Start | Dynamic Engine changelog Help

Release information

Release Name: Dynamic Engine 1.7.0 (October 2026)
Release Date: October 7, 2026
Compatibility: Kubernetes v1.34 and above

Notable new features

Notable new features grouped by mechanism
Feature	Description	Ticket	Related documentation
Native execution and multi-platform images	Dynamic Engine uses native execution, produces multi-platform image manifests, and uses Native Image for init containers. Docker native jobs use consolidated handling and corrected image tag names.	DPE-4326, DPE-3936, DPE-4111, DPE-4120	No dedicated configuration topic. These changes primarily improve execution and image handling.
Job-data persistence and lifecycle	Persistence is disabled by default in v1.7.0, so the default deployment does not create persistent volumes or claims for shared storage. PVC support is restored with a deprecation notice, and PVC use is reduced to jobData. The embedded docker-registry service is also non-persistent by default; its images are lost if its pod restarts. Configure persistence when you need to retain Job data or registry images.	DPE-3607, DPE-3736, DPE-3911, DPE-3275, DPE-3758, DPE-3414, DPE-3192	For configuration and upgrade paths, see Default Helm deployment and Upgrading Dynamic Engine to 1.7.0 with persistent storage.
OpenTelemetry logging	Logging uses an OpenTelemetry-compliant format. The LOGGING_LAYOUT setting selects the otel or text layout, and an OpenTelemetry-compatible JSON formatter replaces ecs_logging.	DPE-3827	No dedicated configuration topic. This change updates logging format and configuration behavior.
CBP routes and metrics	Non-CBP Routes, Java agent and CBP metrics configuration, Prometheus support, and unique FlowdId values in image names are supported.	DPE-3391, DPE-3395, DPE-3471	No dedicated configuration topic. These changes primarily add runtime and monitoring capabilities.
SSL/TLS and HTTPS configuration	SSL/TLS configuration includes SSL bundle support for ConfigManagerClient, the qlik-ssl profile, and HTTPS support in the engine-config-manager sidecar with a CA bundle.	DPE-3388, DPE-3037, DPE-3393, DPE-3302	No dedicated configuration topic is listed for these release changes.
Job lifecycle and lineage	Job services handle terminated and not-found Jobs and expose lineage processing status in the Jobs ConfigMap.	DPE-3758, DPE-3414, DPE-3192	No dedicated configuration topic. These changes primarily improve runtime job handling.
Telemetry and service efficiency	Services send data only when needed, add fluent-bit only when needed, and use the v2 Ipaas heartbeat endpoint.	DPE-4070, DPE-4311, DPE-3522	No dedicated configuration topic. These changes primarily improve service efficiency.
Runtime and deployment improvements	A Talend Management Console version file is generated for runtime use, Java applications receive Kubernetes SIGTERM, the central region is removed, and affinity is supported.	DPE-3769, DPE-3426, DPE-4111	For affinity configuration, see Configuring affinity and node selector rules.
Build and release improvements	The di-job-deployer API library is built with Java 21, Docker images are attested on release, and builds use common Jenkins secrets for Artifactory credentials.	DPE-3982, DPE-3016, DPE-4049	No dedicated configuration topic. These changes primarily affect build and release processes.
S3 proxy support	The S3 client supports HTTP and HTTPS proxies.	DPE-3532	No dedicated configuration topic is listed for this release change.

Key improvements and fixes

DPE-3613, DPE-4067, DPE-4068, DPE-4040, DPE-3826, DPE-3539: Improved engine configuration and versioning, including configuration retrieval, startup initialization, token refresh, and context fallback behavior.
DPE-3607, DPE-3736, DPE-3911, DPE-3275: Improved Job deployment and lifecycle behavior, restored PVC support with a deprecation notice, rejected Jobs without an image name, corrected resource ownership and DeployEvent handling, and added a readiness HealthIndicator.
DPE-4314, DPE-3481, DPE-3447, DPE-3470, DPE-3607: Improved data handling and error responses for rejected data, lineage processing, non-200 responses, NAME_UNKNOWN, and Job error messages.
DPE-3691, DPE-3508, DPE-3777, DPE-3692, DPE-2196, DPE-4068: Improved certificate and credential handling, brace-containing value masking, S3 trust-store handling, and artifact-downloader configuration.
DPE-3827, DPE-3680, DPE-3914: Improved command logging, propagated LOGGING_LAYOUT, rolled out the operator when its ConfigMap changes, and limited shell option removal to the intended options.

