> ## Documentation Index
> Fetch the complete documentation index at: https://docs.streamnative.io/llms.txt
> Use this file to discover all available pages before exploring further.

# V4.0.10.1

# StreamNative Weekly Release Notes v4.0.10.1 (stable)

## Download

### Distributions

* [https://github.com/streamnative/pulsar/releases/tag/v4.0.10.1](https://github.com/streamnative/pulsar/releases/tag/v4.0.10.1)

### Packages

* [Maven Central](https://search.maven.org/artifact/io.streamnative/pulsar/4.0.10.1/pom)

### Images

* [sn-platform](https://hub.docker.com/layers/streamnative/sn-platform/4.0.10.1/images/sha256-d2d42b5a1c0467cf66ed3b0a042941a16bf6f0dbd97e78db9e75101705a18e98)

* [sn-platform-slim](https://hub.docker.com/layers/streamnative/sn-platform-slim/4.0.10.1/images/sha256-28b277e679d57df6ca19776887cb8ed1553d134c5292c0f39315c6980f2a9fef)

* [private-cloud](https://hub.docker.com/layers/streamnative/private-cloud/4.0.10.1/images/sha256-28b277e679d57df6ca19776887cb8ed1553d134c5292c0f39315c6980f2a9fef)

## General Changes

### Apache Pulsar

([#25518](https://github.com/apache/pulsar/pull/25518)) \[improve]\[broker] Use full bundle name for namespace bundle destination affinity in ModularLoadManagerImpl

([#25566](https://github.com/apache/pulsar/pull/25566)) \[fix]\[test] Flaky SameAuthParamsLookupAutoClusterFailoverTest

([#25561](https://github.com/apache/pulsar/pull/25561)) \[fix]\[test] Fix flaky OffloadPrefixTest.testPositionOnEdgeOfLedger race with ledger rollover

([#25563](https://github.com/apache/pulsar/pull/25563)) \[fix]\[test] Extend SameAuthParamsLookupAutoClusterFailoverTest phase timeouts

([#25557](https://github.com/apache/pulsar/pull/25557)) \[fix]\[broker] pulsar admin stats internal with metadata command

([#25562](https://github.com/apache/pulsar/pull/25562)) \[fix]\[test] Relax BrokerRegistryIntegrationTest broker-close threshold

([#25389](https://github.com/apache/pulsar/pull/25389)) \[fix]\[test] Fix flaky OneWayReplicatorUsingGlobalZKTest.cleanup

([#25313](https://github.com/apache/pulsar/pull/25313)) \[fix]\[test] Fix flaky OneWayReplicatorUsingGlobalZKTest cleanup

([#25385](https://github.com/apache/pulsar/pull/25385)) \[fix]\[test] Fix flaky PersistentStickyKeyDispatcherMultipleConsumersClassicTest.testSkipRedeliverTemporally

([#24823](https://github.com/apache/pulsar/pull/24823)) \[fix]\[test] Fix flaky SingleThreadNonConcurrentFixedRateSchedulerTest.testPeriodicTaskCancellation

([#25307](https://github.com/apache/pulsar/pull/25307)) \[fix] Fix flaky testEstimatedTimeBasedBacklogQuotaCheckWhenNoBacklog

([#25463](https://github.com/apache/pulsar/pull/25463)) \[fix]\[test] Fix flaky BrokerRegistryIntegrationTest port binding race

([#25560](https://github.com/apache/pulsar/pull/25560)) \[fix]\[test] Recreate EventLoop in PublishRateLimiterTest setup

([#25502](https://github.com/apache/pulsar/pull/25502)) \[fix]\[broker] Unthrottle producers immediately when publish rate limiting is disabled

([#25558](https://github.com/apache/pulsar/pull/25558)) \[fix]\[broker] Lower log level of DrainingHashesTracker not-found entry to DEBUG

([#25098](https://github.com/apache/pulsar/pull/25098)) \[fix]\[broker] fix flaky test in SystemTopicBasedTopicPoliciesServiceTest

