<a id="hdfs-connector-changelog"></a>

# Changelog for HDFS 2 Sink Connector for Confluent Platform

## Version 10.2.17

* [PR-740](https://github.com/confluentinc/kafka-connect-hdfs/pull/740) - CC-34816: Bumped `jersey-core` version to 1.13 to resolve CVE-2014-3643.

## Version 10.2.16

* [PR-739](https://github.com/confluentinc/kafka-connect-hdfs/pull/739) -  CC-34196: Bumped `commons-beanutils:commons-beanutils` version to 1.11.0 to resolve CVE-2025-48734.

## Version 10.2.15

* [PR-736](https://github.com/confluentinc/kafka-connect-hdfs/pull/736) - CC-30700: Bumped `com.jayway.jsonpath` version to 2.9.0 to resolve CVE-2023-51074
* [PR-736](https://github.com/confluentinc/kafka-connect-hdfs/pull/736) - CC-33758: Bumped `kafka-connect-storage-common` version to 11.2.24 to resolve CVE-2024-13009
* [PR-736](https://github.com/confluentinc/kafka-connect-hdfs/pull/736) - CC-33759: Bumped `kafka-connect-storage-common` version to 11.2.24 to resolve CVE-2025-46762

## Version 10.2.14

* [PR-733](https://github.com/confluentinc/kafka-connect-hdfs/pull/733) - CC-32379: Use RE2/J to address potential ReDOS vulnerability in `java.util.regex`

## Version 10.2.13

* [PR-727](https://github.com/confluentinc/kafka-connect-hdfs/pull/727) - CC-33022, CC-33021: Bumped `kafka-connect-storage-common` version to 11.2.22 to resolve CVE-2025-30065

## Version 10.2.12

* [PR-705](https://github.com/confluentinc/kafka-connect-hdfs/pull/705) - CC-29504: Bumped `kafka-connect-storage-common` version to 11.2.20 to resolve CVE-2024-47561
* [PR-705](https://github.com/confluentinc/kafka-connect-hdfs/pull/705) - CC-29566: Bumped `kafka-connect-storage-common` version to 11.2.20 to resolve CVE-2024-8184
* [PR-705](https://github.com/confluentinc/kafka-connect-hdfs/pull/705) - CC-29601: Bumped `velocity-engine-core` dependency version to 2.4 to resolve CVE-2024-47554

## Version 10.2.11

* [PR-704](https://github.com/confluentinc/kafka-connect-hdfs/pull/704) - CC-29302: Bumped `protobuf-java` dependency version to 3.25.5 to resolve CVE-2024-7254
* [PR-704](https://github.com/confluentinc/kafka-connect-hdfs/pull/704) - CC-29425: Bumped `commons-io` dependency version to 2.14.0 to resolve CVE-2024-47554

## Version 10.2.10

* [PR-703](https://github.com/confluentinc/kafka-connect-hdfs/pull/703) - CC-28069: Bumped `tomcat-embed-core` dependency version to 8.5.100 to resolve CVE-2021-30640, CVE-2021-33037, CVE-2021-42340, CVE-2022-23181, CVE-2022-25762, CVE-2022-29885, CVE-2022-34305, CVE-2022-42252, CVE-2023-28708, CVE-2023-41080, CVE-2023-42795, CVE-2023-44487, CVE-2023-45648, CVE-2023-46589, CVE-2024-24549

## Version 10.2.9

* [PR-702](https://github.com/confluentinc/kafka-connect-hdfs/pull/702) - CC-27237: Bumped `libthrift` dependency version to 0.14.0 to resolve CVE-2020-13949
* [PR-702](https://github.com/confluentinc/kafka-connect-hdfs/pull/702) - CC-27444: Bumped `aircompressor` dependency version to 0.27.0 to resolve CVE-2024-36114

## Version 10.2.8

* [PR-700](https://github.com/confluentinc/kafka-connect-hdfs/pull/700) - CC-27233: Bumped `jetty-io` dependency version to 9.4.53.v20231009 to resolve CVE-2023-44487, CVE-2023-36478, CVE-2023-41900, CVE-2023-40167 and CVE-2023-36479
* [PR-693](https://github.com/confluentinc/kafka-connect-hdfs/pull/693) - CC-26341: Bumped `jackson-databind` dependency version to 2.16.1 to resolve CVE-2023-35116
* [PR-693](https://github.com/confluentinc/kafka-connect-hdfs/pull/693) - CC-26342: Bumped `nimbus-jose-jwt` dependency version to 9.37.2 to resolve CVE-2023-52428
* [PR-693](https://github.com/confluentinc/kafka-connect-hdfs/pull/693) - CC-26343: Excluded `commons-httpclient` dependency to resolve CVE-2020-13956
* [PR-693](https://github.com/confluentinc/kafka-connect-hdfs/pull/693) - CC-26345: Bumped `okio` dependency version to 3.4.0 to resolve CVE-2023-3635
* [PR-693](https://github.com/confluentinc/kafka-connect-hdfs/pull/693) - CC-26346: Bumped `netty-codec-http` dependency version to 4.1.108.Final to resolve CVE-2024-29025
* [PR-693](https://github.com/confluentinc/kafka-connect-hdfs/pull/693) - CC-27071: Bumped `avatica-core` dependency version to 1.22.0 to resolve CVE-2022-36364

## Version 10.2.7

* [PR-688](https://github.com/confluentinc/kafka-connect-hdfs/pull/688) - CC-26117: Fixed CVE-2023-39410, CVE-2023-4586, CVE-2023-44487, CVE-2023-44981, CVE-2024-26308

## Version 10.2.6

* [PR-677](https://github.com/confluentinc/kafka-connect-hdfs/pull/677) - CC-23123 : Integrated Sonarqube code quality check
* [PR-678](https://github.com/confluentinc/kafka-connect-hdfs/pull/678) - RCCA-16236: AVRO buffer loss fix on IOException

## Version 10.2.5

* [PR-672](https://github.com/confluentinc/kafka-connect-hdfs/pull/672) - Fixed CVE-2023-43642, CVE-2023-34455, CVE-2022-46751.

## Version 10.2.4

* [PR-668](https://github.com/confluentinc/kafka-connect-hdfs/pull/668) -PRISMA-2023-0067

## Version 10.2.3

* [PR-667](https://github.com/confluentinc/kafka-connect-hdfs/pull/667) - CVE-2023-34455

## Version 10.2.2

* [PR-652](https://github.com/confluentinc/kafka-connect-hdfs/pull/652) - Fixed CVE-2020-13956, CVE-2022-2343, CVE-2014-125087, CVE-2021-41973, CVE-2019-0231,  CVE-2022-37865, CVE-2022-37866, CVE-2023-1370, CVE-2021-37533, CVE-2023-1436, CVE-2023-1370, CVE-2022-37865, CVE-2014-125087. Updated Ivy, commons-net, json-smart, mina-core and xmlbuilder.

## Version 10.2.1

* [PR-656](https://github.com/confluentinc/kafka-connect-hdfs/pull/656) - Fixed CVE-2022-40149, CVE-2022-40150, CVE-2022-40153, CVE-2022-42003, CVE-2022-42004.

## Version 10.2.0

* [PR-651](https://github.com/confluentinc/kafka-connect-hdfs/pull/651) - CCLOG-2401: Support for hierarchical ORC data and logical tpes.