Skip to main content

​
StreamNative Weekly Release Notes v4.2.0.7

​
Download

​
Distributions

​
Packages

​
Images

​
General Changes

​
Apache Pulsar

(#25679) [fix][test] Fix flaky OneWayReplicatorDeduplicationTest.testDeduplication (#25677) [improve][test] Set diskUsageThreshold to 0.999 for tests to effectively disable the check (#25641) [fix][test] Make NamespacesTest.cleanupAfterMethod tolerant of transient infra failures (#25640) [fix][test] Fix flaky testGetExcludedBookiesWithIsolationGroups (#25638) [fix][test] Reduce flakiness in testLoadBalancerServiceUnitTableViewSyncer (#25596) [fix][test] Fix flaky ExtensibleLoadManagerImplTest.testLoadBalancerServiceUnitTableViewSyncer (#25759) [fix][client] Apply Avro logical type conversions when decoding schema without classloader (#25752) [improve][misc] Upgrade Jetty to 12.1.9 (#25538) [improve][client] Implement tls_client_auth for AuthenticationOAuth2 (#25736) [fix][broker] Merge broker offload extra configurations (#25626) [improve][broker] optimize namespaceBundle validation to fix single-thread 100% CPU during unloading entire namespaces (#25624) [fix][broker] Close pending acks cleanup gap in BacklogQuotaManager (#25592) [fix][broker] Move pending acks cleanup to selected mark-delete callbacks (#25589) [fix][broker] Fix race in pending acks removal in redeliverUnacknowledgedMessages (#25579) [fix][broker] Wait for orphan schema ledger cleanup before retry (#25514) [fix][broker] Clean up orphan ledger on concurrent initial schema creation in BookkeeperSchemaStorage (#25681) [fix][broker] Correct two race conditions in the tracker code and logic bug in InMemoryDelayedDeliveryTracker that failed with NoSuchElementException (#25684) [fix][broker] Skip backlog-quota eviction on fenced/closing topics (#25730) (#25739) [fix][client] Make ClientBuilder serializable (#25581) [fix][broker] Decrement unacked counter when removeAllUpTo removes pending acks (#25126) [improve][cli] Add client side looping in “pulsar-admin topics analyze-backlog” cli to avoid potential HTTP call timeout (#25725) [fix][client]Broker-side producer handle leak if closes a producer which state is regitering schema (#25728) [fix][broker][branch-4.2] URL-encode sub-name in Txn pending-ack topic #25727 (#25583) [fix][broker][fix][broker]Replication stats is empty when the cluster is the target cluster of a one-way replication (#25625) [fix][broker]Replication is stuck because failed to read entries (#25663) [improve][misc] Upgrade Caffeine to 3.2.4 (#25644) [fix][broker] ConcurrentLongHashMap throw ArrayIndexOutOfBoundsException (#25572) [fix][broker] Race condition causes perpetual backlog on internal topics

​
KoP

Implement lazy recovery for producer state management for classic engine 4c5015c44 [branch-4.2] Remove proxy from build.sh 18f8469c8 Remove pulsar-kafka-proxy dependency from pom.xml Fix fetch request duplicate key issue Fix rdkafka requests might be forward to non-leader brokers and never recovered Skip permission check for internal stats consumer Stabilize generated swagger definitions Remove proxy module and related tests Fix possible message loss from idempotent producers during ledger rollover

​
StreamNative Pulsar Plugins

fix: upgrade Netty to 4.1.133.Final in bookie-rackinfo to fix CVEs for sn-platform-slim:4.2.0.6 Fix to allow message id seek for non-partitioned topics

​
pulsarctl

Bump go version to 1.25.10 to fix CVE Add JDK path

​
Function Mesh Worker Service

5fbc54fb fix ci feat: Support pin agent version when create session feat: support filter based on metadata and use CRD for sessions feat: Align with Anthropic api fix(registry-service): mirror agent rename onto binding display-name feat: add default metadata and add metadata to labels feat: Support sandbox agent

​
StreamNative Unified RBAC

refactor: remove Pulsar servlet compatibility logic on main 63f1b65 Bump version to 1.13.2-rc10 41b673e Bump version to 1.13.2-rc9 b2f01df Bump version to 1.13.2-rc8 feat: add more agent related permissions 6dfb0ea Bump version to 1.13.2-rc7 c2fd5c0 Bump version to 1.13.2-rc6 [codex] Fix maintenance notification action RBAC mappings 0ad4ea1 Bump version to 1.13.2-rc5 feat: add MaintenanceNotification permissions to unified RBAC 9c144cf Bump version to 1.13.2-rc4 ba6b888 Bump version to 1.13.2-rc3 feat: add test cases for workspaces and update sdk-apiserver bde7d6e Bump version to 1.13.2-rc2 fix: update workspaces’ api group to compute.streamnative.io 66bbb7a Bump version to 1.13.2-rc1 fix: support cloud integration with specified image fix: remove Cloud Integration workflow fix: switch default Pulsar to snstage/pulsar:4.0.9.6 and simplify integration tests fix: exclude integration tests from PR CI fix: remove duplicate CI runs on branch-* pushes fix: make pulsar-broker Maven group configurable 0c6a183 Bump version to 1.13.1 9aa9527 Bump version to 1.13.1-rc5 fix: remove duplicate npm version in Publish JS step 60db2c5 Bump version to 1.13.1-rc4 fix: bump sdk-js package.json version in release step 82eb61a Bump version to 1.13.1-rc3 feat: validate before release, fix pipeline ordering 00b7cc6 Bump version to 1.13.1-rc2 refactor: independent versioning, sdk-java-admin split, shade cel

​
Security Fixes

​
Apache Pulsar

(#25744) [fix][sec] Upgrade thrift to 0.23.0 to address CVE-2026-43869 (#25745) [fix][sec] Upgrade vertx to 4.5.27 to address CVE-2026-6860 (#25737) [fix][sec] Upgrade vert.x to 4.5.25 to address CVE-2026-6860 (#25670) [fix][sec] Upgrade Netty to 4.1.133.Final to address CVEs