stacktraces for fatal errors instead of swallowing them. Pull request #83155
- Include Romanian in the translation sync workflow. Pull request #84470
- Register the new repair error in the error registry. Pull request #84700
- Hide stored query results when query execution is turned off. Pull request #84529
This week: faster Athena syncs for names with underscores, Number and Trend titles stay visible on small cards, all trend comparisons show on tall enough dashcards, chain filters no longer multiply rows behind one-to-many joins, and Row Charts moved to Echarts.
This week in Metabase: Athena syncs no longer slow down on database names with underscores. Number and Trend card titles stay visible on small dashboard cards, and dashcards tall enough now show every trend comparison. Chain filter constraints behind one-to-many joins now apply as semi-joins, fixing row multiplication. Row Charts moved to an Echarts implementation. Metrics are now offered in both embedding data pickers. Data apps no longer store data_app.table_ids, and Library dashboards in Data Studio support inline editing of name and description. Fatal errors now log full stacktraces.
Week of October 5, 2026
What shipped
- Stopped persisted model caches from being used to answer sandboxed, impersonated, or database-routed requests. Pull request #82579
- Replaced the dashboard loading spinner with an instant skeleton for the header, filter bar and card grid. Pull request #83288
- Made serialization import create a stub database for a missing database instead of failing, with stubs listed via
include_stubson the admin databases page. Pull request #83574 - Gave every data app its own resource collection in a dedicated data-apps namespace. Pull request #83766
- Added a UNION ALL approach for running pivot queries, producing the same result set as the grouping sets approach. Pull request #81406
- Changed answers for creating or retargeting a transform onto an existing table from 403 to 409. Pull request #83799
- Fixed loading the revision history of a renamed transform test, which previously failed with status 500. Pull request #83818
- Fixed SmartScalar comparison labels across daylight saving changes so dates and times are shown correctly. Pull request #82457
- Applied the configured readable-paths settings to the Snowflake OIDC token file. Pull request #83496
- Removed 58 unreferenced image files, 1.81 MB, from app/assets/img and app/img. Pull request #82788
Why it matters
This week matters because several fixes and optimizations improve day-to-day reliability and speed. Dashboard loading shows a skeleton instead of a spinner, serialization import handles missing databases, pivot queries gain a UNION ALL approach, and data apps get their own resource collection. Cached model data is no longer substituted for sandboxed, impersonated, or database-routed users, which makes request results more consistent.
Changelog entry
- Don't use persisted model cache for sandboxed, impersonated, or database-routed requests. Pull request #82579
- Replace the dashboard loading spinner with an instant skeleton. Pull request #83288
- Create stub databases for missing databases on serialization import, with
include_stubslisting them. Pull request #83574 - Data app resource collections now use a collection of the data-apps namespace. Pull request #83766
- Implement the UNION ALL approach for running pivot queries. Pull request #81406
- Answer a transform onto an existing table with 409 instead of 403. Pull request #83799
- Fix the revision history of a renamed transform test. Pull request #83818
- Fix SmartScalar comparison labels across daylight saving changes. Pull request #82457
- Apply configured path settings to the Snowflake OIDC token file. Pull request #83496
- Remove 58 unreferenced image files, 1.81 MB, from app/assets/img and app/img. Pull request #82788
- Fix parseZone day arithmetic for datetimes without an offset. Pull request #83394
- Remote sync now names the cause of a diverged-export conflict. Pull request #83682
Dashboard loading now uses an instant skeleton instead of a spinner. Serialization import creates a stub database for missing databases instead of failing. Pivot queries gained a UNION ALL approach. Transform creation onto an existing table answers 409. Data apps own their resour
This week in Metabase: dashboards open with an instant skeleton instead of a loading spinner, so the header, filter bar and card grid render immediately. Serialization import now creates a stub database when a database is missing instead of failing outright. Pivot queries gained a UNION ALL approach that matches the grouping sets result set. Transform creation or retargeting onto an existing table now answers 409 instead of 403. Every data app owns its resource collection in the data-apps namespace. Persisted model caches are no longer substituted for sandboxed, impersonated, or database-routed users. Support for the configured path settings was extended to the Snowflake OIDC token file.
Week of September 28, 2026
What shipped
- Database connection form now has a test button so users can validate connections before creating them, using the existing validate endpoint. Pull request #83100
- Alert and subscription emails no longer wrap entire cards in links, fixing issues with selecting text and allowing clicks on table cells to work as intended. Pull request #83269
- Filter value lists migrate off Emotion to Mantine styling. Pull request #83501
- Dashboard tabs now display a single clean border instead of doubled lines where the header and tab row meet. Pull request #83295
- Side-effect file scanning now runs in parallel across worker threads, reducing test suite time. Pull request #83493
- Visualizer e2e tests consolidated from 43 to 32 tests across 6 specs with no coverage loss. Pull request #83556
- Homepage no longer waits unnecessarily for settings request, removing spinner delay on page load. Pull request #82629
- Dashboard edit protection fix backported to v64 release branch. Pull request #83592
Why it matters
This week brings quality-of-life improvements for database setup, email notifications, and UI consistency, alongside faster test execution and broader Metabot provider support. Multiple styling migrations continue moving the codebase away from Emotion toward Mantine components.
