Metabase Release Notes

Upgrade instructions

Following our security update last week, today we are releasing hardened versions of Metabase which incorporate several security improvements, including hardening our api and fixing issues that are derivatives of the vulnerability we encountered last week.

We strongly encourage you to upgrade immediately.

This update was largely a result of our first-party security research (with hat tips to DOS, Ophion Security, and Anthropic for helping identify areas of focus).

While we’re proud of the new features we’ve developed, we’re holding off on our next release, and will instead focus on weekly minor releases. These will be largely security and observability centered.

We understand you are interested in what happened and how you can best protect yourself. We appreciate your patience as our internal and external investigations proceed, and we will update you if we have additional relevant information to share.

In the meantime, we’re working hard to protect you and help you protect yourselves. We will continue to invest heavily in our internal security research as well as engage with third-party researchers.

See the list of versions below and find the latest point version for the Metabase version you’re running. For example, if you are running 0.58.6, you should upgrade to 0.58.28 release or later.

Minimum safe releases for each Metabase version

The downloads below include the minimum safe release for each Metabase version.

v0.63.10

• Docker image: metabase/metabase:v0.63.10
• Download the JAR here: https://downloads.metabase.com/v0.63.10/metabase.jar

v0.62.13

• Docker image: metabase/metabase:v0.62.13
• Download the JAR here: https://downloads.metabase.com/v0.62.13/metabase.jar

v0.61.15

• Docker image: metabase/metabase:v0.61.15
• Download the JAR here: https://downloads.metabase.com/v0.61.15/metabase.jar

v0.60.21

• Docker image: metabase/metabase:v0.60.21
• Download the JAR here: https://downloads.metabase.com/v0.60.21/metabase.jar

v0.59.25

• Docker image: metabase/metabase:v0.59.25
• Download the JAR here: https://downloads.metabase.com/v0.59.25/metabase.jar

v0.58.28

• Docker image: metabase/metabase:v0.58.28
• Download the JAR here: https://downloads.metabase.com/v0.58.28/metabase.jar

Fix QB perf (#79132)

Fix QB perf

Forbid loading every field via GET /api/database/:id/metadata

Make skip_fields a required true on the FE request type so no caller can ask
for field-level metadata, which grows with every column in the database.

The two callers that needed fields now scope their fetch to a single table:
Data Reference field pages fetch the table's own query metadata (which also
pulls FK target tables and their fields)
useAuditTable resolves the table from the plain database response, then loads
/api/dataset/query_metadata for that table

Withhold the audit table until its fields load

ConversationStatsPage renders charts straight from useAuditTable's table
without checking isLoading, so handing back a table built from the field-less
database metadata made it paint once and re-render when the ad-hoc query
metadata arrived, detaching the chart nodes mid-assertion.

Also make the segment field list spec's database mock honour skip_fields, so
unit tests can catch a caller that stops asking for fields.

fix be

Co-authored-by: Alexander Polyankin [email protected]

Co-authored-by: Claude Opus 5 [email protected]

v63 adds a new visualization type, ships 2FA, brings PDF attachments to subscriptions, and lets Metabot work with the AI provider you already pay for.

• If you’re hosted on Metabase Cloud, we are rolling v63 this week. If you’d like to get it sooner, just let us know. Email [email protected] and we’ll upgrade you.
• If you’re self-hosting Metabase, you (or your admin) can follow the docs on how to upgrade.

Treemaps charts are here

By popular demand, we branched out to support treemap charts (c’mon, that was low-hanging fruit) for data with categories nested inside categories, like revenue by region by product, spend by department by category, traffic by source by campaign — each box sized by value, all in a single view.

To try: Open any question with hierarchical data and pick Treemap from the viz list.

Side note: If you’re itching for a viz type that’s not natively supported in Metabase, don’t forget we shipped custom viz, released in v62 so you can build and bring whichever chart type you need in Metabase yourself (plus more news on that below.)

Two-factor authentication

You can now turn on 2FA for your Metabase instance, so people signing in with a password get an extra layer of account security. A long-standing request, now built in.

