> ## Documentation Index
> Fetch the complete documentation index at: https://docs.streamnative.io/llms.txt
> Use this file to discover all available pages before exploring further.

# V4.0.12.4

# StreamNative Weekly Release Notes v4.0.12.4

## Download

### Distributions

* [https://github.com/streamnative/pulsar/releases/tag/v4.0.12.4](https://github.com/streamnative/pulsar/releases/tag/v4.0.12.4)

### Packages

* [Maven Central](https://search.maven.org/artifact/io.streamnative/pulsar/4.0.12.4/pom)

### Images

* [sn-platform](https://hub.docker.com/layers/streamnative/sn-platform/4.0.12.4/images/sha256-d126900f2be56dfda86a4d8f1684dcc88df605a0230914d21aef47a67a950aef)

* [sn-platform-slim](https://hub.docker.com/layers/streamnative/sn-platform-slim/4.0.12.4/images/sha256-df00856654d1ed28ce64b5d4610a018519fc0ddbbfc34b8cc30602b44ef73d90)

* [private-cloud](https://hub.docker.com/layers/streamnative/private-cloud/4.0.12.4/images/sha256-df00856654d1ed28ce64b5d4610a018519fc0ddbbfc34b8cc30602b44ef73d90)

## General Changes

### Apache Pulsar

([#26384](https://github.com/apache/pulsar/pull/26384)) \[fix]\[client] Divide the across-partitions budget only when it was set explicitly

([#26382](https://github.com/apache/pulsar/pull/26382)) \[fix]\[test] Fix OneWayReplicatorSchemaValidationEnforcedTest racing the replicator's remote topic creation

([#26365](https://github.com/apache/pulsar/pull/26365)) \[fix]\[cli] Set --enable-native-access=ALL-UNNAMED for the CLI tools on Java 24+

([#26371](https://github.com/apache/pulsar/pull/26371)) \[fix]\[cli]\[branch-4.0] Don't pass unset pulsar-perf pending-message options to the producer

([#26342](https://github.com/apache/pulsar/pull/26342)) \[fix]\[client] Apply no-memory-limit producer queue defaults at producer creation

([#26372](https://github.com/apache/pulsar/pull/26372)) \[fix]\[offload] Normalize offloader cache directory path

([#26249](https://github.com/apache/pulsar/pull/26249)) \[fix]\[test] Fix flaky AdminApiTest caused by leaked brokerShutdownTimeoutMs

([#26268](https://github.com/apache/pulsar/pull/26268)) \[fix]\[broker] Prevent Key\_Shared out-of-order replay starvation at the end of topic

([#25973](https://github.com/apache/pulsar/pull/25973)) \[improve]\[misc] Upgrade log4j to 2.26.0 and slf4j to 2.0.18

([#26315](https://github.com/apache/pulsar/pull/26315)) \[improve]\[misc] Upgrade Conscrypt to 2.6.2 to restore the native library glibc baseline

([#26325](https://github.com/apache/pulsar/pull/26325)) \[fix]\[client] Restore OAuth2 HTTP client after deserialization

### AoP

Fix test.

\[fix] Fix issues caused by rabbitmq client

### KoP

Change `NOT_LEADER_OR_FOLLOWER` log level to WARN

\[fix] Support return leader epoch for the metadata request

### StreamNative Pulsar Plugins

fix: upgrade metadata tool Netty and Log4j dependencies

fix: address Trivy Go and Netty CVEs in platform image

### pulsarctl

fix: upgrade Go to 1.25.14 and x/sys to 0.44.0 for CVEs

### Pulsar Tiered Storage v2

test(read): allocate cache chunks from the pooled allocator and log resolved config

73be6c8 update: bump Pulsar and StreamNative BOM versions to 4.0.12.3 and update test image version

revert(index): restore byte-limit span behavior

e14e156 chore(deps): update Pulsar and StreamNative BOM versions to 4.0.12.2 and bump Caffeine version to 3.2.4

## Security Fixes

### Apache Pulsar

([#26370](https://github.com/apache/pulsar/pull/26370)) \[fix]\[sec]\[branch-4.2] Upgrade BouncyCastle to 1.85 and BouncyCastle FIPS to 2.0.2 to address CVEs

([#26339](https://github.com/apache/pulsar/pull/26339)) \[fix]\[sec] Upgrade Jackson to 2.18.10

([#26329](https://github.com/apache/pulsar/pull/26329)) \[fix]\[sec] Bump log4j2 from 2.26.0 to 2.26.1