Cherry-picked changes

• [fix][sec][branch-4.0] Upgrade Hadoop to 3.5.0 (#26195)
• [fix][sec][branch-4.0] Upgrade Jackson version to 2.18.9 (#26187)
• [fix][sec][branch-4.0] Upgrade Netty to 4.1.136.Final (#26170)
• [fix][ci] Upgrade sandboxed-trivy-action to approved sha (#26169)
• [improve][meta] Upgrade Oxia client to 0.8.0 (#25964)
• [improve][meta] Upgrade Oxia client to 0.9.4 (#26193)
• [improve][monitor][branch-4.0] Upgrade OpenTelemetry libraries (#26165)
• [improve][build] Upgrade docker base image Alpine to 3.24 (#26225)
• [improve][build] Upgrade slog to 0.10.0 (#26226)
• [improve][misc] Upgrade Jetty to 12.1.11 (#26233)
• [improve][misc] Upgrade to Alpine 3.23 (#25180)

• [fix][broker] Check deliverAt before containsMessage in bucket addMessage (#26230)
• [fix][broker] Fix getEstimatedSizeSinceMarkDeletePosition throw IllegalArgumentException (#26184)
• [fix][broker] Fix bucket delayed message index metrics reset on scrape (#26171)
• [fix][broker] Fix delayed message index data loss when trimming overlapping bucket snapshots (#26240)
• [fix][broker] Fix incorrect listener URLs returned by ModularLoadManager lookups (#26245)
• [fix][broker] Fix Key_Shared delivery stall when look-ahead triggers at the end of the topic (#26236)
• [fix][broker] Fix silently dropped acknowledgement failures in PulsarMetadataEventSynchronizer (#26237)
• [fix][broker] Fix TableViewLoadDataStoreImpl close deadlock that stalls broker shutdown (#26243)
• [fix][broker] Prevent completing replicated snapshot before marker publish (#26119)
• [fix][broker] Prevent partition expansion from inheriting delayed-delivery bucket state (#26179)
• [fix][broker] Prevent stale read completions from stranding Failover subscriptions (#26174)
• [fix][broker] Prevent stale service unit callbacks from dropping active lookup and cleanup jobs (#26146)
• [fix][broker] Prevent stale topic unload cleanup from removing active cache entries (#26145)
• [fix][broker] Read subscription properties directly from cursor (#26159)
• [fix][broker] Release entry on GetLastMessageId when parseMessageMetadata throws (#26089)
• [fix][broker] Trigger max read position callback for messages published during transaction buffer recovery (#26234)
• [fix][broker][branch-4.2] Fix admin API HTTP 400 FAIL_ON_TRAILING_TOKENS when a broker interceptor is loaded (#26223)
• [fix][ml] Preserve ledger entries/size when transformLedgerInfo callback completes after a concurrent close (#26228)
• [fix][meta] Complete handleMetadataEvent future exceptionally when the initial get fails (#26199)
• [fix][meta] Fix NPE in shouldIgnoreEvent when MetadataEvent options is null (#26200)
• [fix][meta] Fix RocksdbMetadataStore instanceId not advancing across restarts (#26218)
• [fix][meta] Record get op stats on the correct completion branch in AbstractMetadataStore (#26201)
• [improve][broker] Skip system cursor when check inactive cursor. (#26149)
• [improve][broker][branch-4.0] Trace the asynchronous tasks in logs when loading topics (#26163) (#26224)
• [improve][offload] Support credentials from offload policies for S3 and Aliyun OSS drivers (#26232)

• [fix][client] Fix lookup permit double-release, waiting queue starvation and timeout-response races in ClientCnx (#26143)
• [fix][client] Fix lookup request semaphore not release problem (#25038)
• [fix][client] Fix UnAckedMessageRedeliveryTracker to skip cancelled timeouts (#26043)
• [fix][client] Fix unAckedMessageTracker cleanup on multi-topics batch ack (#26001)
• [fix][client] Preserve null values in pulsar-admin schema output (#26196)
• [fix][client] Sync ackSet in client with broker to stop acked messages reaching the DLQ (#26135)

• [fix][fn] Forward source message properties in Python runtime (#26191)
• [fix][fn] Return inputSpecs consumerProperties in function GET info (#26217)

• [improve][misc][branch-4.0] Add CustomLog config for slog
• [fix][metadata] Fix orphaned UR parent nodes not cleaned up with Oxia metadata backend (#26158)
• [fix][misc][branch-4.0] Make log4j pattern compatible with slog which got pulled in by Oxia client upgrade

• [fix][test] Fix flaky test testCompactionPriority (#26198)
• [improve][ci] Replace trivy-action with sandboxed-trivy-action (#25480)
• [fix][build][branch-4.0] Fix spotbugs failure in OffloadPoliciesImpl
• [fix][ci][branch-4.0] Fix OpenTelemetrySanityTest after Otel library upgrade
• [fix][ci][branch-4.0] Skip testMarkReplicatedDeletesEmptyParentNodes for Etcd

For the complete list, check the full changelog.