([#25500](https://github.com/apache/pulsar/pull/25500)) \[fix]\[test] Fix flaky ExtensibleLoadManagerTest.startBroker timeout

([#25509](https://github.com/apache/pulsar/pull/25509)) \[fix]\[test] Fix flaky ExtensibleLoadManagerImpl client reconnection tests: PulsarClientException\$AlreadyClosedException: Client already closed

([#25427](https://github.com/apache/pulsar/pull/25427)) \[fix]\[test] Fix flaky testLoadBalancerServiceUnitTableViewSyncer

([#25378](https://github.com/apache/pulsar/pull/25378)) \[fix]\[test] Fix flaky ExtensibleLoadManagerImplTest.testLoadBalancerServiceUnitTableViewSyncer

([#25497](https://github.com/apache/pulsar/pull/25497)) \[fix]\[test] Fix flaky ServerCnxTest.testCreateProducerTimeoutThenCreateSameNamedProducerShouldFail

([#25460](https://github.com/apache/pulsar/pull/25460)) \[fix]\[broker] Prevent timed-out producer creation from racing with retry

([#25358](https://github.com/apache/pulsar/pull/25358)) \[fix]\[test] Fix flaky ReplicatorTest.testResumptionAfterBacklogRelaxed

([#25551](https://github.com/apache/pulsar/pull/25551)) \[fix]\[broker]Namespaces can be created with may empty replication\_clusters policy

([#24463](https://github.com/apache/pulsar/pull/24463)) \[improve]\[broker] Improve the performance of TopicName constructor

([#25367](https://github.com/apache/pulsar/pull/25367)) \[improve]\[common] Optimize TopicName.get() to reduce lock contention on cache lookup

([#24875](https://github.com/apache/pulsar/pull/24875)) \[fix]\[test] Stabilize FunctionAssignmentTailerTest.testErrorNotifier by synchronizing mock stubbing with CountDownLatch

([#25017](https://github.com/apache/pulsar/pull/25017)) \[improve]\[client]\[branch-4.0] Deduplicate in-progress lookup requests also for HttpLookupService

([#25469](https://github.com/apache/pulsar/pull/25469)) \[cleanup]\[ci] Remove documentation label bot

([#25470](https://github.com/apache/pulsar/pull/25470)) \[cleanup]\[ci] Remove ready-to-test label enforcement

### AoP

86fd755 test(aop): ignore closed multibundle cleanup

9657c29 fix(aop): update jetty 12 handler APIs

### MoP

a2657bde fix(mqtt): adapt additional servlet api

947864b9 fix checkstyle

ea1f8dba Fix mqtt client not have the consumer metric

### KoP

f30e46cde Bump pulsar and sn bom versions to 4.0.10.1 and fix assertion message for invalid topic name in SimpleLoadBalanceTest

Fix KsnRestServlet issue due to jetty upgrading

### StreamNative Pulsar Plugins

9f7638887 fix(servlet): adapt additional servlets to jetty 12

Add keyword to filter the result

372d9b481 Add permission/ACL audit logging

### pulsarctl

Fix flaky tests

### Function Mesh Worker Service

feat: add default metadata and add metadata to labels

e2b016f7 apply api changes introduced by [https://github.com/apache/pulsar/pull/25534](https://github.com/apache/pulsar/pull/25534)

feat: Support sandbox agent

feat: Support setting extraDependenciesDir via CustomRuntimeOptions

fix(auth): preserve service account when updateAuthData is false

### StreamNative Unified RBAC

8da9057 fix: support Pulsar 4.0.10.x servlet loading

## Security Fixes

### Apache Pulsar

([#25569](https://github.com/apache/pulsar/pull/25569)) \[fix]\[sec] Upgrade BouncyCastle to 1.84 (CVE-2026-5588, CVE-2026-0636)

([#25534](https://github.com/apache/pulsar/pull/25534)) \[fix]\[sec]\[branch-4.0] Upgrade to Jetty 12.1.8 to address several CVEs

([#25546](https://github.com/apache/pulsar/pull/25546)) \[fix]\[sec] Upgrade to async-http-client 2.14.5 to address CVE-2026-40490