What's new.

- Added: - Every Kpow REST endpoint as a `fh kafka …` command, with table, JSON and YAML output - Identifiers are arguments (`fh kafka topic get orders`); scope is a flag (`--cluster`, `--connect`, `--registry`) - One `fh kafka schema …` tree for Confluent and AWS Glue registries - Sign in with basic auth or OpenID Connect (`fh auth login` opens the browser; tokens refresh automatically) - Named contexts for multiple deployments (`fh config context …`, `--context`, `FH_CONTEXT`) - `fh tui`: a live terminal UI over the Kpow data feed, covering overview, signals, data inspect, topics, consumer groups, Kafka Streams, schema registries, brokers, Kafka Connect and Flink - Topic create, add partitions and delete, and consumer group offset reset, from the TUI; staged mutations wait for approval as they do in Kpow - Pin a topic or group to narrow every view to it; sort any list by any column; `?` shows the keys for the current view - `fh skills install` puts seven Kpow agent skills into Claude Code, Codex, GitHub Copilot and other Agent Skills clients - Signed checksums, an SBOM per archive and a vulnerability report with every release

### New features - Signals (Alpha) - early access version ### Bug fixes - Fix Connector configuration modal overflow issue for large values - Fix "View groups" topic action to redirect to Groups dimension of the consumer groups panel - Fix API + tenancy regressions in list clusters, topics, and consumer groups endpoints - kJQ AI query generation: include associated schemas for additional model context ### CVE Resolved - CVE-2026-34481: MEDIUM - cpe:2.3:a:apache:log4j

### New features - New "Bulk clone to topic" functionality - Extending support to all Avro logical types (Note: see release notes details to understand what has been removed as part of this work) - Introducing a new display preference to persist Avro schema field order in Data Inspect result - Introducing configurable default display preferences for Data inspect results - Introducing an ability to pre-fill Data Inspect search form based on the query from the selected results tab - Adding Group overage support for Microsoft Entra when users belong to more than 150 groups - Introducing a new in-line schema references expansion and navigation view ### Bug fixes - Ensuring simple consumer reads are reflected in Topics view - Removing confusing Count column from Data inspect metrics view in Admin UI - Fixing the UI bug when viewing connector configuration with long topic list - Fixing Clone to topic functionality not cloning header details - Fixing Clone to topic partition and offset form fields display issues - Fixing Big Query and MSK connector topic inference issues - topics appearing blank - Adding better error messages when running Kpow enterprise with a Community license - Adding better error messages around Header SerDes when performing Key mode search in Data Inspect ### CVE Resolved - CVE-2026-45249: MEDIUM - echarts - CVE-2026-45536: MEDIUM - cpe:2.3:a:netty:netty - CVE-2026-48059: HIGH - cpe:2.3:a:netty:netty - CVE-2026-47244: MEDIUM - cpe:2.3:a:netty:netty - CVE-2026-44249: HIGH - cpe:2.3:a:netty:netty - CVE-2026-44893: HIGH - cpe:2.3:a:netty:netty - CVE-2026-48043: HIGH - cpe:2.3:a:netty:netty - CVE-2026-45673: MEDIUM - cpe:2.3:a:netty:netty - CVE-2026-45416: HIGH - cpe:2.3:a:netty:netty - CVE-2026-44250: HIGH - cpe:2.3:a:netty:netty - CVE-2026-48006: HIGH - cpe:2.3:a:netty:netty - CVE-2026-45674: CRITICAL - cpe:2.3:a:netty:netty - CVE-2026-44890: HIGH - cpe:2.3:a:netty:netty - CVE-2026-50560: MEDIUM - cpe:2.3:a:netty:netty - CVE-2026-50020: MEDIUM - cpe:2.3:a:netty:netty - CVE-2026-50011: HIGH - cpe:2.3:a:netty:netty - CVE-2026-46340: HIGH - cpe:2.3:a:netty:netty - CVE-2026-50010: HIGH - cpe:2.3:a:netty:netty - CVE-2026-47691: CRITICAL - cpe:2.3:a:netty:netty - CVE-2026-41240: MEDIUM - cpe:2.3:a:cure53:dompurify - CVE-2026-0540: MEDIUM - cpe:2.3:a:cure53:dompurify - CVE-2025-15599: MEDIUM - cpe:2.3:a:cure53:dompurify - CVE-2026-54516: MEDIUM - cpe:2.3:a:fasterxml:jackson-databind

