Release Notes for Apicurio Registry 2.0

IPT-651 - Error deserializing Protobuf message when getting schema from Apicurio Registry

The Kafka producer application can set the schema, but the consumer application fails to get the schema from the registry and raises a org.apache.kafka.common.errors.SerializationException with an error such as:

IPT-625 - Error uploading artifact to Apicurio Registry with KafkaSQL storage

When Apicurio Registry is installed with the KafkaSQL storage option, an io.apicurio.registry.storage.RegistryStorageException is raised when a new artifact is uploaded. Possible error messages include SQL error: Expected one element, but found none.

IPT-159 - Registry v1 API and Confluent compatibility API mismatch

Existing users migrating to Apicurio Registry v2.x were required to upgrade all of their Kafka client applications that use Apicurio Registry v1 serializers/deserializers (SerDes) to use the Apicurio Registry v2 SerDes instead.

Registry-1619 - Apicurio Registry server cannot be properly configured to require authentication without role-based authorization

When role-based authorization is disabled in the Apicurio Registry server, authentication is effectively also disabled. Even when OpenID Connect is enabled in Quarkus, users are not required to provide credentials. If a user provides invalid credentials, a request fails. However, if a user provides no credentials, the request succeeds on behalf of an anonymous user. And because roles are disabled, no additional checking is done.

Registry-1289 - Registry does not work on IPv6

When trying to deploy Apicurio Registry using the Operator on a Kubernetes server with Internet Protocol v6, the registry server fails to start.

Registry-1151 - Error fetching JavaScript libraries when running in a closed network

When running in a closed network, the Redoc JavaScript libraries do not load properly because they reference a CDN rather than get included or bundled in the application.

Registry-1007 - Registry REST API returns 406 error

The Registry REST API returns a 406 error when the Accept: application/json header is included in the request.

Registry-711 - Apicurio Registry client does not work with Jersey HTTP client

When the Jersey and RESTEasy JAX-RS providers are both in the classpath, RESTEasy takes precedence and breaks other HTTP client functionality relying on Jersey client support for the application/octet-stream transport, which RESTEasy does not seem to support.

Operator-41 - Example CRD is empty

The provided example ApicurioRegistry custom resource definition should not be empty.

Registry-2394 - Apicurio Registry API endpoint for core v1 compatibility not properly protected by authentication

The legacy MY-REGISTRY-URL/api/ endpoint is an alias for the v1 core registry API that moved to MY-REGISTRY-URL/apis/registry/v1 in Apicurio Registry v2.x. This legacy endpoint is currently not protected when authentication is configured. This issue is fixed in Apicurio Registry v2.1.x, where the authentication layer no longer uses the Quarkus policies configured in application.properties.

IPT-701 - CVE-2022-23221 H2: Loading of custom classes from remote servers through JNDI

When Apicurio Registry data is stored in AMQ Streams, the H2 database console allows remote attackers to execute arbitrary code using the JDBC URL. Apicurio Registry is not vulnerable by default and a malicious configuration change is required.

Operator-42 - Auto-generation of OpenShift route may use wrong base host value

The auto-generation of the Apicurio Registry OpenShift route may use a wrong base host value if there are multiple routerCanonicalHostname values.

Operator-32 - Operator should support SCRAM authorization without TLS, not only SCRAM+TLS

The Apicurio Registry Operator should support Salted Challenge Response Authentication Mechanism (SCRAM) authorization without Transport Layer Security (TLS), not only SCRAM+TLS.