Changelog entry
- Database connection form includes a test button to validate connections before creation Pull request #83100
- Alert and subscription emails no longer wrap cards in links, fixing text selection and cell clicks Pull request #83269
- Dashboard tabs display single border instead of doubled line at header Pull request #83295
- Filter value lists migrated to Mantine styling Pull request #83501
- Homepage loads faster by removing unnecessary settings wait Pull request #82629
- Side-effect file scanning uses parallel worker threads for speed Pull request #83493
- Visualizer e2e tests consolidated with no coverage loss Pull request #83556
- Multiple UI components migrated off Emotion to Mantine (color picker, help card, segment form, public actions, accordion lists) Pull request #83384
Week of September 21, 2026
What shipped
- SendMeteringEvents job no longer does full table scans of
query_execution, reducing load on the app database on busy instances. Pull request #83034 - Related tables lookup in the MCP
browse_datatool now caps permission queries instead of making uncapped requests to the app DB. Pull request #82962 - The Metabot illustrations toggle in Admin > AI > Customization now stays visible after being toggled on. Pull request #82946
- Pgvector credentials are no longer exposed in error messages when using alternate user:pass@host URL forms. Pull request #83010
- Pgvector database URL and credentials are excluded from c3p0 and pgjdbc log output. Pull request #82930
- Remote Sync now properly types columns when importing a GUI model before the target database schema sync completes. Pull request #82945
- Remote Sync now cleans up nested content when a parent collection is archived, preventing orphaned files from accumulating in git. Pull request #82876
- Pivot table subtotals with month-bucketed dates now maintain correct localization when formatted multiple times. Pull request #82947
- Storybook builds for Loki screenshot runs now skip unnecessary steps like React docgen, MDX docs, and source maps. Pull request #83003
- Permission errors on cards and dashboards no longer replace the entire page. Pull request #82943
Why it matters
This week addressed several performance bottlenecks affecting database load and API efficiency, fixed credential exposure in logs and error messages, and resolved UI issues where toggles and error messages were behaving unexpectedly. These improvements reduce operational strain on busy instances and enhance security for sensitive database configurations.
Changelog entry
- Performance: SendMeteringEvents job no longer performs full table scans of
query_executionPull request #83034 - Performance: MCP
browse_datatool caps permission queries for related tables lookup Pull request #82962 - Fixed: Metabot illustrations toggle now remains visible in Admin > AI > Customization Pull request #82946
- Security: pgvector credentials removed from error messages using alternate URL forms Pull request #83010
- Security: pgvector database URL and credentials excluded from logs Pull request #82930
- Fixed: Remote Sync now properly types columns when importing models before schema sync completes Pull request #82945
- Fixed: Remote Sync cleans up nested content when parent collections are archived Pull request #82876
- Fixed: Pivot table subtotals with bucketed dates maintain correct localization Pull request #82947
- Fixed: Permission errors no longer replace the entire page Pull request #82943
- Build: Storybook optimized for Loki screenshot runs with reduced build steps Pull request #83003
This week we fixed performance issues in metering jobs and related table lookups, prevented credential leaks in pgvector logs, made Remote Sync handle archiving properly, and ensured UI toggles and error messages work as expected.
This week's updates focus on performance, security, and reliability. We eliminated full table scans in the metering job that were slowing busy instances, prevented pgvector credentials from leaking in logs and errors, fixed Remote Sync to properly clean up archived content, and addressed UI issues with toggles and error displays. These improvements reduce database strain, enhance security, and improve user experience.
Week of September 14, 2026
What shipped
- Unauthenticated request body sizes are now limited to help protect server memory, while authenticated users remain unaffected. Pull request #82572
- Indexed-entity handling in xrays was improved to avoid using indexed-entry values directly. Pull request #82699
- Development Docker ports, socket REPL, and rspack dev server now bind to loopback only instead of 0.0.0.0 for improved security. Pull request #82707
- Remote sync was made robust against restarts to fix issues where pull operations could get stuck for extended periods. Pull request #82553
- C3p0 pool stats are now read directly from pool objects instead of through JMX to avoid locking issues. Pull request #82760
- Channel write permissions are now required when sending to a channel by ID. Pull request #82608
- Filter widgets set to Input box type now return empty lists from values endpoints since the UI never requests values for that widget type. Pull request #82535
- Slack messages without text fields now contribute their attachments to thread history instead of being dropped. Pull request #82631
- Memory allocation during remote sync statistics collection was improved to reduce OOMKill incidents. Pull request #82625
- Error messages now format blocked table IDs as plain numbers without thousands separators. Pull request #82772
Why it matters
This week focused on stability and security improvements across multiple systems. Server memory protection, permission checking, and robustness against restarts address production reliability concerns that users experience with long-running operations and sync processes.
Changelog entry
- Unauthenticated request body sizes are now limited Pull request #82572
- Improved indexed-entity handling in xrays Pull request #82699
- Development servers now bind to loopback only for security Pull request #82707
- Remote sync is now robust against restarts Pull request #82553
- C3p0 pool stats now read directly from pool objects Pull request #82760
- Channel write permissions required for sending by channel ID Pull request #82608
- Input box filter widgets no longer return values from endpoints Pull request #82535
- Slack attachments preserved in thread history when text is missing Pull request #82631
- Remote sync memory allocation improved Pull request #82625
- Error messages format table IDs as plain numbers Pull request #82772
This week: request body limits for unauthenticated users, improved remote sync robustness, better permission checks, and fixes for xrays and pool stats reading.
Metabase shipped several important improvements this week focused on stability and security. We added request body size limits for unauthenticated requests to protect server memory, made remote sync operations more robust against restarts to fix extended wait times, and improved permission checking for channel operations. We also fixed issues with indexed-entity handling in xrays and optimized how database pool statistics are read to prevent locking problems.