Dagster 1.13.7 Release Addresses ClickHouse Security and Asset Check Logic

Dagster version 1.13.7 was published on May 28, 2026, bringing critical security patches for ClickHouse integrations and refinements to asset check execution. This release also updates the Kubernetes Helm chart to improve how run pods inherit security configurations from the deployment environment.

The full release notes and downloads are on the GitHub release page.

The most significant change in this update is a fix for a SQL injection vulnerability within the dagster-clickhouse suite. The issue affected dagster-clickhouse, dagster-clickhouse-pandas, and dagster-clickhouse-polars when pipelines utilized dynamic partition keys. Previously, some partition queries interpolated partition key values directly into SQL strings, which could allow malicious input to alter query logic.

In the new version, the project transitioned these queries to use driver parameter binding. By separating the SQL command from the data values, the system ensures that partition keys are treated as literal data rather than executable code. This is a standard security practice that prevents data from being misinterpreted as part of the query syntax. Engineers using ClickHouse for partitioned data storage should prioritize this update to secure their orchestration layer.

Dagster 1.13.7 resolves a regression involving blocking asset checks that did not emit a result. In earlier versions, if a blocking check failed to produce an output (such as a dbt test skipped due to cautious indirect selection), the scheduler would silently skip all downstream assets. This behavior led to incomplete pipeline runs without clear failure signals for the dependent steps.

The project changed this logic so that missing results for blocking checks now trigger a warning rather than a silent skip. Downstream assets are now permitted to proceed when a check result is absent. This change ensures that infrastructure issues or configuration choices in external tools like dbt do not stall an entire data pipeline. However, failed checks that do emit a result continue to block downstream progress as intended, maintaining the integrity of the data flow.

For teams running Dagster on Kubernetes, the 1.13.7 Helm chart includes a useful update for run pod configuration. When the includeConfigInLaunchedRuns.enabled flag is active, run pods will now inherit nodeSelector, tolerations, and podSecurityContext directly from the user deployment settings. This allows for more consistent security and scheduling policies across the orchestration cluster without manual overrides for every individual run.

Additionally, the release fixes an AttributeError that appeared when using the kubernetes Python client version 36 or higher. The newer client uses Python type hints that follow PEP 585 dict syntax, which caused issues with the OpenAPI annotations in older Dagster code. This fix was contributed by @vanika02 and ensures compatibility with modern Python environments and more recent versions of the official Kubernetes library.

The dagster-airlift library now supports Python 3.12, 3.13, and 3.14, expanding the available runtime options for engineers migrating from Airflow. This update allows teams to use the performance improvements and language features of the latest Python releases while managing their task orchestration.

The dagster-fivetran component received a new fetch_column_metadata option. When enabled, this feature allows the Fivetran integration to pull column level metadata for synced tables. This metadata is useful for data discovery and cataloging efforts, as it provides deeper insight into the schema structure of the data landing in the warehouse.

The project also improved the core scheduler logic. The owners parameter was added to build_schedule_from_partitioned_job, a change contributed by @dragos-pop to allow for better ownership tracking on schedules. Furthermore, the AutomationCondition.any_downstream_conditions() function received improved deduplication logic. This change prevents condition sizes from expanding recursively when multiple automation rules are combined. This optimization is important for complex pipelines where automation conditions can grow large enough to impact scheduler performance.

The core Dagster components are available at version 1.13.7, while the associated libraries are tagged as 0.29.7.

• The full release notes and downloads are on the GitHub release page.
• The project source code is hosted on the main repository.
• The specific tag for this release is 1.13.7.