Ververica Platform 3.1.5

Release Date: 2026-10-29

Ververica Platform 3.1.5 is a maintenance release focused on security and access control, including Console fixes for custom namespace roles.

New Features and Improvements

Spring Boot 4

The platform services now run on Spring Boot 4.0 and Spring Cloud 2025.1, which keep receiving security updates after the end of open source support for Spring Boot 3.5.

Bug Fixes

Validate and Debug SQL Drafts Without Edit Permission

Ververica Platform 3.1.5 allows users without edit permission to validate and debug SQL drafts in the SQL Editor. Previously, Validate and Debug required the edit lock of the draft, so a custom namespace role without SQL__CREATE_MODIFY_DRAFT could not use them.

A role with SQL__FULLY_CHECK_DRAFT can now run Validate, and a role with SQL__FULLY_CHECK_DRAFT and SQL__DEBUG_DRAFT can run Debug, on any draft the user can open. The draft is validated or debugged as last saved and is not modified. Editing a draft still requires SQL__CREATE_MODIFY_DRAFT, and deploying it still requires SQL__DEPLOY_DRAFT.

Delete Catalog Enabled for Viewers

Ververica Platform 3.1.5 fixes an issue where the Delete action in the catalog list was enabled for viewers. The request already failed for viewers, and the action is now disabled.

Misleading Validate Messages in the SQL Editor

Ververica Platform 3.1.5 fixes the SQL Editor messages that described Validate as a network connectivity check. Validate checks the SQL syntax and semantics of the draft and the metadata of the tables it uses, and it doesn't test whether the sources and sinks of the job are reachable. The result panel is now named Validate instead of Deep Validate. To check connectivity to upstream and downstream systems, use Network detection.

Vulnerability Fixes (Inside Apache Flink®)

• No new fixes to report.

Vulnerability Fixes (Outside Apache Flink®)

• Removed commons-lang:commons-lang to address CVE-2025-48924
• Removed net.jpountz.lz4:lz4 to address CVE-2025-12183, CVE-2025-66566
• Removed org.jdom:jdom to address CVE-2021-33813
• Updated at.yawk.lz4:lz4-java to 1.11.4 to address CVE-2026-106449, CVE-2026-106450, CVE-2026-106451, CVE-2026-106452, CVE-2026-106453
• Updated com.fasterxml.jackson.core:jackson-core to 2.21.7 to address CVE-2026-89407, CVE-2026-89425
• Updated com.fasterxml.jackson.core:jackson-databind to 2.21.7 to address CVE-2026-91776, CVE-2026-91777
• Updated org.springframework:spring-webmvc to 7.0.9 to address CVE-2026-47884, CVE-2026-47890
• Updated tools.jackson.core:jackson-core to 3.1.7 to address CVE-2026-89407, CVE-2026-89425
• Updated tools.jackson.core:jackson-databind to 3.1.7 to address CVE-2026-91776, CVE-2026-91777

Upgrade

To upgrade Ververica Platform to version 3.1.5, run the following Helm command:

1helm upgrade --install <RELEASE_NAME> \
2  oci://registry.ververica.cloud/platform-charts/ververica-platform \
3  --version 3.1.5 \
4  --namespace vvp-system \
5  --values values.yaml