You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by lh...@apache.org on 2026/10/05 20:12:45 UTC
(pulsar-site) 07/07: Add release notes for 4.2.5
This is an automated email from the ASF dual-hosted git repository.
lhotari pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/pulsar-site.git
commit e7bb613a6ee9b6e8b30d595f4ca77dfca9dc25a7
Author: Lari Hotari <lh...@users.noreply.github.com>
AuthorDate: Mon Oct 5 13:08:09 2026 -0700
Add release notes for 4.2.5
---
release-notes/versioned/client-java-4.2.5.md | 31 ++++
release-notes/versioned/pulsar-4.2.5.md | 229 +++++++++++++++++++++++++++
2 files changed, 260 insertions(+)
diff --git a/release-notes/versioned/client-java-4.2.5.md b/release-notes/versioned/client-java-4.2.5.md
new file mode 100644
index 00000000000..cf0b80b69d9
--- /dev/null
+++ b/release-notes/versioned/client-java-4.2.5.md
@@ -0,0 +1,31 @@
+---
+id: client-java-4.2.5
+title: Client Java 4.2.5
+sidebar_label: Client Java 4.2.5
+---
+
+- [fix][client] Apply no-memory-limit producer queue defaults at producer creation ([#26342](https://github.com/apache/pulsar/pull/26342))
+- [fix][client] Avoid exception in ConsumerImpl hasMessageAvailable before first receive ([#25857](https://github.com/apache/pulsar/pull/25857))
+- [fix][client] Complete table view refresh after applying messages ([#26566](https://github.com/apache/pulsar/pull/26566))
+- [fix][client] Defer op cmd release to the write event loop on send timeout ([#26456](https://github.com/apache/pulsar/pull/26456))
+- [fix][client] Divide the across-partitions budget only when it was set explicitly ([#26384](https://github.com/apache/pulsar/pull/26384))
+- [fix][client] Don't close a shared DNS resolver group's address resolver when a client closes ([#26723](https://github.com/apache/pulsar/pull/26723))
+- [fix][client] Drop a send receipt for a removed producer, not the connection ([#26618](https://github.com/apache/pulsar/pull/26618))
+- [fix][client] Enable TableView compacted reads for short topic names ([#26626](https://github.com/apache/pulsar/pull/26626))
+- [fix][client] Fix buffer ownership on the send failure paths ([#26455](https://github.com/apache/pulsar/pull/26455))
+- [fix][client] Fix incorrect topic in OTel spans for partitioned producers ([#25896](https://github.com/apache/pulsar/pull/25896))
+- [fix][client] Fix OpenTelemetryProducerInterceptor not executing due to eligible check ([#25585](https://github.com/apache/pulsar/pull/25585))
+- [fix][client] Flush acknowledgment groups at the combined size limit ([#26594](https://github.com/apache/pulsar/pull/26594))
+- [fix][client] Inject trace context into message properties for producer-consumer span correlation ([#25749](https://github.com/apache/pulsar/pull/25749))
+- [fix][client] Keep transactional and non-transactional messages in separate batches ([#26547](https://github.com/apache/pulsar/pull/26547))
+- [fix][client] Prevent duplicate cleanup and leaks on producer send failures ([#26641](https://github.com/apache/pulsar/pull/26641))
+- [fix][client] Release connections opened after close ([#26733](https://github.com/apache/pulsar/pull/26733))
+- [fix][client] Release the command header when send serialization fails ([#26492](https://github.com/apache/pulsar/pull/26492))
+- [fix][client] Release the reserved memory only once when failing a send in a terminal state ([#26476](https://github.com/apache/pulsar/pull/26476))
+- [fix][client] Restore OAuth2 HTTP client after deserialization ([#26324](https://github.com/apache/pulsar/pull/26324))
+- [fix][client] Stop tracking ack timeouts on non-persistent topics ([#26548](https://github.com/apache/pulsar/pull/26548))
+- [improve][client] Avoid eager broker metadata allocation for outgoing messages ([#26521](https://github.com/apache/pulsar/pull/26521))
+- [improve][client] Avoid unused send-stat snapshots for default callbacks ([#26519](https://github.com/apache/pulsar/pull/26519))
