Conduit v0.21.0 release

Upgrade to v0.21.2

Skip v0.21.0 and v0.21.1. Upgrade to v0.21.2.

v0.21.0 refuses to start every pipeline that has no dead-letter-queue block, including the hello-pipeline example and the template gallery, with pipeline.dlq_not_recoverable. The default DLQ never receives a record (the first nack stops the pipeline and the record is not acked), so v0.21.2 refuses a hash-only log DLQ only when it does receive records. No data is lost by the refusal: the pipeline does not start. v0.21.1 was tagged but never built.

Correction (2026-11-03): an earlier version of this post described features that did not ship in v0.21.0. The post now describes what the release contains. The items that did not ship are listed at the end, with where each one is planned.

Conduit v0.21.0 ships the first slice of the Kafka Connect migration work: conduit migrate kafka-connect for Debezium Postgres, the S3 sink and MirrorMaker 2, five certified connectors, protocol v3 with lossless structured values, Protobuf decode, and secrets at rest. It also changes several defaults, so read the breaking changes below before you upgrade.

Breaking changes

Change	What to do
The HTTP/gRPC API binds to localhost by default. A listener on anything but loopback requires an auth token.	Keep the default localhost bind, or set a token when you bind the API to a network interface.
${VAR} references are allowlisted. Plugins and processors only receive variables named in the env.allow list.	Add every variable your config expands to the allowlist.
File and JavaScript paths are allowlisted. The file connector and the custom.javascript processor restrict reads, writes, and require to configured directories.	Configure the allowed directories for any path outside the default.
Outbound HTTP is guarded. Connector egress is checked at dial time against an allowlist.	Add each connector's outbound endpoint to the egress allowlist.
The log connector is metadata-only. It no longer writes record payload values; keys and positions are logged as salted hashes.	Set payload: true on the log connector if you need full record contents.
A pipeline with no recoverable DLQ refuses to start (pipeline.dlq_not_recoverable). A log DLQ without payload: true no longer counts. v0.21.0 also refused every pipeline with no dead-letter-queue block; v0.21.2 fixed that.	Configure a real DLQ, or a log DLQ with payload: true. Run v0.21.2 or later.
Kafka refuses SASL without TLS. A SASL mechanism that would send credentials in plaintext is refused unless saslAllowPlaintext: true.	Enable TLS, or set saslAllowPlaintext if you accept the exposure.
Postgres refuses a replaced replication slot. The source detects a slot recreated under the same name, a restored database, or a changed WAL history, and refuses to resume instead of silently losing data.	Re-snapshot after a restore; the source tells you when.

Record values and keys, request URLs and bodies, and registry URLs are also redacted from errors and logs. See the v0.21.0 release notes for the complete list.

Migrating from Kafka Connect

• conduit migrate kafka-connect. Reads a Kafka Connect worker and connector config and emits Conduit pipeline config plus a compatibility report. Every setting is translated, approximated, or flagged as blocking — the command never silently drops config it can't translate. v0.21 has rules for Debezium Postgres, the Confluent S3 sink, and MirrorMaker 2 (source, checkpoint and heartbeat). Other connector classes, including Debezium MySQL, JDBC and Elasticsearch, are reported as unsupported.
• Offsets are not imported. The report carries kc.offsets_not_migrated on every migration. A migrated pipeline starts from scratch: a Postgres pipeline re-snapshots, and a Kafka pipeline reads from the beginning.

Certified connectors

Five connectors are certified on the v0.21 protocol v3 releases, with the SDK acceptance suite v2 green. conduit migrate kafka-connect emits only builtin:postgres, builtin:kafka and builtin:s3; MySQL and Elasticsearch are certified but migrate has no rules for them yet.

• Postgres CDC — the built-in source, with the Debezium parity work (versioned positions, resumable snapshot, schema-drift policy) and a SIGKILL chaos harness.
• MySQL CDC (beta) — the labs mysql source. The connector README still calls it beta.
• Elasticsearch — the labs sink.
• Kafka — the built-in connector has a mirror mode that preserves partition, headers and timestamps. migrate does not turn mirror mode on: a MirrorMaker 2 migration keeps key, value and topic name, not partition, headers or timestamp, and the report says so.
• S3 — the built-in destination has Kafka Connect style partitioners, a bytearray format, gzip, and the AWS default credential chain (opt-in, through the operator's connectors.ambient-credentials allowlist). migrate does not map to these yet: an S3 sink migration is blocked on kc.output_shape_differs unless you pass --accept-gaps.

Notable features

• Protocol v3 and lossless structured values. int64, uint64, bytes, and decimal now cross the plugin boundary exactly — no 2^53 rounding, no []byte→base64, no NaN/Inf→string. Processors that declare structured_values_v2 receive the lossless records.
• Protobuf decode for Confluent Schema Registry, as the built-in protobuf.decode processor. Decode only; Conduit does not register Protobuf schemas.
• Secrets at rest. ${VAR} references are no longer stored in plaintext; they are resolved when a connector, processor, or DLQ is provisioned.
• Processor input isolation keeps DLQ records faithful.
• Connector observability. Per-connector record and error counters.
• Python connector scaffold. conduit connector new --lang python scaffolds a connector on the merged conduit.connector / conduit.client distribution. Connectors only; processors are rejected. The generated pyproject.toml depends on conduitio>=0.1.0.dev0, but conduitio on PyPI is only a 0.0.0 placeholder, so the generated project's dependencies do not install yet. The Python SDK is not GA.
• Catalog. Quality tiers are in the registry index: the five certified connectors above, and nine labs connectors at community tier.
• Engine. arch-v2 grows toward the single engine, and the benchi regression gate is live.

Protocol version 2 deprecation

Protocol v2 remains fully supported and is what existing plugins negotiate. Protocol v3 is used only when both peers support it. Protocol v2 will be deprecated with a warning in v0.22 and removed no earlier than v0.24. No user action is required for v0.21.

Migrating

Start with the migration guide, or read the migration command's --help. The command prints a compatibility report for every run, so you can see exactly what translated, what was approximated, and what would block before you switch.

Not in v0.21.0

Earlier versions of this post listed the following. They are not in v0.21.0, v0.21.1 or v0.21.2.

• Offset import and "no re-snapshot for Postgres". migrate does not read Debezium offsets. Planned for v0.22.
• Migration rules for Debezium MySQL, JDBC source and sink, and Elasticsearch/OpenSearch. Planned for v0.22.
• Debezium-compatible output for Postgres, "verified against real Debezium". Not usable. The debezium.encode processor (JSON converter only) and the Debezium golden captures are in the repository, but the processor is not registered as a built-in, the Postgres source has no Debezium output mode, and the Kafka destination cannot write its messages. Not scheduled.
• "Every connector migrate emits is certified" as a statement about Debezium MySQL, JDBC and Elasticsearch. migrate does not emit them yet. Planned for v0.22 with their rules.
• OpenSearch certification. No evidence it was tested. Not scheduled.
• Kafka→Kafka partition, header and topic preservation through migrate. The connector can do it; migrate does not enable it. Not scheduled.
• S3 sink format and partitioning parity through migrate. The connector has the options; migrate does not use them. Not scheduled.
• Processor batch API and the stateless declaration. Design only; the implementation PR (#3184) is open. Not scheduled.
• Python connector SDK GA and a published merged Python distribution. Not scheduled.