- Update to JVM 25 and Jetty 12.1 - Introduce data lineage derived from schema registry metadata - Introduce new 'Clone to topic' function for message replay without modification - Introduce wildcard '\*' action for RBAC policies - Introduce `SNAPSHOT_CONFIG_PERIOD_MS` to provide configurable config period - Introduce `JETTY_SECURE_COOKIE` flag to require secure cookies when ssl terminated at proxy - Improve UI behavior and performance with large datasets and long field-names - Improve broker and topic filtering when viewing consumer groups - Improve tenant materialization performance - Fix empty consumer count by removing simple consumers from the empty consumer total - Fix simple consumer topic summary information - Fix OpenID Connect authentication error when presented with an overage claim - Fix sort-by columns for consumer topic, host, and broker views - Fix potential OOM when supporting a high number of concurrent users - Fix simple consumer offset-reset function ### CVE Resolved - CRITICAL CVE-2026-4140 org.apache.mina:mina-core - CRITICAL CVE-2026-4163 org.apache.mina:mina-core - CRITICAL CVE-2026-4277 org.apache.mina:mina-core - CRITICAL CVE-2026-4277 org.apache.mina:mina-core - CRITICAL CVE-2026-4202 org.apache.opennlp:opennlp-tools - CRITICAL CVE-2026-4068 org.apache.opennlp:opennlp-tools - HIGH CVE-2026-4258 io.netty:netty-codec - HIGH CVE-2026-4257 io.netty:netty-codec-dns - HIGH CVE-2026-4258 io.netty:netty-codec-http - HIGH CVE-2026-4258 io.netty:netty-codec-http - HIGH CVE-2026-4258 io.netty:netty-codec-http2 - HIGH CVE-2026-34480 org.apache.logging.log4j - HIGH CVE-2026-34478 org.apache.logging.log4j - HIGH CVE-2026-4244 org.apache.opennlp:opennlp-tools - HIGH CVE-2026-233 org.eclipse.jetty:jetty-http - MEDIUM CVE-2026-4258 io.netty:netty-codec-http - MEDIUM CVE-2026-4258 io.netty:netty-codec-http - MEDIUM CVE-2026-4258 io.netty:netty-codec-http - MEDIUM CVE-2026-4141 io.netty:netty-codec-http - MEDIUM CVE-2026-686 io.vertx:vertx-core - MEDIUM CVE-2026-3447 org.apache.logging.log4j:log4j-1.2-api - MEDIUM CVE-2026-3447 org.apache.logging.log4j:log4j-core - MEDIUM CVE-2026-3447 org.apache.logging.log4j:log4j-core - MEDIUM CVE-2026-3448 org.apache.logging.log4j:log4j-core - MEDIUM CVE-2024-676 org.eclipse.jetty:jetty-http - LOW CVE-2026-4257 io.netty:netty-handler-proxy - LOW CVE-2025-1114 org.eclipse.jetty:jetty-http

### Kpow #### Added - Added a new "Snapshot age" table in the admin performance UI to better debug Kpow's internal compute #### Fixed - Fixed regression in Kafka OAuth authentication #### Changed - Improved logging around internal observation and materialization for better debugging - Improve UI performance for large Kafka deployments - Revert base Docker image of main tag back to Java17 from Java21

### Kpow #### Added - Data inspect workers to handle concurrent queries - Strimzi support - Code folding in the Schema Registry editor for Avro and JSON schemas. - Base64 deserializer in data inspect #### Fixed - Empty consumers reset offset actions available in UI - Empty consumer lag calculation - Auto SerDes: allow fallback to String when data policies applied #### Changed - Added simple consumers by dimension in UI - Added simple consumer offset management actions - Added `deploymentAnnotations` on Helm Charts - Sort tenancy overview UI alphabetically and add sorting options - Consumer offset management: add controls to reset a topic to start, commit or end positions - The Kafka internal topic `__transaction_state` is included in Kpow's `hide_internal_resources` tenant ### Flex #### Fixed - Job chart dropdown presets now use record reads & writes for sorting #### Changed - Added `deploymentAnnotations` on Helm Charts

### Kpow v95.3 #### Fixed - Fix memory leak impacting customers running with in-memory compute ### Flex v95.3 #### Fixed - Fix memory leak impacting customers running with in-memory compute

### Kpow v95.2 #### Added - Support for simple consumer group offset management #### Changed - Update heatmap UI component state colour palette - Prometheus egress: support the `env` field for all resource types (ksqlDB, Connect, Schema, Flink, etc) - Helm: add API configuration options and a new flag to control automatic mounting of service account API credentials (default: false) ([Kubernetes docs](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting)). #### Fixed - Fixed a bug in the consumer group UI where Empty consumers were not appearing in the Topic dimension - Fixed advanced filters in the consumer groups UI by dimension - Data inspect: fix regression handling results with deserializaiton errors ### Flex v95.2 #### Changed - Update heatmap UI component state colour palette - Add chart/configuration to Job state in Home & Jobs - Prometheus egress: support the `env` field for all resource types (ksqlDB, Connect, Schema, Flink, etc) - Helm: add API configuration options and a new flag to control automatic mounting of service account API credentials (default: false) ([Kubernetes docs](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting)).

