V4.0.9.7

StreamNative Weekly Release Notes v4.0.9.7

Download

Distributions

• https://github.com/streamnative/pulsar/releases/tag/v4.0.9.7

Packages

• Maven Central

Images

• sn-platform

• sn-platform-slim

• private-cloud

General Changes

Apache Pulsar

(#25510) [fix][ci] Ensure discard_max_bytes is set to 0 only for existing block devices

(#25373) [fix][ci] Disable trivy-action

(#25075) [fix][ci] Fix .github/actions/ssh-access which is used for debugging Pulsar CI in forks

(#25272) [fix][broker] Fix backlog clearing for unloaded namespace bundles

(#25478) [fix][admin] Refactor namespace migration operation to async in rest api

(#25289) [fix][broker] Return failed future instead of throwing exception in async methods

(#25287) [fix][client] Fix async APIs to return failed futures on validation errors

(#25086) [fix][admin] Refactor namespace anti affinity group sync operations to async in rest api

(#25272))) Revert “[fix][broker] Fix backlog clearing for unloaded namespace bundles

(#25478))) Revert “[fix][admin] Refactor namespace migration operation to async in rest api

(#25384))) Revert “[refactor][broker] Decouple delayed delivery trackers from dispatcher

(#25272) [fix][broker] Fix backlog clearing for unloaded namespace bundles

(#25352) [fix][broker] Fix race condition in ServerCnx producer/consumer async callbacks

(#25370) [feat][bookkeeper] add certs refresh

(#25379) [fix][broker] Fix ExtensibleLoadManagerImpl stuck Assigning bundle state after broker restart

(#25384) [refactor][broker] Decouple delayed delivery trackers from dispatcher

(#25400) [fix][client] Fix thread-safety and refactor MessageCryptoBc key management

(#25444) [improve][ci] Cleanup tune-runner-vm and clean-disk actions

(#25478) [fix][admin] Refactor namespace migration operation to async in rest api

(#25483) [fix][broker] Change the schema incompatible log from ERROR to WARN level

(#25520) [improve][broker] Close connection when close consumer write fails

KoP

[branch-4.0] Bump pulsar and sn bom versions to 4.0.9.7

Increase timeout values and ensure topic creation is completed in transaction test

Return UNKNOWN_TOPIC_OR_PARTITION error for partitioned metadata loss

Include client id as the suffix of producer name in topic stats

Prevent concurrent metadata requests in each connection

Improve the performance of metadata request processing

Support listing non-partitioned topics

Speed up maven build by adjusting the repository order

Only try creating missed partition when the partition does not exist

fix: respect max bytes limit for both requests and partitions

Fix “LastConfirmedEntry is xxx when reading” read failures after ledger rollover

StreamNative Pulsar Plugins

0887fed87 Upgrade zookeeper version to 3.9.5

fix: patch CVE-2026-33870 in pulsar-metadata-tool

fix: upgrade alpine to 3.23 and patch musl, libssl3, libcrypto3 for CVEs

fix: upgrade log4j to 2.25.4 to fix CVE-2026-34480, CVE-2026-34481

pulsarctl

Bump go version to 1.25.9 to fix CVE-2026-32280

Cloud Pulsar Plugins

[ApiKeys] Include role in auth failure log during new/refresh auth state

Function Mesh Worker Service

feat: add more cases for registry CI

Security Fixes

Apache Pulsar

(#25353) [fix][sec] Bump google.golang.org/grpc from 1.60.0 to 1.79.3 in /pulsar-function-go

(#25399) [fix][sec] Upgrade to Netty 4.1.132.Final to address CVEs