+- [improve][client] Coalesce message listener drain scheduling ([#26531](https://github.com/apache/pulsar/pull/26531))
+- [fix][client] Fix incorrect topic in OTel spans for multi-topic consumers
+- [fix][client] Remove the dead letter candidate entry using the entry-level message id
\ No newline at end of file
diff --git a/release-notes/versioned/pulsar-4.2.5.md b/release-notes/versioned/pulsar-4.2.5.md
new file mode 100644
index 00000000000..edf78f0a27f
--- /dev/null
+++ b/release-notes/versioned/pulsar-4.2.5.md
@@ -0,0 +1,229 @@
+---
+id: pulsar-4.2.5
+title: Apache Pulsar 4.2.5
+sidebar_label: Apache Pulsar 4.2.5
+---
+
+#### 2026-08-03
+
+### Library updates
+
+- [improve][broker][branch-4.2] Upgrade bookkeeper to 4.17.4 ([#26219](https://github.com/apache/pulsar/pull/26219))
+- [fix][sec] Bump google.golang.org/grpc from 1.79.3 to 1.82.1 in /pulsar-function-go/examples ([#26231](https://github.com/apache/pulsar/pull/26231))
+- [fix][sec] Bump google.golang.org/grpc from 1.82.1 to 1.83.1 in /pulsar-function-go ([#26446](https://github.com/apache/pulsar/pull/26446))
+- [fix][sec] Bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /pulsar-function-go ([#26541](https://github.com/apache/pulsar/pull/26541))
+- [fix][sec] Bump log4j2 from 2.26.0 to 2.26.1 ([#26329](https://github.com/apache/pulsar/pull/26329))
+- [fix][sec] Upgrade at.yawk.lz4:lz4-java to 1.11.4 ([#26758](https://github.com/apache/pulsar/pull/26758))
+- [fix][sec] Upgrade avro to 1.12.2 ([#24992](https://github.com/apache/pulsar/pull/24992))
+- [fix][sec] Upgrade grpc in pulsar-function-go to 1.82.1 to fix GHSA-hrxh-6v49-42gf ([#26235](https://github.com/apache/pulsar/pull/26235))
+- [fix][sec] Upgrade Jackson to 2.18.10 ([#26339](https://github.com/apache/pulsar/pull/26339))
+- [fix][sec] Upgrade lz4-java to 1.11.1 to address CVE-2026-59949 ([#26250](https://github.com/apache/pulsar/pull/26250))
+- [fix][sec][branch-4.2] Upgrade BouncyCastle to 1.85 and BouncyCastle FIPS to 2.0.2 to address CVEs ([#26370](https://github.com/apache/pulsar/pull/26370))
+- [fix][sec][branch-4.2] Upgrade Netty to 4.1.137 to address several CVEs and bugs ([#26301](https://github.com/apache/pulsar/pull/26301))
+- [fix][sec][branch-4.2] Upgrade Spring to 7.0.8 ([#26270](https://github.com/apache/pulsar/pull/26270))
+- [fix][sec][branch-4.x] Upgrade async-http-client to 2.16.1 ([#26436](https://github.com/apache/pulsar/pull/26436))
+- [fix][sec][branch-4.x] Upgrade lz4-java to 1.11.2 ([#26439](https://github.com/apache/pulsar/pull/26439))
+- [fix][sec][branch-4.x] Upgrade Netty to 4.1.138 to address several CVEs and bugs ([#26515](https://github.com/apache/pulsar/pull/26515))
+- [fix][sec][branch-4.x] Upgrade Thrift to 0.24.0 ([#26438](https://github.com/apache/pulsar/pull/26438))
+- [fix][sec][branch-4.x] Upgrade vertx to 4.5.32 ([#26437](https://github.com/apache/pulsar/pull/26437))
+- [fix][build] Upgrade Conscrypt to 2.6.3 ([#26660](https://github.com/apache/pulsar/pull/26660))
+- [improve][zk] Upgrade ZooKeeper to 3.9.6 ([#26750](https://github.com/apache/pulsar/pull/26750))
+- [improve][build] Upgrade Apache Commons libraries ([#26348](https://github.com/apache/pulsar/pull/26348))
+- [improve][build] Upgrade Bouncy Castle libraries ([#26753](https://github.com/apache/pulsar/pull/26753))
+- [improve][build] Upgrade Caffeine to 3.3.0 ([#26755](https://github.com/apache/pulsar/pull/26755))
+- [improve][build] Upgrade Guava to 33.7.1-jre ([#26760](https://github.com/apache/pulsar/pull/26760))
+- [improve][build] Upgrade Oxia Java client to 0.9.5 ([#26538](https://github.com/apache/pulsar/pull/26538))
+- [improve][misc] Upgrade Conscrypt to 2.6.1 to add aarch64 native support ([#26314](https://github.com/apache/pulsar/pull/26314))
+- [improve][misc] Upgrade Conscrypt to 2.6.2 to restore the native library glibc baseline ([#26315](https://github.com/apache/pulsar/pull/26315))
