Redpanda Connect v4.107.2 - DynamoDB CDC Lint And Snapshot Barriers

Redpanda Connect v4.107.2 shipped on 31 August 2026. Config lint for aws_dynamodb_cdc no longer rejects valid snapshot_throttle durations, and an expired DynamoDB shard iterator is now a permanent error instead of an infinite retry. The same tag reworks SQL Server and Oracle snapshot barriers so a failed publisher does not drop records or loop.

The full release notes and downloads are on the GitHub release page.

aws_dynamodb_cdc had a lint rule that compared a duration string to a numeric literal. Valid snapshot_throttle values then failed configuration validation, so the pipeline never started. PR 4723 fixes the comparison. If a DynamoDB CDC job was rejected at load with a type error on that field, this tag is the first thing to rerun against the same YAML.

A second DynamoDB bug shows up after the pipeline is already running. When a stream shard is deleted, the shard iterator can expire. That error was treated as transient, so the connector retried without bound. PR 4727 classifies the error as permanent. Operators get a hard failure instead of a retry storm after shard teardown. The blast radius is any table stream whose shards were deleted while Connect still held an iterator.

The two fixes pull in opposite directions. Lint now lets a legal duration through. Iterator expiry now fails closed. Start the job when the config is valid. Stop the job when the shard is gone.

mssqlserver_cdc and oracledb_cdc both received the same class of fixes: snapshot barrier behavior, batch ordering, and publisher lifecycle. The notes say those failures produced data loss and infinite retries after a publisher error. The SQL Server work is PR 4677. The Oracle work is PR 4675.

SQL Server also had a silent stall when the flush loop failed. The process stayed up while no longer flushing. PR 4729 detects that failure and reconnects from the last durable checkpoint. A reconnect is visible in lag and in restart time. A silent stall is not. Prefer the reconnect.

MongoDB and PostgreSQL CDC share a related contract fix in PR 4676: nack handling, marshal error recovery, and streaming checkpoint persistence. The notes frame this as a contract violation, not a new feature. If nacks and marshal errors did not persist checkpoints the way the CDC layer claimed, source offsets and downstream offsets could drift. That is an internal repair with operator visible checkpoint effects. Treat it as a reason to compare stored checkpoints before and after the upgrade on MongoDB and PostgreSQL CDC jobs.

gcp_spanner_cdc could persist watermarks out of order and mishandle the partition batcher lifecycle. On restart, records could be skipped. PR 4686 is the fix. Recheck Spanner CDC jobs that restarted during a partition batcher cycle. Skipped records will not replay themselves if the watermark already moved.

SFTP sits outside the CDC work. Modern OpenSSH servers reject classic ssh-rsa during host key negotiation. Connect now advertises rsa-sha2 algorithms when a pinned RSA key is in use. That is PR 4725. Pipelines that talk to current OpenSSH with a pinned RSA host key should handshake again. If an SFTP input or output failed against a recently patched OpenSSH box while the same pin still worked on older daemons, this is the matching fix.

The one listed behavior change is on Oracle snapshots. PR 4696 removes snapshot primary key ordering. The notes give snapshot performance as the reason. Snapshot rows may arrive in a different order than before. Downstream processors that treated arrival order as PK order during the snapshot window need a review. The notes do not say streaming after snapshot changed.

Winners are snapshot throughput on Oracle CDC jobs. Losers are any transform that inferred key order from the snapshot batch. If the pipeline already sorts or keys on the primary key column, arrival order does not matter. If it does not, add an explicit sort before cutting over.

The notes list no config key rename and no migration step. Revisit snapshot_throttle on DynamoDB CDC configs that previously failed lint. Revisit SFTP host key pins if the peer is a current OpenSSH server. Install steps stay on the getting started guide. The changelog file in the repo is CHANGELOG.md.