Cherry-picked changes

Cherry-picked changes

Merged PRs included in the milestone

• [fix][sec] Bump org.asynchttpclient:async-http-client from 2.14.5 to 2.15.0 (#25818)
• [fix][sec] Upgrade commons-configuration2 to 2.15.0 to address CVE-2026-45205 (#25844)
• [fix][sec] Upgrade Netty to 4.1.133.Final to address CVEs (#25670)
• [improve][misc] Upgrade Netty to 4.1.134 (#25870)
• [fix][sec] Upgrade Netty to 4.1.135.Final to address several CVEs (#25918)
• [fix][sec] Upgrade thrift to 0.23.0 to address CVE-2026-43869 (#25744)
• [fix][sec] Upgrade vert.x to 4.5.25 to address CVE-2026-6860 (#25737)
• [fix][sec] Upgrade vertx to 4.5.27 to address CVE-2026-6860 (#25745)
• [improve][misc] Upgrade vert.x to 4.5.28 (#25924)
• [improve][build] Remove kotlin-stdlib override; upgrade okhttp3 5.3.2 and okio 3.17.0 (#25855)
• [improve][build] Upgrade org.apache.kerby:kerb-simplekdc from 1.1.1 to 2.1.1 (#25785)
• [improve][misc] Upgrade Jetty to 12.1.9 (#25752)
• [improve][misc] Upgrade Jetty to 12.1.10 (#25943)
• [improve][misc] Upgrade Caffeine to 3.2.4 (#25663)

• [fix][broker] Clean up orphan ledger on concurrent initial schema creation in BookkeeperSchemaStorage (#25514)
• [fix][broker] Close pending acks cleanup gap in BacklogQuotaManager (#25624)
• [fix][broker] ConcurrentLongHashMap throw ArrayIndexOutOfBoundsException (#25644)
• [fix][broker] Correct two race conditions in the tracker code and logic bug in InMemoryDelayedDeliveryTracker that failed with NoSuchElementException (#25681)
• [fix][broker] Decrement unacked counter when removeAllUpTo removes pending acks (#25581)
• [fix][broker] Fix compaction cursor reset may lose mark-delete properties (#25862)
• [fix][broker] Fix ManagedLedgerImpl.advanceCursorsIfNecessary() method may lose non-durable cursor properties in race condition (#25796)
• [fix][broker] Fix non-batched null-value messages not removed during topic compaction (#25817)
• [fix][broker] Fix PersistentMessageExpiryMonitor findEntryComplete() method may lose mark-delete properties in race condition (#25803)
• [fix][broker] Fix precision loss in DataSketchesSummaryLogger by replacing LongAdder with DoubleAdder for sum accumulation (#25594)
• [fix][broker] Fix PulsarService.closeAsync where Condition.signalAll was called without holding a lock (#25777)
• [fix][broker] Fix race in pending acks removal in redeliverUnacknowledgedMessages (#25589)
• [fix][broker] Fix stuck chunks in SharedConsumerAssignor permit tracking (#25620)
• [fix][broker] Merge broker offload extra configurations (#25736)
• [fix][broker] Move pending acks cleanup to selected mark-delete callbacks (#25592)
• [fix][broker] Race condition causes perpetual backlog on internal topics (#25572)
• [fix][broker] Skip backlog-quota eviction on fenced/closing topics (#25684)
• [fix][broker] Use effective offload policies for extra configs (#25781)
• [fix][broker] Wait for orphan schema ledger cleanup before retry (#25579)
• [fix][broker][fix][broker]Replication stats is empty when the cluster is the target cluster of a one-way replication (#25583)
• [fix][broker]Replication is stuck because failed to read entries (#25625)
• [fix][bk] Fix NPE in IsolatedBookieEnsemblePlacementPolicy when policy class does not match (#25825)
• [fix][meta] Fix PulsarZooKeeperClient async addWatch callback retry behavior (#25913)
• [fix][meta] Fix ZooKeeper session reconnect race condition in PulsarZooKeeperClient.clientCreator (#25910)
• [improve][broker] optimize namespaceBundle validation to fix single-thread 100% CPU during unloading entire namespaces (#25626)
• [improve][broker] Prevent stale replicator pending reads after termination (#25767)
• [improve][offload] Coalesce automatic offload triggers to reduce retry loops and ledger scans (#25793)
• [fix][broker][branch-4.2] URL-encode sub-name in Txn pending-ack topic #25727 (#25728)

