> ## Documentation Index
> Fetch the complete documentation index at: https://docs.streamnative.io/llms.txt
> Use this file to discover all available pages before exploring further.

# V4.0.7.2

# StreamNative Weekly Release Notes v4.0.7.2

## Download

### Distributions

* [https://github.com/streamnative/pulsar/releases/tag/v4.0.7.2](https://github.com/streamnative/pulsar/releases/tag/v4.0.7.2)

### Packages

* [Maven Central](https://search.maven.org/artifact/io.streamnative/pulsar/4.0.7.2/pom)

### Images

* [sn-platform](https://hub.docker.com/layers/streamnative/sn-platform/4.0.7.2/images/sha256-47a4b3ea2619d895fce176224eba8c8528620856e9a99e1a72443462ddb34c63)

* [sn-platform-slim](https://hub.docker.com/layers/streamnative/sn-platform-slim/4.0.7.2/images/sha256-300354c0a0b0fcb66bdd872b7df152f5c43818d9f04066b7a998b79e47f99191)

* [private-cloud](https://hub.docker.com/layers/streamnative/private-cloud/4.0.7.2/images/sha256-300354c0a0b0fcb66bdd872b7df152f5c43818d9f04066b7a998b79e47f99191)

## General Changes

### Apache Pulsar

([#24983](https://github.com/apache/pulsar/pull/24983)) \[improve] Upgrade Apache Commons library versions

([#24995](https://github.com/apache/pulsar/pull/24995)) \[improve]\[test] Use Oxia project docker container for integration tests

([#24986](https://github.com/apache/pulsar/pull/24986)) \[fix] Handle TLS close\_notify to avoid SslClosedEngineException: SSLEngine closed already

([#24982](https://github.com/apache/pulsar/pull/24982)) \[improve]\[build] Upgrade Testcontainers to 1.21.3

([#24975](https://github.com/apache/pulsar/pull/24975)) \[improve]\[broker]Improve error response of failed to delete topic if it has replicators connected

([#24938](https://github.com/apache/pulsar/pull/24938)) \[fix]\[broker]Wrong backlog: expected 0 but got 1

([#24985](https://github.com/apache/pulsar/pull/24985)) \[improve] Upgrade Log4j2 to 2.25.2 and slf4j to 2.0.17

([#24871](https://github.com/apache/pulsar/pull/24871)) \[fix]\[test] Fixed Non-Guaranteed Order in PoliciesDataTest.propertyAdmin

([#24981](https://github.com/apache/pulsar/pull/24981)) \[fix]\[build] Remove Confluent and Restlet maven repositories from top level pom.xml

([#24976](https://github.com/apache/pulsar/pull/24976)) \[feat]\[meta] upgrade oxia version to 0.7.2

([#24446](https://github.com/apache/pulsar/pull/24446)) \[fix]\[cli] Print result of GetMessageIdByIndex command

([#24222](https://github.com/apache/pulsar/pull/24222)) \[feat]\[admin] PIP-415: Support getting message ID by index

([#24971](https://github.com/apache/pulsar/pull/24971)) \[fix]\[broker]Leaving orphan schemas and topic-level policies after partitioned topic is deleted by GC

([#24805](https://github.com/apache/pulsar/pull/24805)) \[fix]\[test] Made ProtobufNativeSchemaTest.testSchema order-independent

([#24962](https://github.com/apache/pulsar/pull/24962)) \[improve]\[client] Deduplicate getTopicsUnderNamespace in BinaryProtoLookupService

([#24972](https://github.com/apache/pulsar/pull/24972)) \[fix]\[test] Add Delta Tolerance in Double-Precision Assertions to Fix Rounding Flakiness

([#24872](https://github.com/apache/pulsar/pull/24872)) \[fix]\[test] Fixed ResponseBody Check in Test Helper

