Redpanda Connect v4.109.0 - Kinesis Fan Out and Iceberg Shredding

Redpanda Connect v4.109.0 was published on 10 September 2026. The upgrade check that will stop a running config is the websocket input and output. A config with tls.enabled: true on a ws:// URL is rejected at startup, because earlier builds ignored the TLS block and sent basic_auth, jwt, or oauth credentials in the clear. The same tag bounds Kinesis GetRecords calls, adds an enhanced_fan_out consumer, and reports a 42 percent cut in Iceberg shredder overhead on case sensitive matches.

The full release notes and downloads are on the GitHub release page.

#4724 adds poll_period and an enhanced_fan_out block to the aws_kinesis input.

poll_period bounds the rate of GetRecords calls per shard. Shared consumers on a shard are limited to 5 reads per second. Calls past that rate do not move more records. They spend the shared allowance and then wait on throttling. The field is the direct control for that interval.

enhanced_fan_out registers a dedicated enhanced fan out consumer. The notes give that consumer 2MB/s of read throughput per shard and keep it off the shared 5 reads per second limit. The cost is a separate consumer on the stream. Pipelines that already share the shard, and that stall on the shared cap, are the ones that benefit. An input that never approaches 5 reads per second does not gain throughput from the registration.

The same pull request fixes an expired cursor. When a stored sequence has aged out of the retention window, the input falls back to the oldest retained record instead of retrying the stale position indefinitely. Records the stream has already dropped are not replayed.

The iceberg output can name a parquet compression codec in #4785. Supported values are snappy, gzip, and zstd. The configuration falls back to table properties for compatibility with the codec the table already declares. Set the field when this pipeline should override the table. The notes do not publish size or CPU numbers for the three codecs.

#4784 removes allocations in the Iceberg shredder on case sensitive record matching. Memory use and CPU overhead in the shredding step fall by 42 percent. That figure is the shredding step, not the whole pipeline, and the notes do not extend it to other match modes. There is no new config key. Treat this as an internal cost cut on that path.

Avro decompression picks up a size cap in #4773. max_decompressed_block_bytes limits how large an object container file block may expand, so a decompression bomb cannot become a denial of service against the pipeline process. The notes do not state a default. Set the cap to the largest expanded block you are willing to hold.

#4795 bumps amqp091-go to address CVE-2026-79921. The notes list a general dependency bump. They name the library and the CVE, and they do not describe the bug or add a config key.

#4745 fixes mysql_cdc so table names can contain Unicode characters MySQL already permits, including accented Latin, CJK, and Cyrillic identifiers. Before this tag the connector rejected those names.

#4777 changes SFTP rotation. The input advances to the next file without reconnecting, which removes the delay of a new session between files. The notes do not mention auth or path filters.

The websocket check fails configs that older builds accepted. With tls.enabled: true and a ws:// URL, TLS settings were silently ignored, the socket stayed plaintext, and configured basic_auth, jwt, or oauth credentials were sent in the clear. v4.109.0 refuses to start that config. Use a wss:// URL when the socket should be TLS. If the TLS block was turned on against a plaintext URL by mistake, remove it or the process exits at startup. The notes credit @Leward and do not cite a pull request number for this check.

Expired Kinesis sequences no longer retry forever. The input moves to the oldest retained record. A stuck cursor is no longer the signal that retention trimmed the stream. The gap up to that oldest record is not available to replay.

The Avro cap, poll_period, enhanced_fan_out, and the parquet codec are new fields. Only the codec notes an explicit fallback, to table properties. Defaults for the other three fields are not in the release notes, so read the component config in your tree before assuming an unset field matches the previous release. The websocket scheme check and the expired sequence fallback apply with no new opt in field.

Installation steps are in the getting started guide. The repo change log is CHANGELOG.md.