Ververica Platform 2.15.13

Release Date: 2026-11-03

Changelog

Apache Flink®

Ververica Platform 2.15.13 supports the following versions:

• Apache Flink® 1.20
• Apache Flink® 1.19
• Apache Flink® 1.18

Ververica Platform 2.15.13 supports Apache Flink® 1.20, Apache Flink® 1.19, and Apache Flink® 1.18 under SLA.

For Stream Edition:

• 1.18.1-stream11-scala_2.12-java8
• 1.18.1-stream11-scala_2.12-java11
• 1.18.1-stream11-scala_2.12-java17
• 1.19.3-stream8-scala_2.12-java8
• 1.19.3-stream8-scala_2.12-java11
• 1.19.3-stream8-scala_2.12-java17
• 1.20.5-stream2-scala_2.12-java8
• 1.20.5-stream2-scala_2.12-java11
• 1.20.5-stream2-scala_2.12-java17

For Spring Edition, the following archives are available:

• 1.18.1-spring11-scala_2.12.tgz
• 1.19.3-spring8-scala_2.12.tgz
• 1.20.5-spring2-scala_2.12.tgz

This is a patch release with improvements and security fixes.

Improvements

• Spring Boot 4.1. Ververica Platform services now run on Spring Boot 4.1, which keeps the platform on a supported Spring Boot release line. The upgrade requires no action from you.

Bug Fixes

This release contains no bug fixes.

Vulnerability Fixes (Inside Apache Flink®)

• Updated certifi to 2026.10.19 to address GHSA-6q48-6c7w-9gw2
• Updated dnspython to 2.9.0 to address CVE-2026-114605
• Updated httplib2 to 0.32.0 to address CVE-2026-59939
• Updated org.apache.logging.log4j:log4j-api to 2.25.5 to address CVE-2026-49844
• Updated pip to 26.2.2 to address CVE-2026-13346
• Updated pymongo to 4.18.2 to address CVE-2026-88029, CVE-2026-96747, CVE-2026-96748, CVE-2026-96749

Vulnerability Fixes (Outside of Apache Flink®)

• Updated com.google.guava:guava to 33.7.2-jre to address CVE-2026-102554
• Updated dnspython to 2.9.1 to address CVE-2026-114605
• Updated httplib2 to 0.32.0 to address CVE-2026-59939
• Updated io.opentelemetry:opentelemetry-api to 1.67.0 to address CVE-2026-118259
• Updated org.apache.logging.log4j:log4j-api to 2.25.5 to address CVE-2026-49844
• Updated org.mariadb.jdbc:mariadb-java-client to 2.7.15 to address CVE-2026-119210, CVE-2026-119276, CVE-2026-119279, CVE-2026-119280, CVE-2026-119281
• Updated org.mariadb.jdbc:mariadb-java-client to 3.5.11 to address CVE-2026-119210, CVE-2026-119276, CVE-2026-119279, CVE-2026-119280, CVE-2026-119281
• Updated org.xerial.snappy:snappy-java to 1.1.10.12 to address CVE-2026-108106, CVE-2026-116590, CVE-2026-93451
• Updated pip to 26.2.1 to address CVE-2026-13346
• Updated pymongo to 4.18.3 to address CVE-2026-106435

Upgrade

We recommend upgrading with Helm using the following commands:

1$ helm repo add ververica https://charts.ververica.com
2$ helm repo update
3$ helm upgrade [RELEASE] ververica/ververica-platform --version 5.11.13 --values custom-values.yaml