Admins turn on 2FA from the Authentication section of Admin settings, and each person sets up their own 2FA from the Security tab in their account settings. Available on Pro and Enterprise plans.

Dashboard subscriptions get PDF attachments

Another much-requested feature — subscriptions can now attach a PDF of the dashboard. Plus, we also have a PDF export API endpoint.

We’ve also extended static rendering to Map, Detail, and Pivot table visualizations so more of your dashboard shows up correctly in email and Slack.

To try: Open a dashboard → go to Subscriptions → toggle Attach a PDF of the dashboard → send yourself a test.

Support for more LLM providers to power Metabot

You can now power Metabot with models from:

• Anthropic
• OpenAI (new)
• AWS Bedrock (new)
• Microsoft Azure (new)

Whether it’s AWS discounts, an enterprise agreement, or data-residency requirements, you can back AI features in Metabase with the provider that fits your setup.

And this works on open source, too. Bring your own key and get AI-powered analytics in Metabase without paying us a dime for tokens. Or let us handle everything with Metabase’s AI service (Cloud only).

Set it up: Admin → AI → AI settings → Connect to a provider, then pick your provider and add your credentials.

Invite someone to your Metabase from a dashboard or question

A new invite button added in the Share menu on dashboards and questions makes it easier for admins to add people to their Metabase and assign them to groups. The invitee is linked directly into the shared item after signup.

To try: Admins can open a dashboard or question → Share → Invite someone to view this → enter an email, pick a group → invite.

CSV uploads now work with Snowflake

You can now upload CSVs directly to Snowflake. Uploaded files land as tables in the database and schema your admin picks, wrapped in a model you can query like anything else.

To try: An admin turns uploads on in Admin → Settings → Uploads and picks the Snowflake database and schema to store them in. From there, anyone with upload permissions can add a CSV.

Embedded Analytics

Embed custom visualizations with the Modular Embedding SDK

Released in the core app in v62, custom visualizations are now supported by the SDK. If your team has built a chart type that Metabase doesn’t ship, write it in React and render it natively in your Metabase and in your embeds.

To try: enable custom viz in the core app, then pass allowedCustomVisualizations=["custom:YourVizName"] to MetabaseProvider.

Security and governance

Audit logs for MCP authorizations

See who is connecting AI tools to your Metabase’s MCP server. Logs include client name, user email, approval status, callback URL, and date, filterable by event type. Dynamic Client Registration is now off by default, and only turns on when you enable MCP.

Find the new Authorizations tab under Admin → AI settings → MCP.

We moved the Sample Database to SQLite

We moved the sample database that ships with all Metabase instances off H2 to the battle-tested (and more secure) SQLite database. Existing sample databases will migrate automatically. The sample database is now read-only, so CSV uploads, actions, and data editing aren’t available on it.

FYI

Long Term Support (LTS) policy

We’re making version support predictable. Every Metabase version now gets at least 60 days of support after it’s released, and twice a year we’ll designate a Long Term Support (LTS) release, supported for at least 14 months. If you’re self-hosting and you’d rather not chase every release, an LTS version is a safe place to sit for over a year.

We’ll also publish an end-of-life date for each version within 30 days of its release, so you always know how long you’re supported and can plan upgrades on your own schedule.

More cool stuff

Register for OUTER JOIN, our IRL conference in October in Denver

Three days with the team behind Metabase, and the folks pushing on where data and AI go next. Sessions on permissions, embedding at scale, and whether headless BI is enough. A workshop on building a robot data engineer. An Ask the Experts lab for the questions you’ve been sitting on. And the Flyte Club party to close it out.

Denver, October 5–7. Sessions aren’t recorded, so it’s the room or nothing. Grab your seat.

Big thanks to everyone who contributed!

Thanks to everyone who submitted bug reports, feature suggestions, and pull requests. Metabase gets better and better thanks to your efforts.

Hope you enjoy the release. If you want to get into the nitty-gritty, check out our changelog.

Cheers,
The Metabase team

v62 extends Metabase in every direction: build any chart type you want, get visual answers in your AI client with the MCP, drive your instance from the terminal, and see how your data fits together.

