pulsar v4.2.5

2026-08-03

Library updates

• [improve][broker][branch-4.2] Upgrade bookkeeper to 4.17.4 (#26219)
• [fix][sec] Bump google.golang.org/grpc from 1.79.3 to 1.82.1 in /pulsar-function-go/examples (#26231)
• [fix][sec] Bump google.golang.org/grpc from 1.82.1 to 1.83.1 in /pulsar-function-go (#26446)
• [fix][sec] Bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /pulsar-function-go (#26541)
• [fix][sec] Bump log4j2 from 2.26.0 to 2.26.1 (#26329)
• [fix][sec] Upgrade at.yawk.lz4:lz4-java to 1.11.4 (#26758)
• [fix][sec] Upgrade avro to 1.12.2 (#24992)
• [fix][sec] Upgrade grpc in pulsar-function-go to 1.82.1 to fix GHSA-hrxh-6v49-42gf (#26235)
• [fix][sec] Upgrade Jackson to 2.18.10 (#26339)
• [fix][sec] Upgrade lz4-java to 1.11.1 to address CVE-2026-59949 (#26250)
• [fix][sec][branch-4.2] Upgrade BouncyCastle to 1.85 and BouncyCastle FIPS to 2.0.2 to address CVEs (#26370)
• [fix][sec][branch-4.2] Upgrade Netty to 4.1.137 to address several CVEs and bugs (#26301)
• [fix][sec][branch-4.2] Upgrade Spring to 7.0.8 (#26270)
• [fix][sec][branch-4.x] Upgrade async-http-client to 2.16.1 (#26436)
• [fix][sec][branch-4.x] Upgrade lz4-java to 1.11.2 (#26439)
• [fix][sec][branch-4.x] Upgrade Netty to 4.1.138 to address several CVEs and bugs (#26515)
• [fix][sec][branch-4.x] Upgrade Thrift to 0.24.0 (#26438)
• [fix][sec][branch-4.x] Upgrade vertx to 4.5.32 (#26437)
• [fix][build] Upgrade Conscrypt to 2.6.3 (#26660)
• [improve][zk] Upgrade ZooKeeper to 3.9.6 (#26750)
• [improve][build] Upgrade Apache Commons libraries (#26348)
• [improve][build] Upgrade Bouncy Castle libraries (#26753)
• [improve][build] Upgrade Caffeine to 3.3.0 (#26755)
• [improve][build] Upgrade Guava to 33.7.1-jre (#26760)
• [improve][build] Upgrade Oxia Java client to 0.9.5 (#26538)
• [improve][misc] Upgrade Conscrypt to 2.6.1 to add aarch64 native support (#26314)
• [improve][misc] Upgrade Conscrypt to 2.6.2 to restore the native library glibc baseline (#26315)
• [improve][misc] Upgrade Jetty to 12.1.12 (#26302)
• [improve][misc] Upgrade Jetty to 12.1.13 (#26738)
• [improve][misc] Upgrade log4j to 2.26.0 and slf4j to 2.0.18 (#25973)
• [improve][misc][branch-4.x] Upgrade Jackson to 2.18.11 (#26759)
• [fix][test][branch-4.2] Fix connector tests broken by the Avro 1.12.2 upgrade