• [fix][client] Apply Avro logical type conversions when decoding schema without classloader (#25759)
• [fix][client] Clean up unacked messages when unsubscribing a topic with ack timeout backoff (#25916)
• [fix][client] Fix failed to close consumer because of the error: param memorySize is a negative value (#25805)
• [fix][client] Make ClientBuilder serializable (#25730) (#25739)
• [fix][client] Match logical topic when removing unacked messages (#25921)
• [fix][client] Preserve equals in FieldParser map values (#25907)
• [fix][client] Prevent duplicate ServiceUrlProvider initialization (#25899)
• [fix][client] Reset higher-index states on recovery in SameAuthParamsLookupAutoClusterFailover (#25826)
• [fix][client] Stabilize scaleReceiverQueueHint against concurrent enqueue/take (#25578)
• [fix][client]Broker-side producer handle leak if closes a producer which state is regitering schema (#25725)
• [improve][client] Best-effort retry for individual/batch-index acks on send failure when ackReceiptEnabled=false (#25525)
• [improve][client] Clean up unacked message tracker when topics are removed in multi-topic consumers (#25923)
• [improve][client] Implement tls_client_auth for AuthenticationOAuth2 (#25538)
• [improve][client] In cases where there is a risk of message loss, adjust the log level to error (#25854)

• [fix][fn] Fix functions update issue where artifact is provided as a http url (#25840)
• [fix][fn] Fix Go function runtime to continue after user exceptions and add neg-ack tests (#25867)
• [fix][fn] Fix orphan exclusive producer on creation timeout in WorkerUtils.createExclusiveProducerWithRetry (#25942)
• [improve][fn] Avoid gRPC timeout when getting status of a dead process runtime (#25819)
• [improve][fn] make built-in connector reload incremental (#25773)
• [improve][fn] make built-in functions reload incremental (#25868)
• [refactor][fn] Use Map instead of TreeMap for connector/function API types (#25790)
• [improve][functions] Allow customizing Kubernetes service domain suffix in Function Worker (#25872)

• [fix][proxy] Avoid intermittent 502 when admin proxy follows a broker redirect for a request with a body (#25919)
• [fix][proxy] Close channel on connection failure (#25770)
• [improve][cli] Add client side looping in "pulsar-admin topics analyze-backlog" cli to avoid potential HTTP call timeout (#25126)

• [fix][test] Add timeout to initial receives in ResendRequestTest.testSharedSingleAckedPartitionedTopic (#25828)
• [fix][test] Fix flaky ExtensibleLoadManagerImplTest.testLoadBalancerServiceUnitTableViewSyncer (#25596)
• [fix][test] Fix flaky OneWayReplicatorDeduplicationTest.testDeduplication (#25679)
• [fix][test] Fix flaky ProducerCleanupTest timer cleanup (#25864)
• [fix][test] Fix flaky PulsarFunctionTlsTest.testFunctionsCreation() test (#25889)
• [fix][test] Fix flaky ResendRequestTest.testSharedSingleAckedPartitionedTopic() test (#25852)
• [fix][test] Fix flaky SameAuthParamsLookupAutoClusterFailoverTest.testAutoClusterFailover() test (#25892)
• [fix][test] Fix flaky testGetExcludedBookiesWithIsolationGroups (#25640)
• [fix][test] Fix flaky testMsgDropStat in NonPersistentTopicTest (#25426)
• [fix][test] Make NamespacesTest.cleanupAfterMethod tolerant of transient infra failures (#25641)
• [fix][test] Reduce flakiness in testLoadBalancerServiceUnitTableViewSyncer (#25638)
• [fix][test] Stabilize testSecondaryIsolationGroupsBookiesNegative() test (#25900)
• [fix][test] Stabilize WebService rate limiting test (#25866)
• [improve][test] Set diskUsageThreshold to 0.999 for tests to effectively disable the check (#25677)
• [fix][test][branch-4.2] Fix PersistentMessageExpiryMonitorTest

For the complete list, check the full changelog.

• [fix][sec][branch-4.0] Upgrade avro to 1.11.5 to address CVE-2025-33042 (#25788)
• [fix][sec] Bump org.asynchttpclient:async-http-client from 2.14.5 to 2.15.0 (#25818)
• [fix][sec] Upgrade commons-configuration2 to 2.15.0 to address CVE-2026-45205 (#25844)
• [fix][sec] Upgrade Netty to 4.1.133.Final to address CVEs (#25670)
• [improve][misc] Upgrade Netty to 4.1.134 (#25870)
• [fix][sec] Upgrade Netty to 4.1.135.Final to address several CVEs (#25918)
• [fix][sec] Upgrade thrift to 0.23.0 to address CVE-2026-43869 (#25744)
• [fix][sec] Upgrade vert.x to 4.5.25 to address CVE-2026-6860 (#25737)
• [fix][sec] Upgrade vertx to 4.5.27 to address CVE-2026-6860 (#25745)
• [improve][misc] Upgrade vert.x to 4.5.28 (#25924)
• [improve][build] Remove kotlin-stdlib override; upgrade okhttp3 5.3.2 and okio 3.17.0 (#25855)
• [improve][build] Upgrade org.apache.kerby:kerb-simplekdc from 1.1.1 to 2.1.1 (#25785)
• [improve][misc] Upgrade Jetty to 12.1.9 (#25752)
• [improve][misc] Upgrade Jetty to 12.1.10 (#25943)

