2026-08-03 Library updates [fix][ci] Upgrade sandboxed-trivy-action to approved sha (#26169) [improve][meta] Upgrade Oxia client to 0.9.4 (#26193) [improve][build] Upgrade docker base image Alpine to 3.24 (#26225) [improve][build] Upgrade slog to 0.10.0 (#26226) [improve][misc] Upgrade Jetty to 12.1.11 (#26233) [fix][sec][branch-4.2] Upgrade Hadoop to 3.5.0 (#26194) [fix][sec][branch-4.2] Upgrade…
2026-08-03 Library updates [fix][sec][branch-4.0] Upgrade Hadoop to 3.5.0 (#26195) [fix][sec][branch-4.0] Upgrade Jackson version to 2.18.9 (#26187) [fix][sec][branch-4.0] Upgrade Netty to 4.1.136.Final (#26170) [fix][ci] Upgrade sandboxed-trivy-action to approved sha (#26169) [improve][meta] Upgrade Oxia client to 0.8.0 (#25964) [improve][meta] Upgrade Oxia client to 0.9.4 (#26193) [improve][moni…
Release 4.0.13-candidate-1
Release 4.2.4-candidate-1
2026-07-06 Backported PIP [feat][pip] PIP-469: Legacy-aware topic policies backend routing and metadata-store topic policies (#25547) Library updates [fix][sec] Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 in /pulsar-function-go (#26142) [fix][sec] Upgrade jline to 4.2.1 and picocli to 4.7.7, drop unused jline2 (#26068) [fix][sec] Upgrade pulsar-client-go to v0.20.0 in pulsar-function-go…
2026-07-06 Backported PIP [feat][pip] PIP-469: Legacy-aware topic policies backend routing and metadata-store topic policies (#25547) Library updates [fix][sec] Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 in /pulsar-function-go (#26142) [fix][sec] Upgrade jline to 4.2.1 and picocli to 4.7.7, drop unused jline2 (#26068) [fix][sec] Upgrade pulsar-client-go to v0.20.0 in pulsar-function-go…
Release 4.0.12-candidate-2
Release 4.2.3-candidate-2
Release 4.0.12-candidate-1
Release 4.2.3-candidate-1
2026-06-23 Apache Pulsar 5.0.0-M1 is the first milestone release on the road to Apache Pulsar 5.0.0, with general availability expected later in 2026. It is a preview: an early build that puts the major new features of 5.0 in your hands so you can try them against real workloads and send feedback ahead of the GA release. It is not meant for production. Two changes stand out — Scalable Topics, a ne…
Release 5.0.0-M1-candidate-1
2026-06-08 Library updates [fix][sec] Bump org.asynchttpclient:async-http-client from 2.14.5 to 2.15.0 (#25818) [fix][sec] Upgrade commons-configuration2 to 2.15.0 to address CVE-2026-45205 (#25844) [fix][sec] Upgrade Netty to 4.1.133.Final to address CVEs (#25670) [improve][misc] Upgrade Netty to 4.1.134 (#25870) [fix][sec] Upgrade Netty to 4.1.135.Final to address several CVEs (#25918) [fix][sec…
2026-06-08 Library updates [fix][sec][branch-4.0] Upgrade avro to 1.11.5 to address CVE-2025-33042 (#25788) [fix][sec] Bump org.asynchttpclient:async-http-client from 2.14.5 to 2.15.0 (#25818) [fix][sec] Upgrade commons-configuration2 to 2.15.0 to address CVE-2026-45205 (#25844) [fix][sec] Upgrade Netty to 4.1.133.Final to address CVEs (#25670) [improve][misc] Upgrade Netty to 4.1.134 (#25870) [fi…
Release 4.0.11-candidate-1
Release 4.2.2-candidate-1
2026-04-27 Upgrade notice This release upgrades Jetty from 9.4.x to 12.1.8 to address several high-severity CVEs in Jetty 9.4.x (#25534). For background and discussion, see the dev list thread. The upgrade introduces the following breaking changes: AdditionalServlet interface change. The org.apache.pulsar.broker.web.plugin.servlet.AdditionalServlet interface was coupled directly to the Jetty 9 org…
2026-04-27 Library updates [fix][sec] Upgrade BouncyCastle to 1.84 (CVE-2026-5588, CVE-2026-0636) (#25569) [fix][sec] Upgrade Jetty to address CVE-2026-2332 (#25527) [fix][sec] Upgrade Jetty to address CVE-2026-5795 (#25532) [fix][sec] Upgrade to async-http-client 2.14.5 to address CVE-2026-40490 (#25546) [fix][sec] Upgrade to Netty 4.1.132.Final to address CVEs (#25399) [fix][sec] Upgrade log4j t…