Broker

• [fix][broker] Add missing bundle Prometheus metrics for extensible load manager (#26192)
• [fix][broker] Align entry filter policy checks for non-persistent topics (#26774)
• [fix][broker] Align partitioned topic truncate checks with non-partitioned topics (#26776)
• [fix][broker] Apply managedLedgerContinueCachingAddedEntriesAfterLastActiveCursorLeavesMillis to managed ledgers (#26785)
• [fix][broker] Apply subscription policies to namespace and topic subscription operations (#26767)
• [fix][broker] Apply the role logging anonymizer to topic authorization denial logs (#26642)
• [fix][broker] Avoid load shedding and metadata writes from a former leader (#26253)
• [fix][broker] Avoid misleading ownership lock expiry logs during shutdown (#26633)
• [fix][broker] Bound classic Key_Shared dispatcher replay queue look-ahead (#26677)
• [fix][broker] Bound the local partition metadata retry when starting a geo-replicator (#26681)
• [fix][broker] Bound the topic deletion retries triggered by a replication cluster removal (#26432)
• [fix][broker] Cancel queued transaction snapshot recovery on topic close (#26335)
• [fix][broker] Cancel queued transaction snapshot recovery on topic close (#26335)
• [fix][broker] Check the original principal of proxied HTTP requests with its own authentication data (#26748)
• [fix][broker] Check topic permissions for binary GetSchema and GetOrCreateSchema (#26643)
• [fix][broker] Check topic permissions for partitions and subscriptions added to a transaction (#26644)
• [fix][broker] Debit un-acked messages only when the consumer is actually removed (#26422)
• [fix][broker] Do not log an error when the tenant does not exist (#26361)
• [fix][broker] Don’t serve topic policies from a cache whose init future has not completed (#26513)
• [fix][broker] Fix assignment and ownership cleanup races in the extensible load manager (#26520)
• [fix][broker] Fix AvgShedder assignment cache keying with stable bundle names (#26246)
• [fix][broker] Fix delayed-delivery bucket merge failures when delayedDeliveryMaxNumBuckets is 1-3 (#26242)
• [fix][broker] Fix dispatcherPauseOnAckStatePersistentEnabled and schemaValidationEnforced returning wrong values when applied=true (#26472)
• [fix][broker] Fix early completion and false timeouts in SplitManager and UnloadManager (#26363)
• [fix][broker] Fix lookup permit leak when namespace policy reads fail (#26606)
• [fix][broker] Fix multi-role authorization regressions and optimize nested checks (#26551)
• [fix][broker] Fix NPE in ManagedLedgerInterceptorImpl when AppendIndexMetadataInterceptor isn’t configured (#26497)
• [fix][broker] Fix ownership-generation races in OwnershipCache removeOwnership and lock-expiry cleanup (#26197)
• [fix][broker] Fix persistent throughput degradation caused by permit loss during frequent reconnects on Shared subscriptions (#26289)
• [fix][broker] Keep accepting Avro named type references written as objects (#26586)
• [fix][broker] Log exception in PulsarMetadataEventSynchronizer failure path (#26203)
• [fix][broker] Preserve compaction state on ledger close failure (#26665)
• [fix][broker] Preserve replicated subscription activity on activation (#26780)
• [fix][broker] Preserve topic initialization failures (#26775)
• [fix][broker] Prevent automatic TTL expiry from skipping reader messages (#26505)
• [fix][broker] Prevent Key_Shared out-of-order replay starvation at the end of topic (#26268)
• [fix][broker] Prevent NPE when the last ACK races with sticky hash reassignment (#26471)
• [fix][broker] Propagate bundle split failures to the completion future (#26735)
• [fix][broker] Release the compaction buffers and permits on flush failures (#26576)
• [fix][broker] Resolve replicator remote cluster by prefix so cluster names containing a dot work (#26451)
• [fix][broker] Send ActiveConsumerChange for non-persistent Failover subscriptions (#26482)
• [fix][broker] Spurious ERROR log for 307 redirect in getReplicatedSubscriptionStatus (#26706)
• [fix][broker] Stop reporting a deliberate ownership release as an expired resource lock (#26533)
• [fix][broker]Producer with AUTO_PRODUCE schema failed to reconnect, which caused by schema incompatible (#25437)
• [fix][admin] Allow defaultNumPartitions for non-partitioned autoTopicCreation override (#25163)
• [fix][admin] Avoid creating subscriptions when peeking messages if auto-creation is disabled (#26279)
• [fix][admin] Reject empty cluster migration URL: fix inverted ClusterUrl.isEmpty() (#26473)
• [fix][ml] Close abandoned write ledger handle to prevent leak (#26585)
• [fix][ml] Fail in-flight adds when a managed ledger is terminated (#26678)
• [fix][ml] Fail queued adds when a managed ledger is terminated during a ledger rollover (#26680)
• [fix][ml] Fix active cursor position tracking after untracking (#26629)
• [fix][ml] Fix active cursor retention and deferred-update synchronization (#26511)
• [fix][ml] Fix backlog estimation during ledger rollover with pending writes (#26647)
• [fix][ml] Fix batch ACK index loss when recovering cursor from MetadataStore (#26474)
• [fix][ml] Make inflight reads limiter work even if managed ledger cache is disabled (#26296)
• [fix][ml] Parse the cached entry’s message metadata from the buffer the cache keeps (#26495)
• [fix][ml] Preserve cursor properties when recovering from an unreadable cursor ledger (#26512)
• [fix][ml] Preserve ledger properties when recovering the last ledger on open (#26509)
• [fix][ml] Propagate cursor ledger deletion failures (#26734)
• [fix][ml] Reset the lazily-cached position when reusing a recycled EntryImpl (#26707)
• [fix][ml] Skip contiguous deleted ranges during reads (#26299)
• [fix][ml] Tolerate concurrent creation of the managed ledger z-node (#26247)
• [fix][ml][broker] Keep source ledger data on every shadow managed ledger trim, delete and offload path (#26746)
• [fix][offload] Cache and reuse entry offsets discovered while skipping in BlobStoreBackedReadHandleImpl (#26424)
• [fix][offload] Normalize offloader cache directory path (#26372)
• [fix][meta] Close resources when ZKMetadataStore construction fails (#26673)
• [fix][meta] Track explicitly acquired underreplicated ledger locks (#26670)
• [improve][broker] Add configuration to enable shadow topics (#26739)
• [improve][broker] Add pulsar_subscription_storage_backlog_age_seconds metric (#26313)
• [improve][broker] Allow dynamically updating topic load timeout (#26781)
• [improve][broker] Avoid iterator allocation in BrokerInterceptors hot paths and restore configured ordering (#26462)
• [improve][broker] Change partition metadata not-found log to warn (#26381)
• [improve][broker] Conflate concurrent readMoreEntries calls (#26539)
• [improve][broker] Copy small entries into a flat buffer when prepending broker entry metadata (#26464)
• [improve][broker] Disable subscription-thread dispatch by default (#26578)
• [improve][broker] Expose interface for the replicator in ManagedLedger instead of cast the class (#26298)
• [improve][broker] Make exposing topic level metric dynamic (#21006)
• [improve][broker] Reduce cache retention after reads and apply retention settings at startup (#26627)
• [improve][broker] Skip unused replicated subscription timestamp updates (#26655)
• [improve][broker] Support OpenID multi-role authorization and improve proxy authentication defaults (#26549)
• [improve][broker]Reduce the lock range of SimpleCache to enhance performance (#25293)
• [fix][txn] Do not fail topic deletion when the aborted txn snapshot cannot be cleared (#26431)
• [fix][txn] Fix X-Pulsar-txn-uncommitted header semantics and add X-Pulsar-txn-consumable for peek messages (#26073)
• [fix][txn] Improve transaction admin checks (#26773)
• [fix][txn] Prevent queued snapshot writes from stalling (#26565)
• [fix][txn] Stop the pending ack replay loop from spinning forever (#26369)
• [improve][ml] Avoid capturing cache insertion arguments (#26524)
• [improve][ml] Parse message metadata at entry cache insert time instead of under the wrapper write lock (#26463)
• [improve][ml] Share read-permit release callbacks within a batch (#26523)
• [feat][broker] PIP-441:Add broker-level metrics for non-recoverable data skips (#24726)
• [Fix][broker]Get a fenced error when loading a topic that does not allowed the cluster to access (#26276)