([#24969](https://github.com/apache/pulsar/pull/24969)) \[fix]\[test] Fixed Nondeterministic Ordering in SchemaInfoTest

([#24965](https://github.com/apache/pulsar/pull/24965)) \[fix]\[client] Fix deduplication for getPartitionedTopicMetadata to include method parameters

([#24945](https://github.com/apache/pulsar/pull/24945)) \[fix]\[broker]Transactional messages can never be sent successfully if concurrently taking transaction buffer snapshot

([#24955](https://github.com/apache/pulsar/pull/24955)) \[fix]\[test] Fix flaky KeySharedSubscriptionBrokerCacheTest.testReplayQueueReadsGettingCached

([#24957](https://github.com/apache/pulsar/pull/24957)) \[fix]\[test] Fix invalid test NonPersistentTopicTest.testProducerRateLimit

([#24952](https://github.com/apache/pulsar/pull/24952)) \[improve]\[fn] Use PulsarByteBufAllocator.DEFAULT instead of ByteBufAllocator.DEFAULT

([#24958](https://github.com/apache/pulsar/pull/24958)) \[cleanup]\[broker] Remove unused configuration maxMessageSizeCheckIntervalInSeconds

([#24954](https://github.com/apache/pulsar/pull/24954)) \[fix]\[broker] AvgShedder comparison error

([#24951](https://github.com/apache/pulsar/pull/24951)) \[fix]\[test] Fix flaky NonPersistentTopicTest.testProducerRateLimit

([#24802](https://github.com/apache/pulsar/pull/24802)) \[fix]\[broker] Trigger topic creation event only once for non-existent topic

### KoP

Bump branch-4.0 to 4.0.7.2

Prevent out-of-order messages caused by asynchronous authorization

Fix snapshot might not be taken when using system topic for producer state

Fix flaky testCommitOffsetsForMultiPartitions

Use `KopTopicTransactionBufferProvider` by default when transaction coordinator is enabled

Fix producer state snapshot

Add kop transaction buffer provider to disable transaction buffer recover for Kafka system topics

feat(kafka): Replace random UUID with Kafka Uuid for topic identification

Align Kafka version to 3.9.1 and replace removed kafka.admin.ConsumerGroupCommand in tests with Kafka Admin client

\[Ursa] Allow client to retry send when the producer state recovery fails

Fix Ursa storage in NamespaceBundleOwnershipListener unload behavior

Add producer ID expiration mechanism for Ursa engine

Remove "Found owner" logs with low lookup latency (\< 10ms)

Schedule unload group metadata if not owner broker

Don't return non-retriable error in metadata response when lookup fails

Fix OffsetCommit request might not take effect unless reloading from metadata store

Support client side retry for temporary metadata or write failures

Support returning partition count in create topics response

Bump spotbugs version to 4.9.8

### pulsarctl

Fix CVE CVE-2025-63811

### Function Mesh Worker Service

Support unified-rbac for all components

add kafka managed auth data annotation

bump funciton-mesh v0.26.0

bump function-mesh to 0.26.0

feat: make function api pass sink and source config

Add retry for ci

### StreamNative Tiered storage

Move the unsupported handler to info level

## Security Fixes

### Apache Pulsar

([#24987](https://github.com/apache/pulsar/pull/24987)) \[fix]\[sec] Bump github.com/dvsekhvalnov/jose2go from 1.6.0 to 1.7.0 in /pulsar-function-go

([#24953](https://github.com/apache/pulsar/pull/24953)) \[fix]\[sec] Update Hbase version to 2.6.3-hadoop3 and exclude Avro from hbase-client to remediate CVEs

([#24949](https://github.com/apache/pulsar/pull/24949)) \[fix]\[sec] Added Exclusions for tomcat-embed-core and derby and override mina-core to remediate CVEs

([#24950](https://github.com/apache/pulsar/pull/24950)) \[fix]\[sec] Upgrade hadoop3 version from 3.4.0 to 3.4.1