id: client-java-4.1.0 title: Client Java 4.1.0 sidebar_label: Client Java 4.1.0

  • [improve][broker] Upgrade avro version to 1.12.0 (#24617)
  • [improve][broker] Upgrade bookkeeper to 4.17.2/commons-configuration to 2.x/grpc to 1.72.0 and enable ZooKeeper client to establish connection in read-only mode (#24468)
  • [fix][sec] Bump commons-io version to 2.18.0 (#23684)
  • [fix][sec] Mitigate CVE-2024-53990 by disabling AsyncHttpClient CookieStore (#23725)
  • [fix][sec] Remove dependency on out-dated commons-configuration 1.x (#24562)
  • [fix][sec] Replace bcprov-jdk15on dependency with bcprov-jdk18-on (#23532)
  • [fix][sec] Upgrade async-http-client to 2.12.4 to address CVE-2024-53990 (#23732)
  • [fix][sec] Upgrade bouncycastle bcpkix-fips version to 1.79 to address CVE-2025-8916 (#24650)
  • [fix][sec] Upgrade golang.org/x/crypto from 0.21.0 to 0.31.0 in pulsar-function-go (#23743)
  • [fix][sec] Upgrade Jetty to 9.4.57.v20241219 to mitigate CVE-2024-6763 (#24232)
  • [fix][sec] Upgrade jwt/v5 to 5.2.2 to address CVE-2025-30204 (#24140)
  • [fix][sec] Upgrade Kafka connector and clients version to 3.9.1 to address CVE-2025-27818 (#24564)
  • [fix][sec] Upgrade pulsar-function-go dependencies to address CVE-2025-22868 (#24547)
  • [fix][sec] Upgrade to Netty 4.1.115.Final to address CVE-2024-47535 (#23596)
  • [fix][sec] Upgrade to Netty 4.1.118 (#23965)
  • [fix][sec] Upgrade to Netty 4.1.124.Final to address CVE-2025-55163 (#24637)
  • [fix][sec] Upgrade Zookeeper to 3.9.3 to address CVE-2024-51504 (#23581)
  • [fix][build] Upgrade json-smart to 2.5.2 (#23966)
  • [improve][io] Upgrade AWS SDK v1 & v2, Kinesis KPL and KPC versions (#24661)
  • [improve][io] Upgrade Kafka client and compatible Confluent platform version (#24201)
  • [improve][io] Upgrade Spring version to 6.1.13 in IO Connectors (#23459)
  • [improve][io] Upgrade Spring version to 6.1.14 in IO Connectors (#23481)
  • [improve][monitor] Upgrade OTel to 1.41.0 (#23484)
  • [improve][monitor] Upgrade OTel to 1.45.0 (#23756)
  • [fix][misc] Upgrade dependencies to fix critical security vulnerabilities (#24532)
  • [fix][misc] Upgrade fastutil to 8.5.16 (#24659)
  • [improve][build] Upgrade Caffeine from 2.9.1 to 3.2.1 (#24527)
  • [improve][build] Upgrade commons-compress version from 1.27.0 to 1.27.1 (#24270)
  • [improve][build] Upgrade errorprone to 2.38.0 (#24242)
  • [improve][build] Upgrade Gradle Develocity Maven Extension dependencies (#24260)
  • [improve][build] Upgrade Lombok to 1.18.38 to support JDK 24 (#24237)
  • [improve][build] Upgrade Mockito to 5.17.0 and byte-buddy to 1.15.11 (#24241)
  • [improve][build] Upgrade SpotBugs to 4.9.x (#24243)
  • [improve][build] Upgrade to jacoco 0.8.13 (#24240)
  • [improve][build] Upgrade zstd version from 1.5.2-3 to 1.5.7-3 (#24263)
  • [improve][ci] Upgrade Gradle Develocity Maven Extension to 1.23.1 (#24004)
  • [improve][test] Upgrade Testcontainers to 1.20.4 and docker-java to 3.4.0 (#24003)
  • [improve][misc] Upgrade Guava to 33.4.8 that uses JSpecify annotations (#24267)
  • [improve][misc] Upgrade Netty to 4.1.122.Final and tcnative to 2.0.72.Final (#24397)
  • [improve][misc] Upgrade RE2/J to 1.8 (#24530)
  • [feat][misc] Upgrade oxia version to 0.4.9 (#23607)
  • [improve] Upgrade Apache Commons library versions to compatible versions (#24205)
  • [improve] Upgrade lombok to 1.18.36 (#23752)
  • [improve] Upgrade Netty to 4.1.119.Final (#24049)
  • [improve] Upgrade Netty to 4.1.121.Final (#24214)
  • [improve] Upgrade OpenTelemetry library to 1.44.1 version (#23656)
  • [improve] Upgrade oxia-java to 0.4.10 and fix closing of OxiaMetadataStore (#23653)
  • [improve] Upgrade pulsar-client-python to 3.7.0 in Docker image (#24302)
  • [improve] Upgrade to Netty 4.1.116.Final and io_uring to 0.0.26.Final (#23813)
  • [improve] Upgrade to Netty 4.1.117.Final (#23863)
  • [fix][client] Cannot access message data inside ProducerInterceptor#onSendAcknowledgement (#23791)
  • [fix][client] Close orphan producer or consumer when the creation is interrupted (#24539)
  • [fix][client] Copy eventTime to retry letter topic and DLQ messages (#24059)
  • [fix][client] fix ArrayIndexOutOfBoundsException in SameAuthParamsLookupAutoClusterFailover (#24662)
  • [fix][client] Fix ArrayIndexOutOfBoundsException when using SameAuthParamsLookupAutoClusterFailover (#23336)
  • [fix][client] Fix building broken batched message when publishing (#24061)
  • [fix][client] Fix consumer leak when thread is interrupted before subscribe completes (#24100)
  • [fix][client] Fix consumer not returning encrypted messages on decryption failure with compression enabled (#24356)
  • [fix][client] Fix ConsumerStats.getRateMsgsReceived javadoc (#21618)
  • [fix][client] Fix deadlock of NegativeAcksTracker (#23651)
  • [fix][client] Fix DLQ producer name conflicts when there are same name consumers (#23577)
