Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 17, 2025

Bumps org.apache.pulsar:pulsar-client-all from 4.1.1 to 4.1.2.

Release notes

Sourced from org.apache.pulsar:pulsar-client-all's releases.

v4.1.2

2025-11-17

Library updates

  • [fix] Update gRPC to 1.75.0 (#24813)
  • [improve][misc] Upgrade Netty to 4.1.128.Final (#24911)
  • [improve] Upgrade Alpine base image to 3.22 version (#24840)
  • [improve][ml] Upgrade Oxia client to 0.7.0 (#24824)
  • [fix][sec] Added Exclusions for tomcat-embed-core and derby and override mina-core to remediate CVEs (#24949)
  • [fix][sec] Bump io.vertx:vertx-web from 4.5.10 to 4.5.22 (#24889)
  • [fix][sec] Override commons-beanutils and commons-configuration2 to remediate CVEs (#24936)
  • [fix][sec] Override kafka-clients in kinesis-kpl-shaded to remediate CVE-2024-31141 and CVE-2025-27817 (#24935)
  • [fix][sec] Override nimbus-jose-jwt to remediate CVE-2023-52428 and CVE-2025-53864 (#24937)
  • [fix][sec] Update Hbase version to 2.6.3-hadoop3 and exclude Avro from hbase-client to remediate CVEs (#24953)
  • [fix][sec] Upgrade BouncyCastle FIPS to 2.0.10 to remediate CVE-2025-8916 (#24923)
  • [fix][sec] Upgrade hadoop3 version from 3.4.0 to 3.4.1 (#24950)
  • [fix][sec] Upgrade Jetty to 9.4.58.v20250814 to address CVE-2025-5115 (#24897)
  • [fix][sec] Upgrade Spring to 6.2.12 to remediate CVE-2025-22233 and CVE-2025-41249 (#24903)
  • [improve][io] Upgrade Debezium version to 3.2.4.Final (#24896)
  • [improve][ci] Upgrade GitHub Actions workflows to use ubuntu-24.04 (#24841)

Broker

  • [fix][broker] Allow intermittent error from topic policies service when loading topics (#24829)
  • [fix][broker] AvgShedder comparison error (#24954)
  • [fix][broker] Avoid recursive update in ConcurrentHashMap during policy cache cleanup (#24939)
  • [fix][broker] BacklogMessageAge is not reset when cursor mdPosition is on an open ledger (#24915)
  • [fix][broker] Ensure LoadSheddingTask is scheduled after metadata service is available again (#24838)
  • [fix][broker] ExtensibleLoadManager: handle SessionReestablished and Reconnected events to re-register broker metadata (#24932)
  • [fix][broker] Fix bug in PersistentMessageExpiryMonitor which blocked further expirations (#24941)
  • [fix][broker] fix getMaxReadPosition in TransactionBufferDisable should return latest (#24898)
  • [fix][broker] Fix incorrect topic loading latency metric and timeout might not be respected (#24785)
  • [fix][broker] Fix stack overflow caused by race condition when closing a connection (#24934)
  • [fix][broker] Fix totalAvailablePermits not reduced when removing consumer from non-persistent dispatcher (#24885)
  • [fix][broker] Fix wrong behaviour when using namespace.allowed_clusters, such as namespace deletion and namespace policies updating (#24860)
  • [fix][broker] Flaky-test: ExtensibleLoadManagerImplTest.testDisableBroker (#24770)
  • [fix][broker] Flaky-test: TopicTransactionBufferTest.testMessagePublishInOrder (#24826)
  • [fix][broker] Run ResourceGroup tasks only when tenants/namespaces registered (#24859)
  • [fix][broker] Stop to retry to read entries if the replicator has terminated (#24880)
  • [fix][broker] Trigger topic creation event only once for non-existent topic (#24802)
  • [fix][broker] Use poll instead remove to avoid NoSuchElementException (#24933)
  • [fix][broker]Leaving orphan schemas and topic-level policies after partitioned topic is deleted by GC (#24971)
  • [fix][broker]Transactional messages can never be sent successfully if concurrently taking transaction buffer snapshot (#24945)
  • [fix][admin] Set local policies overwrites "number of bundles" passed during namespace creation (#24762)
  • [fix][ml] Fix getNumberOfEntries may point to deleted ledger (#24852)
  • [fix][ml] Fix ledger trimming race causing cursor to point to deleted ledgers (#24855)
  • [fix][ml] PIP-430: Fix concurrency issue in MessageMetadata caching and improve caching (#24836)
  • [fix]Fixed getChildren('/') on Oxia based provider (#24863)
  • [improve][broker] Add tests for using absolute FQDN for advertisedAddress and remove extra dot from brokerId (#24787)

... (truncated)

Commits
  • 5f587c1 Release 4.1.2
  • 1150652 [fix][broker]Leaving orphan schemas and topic-level policies after partitione...
  • a6a71bc [fix][test] Made ProtobufNativeSchemaTest.testSchema order-independent (#24805)
  • faefc6c [improve][client] Deduplicate getTopicsUnderNamespace in BinaryProtoLookupSer...
  • 4aabd82 [fix][test] Add Delta Tolerance in Double-Precision Assertions to Fix Roundin...
  • cb0998b [fix][test] Fixed ResponseBody Check in Test Helper (#24872)
  • 7afa30f [fix][test] Fixed Nondeterministic Ordering in SchemaInfoTest (#24969)
  • 27f57cf [fix][client] Fix deduplication for getPartitionedTopicMetadata to include me...
  • 0a2772c [fix][broker]Transactional messages can never be sent successfully if concurr...
  • fb8a0e8 [fix][test] Fix flaky KeySharedSubscriptionBrokerCacheTest.testReplayQueueRea...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [org.apache.pulsar:pulsar-client-all](https://github.com/apache/pulsar) from 4.1.1 to 4.1.2.
- [Release notes](https://github.com/apache/pulsar/releases)
- [Commits](apache/pulsar@v4.1.1...v4.1.2)

---
updated-dependencies:
- dependency-name: org.apache.pulsar:pulsar-client-all
  dependency-version: 4.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added the type: dependency-upgrade A dependency upgrade label Nov 17, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

type: dependency-upgrade A dependency upgrade

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant