apache · OlivierHermans · Nov 10, 2025 · Nov 10, 2025 · Nov 12, 2025 · Nov 12, 2025
diff --git a/.github/workflows/docs.sh b/.github/workflows/docs.sh
@@ -51,6 +51,16 @@ if [ $? -ne 0 ]; then
 	exit 1
 fi
 
+# Generate .htaccess with dynamic 404 path based on branch
+BRANCH=$(git branch --show-current)
+cat > docs/target/.htaccess << EOF
+# Ensure index.html is served for directory requests
+DirectoryIndex index.html
+
+# Custom 404 error page
+ErrorDocument 404 /flink/flink-docs-${BRANCH}/404.html
+EOF
+
 # build Flink; required for Javadoc step
 mvn clean install -B -DskipTests -Dfast -Dskip.npm -Pskip-webui-build
 
@@ -62,7 +72,16 @@ mvn javadoc:aggregate -B \
     -Dcheckstyle.skip=true \
     -Dspotless.check.skip=true \
     -Denforcer.skip=true \
-    -Dheader="<a href=\"http://flink.apache.org/\" target=\"_top\"><h1>Back to Flink Website</h1></a> <script>var _paq=window._paq=window._paq||[];_paq.push([\"disableCookies\"]),_paq.push([\"setDomains\",[\"*.flink.apache.org\",\"*.nightlies.apache.org/flink\"]]),_paq.push([\"trackPageView\"]),_paq.push([\"enableLinkTracking\"]),function(){var u=\"//matomo.privacy.apache.org/\";_paq.push([\"setTrackerUrl\",u+\"matomo.php\"]),_paq.push([\"setSiteId\",\"1\"]);var d=document, g=d.createElement('script'), s=d.getElementsByTagName('script')[0];g.async=true; g.src=u+'matomo.js'; s.parentNode.insertBefore(g,s)}();</script>"
+    -Dheader="<a href=\"http://flink.apache.org/\" target=\"_top\"><h1>Back to Flink Website</h1></a> <script>var _paq=window._paq=window._paq||[];_paq.push([\"disableCookies\"]),_paq.push([\"setDomains\",[\"*.flink.apache.org\",\"*.nightlies.apache.org/flink\"]]),_paq.push([\"trackPageView\"]),_paq.push([\"enableLinkTracking\"]),function(){var u=\"//analytics.apache.org/\";_paq.push([\"setTrackerUrl\",u+\"matomo.php\"]),_paq.push([\"setSiteId\",\"1\"]);var d=document, g=d.createElement('script'), s=d.getElementsByTagName('script')[0];g.async=true; g.src=u+'matomo.js'; s.parentNode.insertBefore(g,s)}();</script>"
+
+# Inject canonical tags into Javadoc HTML files to point to stable docs version
+CANONICAL_BASE="https://nightlies.apache.org/flink/flink-docs-stable/api/java"
+find target/site/apidocs -name "*.html" -type f | while read -r file; do
+    REL_PATH="${file#target/site/apidocs/}"
+    CANONICAL_URL="${CANONICAL_BASE}/${REL_PATH}"
+    sed -i "s|<head>|<head>\n<link rel=\"canonical\" href=\"${CANONICAL_URL}\">|" "$file"
+done
+
 mv target/site/apidocs docs/target/api/java
 
 # build python docs

diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
@@ -101,7 +101,10 @@ jobs:
         with:
           python-version: '3.x'
       - name: "Install cibuildwheel"
-        run: python -m pip install cibuildwheel==2.16.5
+        # Need to limit setuptools here in order to apply limitations for transitive dependencies
+        run: |
+          python -m pip install cibuildwheel==2.16.5
+          echo "setuptools<82" > /tmp/build-constraints.txt
       - name: "Build python wheels for ${{ matrix.os_name }}"
         run: python -m cibuildwheel --output-dir flink-python/dist flink-python
         env:
@@ -116,6 +119,7 @@ jobs:
           CIBW_REPAIR_WHEEL_COMMAND_LINUX: "auditwheel repair -w {dest_dir} {wheel}"
           # Skip repair on MacOS
           CIBW_REPAIR_WHEEL_COMMAND_MACOS: ""
+          PIP_CONSTRAINT: /tmp/build-constraints.txt
       - name: "Upload python wheels"
         uses: actions/upload-artifact@v4
         with:

diff --git a/.github/workflows/template.flink-ci.yml b/.github/workflows/template.flink-ci.yml
@@ -247,17 +247,36 @@ jobs:
         working-directory: ${{ env.CONTAINER_LOCAL_WORKING_DIR }}
         run: ./tools/azure-pipelines/cache_docker_images.sh load
 
+      - name: "Create non-root user for test execution"
+        run: |
+          useradd -m -u 1001 flink
+          echo "flink ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
+          for sock in /var/run/docker.sock /run/docker.sock; do
+            if [ -e "$sock" ]; then
+              chmod 666 "$sock"
+              echo "Docker socket found at $sock"
+            fi
+          done
+          mkdir -p \
+            ${{ env.CONTAINER_LOCAL_WORKING_DIR }} \
+            ${{ env.MAVEN_REPO_FOLDER }} \
+            ${{ env.DOCKER_IMAGES_CACHE_FOLDER }}
+          chown -R flink:flink ${{ env.CONTAINER_LOCAL_WORKING_DIR }}
+          chown -R flink:flink ${{ env.MAVEN_REPO_FOLDER }}
+          chown -R flink:flink ${{ env.DOCKER_IMAGES_CACHE_FOLDER }}
+
       - name: "Test - ${{ matrix.module }}"
         id: test-run
         working-directory: ${{ env.CONTAINER_LOCAL_WORKING_DIR }}
         env:
           IT_CASE_S3_BUCKET: ${{ secrets.s3_bucket }}
           IT_CASE_S3_ACCESS_KEY: ${{ secrets.s3_access_key }}
           IT_CASE_S3_SECRET_KEY: ${{ secrets.s3_secret_key }}
+          DOCKER_HOST: unix:///var/run/docker.sock
         timeout-minutes: ${{ fromJSON(env.GHA_JOB_TIMEOUT) }}
         run: |
-          ${{ inputs.environment }} PROFILE="$PROFILE -Pgithub-actions" ./tools/azure-pipelines/uploading_watchdog.sh \
-              ./tools/ci/test_controller.sh ${{ matrix.module }}
+          runuser -u flink -- bash -c '${{ inputs.environment }} PROFILE="$PROFILE -Pgithub-actions" ./tools/azure-pipelines/uploading_watchdog.sh \
+              ./tools/ci/test_controller.sh ${{ matrix.module }}'
 
       - name: "Post-build Disk Info"
         if: ${{ always() }}

diff --git a/.gitignore b/.gitignore
@@ -7,11 +7,14 @@ scalastyle-output.xml
 !.idea/vcs.xml
 !.idea/icon.png
 .vscode
+.metals
+.bloop
 .cursor
 .metadata
 .settings
 .project
 .version.properties
+.spotless-index-file
 filter.properties
 logs.zip
 .mvn/wrapper/*.jar

diff --git a/docs/config.toml b/docs/config.toml
@@ -14,7 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-baseURL = '//nightlies.apache.org/flink/flink-docs-master'
+baseURL = '//nightlies.apache.org/flink/flink-docs-release-2.2'
 languageCode = "en-us"
 title = "Apache Flink"
 enableGitInfo = false
@@ -24,7 +24,7 @@ pygmentsUseClasses = true
 [params]
   # Flag whether this is a stable version or not.
   # Used for the quickstart page.
-  IsStable = false
+  IsStable = true
 
   # Flag to indicate whether an outdated warning should be shown.
   ShowOutDatedWarning = false
@@ -34,14 +34,14 @@ pygmentsUseClasses = true
   # we change the version for the complete docs when forking of a release branch
   # etc.
   # The full version string as referenced in Maven (e.g. 1.2.1)
-  Version = "2.2-SNAPSHOT"
+  Version = "2.2.0"
 
   # For stable releases, leave the bugfix version out (e.g. 1.2). For snapshot
   # release this should be the same as the regular version
-  VersionTitle = "2.2-SNAPSHOT"
+  VersionTitle = "2.2"
 
   # The branch for this version of Apache Flink
-  Branch = "master"
+  Branch = "release-2.2"
 
   # The github repository for Apache Flink
   Repo = "//github.com/apache/flink"
@@ -60,19 +60,20 @@ pygmentsUseClasses = true
 
   ZhDownloadPage = "//flink.apache.org/zh/downloads.html"
 
-  JavaDocs = "//nightlies.apache.org/flink/flink-docs-master/api/java/"
+  JavaDocs = "//nightlies.apache.org/flink/flink-docs-release-2.2/api/java/"
 
-  PyDocs = "//nightlies.apache.org/flink/flink-docs-master/api/python/"
+  PyDocs = "//nightlies.apache.org/flink/flink-docs-release-2.2/api/python/"
 
   # External links at the bottom
   # of the menu
   MenuLinks = [
     ["Project Homepage", "//flink.apache.org"],
-    ["JavaDocs", "//nightlies.apache.org/flink/flink-docs-master/api/java/"],
-    ["PyDocs", "//nightlies.apache.org/flink/flink-docs-master/api/python/"]
+    ["JavaDocs", "//nightlies.apache.org/flink/flink-docs-release-2.2/api/java/"],
+    ["PyDocs", "//nightlies.apache.org/flink/flink-docs-release-2.2/api/python/"]
   ]
 
