Meltano v3.9.5 - Project Root Path Boundary Fix

Meltano v3.9.5 was published on July 22, 2026. Its single documented fix prevents include_paths from escaping the project root, which makes the project directory the enforced boundary for this path input.

The full release notes and downloads are on the GitHub release page.

The release corrects a boundary failure in include_paths. Before this fix, that input could escape the Meltano project root. Version v3.9.5 prevents that behavior.

This is the whole documented change set. It is narrow, but the boundary matters when a Meltano project is executed in CI, a shared runner, or an orchestration container. A path selector that reaches beyond the project directory can make job behavior depend on files that are not part of the project itself. It can also weaken the separation between the checked out project and the surrounding worker file system.

The notes classify the change as a fix, not as a security advisory. They do not describe the exact path syntax that triggered the escape, the resulting error behavior, or any change to normal paths inside the project root. The linked issue is the only specific tracker URL cited by the release.

The compatibility risk is concentrated in projects that intentionally or accidentally use include_paths to select material outside the project root. A configuration that depended on that reach will no longer have the same effective path scope after the upgrade. The release does not provide a migration mechanism for such a dependency.

Search project configuration and deployment templates for include_paths. Identify entries intended to select files beyond the project directory. Pay particular attention to values injected by CI variables, generated configuration, or environment specific overlays, since the source of the value may sit outside the repository even when the final Meltano command looks unchanged.

Validation should exercise one expected path inside the project root and one attempted path outside it. Confirm that the first remains available and that the second cannot cross the boundary. Then run a representative pipeline and compare the selected project files with the previous successful run. This is more useful than a generic process health check because the release changes path scope, not the advertised pipeline runtime.

Meltano v3.9.5 is a stable release, not a prerelease. The notes contain no breaking change label, migration step, schema change, connector update, or state handling change. There is also no claimed performance improvement.

That limited scope makes the rollout decision straightforward. Projects whose include_paths values stay within the project root should verify normal selection and proceed through the usual promotion path. Projects that depend on external files should first place the required material within the project boundary or redesign how that material enters the job. The release notes do not document an alternate external path mechanism, so assuming one would add unsupported behavior to the upgrade plan.

The practical tradeoff is clear. The stricter boundary removes behavior that some existing jobs might have used, but it also makes the project root a reliable limit for include_paths. For shared execution infrastructure, that predictability is worth testing explicitly before promotion. The v3.9.5 release page remains the authoritative record for the fix.