dependabot[bot] opened a new pull request, #22397: URL: https://github.com/apache/camel/pull/22397
Bumps `pulsar-version` from 4.1.3 to 4.2.0. Updates `org.apache.pulsar:pulsar-client` from 4.1.3 to 4.2.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/apache/pulsar/releases";>org.apache.pulsar:pulsar-client's releases</a>.</em></p> <blockquote> <h2>v4.2.0</h2> <h4>2026-04-01</h4> <h3>Approved PIPs</h3> <ul> <li><a href="https://github.com/apache/pulsar/tree/master/pip/pip-434.md";>PIP-434: Expose Netty channel configuration WRITE_BUFFER_WATER_MARK to pulsar conf and pause receive requests when channel is unwritable</a></li> <li><a href="https://github.com/apache/pulsar/tree/master/pip/pip-437.md";>PIP-437: Granular and Fixed-Delay Policies for Message Delivery</a></li> <li><a href="https://github.com/apache/pulsar/tree/master/pip/pip-439.md";>PIP-439: Adding Transaction Support to Pulsar Functions Through Managed Transaction Wrapping</a></li> <li><a href="https://github.com/apache/pulsar/tree/master/pip/pip-442.md";>PIP-442: Add memory limits for CommandGetTopicsOfNamespace and CommandWatchTopicList on Broker and Proxy</a></li> <li><a href="https://github.com/apache/pulsar/tree/master/pip/pip-443.md";>PIP-443: Stop using Netty Recycler in new code</a></li> <li><a href="https://github.com/apache/pulsar/tree/master/pip/pip-444.md";>PIP-444: Rate limit for deleting ledger to alleviate the zk pressure.</a></li> <li><a href="https://github.com/apache/pulsar/tree/master/pip/pip-446.md";>PIP-446: Support Native OpenTelemetry Tracing in Pulsar Java Client</a></li> <li><a href="https://github.com/apache/pulsar/tree/master/pip/pip-447.md";>PIP-447: Customizable Prometheus Labels for Topic Metrics</a></li> <li><a href="https://github.com/apache/pulsar/tree/master/pip/pip-452.md";>PIP-452: Customizable topic listing of namespace with properties</a></li> <li><a href="https://github.com/apache/pulsar/tree/master/pip/pip-453.md";>PIP-453: Improve the metadata store threading model</a></li> <li><a href="https://github.com/apache/pulsar/tree/master/pip/pip-454.md";>PIP-454: Metadata Store Migration Framework</a></li> <li><a href="https://github.com/apache/pulsar/tree/master/pip/pip-464.md";>PIP-464: Deprecate legacy Jackson JsonSchema format for SchemaType.JSON</a></li> </ul> <h3>Library updates</h3> <ul> <li>[improve][broker] Upgrade bookkeeper to 4.17.3 (<a href="https://redirect.github.com/apache/pulsar/pull/25166";>#25166</a>)</li> <li>[improve][ml] Upgrade Oxia client to 0.7.0 (<a href="https://redirect.github.com/apache/pulsar/pull/24824";>#24824</a>)</li> <li>[fix][sec] Added Exclusions for tomcat-embed-core and derby and override mina-core to remediate CVEs (<a href="https://redirect.github.com/apache/pulsar/pull/24949";>#24949</a>)</li> <li>[fix][sec] Bump at.yawk.lz4:lz4-java from 1.9.0 to 1.10.1 in /pulsar-common (<a href="https://redirect.github.com/apache/pulsar/pull/25045";>#25045</a>)</li> <li>[fix][sec] Bump github.com/dvsekhvalnov/jose2go from 1.6.0 to 1.7.0 in /pulsar-function-go (<a href="https://redirect.github.com/apache/pulsar/pull/24987";>#24987</a>)</li> <li>[fix][sec] Bump