Changelog for Google Cloud Spanner Sink Connector for Confluent Platform
Version 1.2.11
CC-46140 Quote DDL statemets to prevent SQL Injection
CC-45382, CC-45285: Upgrade jackson-core and jackson-databind to 2.22.3
Version 1.2.10
CVE-25128: Upgrade netty to 4.2.17.Final
CC-43929 Validate pk.mode/pk.fields arity at config-validate time, fail fast on it
Version 1.2.9
Bump netty to 4.2.16.Final, grpc to 1.82.2, and connect-plugins-parent to 0.9.52 to fix CVEs
Version 1.2.8
INC-12079 Improvement of exception data handling and telemetry CVE fix
Version 1.2.7
CVE-18056: Bump opentelemetry from 1.42.1 to 1.62.0 (fixes CVE-2026-45292)
INC-12079 Addition of error code data by segregating normal Exception
Version 1.2.6
Stop logging config and record data through error messages
Version 1.2.5
Update plugins parent version to 0.9.50 to fix jackson.core:jackson-databind CVE
Version 1.2.4
CC-41675 - Replaced GcpCredsFilter with GcpCredentials
Updated io.netty:netty-handler and io.netty:netty-codec-http2 to 4.2.15.Final to fix CVEs
Version 1.2.3
CC-41150 — Bumped both netty.version and netty.codec.http.version from 4.1.132.Final → 4.1.133.Final for a CVE fix.
Region change in integration tests.
Version 1.2.2
CC-40935 CC-40958 - Fixed class cast exception by handling Decimal and Time logical types.
CC-40248 - Updated grpc and netty versions to fix CVEs.
CC-40607 – Fixed a security vulnerability where GCP config credentials bypassed
GcpCredsFilter, preventing potential credential injection, SSRF, or data exfiltration.
Version 1.2.1
Removed duplicate reload4j dependency
CC-39696 - Fixed gRPC ContextStorageOverride classloader conflict in CP 8.2.x (CC-39696)
CC-39525 - Bumped jackson-core to 2.21.1 for CVE fix
Version 1.2.0
CC-39510 - Fix NULL handling: explicitly bind NULL for optional fields to get updated to Spanner instead of omitting them.