Ververica DocsVerverica Docs
Docs Home
Viewing docs for
Self-ManagedNot available for BYOC

Ververica Platform 2.15.11

Applies toSelf-Managed v2
1 min read
On this page

Release Date: 2026-07-28

Changelog

Apache Flink®

Ververica Platform 2.15.11 supports the following versions:

  • Apache Flink® 1.20
  • Apache Flink® 1.19
  • Apache Flink® 1.18

Ververica Platform 2.15.11 supports Apache Flink® 1.20, Apache Flink® 1.19, and Apache Flink® 1.18 under SLA.

For Stream Edition:

  • 1.18.1-stream10-scala_2.12-java8
  • 1.18.1-stream10-scala_2.12-java11
  • 1.18.1-stream10-scala_2.12-java17
  • 1.19.3-stream7-scala_2.12-java8
  • 1.19.3-stream7-scala_2.12-java11
  • 1.19.3-stream7-scala_2.12-java17
  • 1.20.5-stream1-scala_2.12-java8
  • 1.20.5-stream1-scala_2.12-java11
  • 1.20.5-stream1-scala_2.12-java17

For Spring Edition the following archives are available:

This is a security patch. Ververica Platform 2.15.11 doesn't include any bug fixes or other improvements beyond the security fixes and the enhancement described below.

Improvements

Ververica Platform now supports custom resource-wide Kubernetes annotations on Session Clusters and application-mode Deployments, through a new kubernetes.annotations map in the spec, alongside the existing kubernetes.labels map.

The annotations are added to every Kubernetes resource that Ververica Platform creates for the Flink cluster: the JobManager and TaskManager workloads, Services, ConfigMaps, Secrets, pods, and the RBAC resources created for Kubernetes high availability.

The field is available through the REST API, the YAML editor, and the Kubernetes operator. Annotation keys are validated against Kubernetes syntax. Existing pod-level kubernetes.pods.annotations keys keep taking precedence on conflicting keys, and annotations are applied when the cluster resources are created, for example on restart. Existing deployments without annotations are unaffected.

ConfigMaps that Flink's own Kubernetes high-availability services create at runtime (high-availability.type: kubernetes) are managed by Flink, not by Ververica Platform, and don't carry these annotations.

Vulnerability Fixes (Inside Apache Flink®)

  • The Flink images are unchanged from 2.15.10 (1.20.5-stream1, 1.19.3-stream7, 1.18.1-stream10), so there are no new fixes to report.

Vulnerability Fixes (Outside of Apache Flink®)

  • Updated com.fasterxml.jackson.core:jackson-databind to 2.22.1 to address CVE-2026-54515, CVE-2026-59889
  • Updated com.fasterxml.jackson.core:jackson-core to 2.22.1 to address GHSA-r7wm-3cxj-wff9
  • Updated io.netty:netty-codec-stomp to 4.1.136.Final to address CVE-2026-44891 (the whole io.netty family is aligned to 4.1.136.Final)
  • Updated ch.qos.logback:logback-core and ch.qos.logback:logback-classic to 1.5.38 to address CVE-2026-10532, CVE-2026-9828
  • Updated org.postgresql:postgresql to 42.7.13 to address CVE-2026-54291
  • Removed the org.eclipse.jetty jars (an unused hadoop-client transitive) from all shipped images to address CVE-2026-10050

Upgrade

We recommend upgrading with Helm using the following commands:

BASH
1$ helm repo add ververica https://charts.ververica.com
2$ helm repo update
3$ helm upgrade [RELEASE] ververica/ververica-platform --version 5.11.11 --values custom-values.yaml
Was this helpful?