Flink Manager 0.0.2 is out

Today we are releasing Flink Manager 0.0.2 — the second release of our management console for Apache Flink clusters. This one is deliberately quiet on features and loud on security: it closes the vulnerabilities found in the Docker Hub scan of the 0.0.1 image, and it makes the image truly portable across CPU architectures.

Closing the Docker Hub scan findings

The scan findings on 0.0.1 traced back, for the most part, to one root cause: the Spring stack the image is built on. Spring Boot 3.5.4 pulled in Tomcat, Spring Framework, Spring Security, Jackson, and the PostgreSQL driver — and that whole line lost open-source support on 30 June 2026. Rather than patching a dead branch, 0.0.2 jumps to Spring Boot 4.1.2, the currently maintained line, which replaces every component in that chain at once.

Two legacy dependencies were removed outright: the redundant feign-form-spring — which dragged in commons-fileupload and commons-io, the source of the high-severity CVEs in the report — and the unused Apache HttpClient 4. Fewer dependencies, smaller attack surface.

Hardening is not only about the framework: the OS packages inside the image and the security code paths of the product itself got the same treatment.

The Docker base image moves from eclipse-temurin:22-jre to 25-jre — the LTS line that is still maintained — and OS packages (openssl, gnutls, perl, …) flagged by the scan are patched at image build time, so what you pull is current. Inside the product, the security, RBAC, and license code paths received additional hardening, and new integration tests now cover the Feign client request encoding.

Docker images that pull natively everywhere

The 0.0.1 image was published with only the architecture of the build machine — if that was not your architecture, Docker fell back to emulation or simply failed. From 0.0.2 on, images are built as multi-platform manifests (linux/amd64 + linux/arm64) and published under a single tag. The same vinteroslabs/flink-manager:0.0.2 tag pulls natively on x86-64 hosts (Windows / Linux) and on Apple Silicon / ARM servers — no emulation flags needed.

One new deployment setting

OpenAPI / Swagger UI deployment settings are now configurable: a locked-down deployment can keep the API-doc endpoints off, while an environment that wants them can expose them deliberately. This is the only functional addition in 0.0.2 — everything else in the console behaves exactly as in 0.0.1, and existing environment variables keep working.

Upgrading from 0.0.1

The upgrade is a drop-in swap: pull the new image tag (or install the new release bundle jar), and the database schema is migrated automatically on startup. No configuration changes are required. Details for both paths are in the installation guide.

Availability

Flink Manager 0.0.2 is available as a Docker image and as a release bundle. The full list of changes is in the changelog, and the documentation covers everything from the first login to production configuration.

Want to try it on your own cluster? Request a free trial license — it is issued instantly and kept renewed by Vinteros Labs, so you can evaluate the latest release without any paperwork.

Frequently asked questions

What changed in Flink Manager 0.0.2? 0.0.2 is a security-hardening release. It upgrades Spring Boot from 3.5.4 to 4.1.2 (replacing the Tomcat, Spring Framework, Spring Security, Jackson, and PostgreSQL driver versions flagged by the Docker Hub scan), removes vulnerable legacy dependencies (feign-form-spring with its commons-fileupload / commons-io transitive CVEs, and the unused Apache HttpClient 4), moves the Docker base image to eclipse-temurin:25-jre with OS packages patched at build time, and hardens internal security/RBAC/license code paths.

Does the 0.0.2 Docker image run on Apple Silicon and ARM servers? Yes. From 0.0.2 on, images are published as multi-platform manifests (linux/amd64 + linux/arm64) under a single tag. The 0.0.1 image was built for the build machine's architecture only; the new tag pulls natively on x86-64 hosts (Windows / Linux) and on Apple Silicon / ARM servers without emulation flags.

Do I need to change my configuration when upgrading to 0.0.2? No. The upgrade is a drop-in image or jar swap — the database schema is migrated automatically on startup and existing environment variables keep working. The only new setting is optional: SPRINGDOC_ENABLED controls whether the OpenAPI / Swagger UI endpoints (/v3/api-docs and /swagger-ui) are exposed; both are disabled by default.

How do I get Flink Manager 0.0.2? Pull vinteroslabs/flink-manager:0.0.2 (or latest) from Docker Hub, or download the flink-manager-0.0.2.zip release bundle from GitHub Releases. A free trial license is issued instantly on the Vinteros Labs website.