Metabase Release Notes

Fix QB perf (#79132)

Fix QB perf

Forbid loading every field via GET /api/database/:id/metadata

Make skip_fields a required true on the FE request type so no caller can ask
for field-level metadata, which grows with every column in the database.

The two callers that needed fields now scope their fetch to a single table:
Data Reference field pages fetch the table's own query metadata (which also
pulls FK target tables and their fields)
useAuditTable resolves the table from the plain database response, then loads
/api/dataset/query_metadata for that table

Withhold the audit table until its fields load

ConversationStatsPage renders charts straight from useAuditTable's table
without checking isLoading, so handing back a table built from the field-less
database metadata made it paint once and re-render when the ad-hoc query
metadata arrived, detaching the chart nodes mid-assertion.

Also make the segment field list spec's database mock honour skip_fields, so
unit tests can catch a caller that stops asking for fields.

fix be

Co-authored-by: Alexander Polyankin [email protected]

Co-authored-by: Claude Opus 5 [email protected]

Original source

v63 adds a new visualization type, ships 2FA, brings PDF attachments to subscriptions, and lets Metabot work with the AI provider you already pay for.

• If you’re hosted on Metabase Cloud, we are rolling v63 this week. If you’d like to get it sooner, just let us know. Email [email protected] and we’ll upgrade you.
• If you’re self-hosting Metabase, you (or your admin) can follow the docs on how to upgrade.

Treemaps charts are here

By popular demand, we branched out to support treemap charts (c’mon, that was low-hanging fruit) for data with categories nested inside categories, like revenue by region by product, spend by department by category, traffic by source by campaign — each box sized by value, all in a single view.

To try: Open any question with hierarchical data and pick Treemap from the viz list.

Side note: If you’re itching for a viz type that’s not natively supported in Metabase, don’t forget we shipped custom viz, released in v62 so you can build and bring whichever chart type you need in Metabase yourself (plus more news on that below.)

Two-factor authentication

You can now turn on 2FA for your Metabase instance, so people signing in with a password get an extra layer of account security. A long-standing request, now built in.

Admins turn on 2FA from the Authentication section of Admin settings, and each person sets up their own 2FA from the Security tab in their account settings. Available on Pro and Enterprise plans.

Dashboard subscriptions get PDF attachments

Another much-requested feature — subscriptions can now attach a PDF of the dashboard. Plus, we also have a PDF export API endpoint.

We’ve also extended static rendering to Map, Detail, and Pivot table visualizations so more of your dashboard shows up correctly in email and Slack.

To try: Open a dashboard → go to Subscriptions → toggle Attach a PDF of the dashboard → send yourself a test.

Support for more LLM providers to power Metabot

You can now power Metabot with models from:

• Anthropic
• OpenAI (new)
• AWS Bedrock (new)
• Microsoft Azure (new)

Whether it’s AWS discounts, an enterprise agreement, or data-residency requirements, you can back AI features in Metabase with the provider that fits your setup.

And this works on open source, too. Bring your own key and get AI-powered analytics in Metabase without paying us a dime for tokens. Or let us handle everything with Metabase’s AI service (Cloud only).

Set it up: Admin → AI → AI settings → Connect to a provider, then pick your provider and add your credentials.

Invite someone to your Metabase from a dashboard or question

A new invite button added in the Share menu on dashboards and questions makes it easier for admins to add people to their Metabase and assign them to groups. The invitee is linked directly into the shared item after signup.

To try: Admins can open a dashboard or question → Share → Invite someone to view this → enter an email, pick a group → invite.

CSV uploads now work with Snowflake

You can now upload CSVs directly to Snowflake. Uploaded files land as tables in the database and schema your admin picks, wrapped in a model you can query like anything else.

To try: An admin turns uploads on in Admin → Settings → Uploads and picks the Snowflake database and schema to store them in. From there, anyone with upload permissions can add a CSV.