• [fix][broker] Clean up orphan ledger on concurrent initial schema creation in BookkeeperSchemaStorage (#25514)
• [fix][broker] Close pending acks cleanup gap in BacklogQuotaManager (#25624)
• [fix][broker] ConcurrentLongHashMap throw ArrayIndexOutOfBoundsException (#25644)
• [fix][broker] Correct two race conditions in the tracker code and logic bug in InMemoryDelayedDeliveryTracker that failed with NoSuchElementException (#25681)
• [fix][broker] Decrement unacked counter when removeAllUpTo removes pending acks (#25581)
• [fix][broker] Fix compaction cursor reset may lose mark-delete properties (#25862)
• [fix][broker] Fix ManagedLedgerImpl.advanceCursorsIfNecessary() method may lose non-durable cursor properties in race condition (#25796)
• [fix][broker] Fix non-batched null-value messages not removed during topic compaction (#25817)
• [fix][broker] Fix PersistentMessageExpiryMonitor findEntryComplete() method may lose mark-delete properties in race condition (#25803)
• [fix][broker] Fix precision loss in DataSketchesSummaryLogger by replacing LongAdder with DoubleAdder for sum accumulation (#25594)
• [fix][broker] Fix PulsarService.closeAsync where Condition.signalAll was called without holding a lock (#25777)
• [fix][broker] Fix race in pending acks removal in redeliverUnacknowledgedMessages (#25589)
• [fix][broker] Fix stuck chunks in SharedConsumerAssignor permit tracking (#25620)
• [fix][broker] Merge broker offload extra configurations (#25736)
• [fix][broker] Move pending acks cleanup to selected mark-delete callbacks (#25592)
• [fix][broker] Race condition causes perpetual backlog on internal topics (#25572)
• [fix][broker] Skip backlog-quota eviction on fenced/closing topics (#25684)
• [fix][broker] Use effective offload policies for extra configs (#25781)
• [fix][broker] Wait for orphan schema ledger cleanup before retry (#25579)
• [fix][broker][fix][broker]Replication stats is empty when the cluster is the target cluster of a one-way replication (#25583)
• [fix][broker]Replication is stuck because failed to read entries (#25625)
• [fix][bk] Fix NPE in IsolatedBookieEnsemblePlacementPolicy when policy class does not match (#25825)
• [fix][meta] Fix PulsarZooKeeperClient async addWatch callback retry behavior (#25913)
• [fix][meta] Fix ZooKeeper session reconnect race condition in PulsarZooKeeperClient.clientCreator (#25910)
• [improve][broker] optimize namespaceBundle validation to fix single-thread 100% CPU during unloading entire namespaces (#25626)
• [improve][broker] PIP-380: Support-setting-up-specific-namespaces-to-skipping-the-load-shedding (#23549)
• [improve][broker] Prevent stale replicator pending reads after termination (#25767)
• [improve][offload] Coalesce automatic offload triggers to reduce retry loops and ledger scans (#25793)

• [fix][client] Apply Avro logical type conversions when decoding schema without classloader (#25759)
• [fix][client] Clean up unacked messages when unsubscribing a topic with ack timeout backoff (#25916)
• [fix][client] Fix failed to close consumer because of the error: param memorySize is a negative value (#25805)
• [fix][client] Fix stale Healthy state in SameAuthParamsLookupAutoClusterFailover causing flaky test (#25388)
• [fix][client] Make ClientBuilder serializable (#25730) (#25740)
• [fix][client] Match logical topic when removing unacked messages (#25921)
• [fix][client] Preserve equals in FieldParser map values (#25907)
• [fix][client] Prevent duplicate ServiceUrlProvider initialization (#25899)
• [fix][client] Reset higher-index states on recovery in SameAuthParamsLookupAutoClusterFailover (#25826)
• [fix][client] Stabilize scaleReceiverQueueHint against concurrent enqueue/take (#25578)
• [fix][client]Broker-side producer handle leak if closes a producer which state is regitering schema (#25725)
• [improve][client] Best-effort retry for individual/batch-index acks on send failure when ackReceiptEnabled=false (#25525)
• [improve][client] Clean up unacked message tracker when topics are removed in multi-topic consumers (#25923)
• [improve][client] Enable configurable preemptive OAuth2 token refresh (#25363)
• [improve][client] Implement tls_client_auth for AuthenticationOAuth2 (#25538)
• [improve][client] In cases where there is a risk of message loss, adjust the log level to error (#25854)

• [fix][fn] Fix functions update issue where artifact is provided as a http url (#25840)
• [fix][fn] Fix Go function runtime to continue after user exceptions and add neg-ack tests (#25867)
• [fix][fn] Fix orphan exclusive producer on creation timeout in WorkerUtils.createExclusiveProducerWithRetry (#25942)
• [improve][fn] Avoid gRPC timeout when getting status of a dead process runtime (#25819)
• [improve][fn] make built-in connector reload incremental (#25773)
• [improve][fn] make built-in functions reload incremental (#25868)
• [refactor][fn] Use Map instead of TreeMap for connector/function API types (#25790)
• [improve][functions] Allow customizing Kubernetes service domain suffix in Function Worker (#25872)

• [improve][proxy][branch-4.0] Restore AdminProxyHandler changes which were accidentially reverted in Jetty 12 upgrade
• [fix][proxy] Avoid intermittent 502 when admin proxy follows a broker redirect for a request with a body (#25919)
• [fix][proxy] Close channel on connection failure (#25770)

• [fix][test] Add timeout to initial receives in ResendRequestTest.testSharedSingleAckedPartitionedTopic (#25828)
• [fix][test] Fix flaky ExtensibleLoadManagerImplTest.testLoadBalancerServiceUnitTableViewSyncer (#25596)
• [fix][test] Fix flaky MessagePublishBufferThrottleTest.testBlockByPublishRateLimiting (#25365)
• [fix][test] Fix flaky OneWayReplicatorDeduplicationTest.testDeduplication (#25679)
• [fix][test] Fix flaky ProducerCleanupTest timer cleanup (#25864)
• [fix][test] Fix flaky PulsarFunctionTlsTest.testFunctionsCreation() test (#25889)
• [fix][test] Fix flaky ResendRequestTest.testSharedSingleAckedPartitionedTopic() test (#25852)
• [fix][test] Fix flaky SameAuthParamsLookupAutoClusterFailoverTest.testAutoClusterFailover() test (#25892)
• [fix][test] Fix flaky testGetExcludedBookiesWithIsolationGroups (#25640)
• [fix][test] Fix flaky testMsgDropStat in NonPersistentTopicTest (#25426)
• [fix][test] Make NamespacesTest.cleanupAfterMethod tolerant of transient infra failures (#25641)
• [fix][test] Reduce flakiness in testLoadBalancerServiceUnitTableViewSyncer (#25638)
• [fix][test] Reduce flakiness in testLoadBalancerServiceUnitTableViewSyncer (#25638)
• [fix][test] Stabilize testSecondaryIsolationGroupsBookiesNegative() test (#25900)
• [fix][build][branch-4.0] Fix issue in backporting PR #25644
• [fix][test] Fix compile error in OffloadPoliciesTest
• [fix][test][branch-4.0] Fix AvroSchemaTest cases that were invalid
• [fix][test][branch-4.0] Fix PersistentMessageExpiryMonitorTest
• [fix][test][branch-4.0] Fix PulsarFunctionTlsTest

For the complete list, check the full changelog.

• [fix][sec] Upgrade BouncyCastle to 1.84 (CVE-2026-5588, CVE-2026-0636) (#25569)
• [fix][sec] Upgrade Jetty to address CVE-2026-2332 (#25527)
• [fix][sec] Upgrade Jetty to address CVE-2026-5795 (#25532)
• [fix][sec] Upgrade to async-http-client 2.14.5 to address CVE-2026-40490 (#25546)
• [fix][sec] Upgrade to Netty 4.1.132.Final to address CVEs (#25399)
• [fix][sec] Upgrade log4j to 2.25.4 to address CVE-2026-34477, CVE-2026-34478, CVE-2026-34480, CVE-2026-34481
• [fix] Upgrade Jetty to 12.1.6 to fix CVE-2026-1605 (#25485)

• [fix][broker] Change the schema incompatible log from ERROR to WARN level (#25483)
• [fix][broker] Fix backlog clearing for unloaded namespace bundles (#25272)
• [fix][broker] Lower log level of DrainingHashesTracker not-found entry to DEBUG (#25558)
• [fix][broker] Prevent timed-out producer creation from racing with retry (#25460)
• [fix][broker] pulsar admin stats internal with metadata command (#25557)
• [fix][broker] Revert "[improve][broker] Enhance advertised address resolution with fallback to localhost (#25238)" (#25523)
• [fix][broker] Unthrottle producers immediately when publish rate limiting is disabled (#25502)
• [fix][broker]Namespaces can be created with may empty replication_clusters policy (#25551)
• [fix][admin] Refactor namespace migration operation to async in rest api (#25478)
• [improve][broker] Close connection when close consumer write fails (#25520)
• [improve][broker] Use full bundle name for namespace bundle destination affinity in ModularLoadManagerImpl (#25518)

• [fix][client] Fix thread-safety and refactor MessageCryptoBc key management (#25400)

