Request for ETA on Metabase v0.63.5 Source Code Release (GitHub ZIP/Release Package)

1

Hi Metabase Team,

We are currently using the Metabase Open Source version 0.62.2 in our organization and are planning to upgrade to version 0.63.5 as soon as possible in order to address a recently identified 0-day security vulnerability.
Historically, we have downloaded the source code package (ZIP) from the Metabase GitHub Releases page:

However, we do not currently see a source code release package for version 0.63.5.
In our environment, we cannot directly use the Docker image or pre-built JAR because we maintain a set of internal customizations on top of the Metabase source code to support our organization's specific requirements. Therefore, our upgrade process depends on obtaining the source code release package for the target version.
At present, the upgrade activity has been put on hold until the v0.63.5 source code becomes available.

Could the Metabase team please provide:

  1. An estimated timeline or expected date for the release of the v0.63.5 source code package on GitHub Releases.
  2. Whether there is a recommended way to obtain the exact v0.63.5 source code while waiting for the release package to be published.
  3. Any guidance for organizations that maintain customized builds of Metabase and need to urgently upgrade for security reasons.

We would greatly appreciate any information you can provide, as this upgrade is currently a high-priority security-related activity for our organization.

Thank you for your assistance and support.

Regards,
Rahul Kumar

2

Sorry, I find the “embargo” on the source release somewhat hilarious. The vulnerabilities are being exploited in the wild, the update JARs have long been decompiled and compared to the last release, and details on the vulnerability have been publicly posted, e.g. Inside the Metabase SQLi: Exploited in the Wild | Wiz Blog

1 Like
3

Unless there are other fixes in it for vulnerabilities they haven’t disclosed yet…

4

Thank you for your patience. Source code release packages are now published on our GitHub Releases page, alongside the corresponding Docker images and JAR downloads. The latest release is v0.63.14.

Each release includes the fixes for the security issues that were addressed in this series. If you're maintaining a customized build on top of the Metabase source, we'd recommend upgrading to the latest v0.63.x release rather than stopping at 0.63.5, since it includes the accumulated fixes from the point releases in between.

We're taking steps to keep source and binary releases better aligned going forward, particularly for security-related releases where teams like yours depend on the source to rebuild custom deployments quickly.

Regards,

Juan

5

Be aware of the breaking change to permissions when you upgrade.