# Changelog for Apache HBase Sink Connector for Confluent Platform ## Version 2.0.45 * CC-43894: Bumped `io.netty:netty-transport-sctp` to `4.2.17.Final` to resolve CVE-2026-59902 * CC-43958: Bumped `io.netty:netty-codec-http` to `4.2.17.Final` to resolve CVE-2026-59903 ## Version 2.0.44 * CC-42920: Upgrade netty to 4.2.16.Final * CC-43058: Upgrade jackson to 2.22.1 ## Version 2.0.43 * CVE-22427-update jackson.databind.version to 2.21.5 ## Version 2.0.42 * CC-42330: Bumped `com.fasterxml.jackson.core:jackson-databind` to `2.21.4` to resolve CVE-2026-54518 ## Version 2.0.41 * CC-41981: Bumped `io.netty:netty-transport-sctp` to `4.2.15.Final` to resolve CVE-2026-46340 * CC-41982: Bumped `io.netty:netty-transport-native-kqueue` to `4.2.15.Final` to resolve CVE-2026-45536 * CC-41983: Bumped `io.netty:netty-transport-native-epoll` to `4.2.15.Final` to resolve CVE-2026-45536 * CC-41984: Bumped `io.netty:netty-resolver-dns` to `4.2.15.Final` to resolve CVE-2026-45673, CVE-2026-45674, CVE-2026-47691 * CC-41985: Bumped `io.netty:netty-handler` to `4.2.15.Final` to resolve CVE-2026-44249, CVE-2026-45416, CVE-2026-50010 * CC-41986: Bumped `io.netty:netty-codec-redis` to `4.2.15.Final` to resolve CVE-2026-44250, CVE-2026-44890, CVE-2026-48006, CVE-2026-50011 * CC-41987: Bumped `io.netty:netty-codec-http3` to `4.2.15.Final` to resolve CVE-2026-44892, CVE-2026-48748 * CC-41988: Bumped `io.netty:netty-codec-http2` to `4.2.15.Final` to resolve CVE-2026-47244, CVE-2026-48043, CVE-2026-50560 * CC-41989: Bumped `io.netty:netty-codec-haproxy` to `4.2.15.Final` to resolve CVE-2026-44893, CVE-2026-48059 * CC-41990: Bumped `io.netty:netty-codec-classes-quic` to `4.2.15.Final` to resolve CVE-2026-44894, CVE-2026-50009 * CC-42133: Bumped `io.netty:netty-codec-http` to `4.2.15.Final` to resolve CVE-2026-50020 ## Version 2.0.40 * No Changes ## Version 2.0.39 * CC-41167: Bumped `io.netty:netty-codec-http` to `4.2.13.Final` to resolve CVE-2026-41417, CVE-2026-42580, CVE-2026-42581, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587 * CC-41315: Bumped `io.netty:netty-transport-native-epoll` to `4.2.13.Final` to resolve CVE-2026-42577 * CC-41322: Bumped `io.netty:netty-codec-http2` to `4.2.13.Final` to resolve CVE-2026-42587 * CC-41324: Bumped `io.netty:netty-codec-dns` to `4.2.13.Final` to resolve CVE-2026-42579 * CC-41325: Bumped `io.netty:netty-codec` to `4.2.13.Final` to resolve CVE-2026-42583 ## Version 2.0.38 * [cve] CC-40280 CC-40271 Upgrade netty to 4.1.132.Final ## Version 2.0.37 * CC-39558: Bumped `com.fasterxml.jackson.core:jackson-core` to `2.21.2` to resolve GHSA-72hv-8253-57qq * CC-39866: Bumped `org.apache.zookeeper:zookeeper` to `3.9.5` to resolve CVE-2026-24308 ## Version 2.0.36 * CC-38272: Bumped `io.netty:netty-codec-http` to `4.1.130.Final` to resolve CVE-2025-67735 ## Version 2.0.35 * CC-38622: Bumped `org.bitbucket.b_c:jose4j` to `0.9.6` to resolve CVE-2024-29371 ## Version 2.0.34 * CC-37268: Bump `io.netty:netty-codec-smtp` to 4.1.128.Final to resolve CVE-2025-59419 ## Version 2.0.33 * CC-35475: Bump `org.apache.commons:commons-lang3` to 3.18.0 to resolve CVE-2025-48924 ## Version 2.0.32 * CC-35379: Bump `com.nimbusds:nimbus-jose-jwt` to 9.37.4 to resolve CVE-2025-53864 * CC-35475: Bump `org.apache.commons:commons-lang3` to 3.18.0 to resolve CVE-2025-48924 * CC-36450: Bump `io.netty:netty-codec` to 4.1.125.Final to resolve CVE-2025-58057 * CC-36519: Bump `io.netty:netty-codec-http` to 4.1.125.Final