• If you’re hosted on Metabase Cloud, v62 and all its goodness are live now and ready to go. Go build.
• If you’re self-hosting Metabase, you (or your admin) can follow the docs on how to upgrade.

Create any chart type in Metabase with custom visualizations

Gantt, org chart, radar, calendar, heatmap — any React-based chart type you can think of, now you can build it in Metabase. The custom visualization plugin SDK (@metabase/custom-viz) lets you build, bundle, and upload any chart type you need. Run npm run build to generate a .tgz file and drop in your new viz type. Set the chart up to work like any other interactive Metabase chart, with drill-through and tooltips. Works with questions, dashboards, and documents. For now, you can’t use custom charts in embeds, and aren’t supported in dashboard subscriptions or alerts.

To try with the calendar heatmap, head to your Admin settings → Custom Visualizations → Enable, and upload a .tgz reference viz . Try for free with Pro.

The MCP server gets more tools, including charts in your chats

Plain English answers were cool, charts are better. Ask a question in Claude, Cursor, or VS Code, and get a visual answer. The MCP server now returns interactive charts for an easier read on your data and trends. Toggle to change the time range and granularity, change chart type, and drill through to a new chart view. Click Explore to open it in Metabase.

We also gave the MCP server more (and better) tools. Run SQL, update questions and dashboards, and create collections, all from your AI client.

Enable the MCP server from your Admin settings → AI → choose your preferred MCP client.

Manage Metabase from your terminal with the Metabase CLI

Build Metabase questions, dashboards, documents, transforms, and more from the command line. The CLI is especially handy when working with AI agents. Hand the CLI to an agent and they can really start cooking. Agents can discover the CLI tools with mb --help and work autonomously to create content for you to review.

Get started:
npm install -g @metabase/cli → mb auth login → mb db list. Using Claude Code? npx skills add metabase/agent-skills -a claude-code adds the Metabase CLI skill.

See how your tables relate in the interactive Schema Viewer

The Schema Viewer is an interactive entity relationship diagram (ERD) in Data Studio. The Schema Viewer shows tables as nodes, foreign and primary key relationships as edges. Foreign keys that point to tables in other schemas can be loaded onto the canvas on demand, so you can trace relationships across schemas without leaving the page.

Pick a schema to explore in Data Studio → Schema viewer. Try for free with Pro.

Organize your Library with collections

You can now add sub-collections to the Data and Metrics collections in the Library. Sub-collections appear in the data picker when you create a new question, and you can set permission on them like you would any other collection.

To create a new collection in the Library, head to Data Studio → Library → New. Try for free with Pro.

See and manage all of your alerts in one place

Alerts get their own dedicated Admin page so you can see what’s being sent, the owner, the channels they’re sent to, and when each alert last ran. Filter, sort, edit, and bulk-edit alerts from one handy place. No more orphaned or erroring alerts that go unnoticed.

Check out all your alerts in Admin → Tools → Alerts Management.

Dropdown filters for IDs, and labels for question-powered dropdowns

ID filters now get dropdown menus. You can also add human-readable labels to dropdown lists that are powered by questions. This lets you do things like create an ID filter where people can search by either ID or another column, like customer name. That way people could search for either ID 12345 or Acme Corp, and the filter would filter for that ID.

Metrics home page, decluttered

Metrics got a bunch of love lately, so we did a little tidy-up for the home page. The Explore button moved into the chart, sources and dependencies are one click away, and caching settings are tucked into the menu until you need them.

Embedded Analytics

Update filters programmatically in embedded questions and dashboards

In addition to setting initial filter values for embedded components, you can now control component filters with your app without reloading the page. For example, you can use your own UI element to power a filter on a chart or dashboard. Your app can set component parameters on the fly, and get parameter values from embedded components, so your app stays in sync with your embed.

Breaking changes

We’re deprecating the legacy Druid driver. Use Druid JDBC instead.

More cool stuff

Register for OUTER JOIN, our first IRL conference

We’re hosting our first in-person conference in October! Join us in Denver to learn more about what we’re builing towards, participate in live workshops, and hang out with the team.

Register here.