Included services

Installer charts
Helm chart name	Chart version	Scope	Artifact path
dynamic-engine-crd	1.7.0	Custom resource definitions	ghcr.io/talend/helm/dynamic-engine-crd
dynamic-engine	1.7.0	Dynamic Engine infrastructure	ghcr.io/talend/helm/dynamic-engine
dynamic-engine-environment	1.7.0	Dynamic Engine environment	ghcr.io/talend/helm/dynamic-engine-environment

Service charts
Service	Chart version	Artifact path
reloader	2.2.12	ghcr.io/talend/helm/reloader
docker-registry	3.0.0	ghcr.io/talend/helm/docker-registry
engine-config-manager	2.15.0	ghcr.io/talend/helm/dpe-engine-config-manager
di-job-deployer	1.39.0	ghcr.io/talend/helm/dpe-di-job-deployer
di-job-controller	1.34.0	ghcr.io/talend/helm/dpe-job-controller
log-collector	1.14.0	ghcr.io/talend/helm/dpe-log-collector
data-service-route-deployer	1.21.0	ghcr.io/talend/helm/dpe-data-service-route-deployer
metrics-agent	0.7.1	ghcr.io/talend/helm/dpe-metrics-agent
metrics-config-manager	0.6.1	ghcr.io/talend/helm/dpe-metrics-config-manager

Service images
Service	Image version	Feature	Artifact path
engine-operator	1.8.0	Infrastructure	ghcr.io/talend/engine-operator
reloader	v1.4.17	Infrastructure	ghcr.io/talend/reloader
docker-registry	3.1.1	Infrastructure	ghcr.io/talend/registry
engine-config-manager	1.16.0	Pairing	ghcr.io/talend/engine-config-manager
di-job-deployer	2.29.0	Data Integration	ghcr.io/talend/di-job-deployer
di-job-controller	2.27.0	Data Integration	ghcr.io/talend/job-controller
di-job-restore-orphans	1.24.0	Data Integration	ghcr.io/talend/di-job-restore-orphans
log-collector	1.14.0	Common	ghcr.io/talend/dynamic-engine-log-collector
fluent-bit	5.0.8	Common	ghcr.io/talend/fluent-bit
data-service-route-deployer	1.16.0	Data Services and Routes	ghcr.io/talend/data-service-route-deployer
image-builder	1.14.0	Data Services and Routes	ghcr.io/talend/image-builder
metrics-agent	0.4.0	Metrics	ghcr.io/talend/dynamic-engine-metrics-agent
metrics-config-manager	0.4.0	Metrics	ghcr.io/talend/dynamic-engine-metrics-config-manager

Artifact signature verification

Qlik provides digital signatures for all official images and Helm charts from Dynamic Engine v0.22 onwards. All artifacts are signed at build time with an asymmetric key pair: the private key is used for signing, and the public key is made available for signature verification.

For further information about this optional authenticity check of Dynamic Engine artifacts, see Security option: Verifying Dynamic Engine artifact signatures.

Fixed CVEs

The following CVEs were corrected in the listed services. This table is provided for reference.