+- [improve][misc] Upgrade Jetty to 12.1.12 ([#26302](https://github.com/apache/pulsar/pull/26302))
+- [improve][misc] Upgrade Jetty to 12.1.13 ([#26738](https://github.com/apache/pulsar/pull/26738))
+- [improve][misc] Upgrade log4j to 2.26.0 and slf4j to 2.0.18 ([#25973](https://github.com/apache/pulsar/pull/25973))
+- [improve][misc][branch-4.x] Upgrade Jackson to 2.18.11 ([#26759](https://github.com/apache/pulsar/pull/26759))
+- [fix][test][branch-4.2] Fix connector tests broken by the Avro 1.12.2 upgrade
+
+### Broker
+
+- [fix][broker] Add missing bundle Prometheus metrics for extensible load manager ([#26192](https://github.com/apache/pulsar/pull/26192))
+- [fix][broker] Align entry filter policy checks for non-persistent topics ([#26774](https://github.com/apache/pulsar/pull/26774))
+- [fix][broker] Align partitioned topic truncate checks with non-partitioned topics ([#26776](https://github.com/apache/pulsar/pull/26776))
+- [fix][broker] Apply managedLedgerContinueCachingAddedEntriesAfterLastActiveCursorLeavesMillis to managed ledgers ([#26785](https://github.com/apache/pulsar/pull/26785))
+- [fix][broker] Apply subscription policies to namespace and topic subscription operations ([#26767](https://github.com/apache/pulsar/pull/26767))
+- [fix][broker] Apply the role logging anonymizer to topic authorization denial logs ([#26642](https://github.com/apache/pulsar/pull/26642))
+- [fix][broker] Avoid load shedding and metadata writes from a former leader ([#26253](https://github.com/apache/pulsar/pull/26253))
+- [fix][broker] Avoid misleading ownership lock expiry logs during shutdown ([#26633](https://github.com/apache/pulsar/pull/26633))
+- [fix][broker] Bound classic Key_Shared dispatcher replay queue look-ahead ([#26677](https://github.com/apache/pulsar/pull/26677))
+- [fix][broker] Bound the local partition metadata retry when starting a geo-replicator ([#26681](https://github.com/apache/pulsar/pull/26681))
+- [fix][broker] Bound the topic deletion retries triggered by a replication cluster removal ([#26432](https://github.com/apache/pulsar/pull/26432))
+- [fix][broker] Cancel queued transaction snapshot recovery on topic close ([#26335](https://github.com/apache/pulsar/pull/26335))
+- [fix][broker] Cancel queued transaction snapshot recovery on topic close ([#26335](https://github.com/apache/pulsar/pull/26335))
+- [fix][broker] Check the original principal of proxied HTTP requests with its own authentication data ([#26748](https://github.com/apache/pulsar/pull/26748))
+- [fix][broker] Check topic permissions for binary GetSchema and GetOrCreateSchema ([#26643](https://github.com/apache/pulsar/pull/26643))
+- [fix][broker] Check topic permissions for partitions and subscriptions added to a transaction ([#26644](https://github.com/apache/pulsar/pull/26644))
+- [fix][broker] Debit un-acked messages only when the consumer is actually removed ([#26422](https://github.com/apache/pulsar/pull/26422))
+- [fix][broker] Do not log an error when the tenant does not exist ([#26361](https://github.com/apache/pulsar/pull/26361))
+- [fix][broker] Don't serve topic policies from a cache whose init future has not completed ([#26513](https://github.com/apache/pulsar/pull/26513))
+- [fix][broker] Fix assignment and ownership cleanup races in the extensible load manager ([#26520](https://github.com/apache/pulsar/pull/26520))
+- [fix][broker] Fix AvgShedder assignment cache keying with stable bundle names ([#26246](https://github.com/apache/pulsar/pull/26246))
+- [fix][broker] Fix delayed-delivery bucket merge failures when delayedDeliveryMaxNumBuckets is 1-3 ([#26242](https://github.com/apache/pulsar/pull/26242))
+- [fix][broker] Fix dispatcherPauseOnAckStatePersistentEnabled and schemaValidationEnforced returning wrong values when applied=true ([#26472](https://github.com/apache/pulsar/pull/26472))
