Skip to main content
Tungsten Replicator

Tungsten Replicator 7.2.2

Build: 19
Release Date: 27 Jul 2026
Release 7.2.2 contains a number of bug fixes and improvements.

Behavior Changes (1)

The following changes may affect existing scripts and integration tools. Any scripts or environment which make use of these tools should check and update for the new configuration:

Installation and Deployment (1)

  • Upgraded 3rd party libraries to remove critical and high severity CVEs. The full list is as follows:

    • zookeeper 3.4.14 → 3.9.4 — CVE-2023-44981 (SASL Quorum auth bypass)
    • log4j-api / log4j-core 2.23.1 → 2.25.3 (consolidated) — keeps log4j current; no known critical post-2.17 CVEs but stays ahead
    • commons-text 1.9 → 1.12.0 / 1.13.0 — CVE-2022-42889 (Text4Shell)
    • commons-compress 1.21 → 1.27.1 — CVE-2024-25710, CVE-2024-26308 (DoS via crafted archives)
    • commons-configuration2 (replaced commons-configuration 1.9) → 2.11.0 — CVE-2024-29131, CVE-2024-29133
    • commons-io 2.11.0 → 2.18.0 — CVE-2024-47554
    • jackson-databind 2.13.0 → 2.17.2 / 2.18.2 — CVE-2022-42003, CVE-2022-42004
    • guava 31.0.1-jre → 33.4.0-jre — CVE-2023-2976
    • h2 1.4.199 → 2.3.232 — CVE-2021-23463, CVE-2022-23221
    • postgresql JDBC 42.5.4 → 42.7.7 — CVE-2024-1597, CVE-2022-31197, CVE-2022-26520
    • dom4j 1.6.1 → 2.1.4 — CVE-2018-1000632, CVE-2020-10683
    • xstream 1.4.20 → 1.4.21 — CVE-2024-47072
    • velocity-engine-core 2.3 → 2.4.1 — CVE-2020-13936 era cleanup
    • kafka-clients 0.10.2.2 → 3.9.1 — CVE-2023-25194, CVE-2024-27309
    • junit 4.12 → 4.13.2 — CVE-2020-15250 (temp-dir disclosure; test-time only)
    • netty / xz xz 1.8 → 1.9 — CVE-2022-26259 era
    • protobuf-java 2.6.1 → 4.33.5 — CVE-2024-7254, CVE-2022-3171

    The following libraries are no longer required and have been removed entirely:

    • bonecp 0.8.0 — abandoned upstream
    • derby 10.12.1.1
    • postgresql 9.0-801.jdbc3 and 9.3-1102.jdbc4 — many old PG-JDBC CVEs gone
    • sqljdbc4 (replaced by mssql-jdbc 12.10.0) — CVE-2022-23270 era
    Issues: CT-2752, CT-2677, CT-2681

Improvements, new features and functionality (3)

Core Replicator (1)

  • Improved logging performance of "UPDATE or DELETE statement did not process any row." messages.

    While these messages should be rare, performance could decrease when displaying a lot of rows. Also, the message format was changed when policy is set to WARN, previously:

    Event seqno=3726720187/fragno=0 : UPDATE or DELETE statement did not process any row. 
        DELETE FROM `someSchema`.`someTable` WHERE `id` = ?  
        Arguments: - ROW# = 0 - KEY(index=1 name=id type=4 [INTEGER] length=8 unsigned=true blob=false desc=BIGINT UNSIGNED) (size = 3) = 123

    Now, only the first line will be displayed by default:

    Event seqno=3726720187/fragno=0 : UPDATE or DELETE statement did not process any row.

    The detailed view of the statement / values that did not change the database will be logged only if log4j is set in DEBUG

    Issue: CT-2733

Security (1)

  • Updated log4j libraries to mitigate security threats found in earlier versions. Note that these issues do not affect Tungsten installations when configured with the default log4j properties files.
    Issue: CT-2674

Documentation (1)

  • All documentation URL references in help text output and template files have been updated.
    Issue: CT-2686