Fixed CVEs by service
Service	Components and CVEs
data-service-route-deployer	Jackson Core: CVE-2026-68494. Jackson Databind: CVE-2026-19032, CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54516, CVE-2026-54517, CVE-2026-54518, CVE-2026-59888, CVE-2026-59889, CVE-2026-68497, CVE-2026-77310, CVE-2026-83557, CVE-2026-91776, CVE-2026-91777. Netty: CVE-2026-59901, CVE-2026-73508, CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-56746, CVE-2026-59898, CVE-2026-59899, CVE-2026-59903, CVE-2026-59921, CVE-2026-56819, CVE-2026-59900, CVE-2026-56816, CVE-2026-75595, CVE-2026-75596. Java: CVE-2026-46917, CVE-2026-46968, CVE-2026-47010, CVE-2026-47021, CVE-2026-47027, CVE-2026-47059, CVE-2026-47063, CVE-2026-60147, CVE-2026-62574. ActiveMQ Client: CVE-2026-49432, CVE-2026-49434, CVE-2026-49877, CVE-2026-50734, CVE-2026-50750, CVE-2026-52760, CVE-2026-53916, CVE-2026-53917, CVE-2026-54475, CVE-2026-59878, CVE-2026-61487, CVE-2026-74761. Spring Retry: CVE-2026-41710. Spring Framework: CVE-2026-47883, CVE-2026-47885, CVE-2026-47886, CVE-2026-47887, CVE-2026-47888, CVE-2026-47889, CVE-2026-47891, CVE-2026-47893, CVE-2026-59280, CVE-2026-59281, CVE-2026-59282, CVE-2026-59283, CVE-2026-59313, CVE-2026-59314, CVE-2026-47892, CVE-2026-47890, CVE-2026-47884. Tomcat: CVE-2026-50229, CVE-2026-53404, CVE-2026-53434, CVE-2026-55276, CVE-2026-55955, CVE-2026-55956, CVE-2026-59083, CVE-2026-59084, CVE-2026-65182, CVE-2026-65183, CVE-2026-65637, CVE-2026-65905, CVE-2026-65927, CVE-2026-66299, CVE-2026-66422, CVE-2026-68525, CVE-2026-68569, CVE-2026-68763, CVE-2026-73180. Unassigned packages: CVE-2026-18401, CVE-2026-32990, CVE-2026-49270.
di-job-deployer	Jackson Core and Databind: CVE-2026-68494, CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54516, CVE-2026-54517, CVE-2026-54518, CVE-2026-59888, CVE-2026-59889, CVE-2026-77310. Java: CVE-2026-46917, CVE-2026-46968, CVE-2026-47010, CVE-2026-47021, CVE-2026-47027, CVE-2026-47059, CVE-2026-47063, CVE-2026-60147, CVE-2026-62574. Commons Configuration: CVE-2026-45205. Apache CXF: CVE-2026-44618, CVE-2026-44930, CVE-2026-54225, CVE-2026-57817, CVE-2026-57818, CVE-2026-57819, CVE-2026-61466, CVE-2026-63687, CVE-2026-64958, CVE-2026-65432, CVE-2026-65583, CVE-2026-66909, CVE-2026-68079, CVE-2026-68481. Apache HttpClient: CVE-2026-64607. Apache HttpCore: CVE-2026-54399, CVE-2026-54428. Log4j: CVE-2026-49844. Bouncy Castle: CVE-2026-13506, CVE-2026-8763. Spring Framework: CVE-2026-41838, CVE-2026-41839, CVE-2026-41840, CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41845, CVE-2026-41846, CVE-2026-41848, CVE-2026-41853, CVE-2026-41854, CVE-2026-41855, CVE-2026-47883, CVE-2026-47885, CVE-2026-47886, CVE-2026-47887, CVE-2026-47888, CVE-2026-47889, CVE-2026-47891, CVE-2026-47893, CVE-2026-59280, CVE-2026-59281, CVE-2026-59282, CVE-2026-59283, CVE-2026-59313, CVE-2026-59314, CVE-2026-47892, CVE-2026-47890, CVE-2026-47884, CVE-2026-41850, CVE-2026-41851, CVE-2026-41852. Unassigned packages: CVE-2025-48913, CVE-2026-18401, CVE-2026-34481.