• [fix][io] Restore lz4 compression with Kafka IO connector after #25198 exclusion

• [improve][common] Optimize TopicName.get() to reduce lock contention on cache lookup (#25367)
• [improve][broker] Improve the performance of TopicName constructor (#24463)

• [fix][ci] Ensure discard_max_bytes is set to 0 only for existing block devices (#25510)
• [fix][test] Extend SameAuthParamsLookupAutoClusterFailoverTest phase timeouts (#25563)
• [fix][test] Fix flaky BrokerRegistryIntegrationTest port binding race (#25463)
• [fix][test] Fix flaky ExtensibleLoadManagerImpl client reconnection tests: PulsarClientException$AlreadyClosedException: Client already closed (#25509)
• [fix][test] Fix flaky ExtensibleLoadManagerTest.startBroker timeout (#25500)
• [fix][test] Fix flaky OffloadPrefixTest.testPositionOnEdgeOfLedger race with ledger rollover (#25561)
• [fix][test] Fix flaky ServerCnxTest.testCreateProducerTimeoutThenCreateSameNamedProducerShouldFail (#25497)
• [fix][test] Fix flaky testLoadBalancerServiceUnitTableViewSyncer (#25427)
• [fix][test] Flaky SameAuthParamsLookupAutoClusterFailoverTest (#25566)
• [fix][test] Recreate EventLoop in PublishRateLimiterTest setup (#25560)
• [fix][test] Relax BrokerRegistryIntegrationTest broker-close threshold (#25562)
• [improve][ci] Cleanup tune-runner-vm and clean-disk actions (#25444)
• [cleanup][ci] Remove documentation label bot (#25469)
• [cleanup][ci] Remove ready-to-test label enforcement (#25470)
• [cleanup][build] Bumped version to 4.2.1-SNAPSHOT
• [fix][build][branch-4.2] Use correct Jetty ee8 BOM coordinates
• [improve][ci] Backport fix for ssh-access action

For the complete list, check the full changelog.

This release upgrades Jetty from 9.4.x to 12.1.8 to address several high-severity CVEs in Jetty 9.4.x (#25534). For background and discussion, see the dev list thread.

The upgrade introduces the following breaking changes:

1. AdditionalServlet interface change. The org.apache.pulsar.broker.web.plugin.servlet.AdditionalServlet interface was coupled directly to the Jetty 9 org.eclipse.jetty.servlet.ServletHolder class. This coupling has been removed, so external implementations of this plugin API need to be updated.

2. Athenz authentication requires Java 17+. pulsar-client-auth-athenz now depends on Jetty and therefore requires Java 17+. The Pulsar Client and Pulsar Admin client themselves remain Java 8+ compatible.

3. Prometheus metrics provider class relocation. The default Prometheus metrics provider classes for BookKeeper and ZooKeeper have been replaced because the previous defaults depended on Jetty 9.4.x. If you are using the previous default configuration file in your deployment, update the following settings:

   Config file	Setting	Old value	New value
   bookkeeper.conf	statsProviderClass	org.apache.bookkeeper.stats.prometheus.PrometheusMetricsProvider	org.apache.pulsar.metrics.prometheus.bookkeeper.PrometheusMetricsProvider
   zookeeper.conf	metricsProvider.className	org.apache.zookeeper.metrics.prometheus.PrometheusMetricsProvider	org.apache.pulsar.metrics.prometheus.zookeeper.PrometheusMetricsProvider

• [fix][sec] Upgrade BouncyCastle to 1.84 (CVE-2026-5588, CVE-2026-0636) (#25569)
• [fix][sec] Upgrade to async-http-client 2.14.5 to address CVE-2026-40490 (#25546)
• [fix][sec] Upgrade to Netty 4.1.132.Final to address CVEs (#25399)
• [fix][sec] Bump google.golang.org/grpc from 1.60.0 to 1.79.3 in /pulsar-function-go (#25353)
• [fix][sec] Bump org.apache.zookeeper:zookeeper from 3.9.4 to 3.9.5 (#25303)
• [fix][sec] Upgrade aircompressor to 2.0.3 to resolve CVE-2025-67721 (#25256)
• [fix][sec] Upgrade Jackson version to 2.18.6 (#25264)
• [fix][sec] Upgrade Python protobuf version to 6.33.5 to address CVE-2026-0994 (#25250)
• [fix][sec][branch-4.0] Upgrade to Jetty 12.1.8 to address several CVEs (#25534)
• [improve][fn] Upgrade Pulsar Python client version to 3.10.0 (#25251)
• [fix][sec] Upgrade log4j to 2.25.4 to address CVE-2026-34477, CVE-2026-34478, CVE-2026-34480, CVE-2026-34481
• [improve] Upgrade RoaringBitmap to 1.6.9 version (#25253)