From newbie to expert with the Learn Metabase Claude skill

Get Claude to coach you on the ins and outs of Metabase, using examples from your own data with the Learn Metabase skill. The interactive skill quizzes you on what you’ve learned and tracks your progress. Works best with Claude Cowork to remember where you got up to, but you can also use it with Claude Chat.

Find this and more skills in our agent-skills repo.

Big thanks to everyone who contributed!

Thanks to everyone who submitted bug reports, feature suggestions, and pull requests. Metabase gets better and better thanks to your efforts.

Hope you enjoy the release. If you want to get into the nitty-gritty, check out our changelog.

Cheers,
The Metabase team

Think of all the stuff you have to do every morning before you even start coding. You need to get caught up from the day before, look over your tickets, figure out which one to work on, clone the right repo, check out a branch, get up to speed on the relevant area of the code, then maybe you can start rolling.

What is a persistent agent?

Most agents are one-shot: you give them a task, they do it, and everything they learned disappears with the session. A persistent agent maintains continuity: it saves its tasks and memory to disk, so it can pick up an unfinished job, wait for your feedback, and resume without you having to re-explain anything.

Persistent Agent, or pa for short, is our lightweight memory and task system for handling chores and getting to the fun stuff faster. pa is inspired by the Night Shift Agentic Workflow and note-taking systems like Obsidian.

pa frees up about 15% of my time each day

All those startup and admin tasks typically eat up between 10% and 20% of a developer’s time. Strangely, these gains get better the less normal your circumstances are: when you’re very busy, under the weather, or stressed, having pa consistently follow the start of day script and propose the next priority helps a lot.

These gains may sound modest compared to the hype surrounding agents. But they are real, low effort, and easy to verify. All you need to do is keep a terminal open on your machine.

A typical day with pa

A typical day with pa

I use pa as a background partner that I pair with and delegate work to. Each morning when I sit down to work, I run sod (start of day) to pair on my start-of-day routine. It:

• pulls updates from Slack, Linear, and GitHub since the last sod
• saves a daily note with a summary since the last one
• updates the state of tracked tasks
• sends my start-of-day message to my team’s Slack standup channel

Then I pick what I’m going to work on myself, and what I want to assign to pa to work on autonomously in the background. Saying work switches pa to the work loop. It will work over its own tasks in auto permissions, cloning repositories as needed into its own workspace, creating plans and PRs, blocking tasks when it needs input from me, waiting for CI and feedback on existing PRs, and logging everything on the task files.

At around lunch time I take a break from the work I’m doing and check up on pa’s progress by saying pair to enter pairing mode. In pairing mode it will ask questions about ongoing tasks, get approval for plans, or let me know that a PR is ready for review. When I’m done pairing, I tell it to work again.

Sometimes during the day I remember something I want pa to take a look at. I run pa todo look at issue XYZ to add it to the current todos, to be picked up on the next work loop. If I want to add to the backlog for later, I use pa backlog instead. I have Claude’s remote control turned on, so I can check on progress on my phone.

How to pick tasks to delegate

There are two broad categories of tasks that are good to delegate to pa: trivial tasks and boring tasks. In both cases, the task’s output should be easy to verify.

There’s no shortage of trivial tasks in any real work context. These tasks don’t require a lot of attention, are usually disruptive (even if they’re not urgent), and can usually be done quickly. With pa, you can just say please add XYZ to your todo, then start a work loop. You don’t have to switch branches, trace code, make tests, make a PR, link it to the issue, etc. You can just check in later and see a PR ready to review.

Boring tasks are usually dominated by downtime. They are tasks where you need to start processes that take a long time to finish, or monitor events over time, or make small changes to a bunch of different files and tests. These tasks need a medium amount of attention in bursts, and make it hard to switch context in the downtime.

Boring and trivial tasks aren’t the only tasks you can delegate, but they’re the ones that ask the least of your attention, and your attention is the limited resource. More open-ended tasks often end up requiring a lot of direction and verification, which can drastically reduce the value of delegation.

How you get started with pa

How you get started with pa

You’ll need to have Claude Code installed. Then fork our Persistent Agent repo, likely into a private repository. Now it’s your own thing to use and change, for personal use, work use, or both.

