v4.109.0

For installation instructions check out the getting started guide.

Added

• avro: Added max_decompressed_block_bytes configuration field to cap OCF block decompression and prevent decompression-bomb denial-of-service attacks. (@Jeffail, #4773)
• aws_kinesis: Added a poll_period field to bound the rate of GetRecords calls per shard, and an enhanced_fan_out configuration block that consumes streams via a dedicated enhanced fan-out consumer with 2MB/s per shard of read throughput, avoiding the shared 5 reads per second per shard limit. (@squiidz, #4724)
• iceberg: Added optional parquet compression codec configuration supporting snappy, gzip, and zstd compression, with fallback to table properties for compatibility. (@Jeffail, #4785)

Fixed

• general: Bumped amqp091-go dependency to address CVE-2026-79921. (@josephwoodward, #4795)
• mysql_cdc: Fixed MySQL CDC to accept Unicode characters in table names, including accented Latin, CJK, and Cyrillic identifiers that MySQL permits. (@samarth70, #4745)
• aws_kinesis: The input now falls back to the oldest retained record when a stored sequence has aged out of the stream's retention window, instead of retrying the stale position indefinitely. (@squiidz, #4724)

Changed

• iceberg: Optimized Iceberg shredder to eliminate unnecessary allocations on case-sensitive record matching, reducing memory usage and CPU overhead by 42% in the shredding step. (@Jeffail, #4784)
• sftp: Improved SFTP input to advance to the next file without reconnecting, eliminating unnecessary delays when rotating through files. (@Leward, #4777)
• websocket input/output: A config that sets tls.enabled: true against a ws:// URL is now rejected at startup. Previously the TLS settings were silently ignored, the connection was plaintext, and any configured basic_auth, jwt or oauth credentials were sent in the clear. Use a wss:// URL to connect with TLS. (@Leward)

The full change log can be found here.