# Changelog for Google Cloud Pub/Sub Source Connector for Confluent Platform ## Version 1.2.25 * Updated `io.netty:netty-codec-http` and `io.netty:netty-handler` to `4.1.137.Final` to fix `CVE-2026-59903 , CVE-2026-75595 , CVE-2026-75596` * Updated `org.apache.logging.log4j:log4j-api` to `2.25.5` to fix `CVE-2026-49844` ## Version 1.2.24 * CC-43085 : No longer surfaces a custom credential provider’s exception in connector logs or status. ## Version 1.2.23 * Updated `io.opentelemetry:opentelemetry-api` to `1.62.0` to fix `CVE-2026-45292` * Updated `io.netty:netty-codec-http` to `4.1.136.Final` to fix `CVE-2026-59921` ## Version 1.2.22 * Updated `com.fasterxml.jackson.core:jackson-databind` to `2.22.0` to fix `CVE-2026-54518` ## Version 1.2.21 * Updated `org.apache.logging.log4j:log4j-core` to `0.25.4` to fix `CVE-2026-34480` ## Version 1.2.20 * Replaced deprecated `GcpCredsFilter` with `GcpCredentials` * Updated `io.netty:netty-handler` to `4.1.135.Final` to fix `CVE-2026-45416` * Updated `io.netty:netty-resolver-dns` to `4.1.135.Final` to fix `CVE-2026-45673` * Updated `org.apache.logging.log4j:log4j-core` to `2.25.4` to fix `CVE-2026-34480` * Updated `io.netty:netty-codec-http2` to `4.1.135.Final` to fix `CVE-2026-47244` ## Version 1.2.19 * Updated `org.bouncycastle:bcprov-jdk18on` to `1.84` to fix `CVE-2026-0636` * Updated `org.bouncycastle:bcpkix-jdk18on` to `1.84` to fix `CVE-2026-5598` * Updated `org.bouncycastle:bcutil-jdk18on` to `1.84` to fix `CVE-2026-5588` * Updated `io.netty:netty-codec-http` to `4.1.133.Final` to fix `CVE-2026-42583` ## Version 1.2.18 * Updated io.netty:netty-codec-http to 4.1.132.Final to fix CVE-2026-33870 ## Version 1.2.17 * Updated `com.squareup.okio:okio-jvm` to `3.9.0` to fix CVE-2023-3635 * Updated `com.fasterxml.jackson.core:jackson-core` to `2.21.1` to fix GHSA-72hv-8253-57qq ## Version 1.2.16 * Upgraded `com.nimbusds:nimbus-jose-jwt` to `10.0.2` to fix CVE-2025-53864 * Upgraded `io.projectreactor.netty:reactor-netty-http` to `1.2.8` to fix CVE-2025-22227 * Upgraded `org.apache.commons:commons-lang3` to `3.18.0` to fix CVE-2025-48924 * Fixed compatibility with CP 8.1 ## Version 1.2.15 * Updated `com.google.cloud:google-cloud-pubsub` to `1.145.0` to fix CVE-2025-55163 * Updated `io.netty:netty-codec-http` to `4.1.129.Final` to fix CVE-2025-67735 ## Version 1.2.14 * Updated io.grpc:grpc-netty-shaded to 1.76.0 and com.google.cloud:google-cloud-pubsub to 1.143.1 to fix CVE-2025-55163 * Add Provider Integration support for GCP Pub/Sub ## Version 1.2.13 * Updated `com.google.cloud:google-cloud-pubsub` to `1.123.20` to fix CVE-2025-55163 * Removed deprecated `sourceTask.commitRecord(SourceRecord record)` in favour of `commitRecord(SourceRecord record, RecordMetadata metadata)`. ## Version 1.2.12 * Upgraded netty-codec-http2 version to 4.1.126.Final ## Version 1.2.11 * CC-31824: Removed usage of non-public Apache Kafka APIs ## Version 1.2.10 * CC-33763: Removed usage of non public and deprecated APIs ## Version 1.2.9 * CC-32049: Updated netty to v4.1.118.Final to fix CVE-2025-24970 ## Version 1.2.8 * CC-30150 : Upgraded plugins parent from v0.8.45 to v0.8.48 to fix CVE-2024-7254 and io.netty from 4.1.100.Final to 4.1.115.Final to fix CVE-2024-47535 ## Version 1.2.7 * RCCA-21714: Added `grpc-rls` 1.55.3 for CP `v7.7` compatibility. ## Version 1.2.6 * Added a new configuration option, gcp.pubsub.return.immediately, to allow the API call for pulling messages from Pub/Sub returns immediately if no records are present. ## Version 1.2.5 * CC-26876: Bumped grpc libraries to 1.55.1, google-cloud-pubsub to 1.123.13. * CC-26424: Bumped jackson-databind to 2.16.2, netty-codec-http to 4.1.110.Final. ## Version 1.2.4 * Added grpc-netty to support CP 7.6.0 and later versions. * Added netty-transport-epoll to support CP 7.6.0 and later versions. ## Version 1.2.3 * CC-24135: Added gcp credentials filter. ## Version 1.2.2 * Bumped `guava` to 32.1.1-jre * Bumped `google-cloud-pubsub` to 1.123.10 * Removed `jose4j` dependency ## Version 1.2.1 * CCLOG-2437: Updated dependencies to address CVE-2022-3171, CVE-2022-3509, and CVE-2022-3510 ## Version 1.2.0 * CCMSG-1995: Added support for bytes data in messages * CCMSG-1816: Bumped `protobuf-java` to 3.19.4