• [fix][broker] Change the schema incompatible log from ERROR to WARN level (#25483)
• [fix][broker] Fix backlog clearing for unloaded namespace bundles (#25272)
• [fix][broker] Lower log level of DrainingHashesTracker not-found entry to DEBUG (#25558)
• [fix][broker] Prevent timed-out producer creation from racing with retry (#25460)
• [fix][broker] pulsar admin stats internal with metadata command (#25557)
• [fix][broker] Unthrottle producers immediately when publish rate limiting is disabled (#25502)
• [fix][broker]Namespaces can be created with may empty replication_clusters policy (#25551)
• [fix][admin] Refactor namespace migration operation to async in rest api (#25478)
• [improve][broker] Close connection when close consumer write fails (#25520)
• [improve][broker] Use full bundle name for namespace bundle destination affinity in ModularLoadManagerImpl (#25518)
• [fix][broker] Fix concurrency bug in BucketDelayedDeliveryTracker (#25346)
• [fix][broker] Fix ExtensibleLoadManagerImpl stuck Assigning bundle state after broker restart (#25379)
• [fix][broker] fix flaky test in SystemTopicBasedTopicPoliciesServiceTest (#25098)
• [fix][broker] Fix IllegalArgumentException in BucketDelayedDeliveryTracker.addMessage (#25371)
• [fix][broker] Fix race condition in ServerCnx producer/consumer async callbacks (#25352)
• [fix][broker] Guard AsyncTokenBucket against long overflow (#25262)
• [fix][broker] Handle missing replicator during snapshot request processing (#25266)
• [fix][broker] Return failed future instead of throwing exception in async methods (#25289)
• [fix][broker] Support namespace unsubscribe when bundles are unloaded (#25276)
• [fix][broker]Producer with AUTO_PRODUCE schema failed to reconnect, which caused by schema incompatible (#25437)
• [fix][broker]system topic was created with different partitions acrossing clusters after enabled namespace-level replication (#25312)
• [fix][admin] Refactor namespace anti affinity group sync operations to async in rest api (#25086)
• [fix][offload] Close all resources in BlobStoreBackedReadHandleImplV2.closeAsync (#25296)
• [improve][broker] Change log level from warn to debug when cursor mark-deleted position ledger doesn't exist (#25200)
• [improve][broker] Optimize AsyncTokenBucket overflow solution further to reduce fallback to BigInteger (#25269)
• [improve][broker]Reduce the lock range of SimpleCache to enhance performance (#25293)
• [refactor][broker] Decouple delayed delivery trackers from dispatcher (#25384)

• [fix][client] Fix thread-safety and refactor MessageCryptoBc key management (#25400)
• [fix][client] Fail messages immediately in ProducerImpl when in terminal state (#25317)
• [fix][client] Fix async APIs to return failed futures on validation errors (#25287)
• [fix][client] Reduce logging in OAuth auth to fix parsing of Pulsar cli command output (#25254)
• [improve][client][branch-4.0] Deduplicate in-progress lookup requests also for HttpLookupService (#25017)

• [fix][io][kca] kafka headers silently dropped (#25325)
• [fix][io] Restore lz4 compression with Kafka IO connector after #25198 exclusion

• [improve][common] Optimize TopicName.get() to reduce lock contention on cache lookup (#25367)
• [improve][broker] Improve the performance of TopicName constructor (#24463)
• [feat][bookkeeper] add certs refresh (#25370)