Embedded Analytics

Embed custom visualizations with the Modular Embedding SDK

Released in the core app in v62, custom visualizations are now supported by the SDK. If your team has built a chart type that Metabase doesn’t ship, write it in React and render it natively in your Metabase and in your embeds.

To try: enable custom viz in the core app, then pass allowedCustomVisualizations=["custom:YourVizName"] to MetabaseProvider.

Security and governance

Audit logs for MCP authorizations

See who is connecting AI tools to your Metabase’s MCP server. Logs include client name, user email, approval status, callback URL, and date, filterable by event type. Dynamic Client Registration is now off by default, and only turns on when you enable MCP.

Find the new Authorizations tab under Admin → AI settings → MCP.

We moved the Sample Database to SQLite

We moved the sample database that ships with all Metabase instances off H2 to the battle-tested (and more secure) SQLite database. Existing sample databases will migrate automatically. The sample database is now read-only, so CSV uploads, actions, and data editing aren’t available on it.

FYI

Long Term Support (LTS) policy

We’re making version support predictable. Every Metabase version now gets at least 60 days of support after it’s released, and twice a year we’ll designate a Long Term Support (LTS) release, supported for at least 14 months. If you’re self-hosting and you’d rather not chase every release, an LTS version is a safe place to sit for over a year.

We’ll also publish an end-of-life date for each version within 30 days of its release, so you always know how long you’re supported and can plan upgrades on your own schedule.

More cool stuff

Register for OUTER JOIN, our IRL conference in October in Denver

Three days with the team behind Metabase, and the folks pushing on where data and AI go next. Sessions on permissions, embedding at scale, and whether headless BI is enough. A workshop on building a robot data engineer. An Ask the Experts lab for the questions you’ve been sitting on. And the Flyte Club party to close it out.

Denver, October 5–7. Sessions aren’t recorded, so it’s the room or nothing. Grab your seat.

Big thanks to everyone who contributed!

Thanks to everyone who submitted bug reports, feature suggestions, and pull requests. Metabase gets better and better thanks to your efforts.

Hope you enjoy the release. If you want to get into the nitty-gritty, check out our changelog.

Cheers,
The Metabase team

Original source

In v60 we put AI features in all plans, including Open Source. With v61, we give you the controls for AI governance that make it yours to deploy safely.

Some call it the Fun Police. We prefer: AI that’s realistic for orgs of all types to roll out, including those who need tighter oversight over who gets to use it (bit of a mouthful though).

• If you’re self-hosting Metabase, you (or your admin) can follow the docs on how to upgrade.

This release is one piece of a bigger story. We wrote a post that connects the dots across everything we've shipped this year.

🧩 AI for everyone, with confidence

Access controls for who can do what with AI

Granular AI controls to manage access per feature and per user group, for internal and embedded analytics. Let your finance team ask questions in their own language in Metabot. Give your product team access to AI for SQL generation or auto-generated transforms. Give your data team access to all AI tools. Set nothing for the teams who shouldn’t have it.

Find AI usage controls in your Admin settings → AI to give access per feature and user group.

Try for free with Pro.

Set token limits so AI doesn’t drain your bank account

Turning AI loose in your org without token restrictions is not for the faint of heart. We added controls to set a token limit at the instance level, and allocate a set amount of tokens or messages per user group, or per customer for embedded analytics. Choose when your limits reset — daily, weekly, or monthly.

Set token limits in your Admin settings → AI.

Try for free with Pro.

Make Metabot your own, with system prompts and customization

White-label Metabot for your org by customizing its name, icon, and adding system prompts to instruct it on how to perform for AI chat, natural language querying, and SQL generation — so it sounds like it’s on your team.

System prompts are like context files that give AI the specifics of your business and your Metabase. Give it guidance on the tone you want it to use in chat, tables to treat as canonical, which colleague to blame if something goes wrong. Literally, anything.

Customize Metabot and set up your system prompts in Admin settings → AI.

Try for free with Pro.

AI usage analytics: see questions asked, token usage, and more

AI usage analytics is a pre-made dashboard in your Admin settings → AI. You can see aggregate views of token spend, which features are being used most, and who’s most active over time.

Track AI usage across your Metabase in Admin settings → AI → Usage auditing.

Try for free with Pro.

Dashboards-as-code built in your AI terminal

Open Claude Code or Cursor. Type: “Create a dashboard for our support tickets.” Your AI tool pulls context from your Metabase metadata, writes the queries, and commits a dashboard YAML file to git, ready for you to review before anything touches production.

Bulk edit and migrate dashboards to a new schema without clicking through the UI. Everything goes through git, with automated validation, before it goes live. Requires Remote Sync.

The MCP server now supports question and dashboard creation

Connect Metabase to your AI terminal and build questions and dashboards through conversation. With the MCP server connected in Claude, try:

Build me a dashboard from the Metabase sample database showing product performance, like total orders, revenue, and average rating by category.

It’s more interesting with real data, but you get the idea - now you have a dashbaord, and all you had to do was ask.

Metabot can write custom expressions in the query builder

What it says on the tin. Open the sample database, pull up Metabot, and try:

Show me a breakdown of product reviews by rating. Use emoji labels for each score.

Metabot will write the CASE expression and build the column without you touching the expression editor.

Not just AI — the metrics layer got smarter too

More power in the Metrics Explorer

The Metrics Explorer launched in v60 for side-by-side metric comparison. v61 adds metric math and more control over each metric:

• Write arithmetic expressions across metrics in the top bar (Revenue / Number of orders, Orders this month - Orders last month). Results appear as a new series in the view.
• Same metric, different slices. Add a metric more than once, each instance with its own filters or dimensions to compare slices side-by-side.
• Totals tab to see the result as a single number rather than a chart.

Handy when you want to combine or compare metrics that live in different tables without having to set up a join. Open a metric and click into Explore to try it.

Security Center for self-hosted Metabases

Targeted, timely security alerts specific to your version and configuration, with guidance on what to do about it. See them in Security Center, or get notified via email or Slack.

This new Admin page polls your instance every few hours against the Metabase security advisory database, or you can check manually any time. Replaces generic blast emails that can be easy to miss or that aren’t relevant to your instance.

Find the Security in your Admin settings (from v56 and up on Pro and Enterprise plans).

Embedded Analytics

AI chat embeds with either inline or dedicated charts

The useMetabot React hook gives you direct access to Metabot’s raw state — messages, loading indicator, send function — so you can build any UI on top of it.

Previously, offered AI querying with 3 preset layouts. useMetabot is the lower-level primitive underneath. Same Metabot with more control over how it looks and fits into your app.

useMetabot works with Modular Embedding SDK.

Try for free with Pro.

More visibility into how your customers use your embedded charts

More usage analytics for embedded analytics to support admins’ understanding of who your most active customers — or tenants — are, which content gets the most views, and how people are accessing your embedded content via auth method for security audits.

Find the preconfigured embedding usage analytics dashboard in the Usage analytics collection, accessible to admins. Filter on date range, time grouping, and drill through charts for more detail.

Find the dashboard in Usage analytics → Embedding Usage in your left-side nav (admins only).

Try for free with Pro.

Automatic token renewal for Guest Embedding

Your embedded users don’t know what JWT is. They just know the dashboard went blank, and they think they’ve hit an error.

Guest embed sessions no longer break mid-dashboard when tokens expire. Automatic renewal means sessions stay alive through multi-tab dashboard explorations, and filters and drill-throughs stay applied for longer sessions.

Easier to configure, preview, and reuse themes for embedded analytics

The new Themes editor gives non-devs a wizard-based tool to try out, preview, and configure new themes to be applied consistently — separating theme configuration from implementation.

Try out themes in Admin settings → Embedding → Themes.

Try for free with Pro.

Responsive layout improvements for embedded SDK components

Better experience for mobile users interacting with your embedded analytics. SDK components are now built for a 6-inch screen, not just desktop. No overflowing filters or truncated text — acts the way mobile users expect.