google.golang.org/grpc from 1.60.0 to 1.79.3 in /pulsar-function-go (<a href="https://redirect.github.com/apache/pulsar/pull/25353";>#25353</a>)</li> <li>[fix][sec] Bump io.vertx:vertx-web from 4.5.10 to 4.5.22 (<a href="https://redirect.github.com/apache/pulsar/pull/24889";>#24889</a>)</li> <li>[fix][sec] Bump org.apache.solr:solr-core from 9.8.0 to 9.10.1 in /pulsar-io/solr (<a href="https://redirect.github.com/apache/pulsar/pull/25175";>#25175</a>)</li> <li>[fix][sec] Bump org.apache.zookeeper:zookeeper from 3.9.4 to 3.9.5 (<a href="https://redirect.github.com/apache/pulsar/pull/25303";>#25303</a>)</li> <li>[fix][sec] Eliminate commons-collections dependency (<a href="https://redirect.github.com/apache/pulsar/pull/25024";>#25024</a>)</li> <li>[fix][sec] Exclude org.lz4:lz4-java and standardize on at.yawk.lz4-java to remediate CVE-2025-12183 and CVE-2025-66566 (<a href="https://redirect.github.com/apache/pulsar/pull/25198";>#25198</a>)</li> <li>[fix][sec] Override commons-beanutils and commons-configuration2 to remediate CVEs (<a href="https://redirect.github.com/apache/pulsar/pull/24936";>#24936</a>)</li> <li>[fix][sec] Override kafka-clients in kinesis-kpl-shaded to remediate CVE-2024-31141 and CVE-2025-27817 (<a href="https://redirect.github.com/apache/pulsar/pull/24935";>#24935</a>)</li> <li>[fix][sec] Override msgpack-core to 0.9.11 to address CVE-2026-21452 (<a href="https://redirect.github.com/apache/pulsar/pull/25233";>#25233</a>)</li> <li>[fix][sec] Override nimbus-jose-jwt to remediate CVE-2023-52428 and CVE-2025-53864 (<a href="https://redirect.github.com/apache/pulsar/pull/24937";>#24937</a>)</li> <li>[fix][sec] Update Hbase version to 2.6.3-hadoop3 and exclude Avro from hbase-client to remediate CVEs (<a href="https://redirect.github.com/apache/pulsar/pull/24953";>#24953</a>)</li> <li>[fix][sec] Upgrade aircompressor to 2.0.3 to resolve CVE-2025-67721 (<a href="https://redirect.github.com/apache/pulsar/pull/25256";>#25256</a>)</li> <li>[fix][sec] Upgrade BouncyCastle FIPS to 2.0.10 to remediate CVE-2025-8916 (<a href="https://redirect.github.com/apache/pulsar/pull/24923";>#24923</a>)</li> <li>[fix][sec] Upgrade hadoop3 version from 3.4.0 to 3.4.1 (<a href="https://redirect.github.com/apache/pulsar/pull/24950";>#24950</a>)</li> <li>[fix][sec] Upgrade Jackson version to 2.18.6 (<a href="https://redirect.github.com/apache/pulsar/pull/25264";>#25264</a>)</li> <li>[fix][sec] Upgrade Jetty to 9.4.58.v20250814 to address CVE-2025-5115 (<a href="https://redirect.github.com/apache/pulsar/pull/24897";>#24897</a>)</li> <li>[fix][sec] Upgrade jose4j to 0.9.6 to address CVE-2024-29371 (<a href="https://redirect.github.com/apache/pulsar/pull/25095";>#25095</a>)</li> <li>[fix][sec] Upgrade log4j to 2.25.3 to address CVE-2025-68161 (<a href="https://redirect.github.com/apache/pulsar/pull/25102";>#25102</a>)</li> <li>[fix][sec] Upgrade Netty to 4.1.127.Final to address CVEs (<a href="https://redirect.github.com/apache/pulsar/pull/24717";>#24717</a>)</li> <li>[fix][sec] Upgrade Netty to 4.1.130.Final (<a href="https://redirect.github.com/apache/pulsar/pull/25078";>#25078</a>)</li> <li>[fix][sec] Upgrade