### Kpow v95.1 #### Added - GCP Integration - temurin-ubi build of Kpow now targets GCP MSAK. - Due to a [bug](https://github.com/googleapis/managedkafka/issues/51) in Google's `GcpBearerAuthCredentialProvider` disallowing multiple credential providers on the classpath at once, GCP functionality is provided in a separate build until resolved. - Data Inspect - Data rule support for Confluent Schema Registry SerDes, supports CEL, CEL\_FIELD, and JSONata data rules when querying for data - ksqlDB - New KSQLDB\_TIMEOUT\_MS configuration option. Default=30s - Access Control - Add ENABLE\_INTERNAL\_TENANT=false environment variable to control the visibility of Kpow’s hide internal resources tenant (simple access control only) #### Changed - Branding - Updated logos, icons, and favicons (light + dark mode) across Community Edition and Enterprise. - Charts - Line charts now consistently colour a series across charts on the same page - Line charts now support keyboard interaction when focused (left and right arrow keys) - Tables - Consistent alignment for readability. Numeric columns (and their headers) are now right-aligned, all other columns are left-aligned to better distinguish IDs/text from numbers - Data Inspect - Updated the kJQ search keybinding to Cmd + Shift + F / Ctrl + Shift + F - Connect - Improved usability & responsiveness of task stacktrace modal, and added new ‘copy to clipboard’ button - Performance - Improved performance of core materialization engine. Larger deployments of Kpow should see significantly less CPU and memory pressure. #### Fixed - Schema Registry - Fixed a bug when observing Karapace Schema Registry schemas - Overview filters are now retained when you drill into a subject and navigate back - Added support for primitive type name Avro schemas (boolean, int, long, string) - Metrics - Fixed a bug introduced in 94.6 where some aggregated metrics weren’t being published ### Flex v95.1 #### Changed - Branding - Updated logos, icons, and favicons (light + dark mode) across Community Edition and Enterprise. - Charts - Line charts now consistently colour a series across charts on the same page - Line charts now support keyboard interaction when focused (left and right arrow keys). - Tables - Consisent alignment for readability. Numeric columns (and their headers) are now right-aligned, all other columns are left-aligned to better distinguish IDs/text from numbers

### Platform v94.6 **Factor Platform** - First Factor Platform release candidate ### Kpow v94.6 **Kpow** - **Upgrades** - Upgraded to Kafka Clients **4.1.0** and Confluent Libraries **8.0.0**. - Updated Confluent Serdes (including Protobuf) to **v4.31.1** to resolve security vulnerabilities and improve serialization resilience. - **Enhancements** - Data Inspect: Expanded kJQ capabilities with new **`map`** and **`select`** operators. - Improved Schema Registry integration: added additional createdAt metadata (supported in Confluent Schema Registry 8.0.0+ or AWS Glue) - Improved the Amazon MSK connector BOOTSTRAP environment variable matching condition to ensure all applicable connectors are displayed. - **Bug Fixes** - Resolved an issue in LDAP auth for creating OBF-obfuscated values. - Schema: Fixed a bug that resulted an incomplete list of schemas when using Confluent Schema Registry and SCHEMA\_REGISTRY\_OBSERVATION\_VERSION=2. - Schema: Fixed a bug where the schema ID was not updated when selecting different schema versions. - Schema Registry integration: Fixed a bug where the schema version ID stat would not update when switching between revisions - Data Inspect: Fixed a serialization exception when searching by key mode with AVRO keys. - Data Inspect: Fixed incorrect display of large numeric values that exceed the browser's native maximum value. - Data Inspect: Fixed raw formatted results overflowing the results container. - Data Inspect: Fixed ghost data appearing when closing a tab during a streaming search. - Connect: Enhanced summary statistics to display both connector-level and task-level counts separately for Running, Paused, Failed, and Unassigned states. - Topology: Fixed missing edges in exported topology diagrams, improving rendering quality for downloaded images. - Fixed CVE-2025-49794 security vulnerability in libxml2. ### Flex v94.6 **Flex** - **Integrations** - Introduced integration with **Ververica Platform (Community and Enterprise v2)** for native Apache Flink® management and observability within the Factor House ecosystem. - **Bug Fixes** - Flink clusters in the top-level menu and tenant selector now respect [**multi cluster configuration**](https://docs.factorhouse.io/flex/configuration/flink-cluster#multi-cluster) ordering. - Fixed incorrectly labeled sinks in Job's Inspect > Topology diagram. - Increased the timeout when submitting a job, which was incorrectly reporting a failure to start the job.