Skip to main content

StreamNative Weekly Release Notes v4.0.14.3

Download

Distributions

Packages

Images

General Changes

Apache Pulsar

(#27051) [fix][broker][branch-4.0] Fix compaction failure on compressed batches with message properties (#27026) [fix][broker] Retry incompatible replication schemas without topic unload (#21767) [fix][client] Fix message leaks and size and permit accounting races when clearing the consumer’s incoming queue (#27021) [fix][broker] Reset fixed delay detection when the in-memory delayed delivery tracker is cleared (#26845) [fix][meta] Fix repeated metadata recovery failures after a ZooKeeper session expires (#27017) [fix][broker] Don’t continue the REST topic listings that waited for a size estimate one after another on a metadata store thread (#26999) [fix][proxy] Fix Proxy Protocol forwarding for UNKNOWN and IPv6 (#26945) [fix][broker] Fix topic listing memory limit enforcement (#27011) [improve][doc] Warn about /tmp cleanup in narExtractionDirectory docs (#27007) [fix][broker] Don’t dispatch a replay read that was pending when all consumers of a Shared subscription disconnected (#27005) [improve][ml] Don’t visit a ledger’s other single-entry pending reads for a read of a single entry (#26701) [fix][broker] Fix spurious placement failures when IsolatedBookieEnsemblePlacementPolicy counts unavailable secondary bookies (#26991) [fix][broker] Fence non-persistent subscriptions before asynchronous … (#26978) [improve][meta] Log metadata store deletes at DEBUG (#26976) [fix][broker] Remove the sticky key hashes of a sparse replay prefix when the mark-delete position moves (#24912) [fix][broker] Fix partitioned topic auto deletion http request timeout (#24793) [fix][broker] Producer still publishes messages to Broker after Topic was unloaded (#24974) [fix][client] Fix retry logic for BinaryProtoLookupService.getTopicsUnderNamespace method (#26664) [fix][broker] Prevent stale messages from surviving compaction retries (#26742) [fix][ml] Complete the original future after ledger deletion retries (#26828) [fix][meta] Fix leader election close deleting a leader node owned by another session (#26940) [fix][metadata] Invalidate ledger metadata cache on version conflicts (#25244) [fix][broker] The configuration subscriptionExpirationTimeMinutes does not work if the topic was reloaded frequently (#25259) [fix][broker] Avoid false WARN log when replicator is already terminated (#25766) [BUG] Fix stats in PulsarZooKeeperClient multi. (#25040) [fix][admin] Use ClientConfigurationData timeout params to set AsyncHttpConnector timeout params

KoP

[fix] Prevent Kafka topic recovery stalls and initialization deadlocks [build][branch-4.0] Use the RBAC SDK from streamnative/rbac

StreamNative Pulsar Plugins

fix(placement-policy): avoid per-entry rack resolution in AZ-aware read reordering fix: upgrade detector compression and kube Go toolchain

pulsarctl

test: use a valid integer for dynamic dispatch rate config Upgrade Go to 1.26.10 to fix CVE-2026-111943

StreamNative Unified RBAC

Fix seven bugs in the Pulsar plugins (4.0) Build the Pulsar plugins for StreamNative Pulsar 4.0 Bump the RBAC SDKs to 1.17.0 Bump the RBAC SDKs to 1.16.3 and require full coverage Remove the catch blocks that can never run from the Pulsar plugins Bump the RBAC SDKs to 1.16.2 Cover the authorization provider with unit tests Cover the management servlet with unit tests Cover the broker interceptor with unit tests Post Claude reviews in a tracking comment Move the Gradle build into eco/sdk-java-pulsar Add Claude Code review and @claude workflows Bump the RBAC SDKs to 1.16.1 Speed up the ECO - Pulsar CI job Move the SDKs to streamnative/rbac perf: limit the authorization cache by estimated heap and expose its metrics perf: route standard authorization checks through authzCache perf: check only static and delegated super users in allowExtraOperationAsync perf: check only static and delegated super users in allow* test: give each benchmark subject its own few topics test: benchmark every RbacAuthorizationProvider authorization endpoint fix: check super user once in canProduce/canConsume/canLookup docs: convert README to Markdown with logo and badges docs: add cherry-pick label rules and make AGENTS.md a symlink to CLAUDE.md fix: build and test main against Pulsar 5.0.0.103 ci: report test coverage to Codecov fix: expect unauthorized when Pulsar cluster listing is denied fix: align CV role expectations and bound pool watches fix: support org-basic role in cv tests ci: version Pulsar plugin releases as <StreamNative release>.N ci: version Pulsar plugin releases as X.Y.Z.N following the Pulsar release ci: release the Pulsar authorization provider of each release line as X.Y.N fix: preserve workspace fields ci: publish release-line broker libraries as X.Y-SNAPSHOT daily fix: unblock the release workflow (Java 21 target for Pulsar 5 plugins, Go 1.25 validation) fix: preserve authentication provider identity in authorization cache Align dependencies and Jakarta integration with Pulsar 5

Security Fixes

Apache Pulsar

(#27023) [fix][sec] Bump github.com/klauspost/compress from 1.18.0 to 1.18.7 in /pulsar-function-go