OpenSearch to 2.19.4 to remediate CVE-2025-9624 (<a href="https://redirect.github.com/apache/pulsar/pull/25206";>#25206</a>)</li> <li>[fix][sec] Upgrade Python protobuf version to 6.33.5 to address CVE-2026-0994 (<a href="https://redirect.github.com/apache/pulsar/pull/25250";>#25250</a>)</li> <li>[fix][sec] Upgrade Spring to 6.2.12 to remediate CVE-2025-22233 and CVE-2025-41249 (<a href="https://redirect.github.com/apache/pulsar/pull/24903";>#24903</a>)</li> <li>[fix][sec] Upgrade vertx to address CVE-2026-1002 (<a href="https://redirect.github.com/apache/pulsar/pull/25152";>#25152</a>)</li> <li>[fix][build] Fix Eclipse/VSCode support after Jetty 12 upgrade (<a href="https://redirect.github.com/apache/pulsar/pull/25169";>#25169</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/apache/pulsar/commit/de347884acbf2e982265e2a50034e0dd6d624213";><code>de34788</code></a> Release 4.2.0</li> <li><a href="https://github.com/apache/pulsar/commit/19ef1fcdb61d1201e146f40b2e8b98dc74765cee";><code>19ef1fc</code></a> [improve][offload] Bump hadoop to 3.4.3 and hbase to 2.6.4 (<a href="https://redirect.github.com/apache/pulsar/issues/25396";>#25396</a>)</li> <li><a href="https://github.com/apache/pulsar/commit/0163ce8677bbb72ec959052d55d0ce43918ca469";><code>0163ce8</code></a> [cleanup] Convert 12 test classes to SharedPulsarBaseTest (<a href="https://redirect.github.com/apache/pulsar/issues/25392";>#25392</a>)</li> <li><a href="https://github.com/apache/pulsar/commit/08d89a2ea1a2a566197f5db004881c4e222bb3ac";><code>08d89a2</code></a> [improve][broker] PIP-464: Strict Avro schema validation for SchemaType.JSON ...</li> <li><a href="https://github.com/apache/pulsar/commit/78281fd04500e1cbd65f2a4818ffd85f42739106";><code>78281fd</code></a> [improve][pip] PIP-464: Deprecate legacy Jackson JsonSchema format for Schema...</li> <li><a href="https://github.com/apache/pulsar/commit/7e5839c16264061819e67336f724fe51fb44d052";><code>7e5839c</code></a> [cleanup] Convert 30 test classes to SharedPulsarBaseTest (<a href="https://redirect.github.com/apache/pulsar/issues/25381";>#25381</a>)</li> <li><a href="https://github.com/apache/pulsar/commit/3bc834f2fa8aae1ffe8f2fb3f795acd3d0de755d";><code>3bc834f</code></a> [fix][client] Fix stale Healthy state in SameAuthParamsLookupAutoClusterFailo...</li> <li><a href="https://github.com/apache/pulsar/commit/ce3429ce878fd2003793b030b3f317deb49a34db";><code>ce3429c</code></a> [fix][test] Fix flaky OneWayReplicatorUsingGlobalZKTest.cleanup (<a href="https://redirect.github.com/apache/pulsar/issues/25389";>#25389</a>)</li> <li><a href="https://github.com/apache/pulsar/commit/ba851d3784f3a8c8a2dca12ed9b6fb9052f999eb";><code>ba851d3</code></a> [feat][bookkeeper] add certs refresh (<a href="https://redirect.github.com/apache/pulsar/issues/25370";>#25370</a>)</li> <li><a href="https://github.com/apache/pulsar/commit/953d092b10ab7ae5215677aeb46df2a5df85c2eb";><code>953d092</code></a> [fix][test] Fix flaky PersistentStickyKeyDispatcherMultipleConsumersClassicTe...