> ## Documentation Index
> Fetch the complete documentation index at: https://docs.streamnative.io/llms.txt
> Use this file to discover all available pages before exploring further.

# V4.2.0.7

# StreamNative Weekly Release Notes v4.2.0.7

## Download

### Distributions

* [https://github.com/streamnative/pulsar/releases/tag/v4.2.0.7](https://github.com/streamnative/pulsar/releases/tag/v4.2.0.7)

### Packages

* [Maven Central](https://search.maven.org/artifact/io.streamnative/pulsar/4.2.0.7/pom)

### Images

* [sn-platform](https://hub.docker.com/layers/streamnative/sn-platform/4.2.0.7/images/sha256-19c9a33900fdbaf2e36635730edb04e9abca2dd7a56c84d56f053168fc3466f5)

* [sn-platform-slim](https://hub.docker.com/layers/streamnative/sn-platform-slim/4.2.0.7/images/sha256-c4c1996c9e0424758532843cf4ba99df1122529a260a32b29bd28b6e498e0140)

* [private-cloud](https://hub.docker.com/layers/streamnative/private-cloud/4.2.0.7/images/sha256-c4c1996c9e0424758532843cf4ba99df1122529a260a32b29bd28b6e498e0140)

## General Changes

### Apache Pulsar

([#25679](https://github.com/apache/pulsar/pull/25679)) \[fix]\[test] Fix flaky OneWayReplicatorDeduplicationTest.testDeduplication

([#25677](https://github.com/apache/pulsar/pull/25677)) \[improve]\[test] Set diskUsageThreshold to 0.999 for tests to effectively disable the check

([#25641](https://github.com/apache/pulsar/pull/25641)) \[fix]\[test] Make NamespacesTest.cleanupAfterMethod tolerant of transient infra failures

([#25640](https://github.com/apache/pulsar/pull/25640)) \[fix]\[test] Fix flaky testGetExcludedBookiesWithIsolationGroups

([#25638](https://github.com/apache/pulsar/pull/25638)) \[fix]\[test] Reduce flakiness in testLoadBalancerServiceUnitTableViewSyncer

([#25596](https://github.com/apache/pulsar/pull/25596)) \[fix]\[test] Fix flaky ExtensibleLoadManagerImplTest.testLoadBalancerServiceUnitTableViewSyncer

([#25759](https://github.com/apache/pulsar/pull/25759)) \[fix]\[client] Apply Avro logical type conversions when decoding schema without classloader

([#25752](https://github.com/apache/pulsar/pull/25752)) \[improve]\[misc] Upgrade Jetty to 12.1.9

([#25538](https://github.com/apache/pulsar/pull/25538)) \[improve]\[client] Implement tls\_client\_auth for AuthenticationOAuth2

([#25736](https://github.com/apache/pulsar/pull/25736)) \[fix]\[broker] Merge broker offload extra configurations

([#25626](https://github.com/apache/pulsar/pull/25626)) \[improve]\[broker] optimize namespaceBundle validation to fix single-thread 100% CPU during unloading entire namespaces

([#25624](https://github.com/apache/pulsar/pull/25624)) \[fix]\[broker] Close pending acks cleanup gap in BacklogQuotaManager

([#25592](https://github.com/apache/pulsar/pull/25592)) \[fix]\[broker] Move pending acks cleanup to selected mark-delete callbacks

([#25589](https://github.com/apache/pulsar/pull/25589)) \[fix]\[broker] Fix race in pending acks removal in redeliverUnacknowledgedMessages

([#25579](https://github.com/apache/pulsar/pull/25579)) \[fix]\[broker] Wait for orphan schema ledger cleanup before retry

([#25514](https://github.com/apache/pulsar/pull/25514)) \[fix]\[broker] Clean up orphan ledger on concurrent initial schema creation in BookkeeperSchemaStorage

([#25681](https://github.com/apache/pulsar/pull/25681)) \[fix]\[broker] Correct two race conditions in the tracker code and logic bug in InMemoryDelayedDeliveryTracker that failed with NoSuchElementException

([#25684](https://github.com/apache/pulsar/pull/25684)) \[fix]\[broker] Skip backlog-quota eviction on fenced/closing topics

([#25730](https://github.com/apache/pulsar/pull/25730)) ([#25739](https://github.com/apache/pulsar/pull/25739)) \[fix]\[client] Make ClientBuilder serializable

([#25581](https://github.com/apache/pulsar/pull/25581)) \[fix]\[broker] Decrement unacked counter when removeAllUpTo removes pending acks

([#25126](https://github.com/apache/pulsar/pull/25126)) \[improve]\[cli] Add client side looping in "pulsar-admin topics analyze-backlog" cli to avoid potential HTTP call timeout