• [fix][ci] Ensure discard_max_bytes is set to 0 only for existing block devices (#25510)
• [fix][test] Extend SameAuthParamsLookupAutoClusterFailoverTest phase timeouts (#25563)
• [fix][test] Fix flaky BrokerRegistryIntegrationTest port binding race (#25463)
• [fix][test] Fix flaky ExtensibleLoadManagerImpl client reconnection tests: PulsarClientException$AlreadyClosedException: Client already closed (#25509)
• [fix][test] Fix flaky ExtensibleLoadManagerTest.startBroker timeout (#25500)
• [fix][test] Fix flaky OffloadPrefixTest.testPositionOnEdgeOfLedger race with ledger rollover (#25561)
• [fix][test] Fix flaky ServerCnxTest.testCreateProducerTimeoutThenCreateSameNamedProducerShouldFail (#25497)
• [fix][test] Fix flaky testLoadBalancerServiceUnitTableViewSyncer (#25427)
• [fix][test] Flaky SameAuthParamsLookupAutoClusterFailoverTest (#25566)
• [fix][test] Recreate EventLoop in PublishRateLimiterTest setup (#25560)
• [fix][test] Relax BrokerRegistryIntegrationTest broker-close threshold (#25562)
• [improve][ci] Cleanup tune-runner-vm and clean-disk actions (#25444)
• [cleanup][ci] Remove documentation label bot (#25469)
• [cleanup][ci] Remove ready-to-test label enforcement (#25470)
• [fix][ci] Disable trivy-action (#25373)
• [fix][ci] Fix .github/actions/ssh-access which is used for debugging Pulsar CI in forks (#25075)
• [fix][test] Fix flaky ExtensibleLoadManagerImplTest.testLoadBalancerServiceUnitTableViewSyncer (#25378)
• [fix][test] Fix flaky OneWayReplicatorUsingGlobalZKTest cleanup (#25313)
• [fix][test] Fix flaky OneWayReplicatorUsingGlobalZKTest.cleanup (#25389)
• [fix][test] Fix flaky PersistentStickyKeyDispatcherMultipleConsumersClassicTest.testSkipRedeliverTemporally (#25385)
• [fix][test] Fix flaky PulsarDebeziumOracleSourceTest (#25314)
• [fix][test] Fix flaky ReplicatorTest.testResumptionAfterBacklogRelaxed (#25358)
• [fix][test] Fix flaky SingleThreadNonConcurrentFixedRateSchedulerTest.testPeriodicTaskCancellation (#24823)
• [fix][test] Stabilize FunctionAssignmentTailerTest.testErrorNotifier by synchronizing mock stubbing with CountDownLatch (#24875)
• [fix] Fix flaky OneWayReplicatorTest.testTopicPoliciesReplicationRule (#25316)
• [fix] Fix flaky testEstimatedTimeBasedBacklogQuotaCheckWhenNoBacklog (#25307)
• [cleanup][build] Bumped version to 4.0.10-SNAPSHOT
• [fix][build] Fix license file for shell distribution
• [fix][build][branch-4.0] Fix broken compilation after cherry-picking #25400
• [fix][build][branch-4.0] Fix missing exclusion in cherry-picking #25264
• [fix][test][branch-4.0] Backport Pulsar IO Debezium connector test framework changes
• [improve][build][branch-4.0] Support docker.golang.image/GOLANG_IMAGE in latest-version-image
• [improve][ci] Backport fix for ssh-access action

For the complete list, check the full changelog.

• [fix][sec] Upgrade BouncyCastle to 1.84 (CVE-2026-5588, CVE-2026-0636) (#25569)
• [fix][sec] Upgrade to async-http-client 2.14.5 to address CVE-2026-40490 (#25546)
• [fix][sec] Upgrade to Netty 4.1.132.Final to address CVEs (#25399)
• [fix][sec] Bump org.apache.zookeeper:zookeeper from 3.9.4 to 3.9.5 (#25303)
• [fix][sec] Upgrade aircompressor to 2.0.3 to resolve CVE-2025-67721 (#25256)
• [fix][sec] Upgrade Jackson version to 2.18.6 (#25264)
• [fix][sec] Upgrade Python protobuf version to 6.33.5 to address CVE-2026-0994 (#25250)
• [improve][fn] Upgrade Pulsar Python client version to 3.10.0 (#25251)
• [fix][sec] Exclude org.lz4:lz4-java and standardize on at.yawk.lz4-java to remediate CVE-2025-12183 and CVE-2025-66566 (#25198)
• [fix][sec] Override kafka-clients in kinesis-kpl-shaded to remediate CVE-2024-31141 and CVE-2025-27817 (#24935)
• [fix][sec] Upgrade log4j to 2.25.4 to address CVE-2026-34477, CVE-2026-34478, CVE-2026-34480, CVE-2026-34481 (#25521)
• [fix][sec]Upgrade jackson to 2.17.2 (#23174)
• [improve] Upgrade Netty to 4.1.131.Final (#25232)

• [improve][broker] Close connection when close consumer write fails (#25520)

• [fix][client] Fail messages immediately in ProducerImpl when in terminal state (#25317)

• [fix][io] Restore lz4 compression with Kafka IO connector after #25198 exclusion

• [improve][common] Optimize TopicName.get() to reduce lock contention on cache lookup (#25367)
• [improve][broker] Improve the performance of TopicName constructor (#24463)

• [improve][ci] Cleanup tune-runner-vm and clean-disk actions (#25444)
• [cleanup][ci] Remove documentation label bot (#25469)
• [cleanup][ci] Remove ready-to-test label enforcement (#25470)
• [fix][ci] Fix .github/actions/ssh-access which is used for debugging Pulsar CI in forks (#25075)
• [fix][test] Stabilize FunctionAssignmentTailerTest.testErrorNotifier by synchronizing mock stubbing with CountDownLatch (#24875)
• [cleanup][build] Bumped version to 3.0.17-SNAPSHOT
• [fix][build][branch-3.0] Fix presto-distribution license file
• [fix][build][branch-3.0] Fix trino license
• [fix][build][branch-3.0] Fix trino license file
• [fix][ci][branch-3.0] Fix docker daemon configuration for branch-3.0
• [fix][ci][branch-3.0] Revert adding min-api-version: 1.24 to /etc/docker/daemon.json
• [improve][ci] Backport fix for ssh-access action

For the complete list, check the full changelog.