   PreviousDocs = [
+    ["2.2", "http://nightlies.apache.org/flink/flink-docs-release-2.2"],
     ["2.1", "http://nightlies.apache.org/flink/flink-docs-release-2.1"],
     ["2.0", "http://nightlies.apache.org/flink/flink-docs-release-2.0"],
     ["1.20", "http://nightlies.apache.org/flink/flink-docs-release-1.20"],

diff --git a/docs/content.zh/docs/connectors/models/downloads.md b/docs/content.zh/docs/connectors/models/downloads.md
@@ -0,0 +1,41 @@
+---
+title: 下载页面
+weight: 100
+type: docs
+bookToc: false
+aliases:
+  - /zh/dev/table/connectors/downloads.html
+---
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# SQL Models 下载页面
+
+{{< unstable >}}
+{{< hint info >}}
+Download links are available only for stable releases.
+{{< /hint >}}
+{{< /unstable >}}
+
+The page contains links to optional sql-client models that are not part of the binary distribution.
+
+# 可选的 SQL Models 
+-------------------
+
+{{< sql_optional_models >}}
diff --git a/docs/content.zh/docs/deployment/overview.md b/docs/content.zh/docs/deployment/overview.md
@@ -302,9 +302,9 @@ Supported Environments:
 Supported Environment:
 {{< label Huawei Cloud >}}
 
-#### Ververica Platform
+#### Ververica's Unified Streaming Data Platform (Managed Service / BYOC / Self-Managed)
 
-[Website](https://www.ververica.com/platform-overview)
+[Website](https://www.ververica.com/product)
 
 Supported Environments:
 {{< label AliCloud >}}

diff --git a/docs/content.zh/docs/deployment/security/security-ssl.md b/docs/content.zh/docs/deployment/security/security-ssl.md
@@ -150,20 +150,16 @@ security.ssl.rest.authentication-enabled: false
 
 ### Cipher suites
 
-{{< hint warning >}}
-The [IETF RFC 7525](https://tools.ietf.org/html/rfc7525) recommends to use a specific set of cipher suites for strong security.
-Because these cipher suites were not available on many setups out of the box, Flink's default value is set to a slightly
-weaker but more compatible cipher suite.
-We recommend that SSL setups update to the stronger cipher suites, if possible, by adding the below entry to the Flink configuration:
+For strong security, it is crucial to use modern and robust cipher suites. [IETF RFC 9325](https://www.rfc-editor.org/info/rfc9325), which supersedes the older RFC 7525, provides current recommendations for the secure use of TLS.
 
+In response to evolving security standards and to ensure compatibility with modern Java versions, Flink has updated its default cipher suites. Recent JDK updates (affecting versions like 11.0.30+, 17.0.18+, etc.) have disabled older `TLS_RSA_*` cipher suites that lack forward secrecy.
 
-```yaml
-security.ssl.algorithms: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
-```
+To support these secure-by-default JDK versions and align with best practices, Flink's default value for `security.ssl.algorithms` is now:
 
-If these cipher suites are not supported on your setup, you will see that Flink processes will not be able to connect to each other.
+`TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`
 
-{{< /hint >}}
+This default provides strong security and wide compatibility. You can customize the cipher suites using the `security.ssl.algorithms` configuration option if your environment has different requirements.
+If these cipher suites are not supported on your setup, you will see that Flink processes will not be able to connect to each other.
 
