# Changelog for Google Cloud Spanner Sink Connector for Confluent Platform ## Version 1.2.10 * CVE-25128: Upgrade netty to 4.2.17.Final * CC-43929 Validate pk.mode/pk.fields arity at config-validate time, fail fast on it ## Version 1.2.9 * Bump netty to 4.2.16.Final, grpc to 1.82.2, and connect-plugins-parent to 0.9.52 to fix CVEs ## Version 1.2.8 * INC-12079 Improvement of exception data handling and telemetry CVE fix ## Version 1.2.7 * CVE-18056: Bump opentelemetry from 1.42.1 to 1.62.0 (fixes CVE-2026-45292) * INC-12079 Addition of error code data by segregating normal Exception ## Version 1.2.6 * Stop logging config and record data through error messages ## Version 1.2.5 * Update plugins parent version to 0.9.50 to fix jackson.core:jackson-databind CVE ## Version 1.2.4 * CC-41675 - Replaced GcpCredsFilter with GcpCredentials * Updated io.netty:netty-handler and io.netty:netty-codec-http2 to 4.2.15.Final to fix CVEs ## Version 1.2.3 * CC-41150 — Bumped both netty.version and netty.codec.http.version from 4.1.132.Final → 4.1.133.Final for a CVE fix. * Region change in integration tests. ## Version 1.2.2 * CC-40935 CC-40958 - Fixed class cast exception by handling Decimal and Time logical types. * CC-40248 - Updated grpc and netty versions to fix CVEs. * CC-40607 – Fixed a security vulnerability where GCP config credentials bypassed `GcpCredsFilter`, preventing potential credential injection, SSRF, or data exfiltration. ## Version 1.2.1 * Removed duplicate reload4j dependency * CC-39696 - Fixed gRPC ContextStorageOverride classloader conflict in CP 8.2.x (CC-39696) * CC-39525 - Bumped jackson-core to 2.21.1 for CVE fix ## Version 1.2.0 * CC-39510 - Fix NULL handling: explicitly bind NULL for optional fields to get updated to Spanner instead of omitting them.