Client

• [fix][client] Apply no-memory-limit producer queue defaults at producer creation (#26342)
• [fix][client] Avoid exception in ConsumerImpl hasMessageAvailable before first receive (#25857)
• [fix][client] Complete table view refresh after applying messages (#26566)
• [fix][client] Defer op cmd release to the write event loop on send timeout (#26456)
• [fix][client] Divide the across-partitions budget only when it was set explicitly (#26384)
• [fix][client] Don’t close a shared DNS resolver group’s address resolver when a client closes (#26723)
• [fix][client] Drop a send receipt for a removed producer, not the connection (#26618)
• [fix][client] Enable TableView compacted reads for short topic names (#26626)
• [fix][client] Fix buffer ownership on the send failure paths (#26455)
• [fix][client] Fix incorrect topic in OTel spans for partitioned producers (#25896)
• [fix][client] Fix OpenTelemetryProducerInterceptor not executing due to eligible check (#25585)
• [fix][client] Flush acknowledgment groups at the combined size limit (#26594)
• [fix][client] Inject trace context into message properties for producer-consumer span correlation (#25749)
• [fix][client] Keep transactional and non-transactional messages in separate batches (#26547)
• [fix][client] Prevent duplicate cleanup and leaks on producer send failures (#26641)
• [fix][client] Release connections opened after close (#26733)
• [fix][client] Release the command header when send serialization fails (#26492)
• [fix][client] Release the reserved memory only once when failing a send in a terminal state (#26476)
• [fix][client] Restore OAuth2 HTTP client after deserialization (#26324)
• [fix][client] Stop tracking ack timeouts on non-persistent topics (#26548)
• [improve][client] Avoid eager broker metadata allocation for outgoing messages (#26521)
• [improve][client] Avoid unused send-stat snapshots for default callbacks (#26519)
• [improve][client] Coalesce message listener drain scheduling (#26531)
• [fix][client] Fix incorrect topic in OTel spans for multi-topic consumers
• [fix][client] Remove the dead letter candidate entry using the entry-level message id