di-job-restore-orphans	aiohttp: CVE-2026-59881, CVE-2026-69243, CVE-2026-69244. cryptography: CVE-2026-69247, CVE-2026-69248, CVE-2026-69249. oauthlib: CVE-2026-49264, CVE-2026-49265. pip: CVE-2026-13346. pyasn1: CVE-2026-59884, CVE-2026-59885, CVE-2026-59886. urllib3: CVE-2026-97687, CVE-2026-97688, CVE-2026-97689.
dynamic-engine-log-collector	Jackson Core: CVE-2026-89407, CVE-2026-89425. Jackson Databind: CVE-2026-19032, CVE-2026-54515, CVE-2026-54517, CVE-2026-54518, CVE-2026-59889, CVE-2026-68497, CVE-2026-77310, CVE-2026-83557, CVE-2026-91776, CVE-2026-91777. Netty: CVE-2026-59901, CVE-2026-73508, CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-56746, CVE-2026-59898, CVE-2026-59899, CVE-2026-59903, CVE-2026-59921, CVE-2026-56819, CVE-2026-59900, CVE-2026-56816, CVE-2026-75595, CVE-2026-75596. Java: CVE-2026-46917, CVE-2026-46968, CVE-2026-47010, CVE-2026-47021, CVE-2026-47027, CVE-2026-47059, CVE-2026-47063, CVE-2026-60147, CVE-2026-62574. Log4j: CVE-2026-49844. Spring Framework: CVE-2026-47883, CVE-2026-47885, CVE-2026-47886, CVE-2026-47887, CVE-2026-47888, CVE-2026-47889, CVE-2026-47891, CVE-2026-47893, CVE-2026-59280, CVE-2026-59281, CVE-2026-59282, CVE-2026-59283, CVE-2026-59313, CVE-2026-59314, CVE-2026-47892, CVE-2026-47890, CVE-2026-47884. Unassigned package: CVE-2026-34481.
dynamic-engine-metrics-agent	Jackson Databind: CVE-2026-19032, CVE-2026-54515, CVE-2026-54517, CVE-2026-54518, CVE-2026-59889, CVE-2026-68497, CVE-2026-77310, CVE-2026-83557, CVE-2026-91776, CVE-2026-91777. Netty codec and compression: CVE-2026-59901; DNS codec: CVE-2026-73508; HTTP codec: CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-56746, CVE-2026-59898, CVE-2026-59899, CVE-2026-59903, CVE-2026-59921; HTTP/2 codec: CVE-2026-56819, CVE-2026-59900; handler: CVE-2026-75595, CVE-2026-75596. Java: CVE-2026-46917, CVE-2026-46968, CVE-2026-47010, CVE-2026-47021, CVE-2026-47027, CVE-2026-47059, CVE-2026-47063, CVE-2026-60147, CVE-2026-62574. Apache CXF: CVE-2026-54225, CVE-2026-57817, CVE-2026-57818, CVE-2026-57819, CVE-2026-61466, CVE-2026-63687, CVE-2026-64958, CVE-2026-65432, CVE-2026-65583, CVE-2026-66909, CVE-2026-68079, CVE-2026-68481. Apache HttpClient: CVE-2026-64607. Apache HttpCore: CVE-2026-54399. Apache HttpCore H2: CVE-2026-54428. Log4j: CVE-2026-49844. Spring Retry: CVE-2026-41710. Spring Core and Web: CVE-2026-47883, CVE-2026-47885, CVE-2026-47886, CVE-2026-47887, CVE-2026-47888, CVE-2026-47889, CVE-2026-47891, CVE-2026-47893, CVE-2026-59280, CVE-2026-59281, CVE-2026-59282, CVE-2026-59283, CVE-2026-59313, CVE-2026-59314; WebFlux: CVE-2026-47892; WebFlux and WebMVC: CVE-2026-47890; WebMVC: CVE-2026-47884. Spring Security: CVE-2026-41707, CVE-2026-47841, CVE-2026-47842, CVE-2026-47877, CVE-2026-59270, CVE-2026-59276, CVE-2026-59277. Tomcat: CVE-2026-50229, CVE-2026-53404, CVE-2026-53434, CVE-2026-55276, CVE-2026-55955, CVE-2026-55956, CVE-2026-59083, CVE-2026-59084, CVE-2026-65182, CVE-2026-65183, CVE-2026-65637, CVE-2026-65905, CVE-2026-65927, CVE-2026-66299, CVE-2026-66422, CVE-2026-68525, CVE-2026-68569, CVE-2026-68763, CVE-2026-73180. Unassigned packages: CVE-2026-32990, CVE-2026-34481.