to resolve CVE-2025-58056 * CC-36847: Bump `org.apache.zookeeper:zookeeper` to 3.9.4 to resolve CVE-2025-58457 ## Version 2.0.31 * Fix security vulnerabilities CC-36124, CC-36119, CC-36117 ## Version 2.0.30 No changes ## Version 2.0.29 No changes ## Version 2.0.28 No changes ## Version 2.0.27 * CC-32075: Bump `io.netty:netty-handler` to 4.1.118.Final to resolve CVE-2025-24970 ## Version 2.0.26 * CC-30675: Bump `io.netty:netty-common` to 4.1.115.Final to resolve CVE-2024-47535 ## Version 2.0.25 * CC-29660: Bump up zookeeper version to fix commons-io CVE ## Version 2.0.24 * CC-29418: Fix commons-io CVE from shaded client ## Version 2.0.23 * CC-29178: Upgrade parent plugin to fix protobuf CVEs ## Version 2.0.22 * CC-27501: Using jackson 2.15.x for htrace and upgrading maven-shade-plugin ## Version 2.0.21 * RCCA-21714: Include google-api and grpc-rls to fix bigtableconnector issue for CP 7.7 ## Version 2.0.20 * CC-27325,CC-27340: Fix netty handler and core jackson CVEs in bigtable connector. ## Version 2.0.19 * CC-27265, CC-27341, CC-27325: Fix io-commons, jre CVEs in bigtable connector ## Version 2.0.18 No changes ## Version 2.0.17 No changes ## Version 2.0.16 * CC-26356, CC-26355, CC-26354, CC-26349: CVE fixes for bigtable ## Version 2.0.15 No changes ## Version 2.0.14 No changes ## Version 2.0.13 No changes ## Version 2.0.12 * CC-23262: Fix CVE issue in bigtable connector * CC-23326: Fix CVE issues in big table connector * Merge Conflict Resolution (from 1.0.x to 2.0.x) * Enable automatic pint merge * Delete Jenkinsfile * Fix NPE in BaseBigtableSinkTask * Add release notes * Update version() test to allow ‘-cloud’ versions * CC-24123 Fix row.key.delimiter bug * Merge Conflict Resolution (from 1.0.x to 2.0.x) * Migration: Jenkins -> Semaphore * RCCA-16272: Add GCP creds type validator and sanitizer * [TD] auto-commit : update connect-templates to v0.45.0 * [TD] auto-generate template-decoupling changes for multi-module connectors ## Version 2.0.11 * CC-21333: Upgraded grpc version to fix CVE issue * Revert gcloud.bigtable.version to 1.23.1 ## Version 2.0.10 * Upgrade hbase client version * Upgrade hbase client version ## Version 2.0.9 * Change the version of bigtable to 1.23.1 ## Version 2.0.8 * CC-21177, CC-20502: Bump common plugin version to fix CVE issues * CC-21333: Fix io.grpc_grpc-protobuf and jackson.core CVE error * CCDB-5339: Exclude hbase-shaded-client from hbase package ## Version 2.0.7 * CCDB-5340: Reshaded `jackson-databind` CVE from `htrace-core4` JAR ## Version 2.0.6 * CCDB-5338: Fixed vulnerability with `json-smart` ## Version 2.0.5 * Added ZooKeeper dependencies to `hbase-shaded` JAR through reshading * CCDB-4934: Fixed CVE vulnerabilities ## Version 2.0.4 * CCDB-5173: Fixed CVE with `woodstox-core` ## Version 2.0.3 * Fixed CCDB-5106 ## Version 2.0.2 * Fixed CVEs * CCDB-4999: Fixed vulnerability with ZooKeeper version 3.5.7 * Upgraded core `jackson-databind` in the shade plugin * CCDB-4976: Fixed vulnerability related to `protobuf-java` ## Version 2.0.1 * Turned off IT tests on Jenkins for Hbase * Adjusted validate function to handle changes from CCDB-4631 * CCDB-4631: Made Bigtable compatible with license injector ## Version 2.0.0 * The connector was updated to use HBase API 2.x (from 1.x). Kafka Connect HBase Connector, which uses the Hbase 2.x client, is expected not to be backward compatible with Hbase 1.x Servers. The Connector’s configuration has not changed in 2.0.0.