[RELEASE] ScyllaDB CDC Source Connector v2.0.6

Release Notes
, , ,
1

Hi everyone,

We’re happy to announce the release of ScyllaDB CDC Source Connector v2.0.6. This release completes the CVE remediation started in v2.0.5, clearing the one finding that was still open.

What’s Changed

Security

  • CVE-2026-59901 (Netty, HIGH, CVSS 8.7) — shaded copy now resolved. v2.0.5 fixed the unshaded netty dependency, but a second instance of the same CVE remained in the copy of netty relocated into the upstream scylla-cdc-driver3 artifact, which dependency management could not reach. Both upstream projects have now released fixes, and the connector consumes them: the shipped scylla-cdc-driver3 jar embeds netty 4.1.136.Final (#295).
  • The temporary netty-bom pin added in v2.0.5 has been removed. Netty 4.1.136.Final now arrives transitively through the driver, so the stopgap is no longer needed (#295).

Dependencies

  • scylla-driver-core updated from 3.11.5.17 to 3.11.5.18 (#295).
  • scylla-cdc-java updated from 1.3.12 to 1.3.13 (#295).
  • at.yawk.lz4:lz4-java remains at 1.11.1, unchanged from v2.0.5.

With this release, all three rows from the vulnerability scan of the published v2.0.4 artifact are cleared — the lz4-java finding, the unshaded netty finding, and the shaded netty finding.

Who should upgrade

Recommended for all users. In particular, if you are on v2.0.5 and track vulnerability scans of the published Confluent Hub artifact, this release removes the last remaining flagged CVE.

Links

As always, feel free to report any issues on GitHub.