Pay as you go for Transforms, no longer a fixed price add-on

Previously available as a fixed-price add-on. Now pay only for what you use. First 1,000 transforms are free.

See the pricing page for more details, or head to Data Studio and give it a try.

Big thanks to everyone who contributed!

Thanks to everyone who submitted bug reports, feature suggestions, and pull requests. Metabase gets better and better thanks to your efforts.

Hope you enjoy the release. If you want to get into the nitty-gritty, check out our changelog.

Cheers,

The Metabase team

Original source

We made AI open source, the official MCP server, Metabot in Slack, split panel charts, metrics explorer, and more.

When your team wants to ask AI about data, they find a way, with or without you. That means data leaving your environment, AI guessing at aggregations, and no way to see how it got there. Now that AI features are available across all plans, no one has to go outside Metabase to get answers. Works inside your data stack, governed by your semantic layer.

If you’re self-hosting Metabase, you (or your admin) can follow the docs on how to upgrade.

This release is one piece of a bigger story. We wrote a post that connects the dots across everything we've shipped this year.

🧩 AI for everyone, with confidence

AI just went open source

Natural language querying.
SQL query and transform code generation and debugging.
Agent API for building your own AI agent integrations.
One-click auto-generated summaries on charts.
Agentic workflows for managing content and embedded analytics.

Every team should have AI-powered data exploration that’s grounded in the trustworthy data layer your data team has already built — curated datasets, reusable metrics, defined segments, consistent measures. Your data team stays at the helm.

The official Metabase MCP server

Connect to the MCP server with Claude, ChatGPT, Cursor, VS Code, and other MCP-clients. You get the same permissions and access as in Metabase.

Bring your own key to power AI features, self-hosted or cloud

Plug your Anthropic key into Metabase, choose your model, and pay only for the tokens you use. You can use our default model with Metabase Cloud.

Chat with Metabot in Slack

Ask questions. Set up alerts where you want them to go. And upload CSVs via Metabot in Slack and start asking questions about your CSV data straight away, or later. Connect your account and get the same permissions and access you have in Metabase.

Semantic search that looks beyond exact keywords

Finds what you mean, not just what you type. AI-powered semantic search understands that one person searching “revenue” and another searching for “earnings” are probably looking for the same thing, and leads them to the most relevant dashboards, questions, and documents. Available on Pro and Enterprise plans.

AI data exploration is cool, but have you tried building with Metabase and AI agents? We’ve got skills for that

Agent skills for embedding Metabase

We’ve created a set of agent skills that teach LLMs about how to set up embedded analytics: SSO implementation, version upgrades, and migrating from one type of embedding to another.

• Skill: SDK version upgrade
• Skill: Full app → modular embedding
• Skill: Modular embedding → SDK (React)
• Skill: Static → Guest embeds
• Skill: SSO for embeds

File-based content editing in Metabase for AI-powered workflows

Export your Metabase content via the CLI’s serialization command, point an agent at the repo, and go. Generate new questions, edit dashboards, bulk-create metrics, then validate against the schema and sync back in. Exported content files now have readable file names, fields, and references in place of numeric IDs — think monthly_revenue_by_region.yaml vs. card_12847.yaml. Easier to parse for humans and LLMs than a directory full of card_12847.yaml files.

• Representations spec and the schema checker
• Skill: Work with Metabase content files

It’s not all AI, we also got new chart types

Split multi-series charts into panels

Split multi-series line, area, bar, combo, and scatter charts into stacked panels, each with its own y-axis while sharing the x-axis. When metrics run on incompatible scales, shared axes flatten the smaller values into noise. And when you’re tracking five or six series at once, a single chart becomes a tangle lines noone can read. Split panels gives each metric room to breathe while keeping the context that ties them together.

Supports any x-axis grouping (time, category, etc). Formatting persists across dashboards, documents, and notifications and alerts in email and Slack.