</li> <li>Additional commits viewable in <a href="https://github.com/apache/pulsar/compare/v4.1.3...v4.2.0";>compare view</a></li> </ul> </details> <br /> Updates `org.apache.pulsar:pulsar-client-admin` from 4.1.3 to 4.2.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/apache/pulsar/releases";>org.apache.pulsar:pulsar-client-admin's releases</a>.</em></p> <blockquote> <h2>v4.2.0</h2> <h4>2026-04-01</h4> <h3>Approved PIPs</h3> <ul> <li><a href="https://github.com/apache/pulsar/tree/master/pip/pip-434.md";>PIP-434: Expose Netty channel configuration WRITE_BUFFER_WATER_MARK to pulsar conf and pause receive requests when channel is unwritable</a></li> <li><a href="https://github.com/apache/pulsar/tree/master/pip/pip-437.md";>PIP-437: Granular and Fixed-Delay Policies for Message Delivery</a></li> <li><a href="https://github.com/apache/pulsar/tree/master/pip/pip-439.md";>PIP-439: Adding Transaction Support to Pulsar Functions Through Managed Transaction Wrapping</a></li> <li><a href="https://github.com/apache/pulsar/tree/master/pip/pip-442.md";>PIP-442: Add memory limits for CommandGetTopicsOfNamespace and CommandWatchTopicList on Broker and Proxy</a></li> <li><a href="https://github.com/apache/pulsar/tree/master/pip/pip-443.md";>PIP-443: Stop using Netty Recycler in new code</a></li> <li><a href="https://github.com/apache/pulsar/tree/master/pip/pip-444.md";>PIP-444: Rate limit for deleting ledger to alleviate the zk pressure.</a></li> <li><a href="https://github.com/apache/pulsar/tree/master/pip/pip-446.md";>PIP-446: Support Native OpenTelemetry Tracing in Pulsar Java Client</a></li> <li><a href="https://github.com/apache/pulsar/tree/master/pip/pip-447.md";>PIP-447: Customizable Prometheus Labels for Topic Metrics</a></li> <li><a href="https://github.com/apache/pulsar/tree/master/pip/pip-452.md";>PIP-452: Customizable topic listing of namespace with properties</a></li> <li><a href="https://github.com/apache/pulsar/tree/master/pip/pip-453.md";>PIP-453: Improve the metadata store threading model</a></li> <li><a href="https://github.com/apache/pulsar/tree/master/pip/pip-454.md";>PIP-454: Metadata Store Migration Framework</a></li> <li><a href="https://github.com/apache/pulsar/tree/master/pip/pip-464.md";>PIP-464: Deprecate legacy Jackson JsonSchema format for SchemaType.JSON</a></li> </ul> <h3>Library updates</h3> <ul> <li>[improve][broker] Upgrade bookkeeper to 4.17.3 (<a href="https://redirect.github.com/apache/pulsar/pull/25166";>#25166</a>)</li> <li>[improve][ml] Upgrade Oxia client to 0.7.0 (<a href="https://redirect.github.com/apache/pulsar/pull/24824";>#24824</a>)</li> <li>[fix][sec] Added Exclusions for tomcat-embed-core and derby and override mina-core to remediate CVEs (<a href="https://redirect.github.com/apache/pulsar/pull/24949";>#24949</a>)</li> <li>[fix][sec] Bump at.yawk.lz4:lz4-java from 1.9.0 to 1.10.1 in /pulsar-common (<a href="https://redirect.github.com/apache/pulsar/pull/25045";>#25045</a>)</li> <li>[fix][sec] Bump github.com/dvsekhvalnov/jose2go from 1.6.0 to 1.7.0 in /pulsar-function-go (<a href="https://redirect.github.com/apache/pulsar/pull/24987";>#24987</a>)</li> <li>[fix][sec] Bump google.golang.org/grpc from 1.60.0 to 1.79.3 in /pulsar-function-go (<a href="https://redirect.github.com/apache/pulsar/pull/25353";>#25353</a>)</li> <li>[fix][sec] Bump io.vertx:vertx-web from 4.5.10 to 4.5.22 (<a href="https://redirect.github.com/apache/pulsar/pull/24889";>#24889</a>)</li> <li>[fix][sec] Bump org.apache.solr:solr-core from 9.8.0 to 9.10.1 in /pulsar-io/solr (<a href="https://redirect.github.com/apache/pulsar/pull/25175";>#25175</a>)</li> <li>[fix][sec] Bump org.apache.zookeeper:zookeeper from 3.9.4 to 3.9.5 (<a href="https://redirect.github.com/apache/pulsar/pull/25303";>#25303</a>)</li> <li>[fix][sec] Eliminate commons-collections dependency (<a href="https://redirect.github.com/apache/pulsar/pull/25024";>#25024</a>)</li> <li>[fix][sec] Exclude org.lz4:lz4-java and standardize on at.yawk.lz4-java to remediate CVE-2025-12183 and CVE-2025-66566 (<a href="https://redirect.github.com/apache/pulsar/pull/25198";>#25198</a>)</li> <li>[fix][sec] Override commons-beanutils and commons-configuration2 to remediate CVEs (<a href="https://redirect.github.com/apache/pulsar/pull/24936";>#24936</a>)</li> <li>[fix][sec] Override kafka-clients in kinesis-kpl-shaded to remediate CVE-2024-31141 and CVE-2025-27817 (<a href="https://redirect.github.com/apache/pulsar/pull/24935";>#24935</a>)</li> <li>[fix][sec] Override msgpack-core to 0.9.11 to address CVE-2026-21452 (<a href="https://redirect.github.com/apache/pulsar/pull/25233";>#25233</a>)</li> <li>[fix][sec] Override nimbus-jose-jwt to remediate CVE-2023-52428 and CVE-2025-53864 (<a href="https://redirect.github.com/apache/pulsar/pull/24937";>#24937</a>)</li> <li>[fix][sec] Update Hbase version to 2.6.3-hadoop3 and exclude Avro from hbase-client to remediate CVEs (<a href="https://redirect.github.com/apache/pulsar/pull/24953";>#24953</a>)</li> <li>[fix][sec] Upgrade aircompressor to 2.0.3 to resolve CVE-2025-67721 (<a href="https://redirect.github.com/apache/pulsar/pull/25256";>#25256</a>)</li> <li>[fix][sec] Upgrade BouncyCastle FIPS to 2.0.10 to remediate CVE-2025-8916 (<a href="https://redirect.github.com/apache/pulsar/pull/24923";>#24923</a>)</li> <li>[fix][sec] Upgrade hadoop3 version from 3.4.0 to 3.4.1 (<a href="https://redirect.github.com/apache/pulsar/pull/24950";>#24950</a>)</li> <li>[fix][sec] Upgrade Jackson version to 2.18.6 (<a href="https://redirect.github.com/apache/pulsar/pull/25264";>#25264</a>)</li> <li>[fix][sec] Upgrade Jetty to 9.4.58.v20250814 to address CVE-2025-5115 (<a href="https://redirect.github.com/apache/pulsar/pull/24897";>#24897</a>)</li> <li>[fix][sec] Upgrade jose4j to 0.9.6 to address CVE-2024-29371 (<a href="https://redirect.github.com/apache/pulsar/pull/25095";>#25095</a>)</li> <li>[fix][sec] Upgrade log4j to 2.25.3 to address CVE-2025-68161 (<a href="https://redirect.github.com/apache/pulsar/pull/25102";>#25102</a>)</li> <li>[fix][sec] Upgrade Netty to 4.1.127.Final to address CVEs (<a href="https://redirect.github.com/apache/pulsar/pull/24717";>#24717</a>)</li> <li>[fix][sec] Upgrade Netty to 4.1.130.Final (<a href="https://redirect.github.com/apache/pulsar/pull/25078";>#25078</a>)</li> <li>[fix][sec] Upgrade OpenSearch to 2.19.4 to remediate CVE-2025-9624 (<a