# Changelog for HDFS 3 Sink Connector for Confluent Platform ## Version 3.0.19 * CC-43890: Bumped `io.netty:netty-transport-sctp` to 4.1.137.Final to resolve CVE-2026-59902. * CC-43793: Bumped `org.apache.httpcomponents.core5:httpcore5-h2` to 5.4.3 to resolve CVE-2026-54428. * CC-43794: Bumped `org.apache.httpcomponents.core5:httpcore5` to 5.4.3 to resolve CVE-2026-54399. ## Version 3.0.18 * CC-42914: Bumped all `io.netty` to 4.1.136.Final to resolve CVE-2026-44891. ## Version 3.0.17 * CC-42310: Bumped `kafka-connect-storage-common` to 11.0.43 to resolve CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, and CVE-2026-54515. * CC-42310: Removed unused `kafka-connect-storage-common-orc-core-shaded-jackson` dependency to resolve CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, and CVE-2026-54515. ## Version 3.0.16 * CC-42179: Bumped `org.jline:jline` to 4.2.1 to resolve GHSA-47qp-hqvx-6r3f and GHSA-2r2c-cx56-8933. * CC-41519: Bumped `org.apache.commons:commons-configuration2` to 2.15.0 to resolve CVE-2026-45205. * CC-42310: Bumped `com.fasterxml.jackson.core:jackson-databind` to 2.21.5 to resolve CVE-2026-54515. * CC-42710: Replaced `org.glassfish:javax.el` with `org.glassfish:jakarta.el:3.0.4` to resolve CVE-2021-28170. * CC-42711: Bumped `org.apache.calcite:calcite-core` to 1.33.0 to resolve CVE-2022-39135. * CC-42712: Bumped `org.springframework:spring-core` to 6.2.19 to resolve CVE-2026-41848. * CC-42713: Bumped `org.springframework:spring-expression` to 6.2.19 to resolve CVE-2026-41852. ## Version 3.0.15 * CC-42271: Bumped `hadoop` to `3.4.3` to support Confluent Platform 8.3 (JDK 25). ## Version 3.0.14 * CC-41906: Bumped all `io.netty` to 4.1.135.Final to resolve CVE-2026-42586, CVE-2026-44248, CVE-2026-44249, CVE-2026-44250, CVE-2026-44890, CVE-2026-44893, CVE-2026-45416, CVE-2026-45673, CVE-2026-45674, CVE-2026-46340, CVE-2026-47691, CVE-2026-48006, CVE-2026-48059, CVE-2026-50010 and CVE-2026-50011. * CC-40730: Bumped `log4j-1.2-api` to 2.25.4 to resolve CVE-2026-34479. ## Version 3.0.13 * CC-41781: Bumped `org.apache.thrift:libthrift` to 0.23.0 to resolve CVE-2026-43869. ## Version 3.0.12 * CC-40906: Bumped `org.bouncycastle:bcprov-jdk18on` to 1.84 to resolve CVE-2026-0636. * CC-41243: Bumped all `io.netty` to 4.1.133.Final to resolve CVE-2026-42583, CVE-2026-42579, CVE-2026-42587 and CVE-2026-41417. * CC-40693: Bumped `org.apache.logging.log4j:log4j-core` to 2.25.4 to resolve CVE-2026-34480. * CC-40905: Bumped `org.pac4j:pac4j-core` to 5.7.10 to resolve CVE-2026-40458. * Fixed Parquet schema evolution to cascade partition schema updates. ## Version 3.0.11 * CC-40255: Bumped `io.netty:netty-codec-http` to 4.1.132.Final to resolve CVE-2026-33870. ## Version 3.0.10 * CC-39973: Bumped remaining `jackson` dependencies to 2.18.6 to resolve GHSA-72hv-8253-57qq. ## Version 3.0.9 * CC-39528: Bumped `com.fasterxml.jackson.core:jackson-core` to 2.18.6 to resolve GHSA-72hv-8253-57qq. * CC-39857: Bumped `org.apache.zookeeper:zookeeper` to 3.9.5 to resolve CVE-2026-24308. ## Version 3.0.8 * CC-39859: Replaced `io.airlift:aircompressor-v3:3.4` with `io.airlift:aircompressor:2.0.3` to fix CVE-2025-67721. ## Version 3.0.7 * CC-39481: Bumped `io.airlift:aircompressor:0.27` to io.airlift:aircompressor-v3:3.4\` to resolve CVE-2025-67721. * CC-39281: Bumped `org.apache.avro:avro` to 1.11.5 to resolve CVE-2025-33042. * Bumped `io.netty:netty-codec-http` to 4.1.130.Final. ## Version 3.0.6 * CC-38599: Bumped `org.bitbucket.b_c:jose4j` to 0.9.5 to resolve CVE-2024-29371 * CC-38391: Bumped `org.apache.logging.log4j:log4j-core` to 2.25.3 to resolve CVE-2025-68161 * CC-38261: Bumped `io.netty:netty-codec-http` to 4.1.128.Final to resolve CVE-2025-67735 ## Version 3.0.5 * CC-37791: Shaded `org.apache.orc:orc-core` and bumped `com.fasterxml.jackson.core:jackson-core` to 2.16.0 to resolve CVE-2025-49128 and CVE-2025-52999 ## Version 3.0.4 * CC-37328: Bumped `org.apache.orc:orc-core:nohive` to 2.2.1 to resolve CVE-2022-3171, CVE-2022-3509, CVE-2022-3510 and CVE-2024-7254 ## Version 3.0.3 * CC-37328: Excluded vulnerable version of `com.google.protobuf:protobuf-java` to resolve CVE-2022-3171, CVE-2022-3509, CVE-2022-3510 and CVE-2024-7254 * CC-36845: Bumped `org.apache.zookeeper:zookeeper` to 3.9.4 to resolve CVE-2025-58457 ## Version 3.0.2 * CC-36915: Bumped `io.grpc:grpc-netty-shaded` to 1.75.0 to resolve CVE-2025-55163 ## Version 3.0.1 * CC-37262: Bumped `netty` version to 4.1.128.Final to resolve CVE-2025-59419 * CC-36349: Bumped `org.bouncycastle:bcpkix-jdk18on` to 1.79 to resolve CVE-2025-8916 * CC-35443: Bumped `org.apache.commons:commons-lang` to 3.18.0 to resolve CVE-2025-48924 * CC-35371: Bumped `com.nimbusds:nimbus-jose-jwt` to 10.0.2 to resolve CVE-2025-53864 ## Version 3.0.0 * CC-36685: Bumped all `springframework` dependencies to 6.2.11 to resolve CVE-2025-41249. * CC-36348: Bumped all `springframework` dependencies to 6.2.11 to resolve CVE-2024-38820. * CC-36347: Bumped all `springframework` dependencies to 6.2.11 to resolve CVE-2025-22233. * Upgraded source and target JDK versions to 17