  • [fix][client] Fix enableRetry for consumers using legacy topic naming where cluster name is included (#23753)
  • [fix][client] fix incomingMessageSize and client memory usage is negative (#23624)
  • [fix][client] Fix inconsistent compression threshold behavior across batching modes (#24102)
  • [fix][client] Fix incorrect producer.getPendingQueueSize due to incomplete queue implementation (#24184)
  • [fix][client] Fix issue in auto releasing of idle connection with topics pattern consumer (#24528)
  • [fix][client] Fix LoadManagerReport not found (#23886)
  • [fix][client] Fix memory leak in ClientCnx.newLookup when there's TooManyRequestsException (#23971)
  • [fix][client] Fix memory leak when message size exceeds max message size and batching is enabled (#23967)
  • [fix][client] Fix producer publishing getting stuck after message with incompatible schema is discarded (#24282)
  • [fix][client] Fix race-condition causing doReconsumeLater to hang when creating retryLetterProducer has failed (#23560)
  • [fix][client] Fix reader message filtering issue during blue-green cluster switch (#23693)
  • [fix][client] Fix Reader.hasMessageAvailable return wrong value after seeking by timestamp with startMessageIdInclusive (#23502)
  • [fix][client] fix the beforeConsume() method earlier hit with message listener (#23578)
  • [fix][client] Fix the javadoc for startMessageIdInclusive (#23508)
  • [fix][client] Fix wrong start message id when it's a chunked message id (#23713)
  • [fix][client] Fixed an issue where a cert chain could not be used in TLS authentication (#23644)
  • [fix][client] Initializing client-authentication using configured auth params (#23610)
  • [fix][client] Make DeadLetterPolicy & KeySharedPolicy serializable (#23718)
  • [fix][client] Make protobuf-java dependency optional in java client libraries (#23632)
  • [fix][client] NPE in MultiTopicsConsumerImpl.negativeAcknowledge (#24476)
  • [fix][client] Orphan producer when concurrently calling producer closing and reconnection (#23853)
  • [fix][client] PIP-425: fix updateServiceUrl and fix flaky ServiceUrlQuarantineTest (#24574)
  • [fix][client] Prevent embedding protobuf-java class files in pulsar-client-admin and pulsar-client-all (#23468)
  • [fix][client] Prevent NPE when seeking with null topic in TopicMessageId (#24404)
  • [fix][client] Prevent retry topic and dead letter topic producer leaks when sending of message fails (#23824)
  • [fix][client] Skip schema validation when sending messages to DLQ to avoid infinite loop when schema validation fails on an incoming message (#24663)
  • [fix][client] The partitionedProducer maxPendingMessages always is 0 (#23593)
  • [fix][client] Use dedicated executor for requests in BinaryProtoLookupService (#23378)
  • [fix][client]Add setCompressMinMsgBodySize method to ProducerBuilder for compression configuration flexibility (#24164)
  • [fix][client]Prevent ZeroQueueConsumer from receiving batch messages when using MessagePayloadProcessor (#24610)
  • [improve][client] Add startTimestamp and endTimestamp for consuming message in client cli (#24521)
  • [improve][client] Add OpenTelemetry metrics for client memory buffer usage (#24647)
  • [improve][client] Enhance error handling for non-exist subscription in consumer creation (#23254)
  • [improve][client] Make replicateSubscriptionState nullable (#23757)
  • [improve][client] PIP-391: Enable batch index ACK by default (#24203)
  • [improve][client] PIP-393: Improve performance of Negative Acknowledgement (#23600)
  • [improve][client] PIP-420: Supports users implement external schemas (#24488)
  • [improve][client] PIP-421: Require Java 17 as the minimum for Pulsar Java client SDK (#24475)
  • [improve][client] Print consumer stats log if prefetched messages are not zero (#23698)
  • [improve][client] Reduce unshaded dependencies and shading warnings in shaded Java client modules (#23647)
  • [improve][client] Replace NameUtil#generateRandomName with RandomStringUtils#randomAlphanumeric (#23645)
  • [improve][client] Support load RSA PKCS#8 private key (#24582)
  • [improve][client] Terminate consumer.receive() when consumer is closed (#24550)
  • [improve][client] Update TypedMessageBuilder deliverAfter and deliverAt api comment (#23969)
  • [improve][client] validate ClientConfigurationData earlier to avoid resource leaks (#24187)
  • [improve][client][PIP-389] Add a producer config to improve compression performance (#23525)
  • [improve][client][pip] Require Java 17 as the minimum for Pulsar Java client SDK (#24364)
  • [improve][client]Improve transaction log when a TXN command timeout (#24230)
  • [improve][client]PIP-425:Support connecting with next available endpoint for multi-endpoint serviceUrls (#24387)
  • [clean][client] Clean code for the construction of retry/dead letter topic name (#24082)
  • [feat][client] Support forward proxy for the ZTS server in pulsar-client-auth-athenz (#23947)