+- [fix][broker] Fix early completion and false timeouts in SplitManager and UnloadManager ([#26363](https://github.com/apache/pulsar/pull/26363))
+- [fix][broker] Fix lookup permit leak when namespace policy reads fail ([#26606](https://github.com/apache/pulsar/pull/26606))
+- [fix][broker] Fix multi-role authorization regressions and optimize nested checks ([#26551](https://github.com/apache/pulsar/pull/26551))
+- [fix][broker] Fix NPE in ManagedLedgerInterceptorImpl when AppendIndexMetadataInterceptor isn't configured ([#26497](https://github.com/apache/pulsar/pull/26497))
+- [fix][broker] Fix ownership-generation races in OwnershipCache removeOwnership and lock-expiry cleanup ([#26197](https://github.com/apache/pulsar/pull/26197))
+- [fix][broker] Fix persistent throughput degradation caused by permit loss during frequent reconnects on Shared subscriptions ([#26289](https://github.com/apache/pulsar/pull/26289))
+- [fix][broker] Keep accepting Avro named type references written as objects ([#26586](https://github.com/apache/pulsar/pull/26586))
+- [fix][broker] Log exception in PulsarMetadataEventSynchronizer failure path ([#26203](https://github.com/apache/pulsar/pull/26203))
+- [fix][broker] Preserve compaction state on ledger close failure ([#26665](https://github.com/apache/pulsar/pull/26665))
+- [fix][broker] Preserve replicated subscription activity on activation ([#26780](https://github.com/apache/pulsar/pull/26780))
+- [fix][broker] Preserve topic initialization failures ([#26775](https://github.com/apache/pulsar/pull/26775))
+- [fix][broker] Prevent automatic TTL expiry from skipping reader messages ([#26505](https://github.com/apache/pulsar/pull/26505))
+- [fix][broker] Prevent Key_Shared out-of-order replay starvation at the end of topic ([#26268](https://github.com/apache/pulsar/pull/26268))
+- [fix][broker] Prevent NPE when the last ACK races with sticky hash reassignment ([#26471](https://github.com/apache/pulsar/pull/26471))
+- [fix][broker] Propagate bundle split failures to the completion future ([#26735](https://github.com/apache/pulsar/pull/26735))
+- [fix][broker] Release the compaction buffers and permits on flush failures ([#26576](https://github.com/apache/pulsar/pull/26576))
+- [fix][broker] Resolve replicator remote cluster by prefix so cluster names containing a dot work ([#26451](https://github.com/apache/pulsar/pull/26451))
+- [fix][broker] Send ActiveConsumerChange for non-persistent Failover subscriptions ([#26482](https://github.com/apache/pulsar/pull/26482))
+- [fix][broker] Spurious ERROR log for 307 redirect in getReplicatedSubscriptionStatus ([#26706](https://github.com/apache/pulsar/pull/26706))
+- [fix][broker] Stop reporting a deliberate ownership release as an expired resource lock ([#26533](https://github.com/apache/pulsar/pull/26533))
+- [fix][broker]Producer with AUTO_PRODUCE schema failed to reconnect, which caused by schema incompatible ([#25437](https://github.com/apache/pulsar/pull/25437))
+- [fix][admin] Allow defaultNumPartitions for non-partitioned autoTopicCreation override ([#25163](https://github.com/apache/pulsar/pull/25163))
+- [fix][admin] Avoid creating subscriptions when peeking messages if auto-creation is disabled ([#26279](https://github.com/apache/pulsar/pull/26279))
+- [fix][admin] Reject empty cluster migration URL: fix inverted ClusterUrl.isEmpty() ([#26473](https://github.com/apache/pulsar/pull/26473))
+- [fix][ml] Close abandoned write ledger handle to prevent leak ([#26585](https://github.com/apache/pulsar/pull/26585))
+- [fix][ml] Fail in-flight adds when a managed ledger is terminated ([#26678](https://github.com/apache/pulsar/pull/26678))
+- [fix][ml] Fail queued adds when a managed ledger is terminated during a ledger rollover ([#26680](https://github.com/apache/pulsar/pull/26680))