Sticky rows and columns in table viz

Freeze rows and columns in table viz settings so you can scroll large tables without losing context. You can specify the number of columns to freeze; dynamically adjusts based on screen size so frozen columns don’t dominate your whole view. Drag columns between frozen and unfrozen sections.

Data Studio also got better in v60

Swap data sources in bulk without breaking your dashboards

One button to find and replace data sources. When selecting a new data source to sub in, you’ll see a column comparison overview to ensure all fields match before committing to the change, with details on any errors. Available in Data Studio on Pro and Enterprise plans.

Simple migration path to convert models to transforms

Model persistence is on its way out in favor of transforms. Transforms replace models with real database tables: they’re faster, more reliable, and fully integrated. Now you can make the switch with a few button clicks in Data Studio. Everything downstream stays intact.

Metrics home page and Explorer

The new Metrics home page gives each metric its own detail view: how it’s defined, where it’s used, and what it depends on.

The Metrics Explorer (which works with measures too) lets you compare multiple metrics side-by-side, automatically surfacing trends across available dimensions. Toggle viz types, change time granularity, add filters, drill into what’s driving a number.

See exactly what a transform did with the Transform Inspector

Get visibility into whether a transform outputs what you expect. Compare data before and after, including column distributions. The transform inspector flags potential issues, like unmatched rows post-join, letting you drill down to diagnose problems. Available with the advanced transforms add-on.

And some other cool stuff in v60

GitLab and Bitbucket support for Remote Sync

Set up a repository to store your analytics content wherever your code lives. Setup for GitLab and Bitbucket works the same as for GitHub: add a repo URL and a personal access token in Admin settings. Available on Pro and Enterprise plans.

Native OIDC (OpenID Connect) SSO support

Compatible with any OIDC-compliant identity provider, like Keycloak, Okta, Auth0, Azure AD, and more. Available on Pro and Enterprise plans.

Faster SDK load times for embedded analytics, zero effort from you

A smoother experience for your customers and people using your in-app analytics, with no code changes needed on your end. Embedded content loads noticeably faster thanks to two performance optimizations made to the SDK:

• JWT auth now runs in parallel with downloading the SDK bundle;
• The SDK bundle is split into multiple smaller chunks for faster parsing.

Update your npm package to v60 to see the difference (try the agent skill). useLegacyMonolithicBundle prop is available as an escape hatch if anything breaks.

Big thanks to everyone who contributed!

Thanks to everyone who submitted bug reports, feature suggestions, and pull requests. Metabase gets better and better thanks to your efforts.

Hope you enjoy the release. If you want to get into the nitty-gritty, check out our changelog. To see what other features we have in the works, see our product roadmap.

Cheers, The Metabase team

Original source

Metabase has grown a lot over the past few years. We’ve added a bunch of tools to help people stay on top of their analytics as things scale.

Eventually, it became clear these tools needed their own home.

Today, we’re introducing Metabase Data Studio, a place where teams can shape their data and define shared metrics.

Analytics starts simple. Then it gets… less simple

One goal at Metabase has always been to help non-technical people answer questions with data. And at first, that’s easy. You connect Metabase to your database, build a few dashboards, and things feel straightforward. But over time, cracks in the data model inevitably start to show.

People aren’t sure which tables to use, dashboard loading times get annoying, and there are three different queries that say “ARR”. AIs don’t stand a chance sifting through this stuff.

Data Studio has all the tools you need to clean up the mess

Data Studio lets teams transform raw tables into analytics-ready datasets. You can define reusable metrics (like MRR) and segments (like Active Customers) that everyone (including AI!) can trust when building dashboards and questions.

Data Studio lives in Metabase: no extra tools, no duplicate work, no workflow overhauls, just publish and share instantly. You can start small and grow into it naturally as analytics becomes more shared and harder to change.