Then:

• clone your fork locally
• cd into it
• run bin/install to add the pa commands globally.
• call pa setup for initial setup

The default Metabase setup uses GitHub/Slack/Linear/Notion/Figma as external tools, but setup will ask you which you want to use and update itself.

How pa works

How pa works

pa is mostly a file structure, a few markdown files on how to use it, and a claude wrapper script:

persistent-agent
├── .claude
│  └── settings.json              // default plugins and permissions
├── bin
│  ├── pa                         // start pa or call other commands
│  ├── pa-backlog                 // add new task to backlog
│  ├── pa-install                 // installs commands globally
│  ├── pa-save                    // commit tasks and daily notes
│  ├── pa-tasks                   // show all tasks
│  ├── pa-today                   // show daily note
│  └── pa-todo                    // add new task to todo
├── daily-notes                    // saved as YYYY-MM-DD.md
├── memory
│  ├── archive
│  ├── feedback                   // saved during interactions
│  ├── skills                     // referenced in .claude/skills/*
│  │  ├── memory.md              // how to use memory
│  │  ├── modes.md               // modes of operation
│  │  ├── self-modification.md   // how to change pa
│  │  ├── setup.md               // initial setup checklist
│  │  ├── start-of-day.md        // start of day routine
│  │  ├── tasks.md               // how to use tasks
│  │  ├── update.md              // how to update pa
│  │  └── work.md                // how to work
│  ├── user.md                    // who the user is
│  └── workspace.md               // tools and repositories
├── tasks                          // .md with yml metadata
│  ├── archive
│  ├── backlog                    // known, but not todo
│  ├── blocked                    // blocked on user
│  ├── in-progress                // being worked on
│  ├── todo                       // ready to work on
│  └── waiting                    // waiting for someone else
├── workspace                      // where repos are cloned
├── CHANGELOG.md                   // used during update
├── CLAUDE.md
└── README.md

You can and should modify pa to work however suits you. The core idea is to give an agent a persistent place of its own, to work with you, in the way you like working.

Your routine

pa has become a part of my day, and I hope it can support you with your own routine tasks. If you fork the Persistent Agent repo and set up your own pa, I’d love to hear how you customized it.

We’ve built a Claude skill that teaches you Metabase. It keeps track of what it has already covered, uses your own data for examples, and is designed for learning not just one-off questions.

Why use AI for learning Metabase

Compared to static guides, an LLM can be much more engaging, ask you questions, and then use your answers to decide what else to cover or where to maybe add some information. In fact, perhaps the most useful aspect of Claude is its ability to be pedantic. If you give it a vague answer to a question, or you’re half right and half wrong, it will tell you what specifically you got right and where you might need some help. It can be slightly annoying at times, but it really helps to hone your skills.

In addition, you can ask an LLM questions. It will present the material to you and ask you questions, but it is there to help you. You can ask it to explain, to clarify, to expand on points. This allows you to be much more active in your learning than when just reading materials online.

The Learn Metabase skill for Claude

We designed the Learn Metabase skill with the following features to make it more than just a re-hashing of our documentation:

• Socratic Method. Claude teaches you by asking questions and walking you through hands-on tasks, rather than dumping a lot of material on you. The goal is active participation and thinking, not passive consumption of content.
• Structure. It is structured in a way that we think is effective for learning Metabase. Since you’re talking to an LLM, not just clicking through a fixed program, you can tell it to skip sections, though.
• Memory. If you’re running it in Claude Cowork and point it at a folder where it can store its small data file, it will keep track of what it has already covered and use a spaced-repetition strategy to remind you of topics you might have forgotten.
• Your own data. If you have the Metabase MCP server connected, Claude will ask you which department you’re in and then use data examples from your own database.

We recommend using Claude Cowork for this skill, because you can have it work in a folder where it can store your progress (in a hidden file under .claude). This allows it to remember your progress and use a spaced-repetition strategy to quiz you on topics covered in earlier sessions.

The skill and instructions on how to use it are available in the Learn section. Give it a try and let us know what you think (on our Discourse server, X, or LinkedIn)!