([#25725](https://github.com/apache/pulsar/pull/25725)) \[fix]\[client]Broker-side producer handle leak if closes a producer which state is regitering schema

([#25728](https://github.com/apache/pulsar/pull/25728)) \[fix]\[broker]\[branch-4.2] URL-encode sub-name in Txn pending-ack topic #25727

([#25583](https://github.com/apache/pulsar/pull/25583)) \[fix]\[broker]\[fix]\[broker]Replication stats is empty when the cluster is the target cluster of a one-way replication

([#25625](https://github.com/apache/pulsar/pull/25625)) \[fix]\[broker]Replication is stuck because failed to read entries

([#25663](https://github.com/apache/pulsar/pull/25663)) \[improve]\[misc] Upgrade Caffeine to 3.2.4

([#25644](https://github.com/apache/pulsar/pull/25644)) \[fix]\[broker] ConcurrentLongHashMap throw ArrayIndexOutOfBoundsException

([#25572](https://github.com/apache/pulsar/pull/25572)) \[fix]\[broker] Race condition causes perpetual backlog on internal topics

### KoP

Implement lazy recovery for producer state management for classic engine

4c5015c44 \[branch-4.2] Remove proxy from build.sh

18f8469c8 Remove pulsar-kafka-proxy dependency from pom.xml

Fix fetch request duplicate key issue

Fix rdkafka requests might be forward to non-leader brokers and never recovered

Skip permission check for internal stats consumer

Stabilize generated swagger definitions

Remove proxy module and related tests

Fix possible message loss from idempotent producers during ledger rollover

### StreamNative Pulsar Plugins

fix: upgrade Netty to 4.1.133.Final in bookie-rackinfo to fix CVEs for sn-platform-slim:4.2.0.6

Fix to allow message id seek for non-partitioned topics

### pulsarctl

Bump go version to 1.25.10 to fix CVE

Add JDK path

### Function Mesh Worker Service

5fbc54fb fix ci

feat: Support pin agent version when create session

feat: support filter based on metadata and use CRD for sessions

feat: Align with Anthropic api

fix(registry-service): mirror agent rename onto binding display-name

feat: add default metadata and add metadata to labels

feat: Support sandbox agent

### StreamNative Unified RBAC

refactor: remove Pulsar servlet compatibility logic on main

63f1b65 Bump version to 1.13.2-rc10

41b673e Bump version to 1.13.2-rc9

b2f01df Bump version to 1.13.2-rc8

feat: add more agent related permissions

6dfb0ea Bump version to 1.13.2-rc7

c2fd5c0 Bump version to 1.13.2-rc6

\[codex] Fix maintenance notification action RBAC mappings

0ad4ea1 Bump version to 1.13.2-rc5

feat: add MaintenanceNotification permissions to unified RBAC

9c144cf Bump version to 1.13.2-rc4

ba6b888 Bump version to 1.13.2-rc3

feat: add test cases for workspaces and update sdk-apiserver

bde7d6e Bump version to 1.13.2-rc2

fix: update workspaces' api group to compute.streamnative.io

66bbb7a Bump version to 1.13.2-rc1

fix: support cloud integration with specified image

fix: remove Cloud Integration workflow

fix: switch default Pulsar to snstage/pulsar:4.0.9.6 and simplify integration tests

fix: exclude integration tests from PR CI

fix: remove duplicate CI runs on branch-\* pushes

fix: make pulsar-broker Maven group configurable

0c6a183 Bump version to 1.13.1

9aa9527 Bump version to 1.13.1-rc5

fix: remove duplicate npm version in Publish JS step

60db2c5 Bump version to 1.13.1-rc4

fix: bump sdk-js package.json version in release step

82eb61a Bump version to 1.13.1-rc3

feat: validate before release, fix pipeline ordering

00b7cc6 Bump version to 1.13.1-rc2

refactor: independent versioning, sdk-java-admin split, shade cel

## Security Fixes

### Apache Pulsar

([#25744](https://github.com/apache/pulsar/pull/25744)) \[fix]\[sec] Upgrade thrift to 0.23.0 to address CVE-2026-43869

([#25745](https://github.com/apache/pulsar/pull/25745)) \[fix]\[sec] Upgrade vertx to 4.5.27 to address CVE-2026-6860

([#25737](https://github.com/apache/pulsar/pull/25737)) \[fix]\[sec] Upgrade vert.x to 4.5.25 to address CVE-2026-6860

([#25670](https://github.com/apache/pulsar/pull/25670)) \[fix]\[sec] Upgrade Netty to 4.1.133.Final to address CVEs