Aerospike Connect for Pulsar - Inbound Release Notes

New Features

• [CONNECTOR-1183] - Use sendTimeout as configured without doubling.
• [CONNECTOR-1184] - Converted transaction debug level messages to trace level.
• [CONNECTOR-1185] - Kotlin version upgraded to 2.x.

Security

• [CONNECTOR-1175] - Updated logback-core to 1.5.15 version to fix CVE-2024-12798, CVE-2024-12801.
• [CONNECTOR-1179] - Updated logback-core to 1.5.15 version to fix CVE-2024-12801.
• [CONNECTOR-1180] - Updated logback-classic to 1.5.15 version to fix CVE-2024-12798.
• [CONNECTOR-1181] - Updated logback-core to 1.5.15 version to fix CVE-2024-12798.
• [CONNECTOR-1188] - Updated io.netty:netty-handler to 4.1.118.Final to fix CVE-2025-24970, CVE-2025-25193, CVE-2024-29025, CVE-2024-47554, CVE-2023-46120 (rabbitmq), CVE-2024-51504 (zookeeper).

Security

• [CONNECTOR-1149] - Fixed Deserialization of Untrusted Data in org.apache.avro:avro:1.11.3.
• [CONNECTOR-1149] - Fixed Denial of Service (DoS) in com.fasterxml.jackson.core:jackson-core.
• [CONNECTOR-1149] - Fixed Race Condition in io.undertow:undertow-core.
• [CONNECTOR-1149] - Fixed Uncontrolled Resource Consumption in commons-io:commons-io.

Security

• [CONNECTOR-1135] - Fix Arbitrary Code Injection affecting platform-python-setuptools & python3-setuptools-wheel.
• Upgraded Pulsar version.
• Fixed com.google.protobuf:protobuf-java Stack-based Buffer Overflow.

Security

• [CONNECTOR-985] - Fix Improper Input Validation.
• [CONNECTOR-986] - Fix Infinite loop.
• [CONNECTOR-987] - Fix Uncontrolled Resource Consumption.
• [CONNECTOR-1030] - Fix Out-of-bounds write vulnerabilities.
• [CONNECTOR-1031] - Fix Out-of-bounds write vulnerabilities.
• [CONNECTOR-1032] - Fix Out-of-bounds write vulnerabilities.
• [CONNECTOR-1033] - Fix Out-of-bounds write vulnerabilities.
• [CONNECTOR-1034] - Fix Out-of-bounds write vulnerabilities.
• [CONNECTOR-1091] - Fix Out-of-bounds write vulnerabilities.

Improvements

• Upgraded a few dependencies.

Security

• [CONNECTOR-892] - Address CVE-2023-33202 in Pulsar inbound.

• Breaking change - Custom transformers will not be able to write Java runtime serialized objects as bins to target Aerospike cluster.

Security

• [CONNECTOR-775] - Address CVE-2023-36480 - upgrade to aerospike-java-client version 7.0.0.

Improvements

• [CONNECTOR-640] - Support invalid record behavior in Pulsar inbound.
• [CONNECTOR-679] - Upgrade vulnerable dependencies.

New Features

• [CONNECTOR-185] - Add Boolean particle type support introduced in server 5.6.
• [CONNECTOR-281] - Add support for PKI authentication introduced in server 5.7.

• Initial General Availability release.