Kafka Log

Release date 2026/08/24

Bugfix

• Fixed a permanent failure that started when a broker answered an ApiVersions request with an error code, an empty API key set, or a malformed frame. The client cached that result and every later request failed with ProduceRequest API version not negotiated; broker may be unreachable until the node restarted, even after the broker recovered. The client now refuses an unusable ApiVersions response, keeps the previous negotiation, and retries the negotiation for a topic whose metadata is already cached.

• Fixed the confluent schema registry client caching fetched schemas and subjects under keys that did not account for the registry URL or authentication. Instances configured with different credentials could be served each other’s cached lookups, letting an unauthorized instance bypass schema-registry authentication once any authorized instance had warmed the cache. Cache entries are now scoped to the registry identity, and the configured schema_registry.confluent.ttl is now applied to these cache entries.

• Fixed a crash that occurred when a plugin set schema_registry.confluent.authentication.mode to oauth2 but omitted the oauth2_client record. Previously this returned a 500 from the Admin API during validation, and once saved it also crashed at runtime while fetching the schema registry OAuth2 token. The absent oauth2_client is now handled and falls back to the default authentication method, so a configuration without oauth2_client works end-to-end.

• Fixed an issue where OAuth2 authentication against Confluent Cloud Schema Registry failed because the client did not send the required target-sr-cluster header.

Release date 2026/07/02

Feature

• Added SASL OAUTHBEARER authentication support.

Bugfix

• Fixed an issue where cached producers could cause memory leaks.

Release date 2026/08/26

Bugfix

• Fixed a permanent failure that started when a broker answered an ApiVersions request with an error code, an empty API key set, or a malformed frame. The client cached that result and every later request failed with ProduceRequest API version not negotiated; broker may be unreachable until the node restarted, even after the broker recovered. The client now refuses an unusable ApiVersions response, keeps the previous negotiation, and retries the negotiation for a topic whose metadata is already cached.

• Fixed an issue where OAuth2 authentication against Confluent Cloud Schema Registry failed because the client did not send the required target-sr-cluster header.

Release date 2026/07/29

Bugfix

• Fixed a crash that occurred when a plugin set schema_registry.confluent.authentication.mode to oauth2 but omitted the oauth2_client record. Previously this returned a 500 from the Admin API during validation, and once saved it also crashed at runtime while fetching the schema registry OAuth2 token. The absent oauth2_client is now handled and falls back to the default authentication method, so a configuration without oauth2_client works end-to-end.

Release date 2026/04/28

Bugfix

• Fixed an issue where cached producers could cause memory leaks.

Release date 2026/04/07

Feature

• The options security.ssl_verify which control SSL certificate verification for Kafka endpoints, are now enabled by default.

Release date 2026/08/20

Bugfix

• Fixed a crash that occurred when a plugin set schema_registry.confluent.authentication.mode to oauth2 but omitted the oauth2_client record. Previously this returned a 500 from the Admin API during validation, and once saved it also crashed at runtime while fetching the schema registry OAuth2 token. The absent oauth2_client is now handled and falls back to the default authentication method, so a configuration without oauth2_client works end-to-end.

• Fixed an issue where OAuth2 authentication against Confluent Cloud Schema Registry failed because the client did not send the required target-sr-cluster header.

Release date 2026/04/08

Bugfix

• Fixed an issue where cached producers could cause memory leaks.

Release date 2025/12/18

Feature

• added new config option ssl_verify to support verifying server certificates. Added support for the tls_certificate_verify global option. When this option is enabled, the plugin’s ssl_verify setting cannot be disabled.

Release date 2026/09/02

Bugfix

• Fixed a permanent failure that started when a broker answered an ApiVersions request with an error code, an empty API key set, or a malformed frame. The client cached that result and every later request failed with ProduceRequest API version not negotiated; broker may be unreachable until the node restarted, even after the broker recovered. The client now refuses an unusable ApiVersions response, keeps the previous negotiation, and retries the negotiation for a topic whose metadata is already cached.

Release date 2026/08/18

Bugfix

• Fixed a crash that occurred when a plugin set schema_registry.confluent.authentication.mode to oauth2 but omitted the oauth2_client record. Previously this returned a 500 from the Admin API during validation, and once saved it also crashed at runtime while fetching the schema registry OAuth2 token. The absent oauth2_client is now handled and falls back to the default authentication method, so a configuration without oauth2_client works end-to-end.

Release date 2026/07/22

Bugfix

• Fixed Kafka keepalive pools leaking connections across different SASL credentials and TLS verification settings.

• Fixed Kafka broker returning failed connections to the keepalive pool, added SSL handshake retry, and improved error propagation.

Release date 2026/04/15

Bugfix

• Fixed an issue where cached producers could cause memory leaks.

Release date 2026/02/26

Bugfix

• Fixed an issue where certificates could not be loaded from non-default workspaces.

Release date 2025/07/03

Feature

• Added support for Kafka 4.0. kafka-upstream: Added support for Kafka 4.0.

• Added support for sending messages with dynamic keys to determine partitions.

• Added support for Schema Registry integration with Confluent Schema Registry for AVRO and JSON schemas.

Release date 2026/08/31

Bugfix

• Fixed a permanent failure that started when a broker answered an ApiVersions request with an error code, an empty API key set, or a malformed frame. The client cached that result and every later request failed with ProduceRequest API version not negotiated; broker may be unreachable until the node restarted, even after the broker recovered. The client now refuses an unusable ApiVersions response, keeps the previous negotiation, and retries the negotiation for a topic whose metadata is already cached.

Release date 2026/04/09

Feature

• Added support for Kafka 4.0 to fix the Confluent deprecation.

Bugfix

• Fixed an issue where certificates could not be loaded from non-default workspaces.

Release date 2024/12/12

Bugfix

• Fixed an issue where the plugin cannot function correctly when it is configured in a non-default workspace with certificate_id.

• Reduced noisy logs from kafka-log and counters.

Release date 2023/08/09

Feature

• The Kafka Log plugin now supports the custom_fields_by_lua configuration for dynamic modification of log fields using Lua code.

Bugfix

• Fixed an issue where the plugin could lose connection to a broker when the broker leadership changed.

Release date 2022/12/06

Feature

• WebSocket service/route support was added for logging plugins: kafka-log