Putki 2026.09 is now available, bringing the latest Apache Hop improvements together with updated security fixes, container images, and release artifacts.
This release is based on Apache Hop 2.19.0, the largest Hop release so far, with 337 issues closed, 22 contributors involved, and three months of development across the platform.
Based on Apache Hop 2.19.0
A large part of this release comes from the work done upstream in Apache Hop. Throughout the 2.19 development cycle, Bart Maertens and Hans Van Akelyen contributed to new functionality, integrations, Marketplace improvements, and many fixes across the platform.
Hans contributed across several areas, including release coordination, new features, and general improvements.
Some of the changes users will notice include consistent append operations across GCS, Azure, and S3, removing the need for provider-specific workarounds. The pipeline editor now supports split view, making it easier to work with larger pipelines, and shell scripts and command files can now be edited directly from the Hop IDE.
Hop Server also received improvements around shutdown handling, which is especially useful for containerized deployments where clean shutdowns help avoid leftover state.
After the initial Marketplace implementation, Hans continued improving its reliability with better dependency handling, installation edge cases, compatibility improvements, and Windows support. Together with many smaller fixes across the codebase, this helped prepare Apache Hop 2.19.0 for release.
Bart focused mainly on integrations, connectivity, and interoperability with external systems.
Hop can now read and write vCard contact information natively through dedicated Input and Output transforms. The WebDAV VFS plugin introduced in Apache Hop 2.18 has been extended with CalDAV and CardDAV support, enabling integration with calendar and contact services such as Nextcloud.
Oracle connectivity received additional authentication options, including wallet-based authentication for enterprise environments. Organizations running their own Forgejo or Gitea instances can now use them as plugin registries for the Marketplace, while credentials for private repositories are stored securely.
Bart also contributed automatic pipeline layout using the Sugiyama algorithm. Hop can now arrange transforms automatically, making it easier to clean up imported or older pipelines where the visual layout no longer matches the actual flow.
Security updates
Putki 2026.09 includes several security improvements and updated vulnerability assessments.
GHSA-r277-6w6q-xmqw, which affected the monitoring image in previous releases through a third-party Grafana datasource plugin, has been resolved by upgrading to a newer Grafana base image.
CVE-2026-75595 (CVSS 9.8) was identified in a bundled Netty dependency inside a gRPC transport library used by the Hop runtime. Putki 2026.09 includes a fixed standalone Netty version where the dependency is directly managed.
Other high-severity findings remain in the monitoring image, but they originate from a third-party Grafana datasource plugin that is not used by any Putki dashboard. The plugin will be removed in Putki 2026.12, and these findings are not reachable through the dashboards shipped with Putki.
The complete vulnerability list, including reachability assessments, is available at putki.io/vulnerability-scans. Subscribers also receive the OpenVEX feed scoped to their Putki edition together with the release artifacts.
Release artifacts
Putki 2026.09 is available from forge.putki.io under the tag v2026.09.
The following container images are available under both the 2026.09 and latest tags:
• putki
• putki-web
• putki-compose-init
• putki-grafana
• putki-warehouse-db
Plugin archives and Maven artifacts are published under bi.know:* in the same registry.
arm64 support is still in progress. This release currently supports linux/amd64 only.
Access to forge.putki.io is included with all Putki subscriptions.
If you want to evaluate Putki for your team, contact us at putki.io/contactus.