Pulsar IO and Pulsar Functions

• [fix][fn] Allow retainKeyOrdering on Go functions (#26421)
• [fix][fn] Apply the worker connectors list checks to the deprecated functions connectors endpoint (#26745)
• [fix][fn] Bound function package downloads from BookKeeper and stop SchedulerManager.close() from hanging on a stuck scheduling round (#26556)
• [fix][fn] Check packages permission for function, source and sink package URLs (#26771)
• [fix][fn] Check produce permission on the input topic when triggering functions (#26777)
• [fix][fn] Honour negativeAckRedeliveryDelayMs in the Go function runtime (#26415)
• [fix][fn] Honour negativeAckRedeliveryDelayMs in the Python function runtime (#26413)
• [fix][fn] Honour producerSpec batching configuration in the Go function runtime (#26393)
• [fix][fn] Honour producerSpec batching configuration in the Python function runtime (#26392)
• [fix][fn] Honour retainOrdering and retainKeyOrdering in the Go function runtime (#26414)
• [fix][fn] Remove deprecated github.com/golang/protobuf dependency from pulsar-function-go (#26587)
• [fix][fn] Return descriptive errors for unknown JSON properties (#26441)
• [fix][fn] Validate package name components and storage paths consistently (#26768)
• [improve][fn] Standardize log4j2 Root logger configuration to use system property (#26121)

Others

• [fix][ws] Check dead letter topic permission for WebSocket consumers (#26772)
• [fix][cli] Apply PULSAR_MEM and PULSAR_GC in bin/pulsar-perf (#26465)
• [fix][cli] Avoid inheriting broker initial heap settings in tools (#26736)
• [fix][cli] Correct admin command documentation generation (#26649)
• [fix][cli] pulsar-perf: register subcommand classes with picocli instead of instances (#26467)
• [fix][cli] Set —enable-native-access=ALL-UNNAMED for the CLI tools on Java 24+ (#26365)
• [fix][cli][branch-4.2] Don’t pass unset pulsar-perf pending-message options to the producer (#26371)
• [fix][misc] Remove unnecessary ” {}” suffix from log lines when there are no context attributes (#26285)
• [fix][misc][branch-4.2] Pass webServiceTlsCiphers to Jetty factory (#26423)
• [improve][cli] Default the pulsar-perf client memory limit to half of the JVM max direct memory (#26491)
• [improve][cli] pulsar-perf: cut latency histogram memory ~100x, fix range units and static stats state (#26466)
• [fix][misc][branch-4.2] Use correct log4j pattern for Log4j test configs
• [fix][Client] permit leak in chunked message discard path (#26661)
• [fix][common] Handle synchronous failures from future suppliers (#25939)
• [fix] Fix cursor deadlock when skipping non-recoverable entries during mark-delete persistence (#26570)
• [fix] Fix ManagedLedgerImpl’s pendingAddEntries leak. (#25240)

Tests & CI

• [improve][ci][branch-4.2] Upgrade GitHub Actions built-in action versions
• [fix][test] Allow for CLI startup in function integration tests (#26564)
• [fix][test] Avoid blocking common-pool workers in ledger shutdown test (#26560)
• [fix][test] Await both DLQ producers in multi-consumer test (#26561)
• [fix][test] Await reader reconnect after seek() to fix flaky TopicReaderTest assertions (#26141)
• [fix][test] Cover scheduler shutdown membership-lock deadlock (#26557)
• [fix][test] Fix flaky AdminApiTest caused by leaked brokerShutdownTimeoutMs (#26249)
• [fix][test] Fix flaky IsolatedBookieEnsemblePlacementPolicyTest by awaiting the initial rack config load (#26429)
• [fix][test] Fix flaky NonDurableCursorTest.subscribeToEarliestPositionWithDeferredDeletion (#26747)
• [fix][test] Fix flaky OneWayReplicatorDeduplicationTest.testDeduplication (#26737)
• [fix][test] Fix flaky RawReaderTest.testPauseAndResumeWithUnloading (#26690)
• [fix][test] Fix OneWayReplicatorSchemaValidationEnforcedTest racing the replicator’s remote topic creation (#26382)
• [fix][test] Isolate mutable broker fixtures between test methods (#26563)
• [fix][test] Isolate token CLI test output from background logging (#26657)
• [fix][test] Join assignment tailer before asserting its last message ID (#26536)
• [fix][test] Make consistent hashing consumer selection test deterministic (#26534)
• [fix][test] Preserve class loading in broker interceptor fixtures (#26567)
• [improve][ci] Configure SSH access action default and update Upterm (#26575)
• [improve][ci] Run the Python function instance tests in CI (#26399)
• [fix][build][branch-4.2] Add missing package-info file
• [fix][ci][branch-4.2] Use an ASF-approved docker/setup-qemu-action version
• [fix][test] Fix import order in authorization test
• [fix][test][branch-4.2] Adapt pulsar-perf pending-limit test to the #26342 backport
• [fix][test][branch-4.2] Create the CLI test producer only once CmdProduce asks for it
• [fix][test][branch-4.x] Explicitly disable memory limit when testing pending-message defaults

---

Source apache/pulsar · v4.2.5 · 2026-10-05 · upstream release

Mirrored verbatim for indexing. All rights belong to the upstream project.