href="https://redirect.github.com/apache/pulsar/pull/25206";>#25206</a>)</li> <li>[fix][sec] Upgrade Python protobuf version to 6.33.5 to address CVE-2026-0994 (<a href="https://redirect.github.com/apache/pulsar/pull/25250";>#25250</a>)</li> <li>[fix][sec] Upgrade Spring to 6.2.12 to remediate CVE-2025-22233 and CVE-2025-41249 (<a href="https://redirect.github.com/apache/pulsar/pull/24903";>#24903</a>)</li> <li>[fix][sec] Upgrade vertx to address CVE-2026-1002 (<a href="https://redirect.github.com/apache/pulsar/pull/25152";>#25152</a>)</li> <li>[fix][build] Fix Eclipse/VSCode support after Jetty 12 upgrade (<a href="https://redirect.github.com/apache/pulsar/pull/25169";>#25169</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/apache/pulsar/commit/de347884acbf2e982265e2a50034e0dd6d624213";><code>de34788</code></a> Release 4.2.0</li> <li><a href="https://github.com/apache/pulsar/commit/19ef1fcdb61d1201e146f40b2e8b98dc74765cee";><code>19ef1fc</code></a> [improve][offload] Bump hadoop to 3.4.3 and hbase to 2.6.4 (<a href="https://redirect.github.com/apache/pulsar/issues/25396";>#25396</a>)</li> <li><a href="https://github.com/apache/pulsar/commit/0163ce8677bbb72ec959052d55d0ce43918ca469";><code>0163ce8</code></a> [cleanup] Convert 12 test classes to SharedPulsarBaseTest (<a href="https://redirect.github.com/apache/pulsar/issues/25392";>#25392</a>)</li> <li><a href="https://github.com/apache/pulsar/commit/08d89a2ea1a2a566197f5db004881c4e222bb3ac";><code>08d89a2</code></a> [improve][broker] PIP-464: Strict Avro schema validation for SchemaType.JSON ...</li> <li><a href="https://github.com/apache/pulsar/commit/78281fd04500e1cbd65f2a4818ffd85f42739106";><code>78281fd</code></a> [improve][pip] PIP-464: Deprecate legacy Jackson JsonSchema format for Schema...</li> <li><a href="https://github.com/apache/pulsar/commit/7e5839c16264061819e67336f724fe51fb44d052";><code>7e5839c</code></a> [cleanup] Convert 30 test classes to SharedPulsarBaseTest (<a href="https://redirect.github.com/apache/pulsar/issues/25381";>#25381</a>)</li> <li><a href="https://github.com/apache/pulsar/commit/3bc834f2fa8aae1ffe8f2fb3f795acd3d0de755d";><code>3bc834f</code></a> [fix][client] Fix stale Healthy state in SameAuthParamsLookupAutoClusterFailo...</li> <li><a href="https://github.com/apache/pulsar/commit/ce3429ce878fd2003793b030b3f317deb49a34db";><code>ce3429c</code></a> [fix][test] Fix flaky OneWayReplicatorUsingGlobalZKTest.cleanup (<a href="https://redirect.github.com/apache/pulsar/issues/25389";>#25389</a>)</li> <li><a href="https://github.com/apache/pulsar/commit/ba851d3784f3a8c8a2dca12ed9b6fb9052f999eb";><code>ba851d3</code></a> [feat][bookkeeper] add certs refresh (<a href="https://redirect.github.com/apache/pulsar/issues/25370";>#25370</a>)</li> <li><a href="https://github.com/apache/pulsar/commit/953d092b10ab7ae5215677aeb46df2a5df85c2eb";><code>953d092</code></a> [fix][test] Fix flaky PersistentStickyKeyDispatcherMultipleConsumersClassicTe...</li> <li>Additional commits viewable in <a href="https://github.com/apache/pulsar/compare/v4.1.3...v4.2.0";>compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