 ### Complete List of SSL Options
 

diff --git a/docs/content.zh/docs/deployment/tasks-scheduling/_index.md b/docs/content.zh/docs/deployment/tasks-scheduling/_index.md
@@ -0,0 +1,23 @@
+---
+title: Tasks Scheduling
+bookCollapseSection: true
+weight: 9
+---
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
diff --git a/docs/content.zh/docs/deployment/tasks-scheduling/balanced_tasks_scheduling.md b/docs/content.zh/docs/deployment/tasks-scheduling/balanced_tasks_scheduling.md
@@ -0,0 +1,123 @@
+---
+title: Balanced Tasks Scheduling
+weight: 5
+type: docs
+
+---
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# Balanced Tasks Scheduling
+
+This page describes the background and principle of balanced tasks scheduling, 
+how to use it when running streaming jobs.
+
+## Background
+
+When the parallelism of all vertices within a Flink streaming job is inconsistent,
+the [default strategy]({{< ref "docs/deployment/config" >}}#taskmanager-load-balance-mode)
+of Flink to deploy tasks sometimes leads some `TaskManagers` have more tasks while others have fewer tasks, 
+resulting in excessive resource utilization at some `TaskManagers` 
+that contain more tasks and becoming a bottleneck for the entire job processing.
+
+{{< img src="/fig/deployments/tasks-scheduling/tasks_scheduling_skew_case.svg" alt="The Skew Case of Tasks Scheduling" class="offset" width="50%" >}}
+
+As shown in figure (a), given a Flink job comprising two vertices, `JobVertex-A (JV-A)` and `JobVertex-B (JV-B)`, 
+with parallelism degrees of `6` and `3` respectively,
+and both vertices sharing the same slot sharing group.
+Under the default tasks scheduling strategy, as illustrated in figure (b), 
+the distribution of tasks across `TaskManagers` may result in significant disparities in task load. 
+Specifically, the `TaskManager`s with the highest number of tasks may host `4` tasks, 
+while the one with the lowest load may have only `2` tasks. 
+Consequently, the `TaskManager`s bearing 4 tasks is prone to become a performance bottleneck for the entire job.
+
+Therefore, Flink provides the task-quantity-based balanced tasks scheduling capability. 
+Within the job's resource view, it aims to ensure that the number of tasks 
+scheduled to each `TaskManager` as close as possible to,
+thereby improving the resource usage skew among `TaskManagers`.
+
+<span class="label label-info">Note</span> The presence of inconsistent parallelism does not imply that this strategy must be used, as this is not always the case in practice.
+
+## Principle
+
+The task-quantity-based load balancing tasks scheduling strategy completes the assignment of tasks to `TaskManagers` in two phases: 
+- The tasks-to-slots assignment phase 
+- The slots-to-TaskManagers assignment phase
+
+This section will use two examples to illustrate the simplified process and principle of 
+how the task-quantity-based tasks scheduling strategy handles the assignments in these two phases.
+
+### The tasks-to-slots assignment phase
+
+Taking the job shown in figure (c) as an example, it contains five job vertices with parallelism degrees of `1`, `4`, `4`, `2`, and `3`, respectively.
+All five job vertices belong to the default slot sharing group.  
+
+{{< img src="/fig/deployments/tasks-scheduling/tasks_to_slots_allocation_principle.svg" alt="The Tasks To Slots Allocation Principle Demo" class="offset" width="65%" >}}
+
+During the tasks-to-slots assignment phase, this tasks scheduling strategy:  
+- First directly assigns the tasks of the vertices with the highest parallelism to the `i-th` slot. 
+
+  That is, task `JV-Bi` is assigned directly to `sloti`, and task `JV-Ci` is assigned directly to `sloti`.
+
+- Next, for tasks belonging to job vertices with sub-maximal parallelism, they are assigned in a round-robin fashion across the slots within the current
+slot sharing group until all tasks are allocated.
+
+As shown in figure (e), under the task-quantity-based assignment strategy, the range (max-min difference) of the number of tasks per slot is `1`, 
+which is better than the range of `3` under the default strategy shown in figure (d).
+
+Thus, this ensures a more balanced distribution of the number of tasks across slots.
+
+### The slots-to-TaskManagers assignment phase
+
+As shown in figure (f), given a Flink job comprising two vertices, `JV-A` and `JV-B`, with parallelism of `6` and `3` respectively,
+and both vertices sharing the same slot sharing group.
+
+{{< img src="/fig/deployments/tasks-scheduling/slots_to_taskmanagers_allocation_principle.svg" alt="The Slots to TaskManagers Allocation Principle Demo" class="offset" width="75%" >}}
+
+The assignment result after the first phase is shown in figure (g), 
+where `Slot0`, `Slot1`, and `Slot2` each contain `2` tasks, while the remaining slots contain `1` task each.
+
+Subsequently:
+- The strategy submits all slot requests and waits until all slot resources required for the current job are ready.
+
+Once the slot resources are ready:  
+- The strategy then sorts all slot requests in descending order based on the number of tasks contained in each request. 
+Afterward, it sequentially assigns each slot request to the `TaskManager` with the smallest current tasks loading. 
+This process continues until all slot requests have been allocated.
+
+The final assignment result is shown in figure (i), where each `TaskManager` ends up with exactly `3` tasks, 
+resulting in a task count difference of `0` between `TaskManagers`. In contrast, the scheduling result under the default strategy, 
+shown in figure (h), has a task count difference of `2` between `TaskManagers`. 
+
+Therefore, if you are seeing performance bottlenecks of the sort described above,
+then using this load balancing tasks scheduling strategy can improve performance.
+Be aware that you should not use this strategy, if you are not seeing these bottlenecks,
+as you may experience performance degradation.
+
+## Usage
+
+You can enable balanced tasks scheduling through the following configuration item: 
+
+- `taskmanager.load-balance.mode`: `tasks`
+
+## More details
+
+See the <a href="https://cwiki.apache.org/confluence/x/U56zDw">FLIP-370</a> for more details.
+
+{{< top >}}