dynamic-engine-metrics-config-manager	Jackson Databind: CVE-2026-19032, CVE-2026-54515, CVE-2026-54517, CVE-2026-54518, CVE-2026-59889, CVE-2026-68497, CVE-2026-77310, CVE-2026-83557, CVE-2026-91776, CVE-2026-91777. Netty codec and compression: CVE-2026-59901; DNS codec: CVE-2026-73508; HTTP codec: CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-56746, CVE-2026-59898, CVE-2026-59899, CVE-2026-59903, CVE-2026-59921; HTTP/2 codec: CVE-2026-56819, CVE-2026-59900; handler: CVE-2026-75595, CVE-2026-75596. Java: CVE-2026-46917, CVE-2026-46968, CVE-2026-47010, CVE-2026-47021, CVE-2026-47027, CVE-2026-47059, CVE-2026-47063, CVE-2026-60147, CVE-2026-62574. Apache CXF: CVE-2026-54225, CVE-2026-57817, CVE-2026-57818, CVE-2026-57819, CVE-2026-61466, CVE-2026-63687, CVE-2026-64958, CVE-2026-65432, CVE-2026-65583, CVE-2026-66909, CVE-2026-68079, CVE-2026-68481. Apache HttpClient: CVE-2026-64607. Apache HttpCore: CVE-2026-54399. Apache HttpCore H2: CVE-2026-54428. Log4j: CVE-2026-49844. Spring Retry: CVE-2026-41710. Spring Core and Web: CVE-2026-47883, CVE-2026-47885, CVE-2026-47886, CVE-2026-47887, CVE-2026-47888, CVE-2026-47889, CVE-2026-47891, CVE-2026-47893, CVE-2026-59280, CVE-2026-59281, CVE-2026-59282, CVE-2026-59283, CVE-2026-59313, CVE-2026-59314; WebFlux: CVE-2026-47892; WebFlux and WebMVC: CVE-2026-47890; WebMVC: CVE-2026-47884. Spring Security: CVE-2026-41707, CVE-2026-47841, CVE-2026-47842, CVE-2026-47877, CVE-2026-59270, CVE-2026-59276, CVE-2026-59277. Tomcat: CVE-2026-50229, CVE-2026-53404, CVE-2026-53434, CVE-2026-55276, CVE-2026-55955, CVE-2026-55956, CVE-2026-59083, CVE-2026-59084, CVE-2026-65182, CVE-2026-65183, CVE-2026-65637, CVE-2026-65905, CVE-2026-65927, CVE-2026-66299, CVE-2026-66422, CVE-2026-68525, CVE-2026-68569, CVE-2026-68763, CVE-2026-73180. Unassigned packages: CVE-2026-32990, CVE-2026-34481.
engine-config-manager	Jackson Core and Databind: CVE-2026-89407, CVE-2026-89425, CVE-2026-19032, CVE-2026-54515, CVE-2026-54517, CVE-2026-54518, CVE-2026-59889, CVE-2026-68497, CVE-2026-77310, CVE-2026-83557, CVE-2026-91776, CVE-2026-91777. Netty: CVE-2026-59901, CVE-2026-73508, CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-56746, CVE-2026-59898, CVE-2026-59899, CVE-2026-59903, CVE-2026-59921, CVE-2026-56819, CVE-2026-59900, CVE-2026-56816, CVE-2026-75595, CVE-2026-75596. Java: CVE-2026-46917, CVE-2026-46968, CVE-2026-47010, CVE-2026-47021, CVE-2026-47027, CVE-2026-47059, CVE-2026-47063, CVE-2026-60147, CVE-2026-62574. Spring Retry: CVE-2026-41710. Spring Framework and Spring Security: CVE-2026-47883, CVE-2026-47885, CVE-2026-47886, CVE-2026-47887, CVE-2026-47888, CVE-2026-47889, CVE-2026-47891, CVE-2026-47893, CVE-2026-59280, CVE-2026-59281, CVE-2026-59282, CVE-2026-59283, CVE-2026-59313, CVE-2026-59314, CVE-2026-47892, CVE-2026-47890, CVE-2026-47884, CVE-2026-41707, CVE-2026-47841, CVE-2026-47842, CVE-2026-47877, CVE-2026-59270, CVE-2026-59276, CVE-2026-59277. Tomcat: CVE-2026-50229, CVE-2026-53404, CVE-2026-53434, CVE-2026-55276, CVE-2026-55955, CVE-2026-55956, CVE-2026-59083, CVE-2026-59084, CVE-2026-65182, CVE-2026-65183, CVE-2026-65637, CVE-2026-65905, CVE-2026-65927, CVE-2026-66299, CVE-2026-66422, CVE-2026-68525, CVE-2026-68569, CVE-2026-68763, CVE-2026-73180. Unassigned package: CVE-2026-32990.
engine-operator	Go: CVE-2026-56864, CVE-2026-56865.
image-builder	Jackson Core and Databind: CVE-2026-89407, CVE-2026-89425, CVE-2026-19032, CVE-2026-54515, CVE-2026-59889, CVE-2026-68497, CVE-2026-77310, CVE-2026-83557, CVE-2026-91776, CVE-2026-91777. Netty: CVE-2026-59901, CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-56746, CVE-2026-59898, CVE-2026-59899, CVE-2026-59903, CVE-2026-59921, CVE-2026-56819, CVE-2026-59900, CVE-2026-75595, CVE-2026-75596. Java: CVE-2026-46917, CVE-2026-46968, CVE-2026-47010, CVE-2026-47021, CVE-2026-47027, CVE-2026-47059, CVE-2026-47063, CVE-2026-60147, CVE-2026-62574. Apache HttpClient: CVE-2026-64607. Apache HttpCore: CVE-2026-54399. Apache HttpCore H2: CVE-2026-54428. Log4j: CVE-2026-49844. Unassigned package: CVE-2026-34481.
job-controller	Jackson Core and Databind, Netty, Java, Spring Framework, and Spring Security: CVE-2026-89407, CVE-2026-89425, CVE-2026-19032, CVE-2026-54515, CVE-2026-54517, CVE-2026-54518, CVE-2026-59889, CVE-2026-68497, CVE-2026-77310, CVE-2026-83557, CVE-2026-91776, CVE-2026-91777, CVE-2026-59901, CVE-2026-73508, CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-56746, CVE-2026-59898, CVE-2026-59899, CVE-2026-59903, CVE-2026-59921, CVE-2026-56819, CVE-2026-59900, CVE-2026-56816, CVE-2026-75595, CVE-2026-75596, CVE-2026-46917, CVE-2026-46968, CVE-2026-47010, CVE-2026-47021, CVE-2026-47027, CVE-2026-47059, CVE-2026-47063, CVE-2026-60147, CVE-2026-62574, CVE-2026-47883, CVE-2026-47885, CVE-2026-47886, CVE-2026-47887, CVE-2026-47888, CVE-2026-47889, CVE-2026-47891, CVE-2026-47893, CVE-2026-59280, CVE-2026-59281, CVE-2026-59282, CVE-2026-59283, CVE-2026-59313, CVE-2026-59314, CVE-2026-47892, CVE-2026-47890, CVE-2026-47884, CVE-2026-41707, CVE-2026-47841, CVE-2026-47842, CVE-2026-47877, CVE-2026-59270, CVE-2026-59276, CVE-2026-59277.
registry	Distribution: CVE-2026-41888. Go: CVE-2026-27140, CVE-2026-27143, CVE-2026-27144. OpenTelemetry OTLP HTTP exporters: CVE-2026-39882.
reloader	Go: CVE-2026-39817, CVE-2026-39819, CVE-2026-42501. golang.org/x/net/http2: CVE-2026-33814.

Dynamic Engine v1.7.0 release