The tools in the toolbox

The first version of Data Studio ships with the following tools:

• Library: A curated space for your organization’s most trusted analytics content—tables, metrics, and SQL snippets that your data team recommends.
• Data structure: Add table metadata to make tables easier to work with.
• Glossary: Define terms relevant to your business, both for people and agents trying to understand your data.
• Dependency graph: A visual map of how your content connects, so you can understand the impact of changes before you make them.
• Dependency diagnostics: See which items have broken dependencies, or that aren’t used.
• Transforms: Wrangle your data in Metabase, write the query results back to your database, and reuse them in Metabase as sources for new queries.

And we have more to come, so stay tuned.

Open source at the core

We want data structure and curation to be accessible to everyone, which is why foundational features of Data Studio are available in our open source edition, with Pro and Enterprise features to grow into as you need them.

Do I even need to care about Data Studio?

People tend to need some kind of data transformations when they have multiple sources of data (like your application and payments data), or a bunch of normalized tables. If you’re under 50 tables in your schema, don’t stress, watercress. If you have multiple data sources or a lot of tables, chances are you’ve been paying a tax on clarity, correctness, and performance. Data Studio can help get you sorted.

Data Studio is just one part of a bumper release. Check out what else is new in v59

How to get started with Data Studio

Data Studio ships with both OSS and EE editions (with some paid features).

Admins can find Data Studio from the top right grid icon. Some paid plans can grant non-admins access to Data Studio by adding people to the Data Analysts group.

Try Metabase Pro for free.

Original source

What happened?

Sho Odagiri, a security researcher, reported a vulnerability in Metabase’s notification API. The vulnerability allowed an authenticated user to craft a specially formatted notification template that could extract database connection details, including credentials, and send them via outbound email.

Who was affected?

We have no evidence that this vulnerability was exploited by any customer or malicious actor prior to the fix being released.
See the Fixed versions below, and find the latest point version for the Metabase version you’re running. If you’re running a point version below that version, you’re still vulnerable and should upgrade immediately.

Why did it happen?

Two independent changes introduced this vulnerability:

1. We updated the notification system to support user-supplied Handlebars templates for rendering email content.
2. We added metadata objects to query results, which could be traversed to access database connection details.

Together, these changes made it possible for an authenticated user to write a template that could extract sensitive database details via an outgoing email.
Part of what made this vulnerability difficult to catch is that the Handlebars library did not clearly document a method resolver that allows templates to invoke arbitrary Java methods.

What did we fix?

We addressed this vulnerability through two fixes:

• Locked down the Handlebars template engine. We removed the method resolver from the Handlebars library configuration, which prevents templates from invoking arbitrary Java methods on objects in the rendering context. This eliminates the ability for user-supplied templates to traverse into internal objects.
• Stripped metadata from query results used in notifications. We ensured that internal metadata objects—which previously could carry a reference to database connection details—are no longer present in the notification rendering context.

Fixed versions

All Metabase Cloud instances have been upgraded and are no longer vulnerable.
If you are self-hosted and haven’t already upgraded, please upgrade to one of the following versions (or higher) for your respective version.

• Version 55: v0.55.20 / v1.55.20
• Version 56: v0.56.20 / v1.56.20
• Version 57: v0.57.13 / v1.57.13
• Version 58: v0.58.7 / v1.58.7

What are we doing to prevent this in the future?

Along with the fixes we’ve made, we’re working through additional improvements to reduce risk:

• Improving logging around template rendering so that we can audit user-supplied templates and detect unusual behavior.
• Adding a wrapper around database credential access to prevent credential access outside of designated connection establishment paths.

Conclusion

Patches are live across all affected versions, and we have no evidence this vulnerability was exploited before the fix landed. We’re tightening template evaluation, locking down credential access paths, and improving logging to catch unusual behavior early.
If you’re self-hosted and haven’t upgraded already, please upgrade as soon as possible.

Credits

Hat tip to Sho Odagiri from GMO Cybersecurity by Ierae, Inc for discovering and disclosing this vulnerability.

Questions or concerns?

Reach out at [email protected].

Original source