+- [fix][ml] Fix active cursor position tracking after untracking ([#26629](https://github.com/apache/pulsar/pull/26629))
+- [fix][ml] Fix active cursor retention and deferred-update synchronization ([#26511](https://github.com/apache/pulsar/pull/26511))
+- [fix][ml] Fix backlog estimation during ledger rollover with pending writes ([#26647](https://github.com/apache/pulsar/pull/26647))
+- [fix][ml] Fix batch ACK index loss when recovering cursor from MetadataStore ([#26474](https://github.com/apache/pulsar/pull/26474))
+- [fix][ml] Make inflight reads limiter work even if managed ledger cache is disabled ([#26296](https://github.com/apache/pulsar/pull/26296))
+- [fix][ml] Parse the cached entry's message metadata from the buffer the cache keeps ([#26495](https://github.com/apache/pulsar/pull/26495))
+- [fix][ml] Preserve cursor properties when recovering from an unreadable cursor ledger ([#26512](https://github.com/apache/pulsar/pull/26512))
+- [fix][ml] Preserve ledger properties when recovering the last ledger on open ([#26509](https://github.com/apache/pulsar/pull/26509))
+- [fix][ml] Propagate cursor ledger deletion failures ([#26734](https://github.com/apache/pulsar/pull/26734))
+- [fix][ml] Reset the lazily-cached position when reusing a recycled EntryImpl ([#26707](https://github.com/apache/pulsar/pull/26707))
+- [fix][ml] Skip contiguous deleted ranges during reads ([#26299](https://github.com/apache/pulsar/pull/26299))
+- [fix][ml] Tolerate concurrent creation of the managed ledger z-node ([#26247](https://github.com/apache/pulsar/pull/26247))
+- [fix][ml][broker] Keep source ledger data on every shadow managed ledger trim, delete and offload path ([#26746](https://github.com/apache/pulsar/pull/26746))
+- [fix][offload] Cache and reuse entry offsets discovered while skipping in BlobStoreBackedReadHandleImpl ([#26424](https://github.com/apache/pulsar/pull/26424))
+- [fix][offload] Normalize offloader cache directory path ([#26372](https://github.com/apache/pulsar/pull/26372))
+- [fix][meta] Close resources when ZKMetadataStore construction fails ([#26673](https://github.com/apache/pulsar/pull/26673))
+- [fix][meta] Track explicitly acquired underreplicated ledger locks ([#26670](https://github.com/apache/pulsar/pull/26670))
+- [improve][broker] Add configuration to enable shadow topics ([#26739](https://github.com/apache/pulsar/pull/26739))
+- [improve][broker] Add pulsar_subscription_storage_backlog_age_seconds metric ([#26313](https://github.com/apache/pulsar/pull/26313))
+- [improve][broker] Allow dynamically updating topic load timeout ([#26781](https://github.com/apache/pulsar/pull/26781))
+- [improve][broker] Avoid iterator allocation in BrokerInterceptors hot paths and restore configured ordering ([#26462](https://github.com/apache/pulsar/pull/26462))
+- [improve][broker] Change partition metadata not-found log to warn ([#26381](https://github.com/apache/pulsar/pull/26381))
+- [improve][broker] Conflate concurrent readMoreEntries calls ([#26539](https://github.com/apache/pulsar/pull/26539))
+- [improve][broker] Copy small entries into a flat buffer when prepending broker entry metadata ([#26464](https://github.com/apache/pulsar/pull/26464))
+- [improve][broker] Disable subscription-thread dispatch by default ([#26578](https://github.com/apache/pulsar/pull/26578))
+- [improve][broker] Expose interface for the replicator in ManagedLedger instead of cast the class ([#26298](https://github.com/apache/pulsar/pull/26298))
+- [improve][broker] Make exposing topic level metric dynamic ([#21006](https://github.com/apache/pulsar/pull/21006))
+- [improve][broker] Reduce cache retention after reads and apply retention settings at startup ([#26627](https://github.com/apache/pulsar/pull/26627))
+- [improve][broker] Skip unused replicated subscription timestamp updates ([#26655](https://github.com/apache/pulsar/pull/26655))
+- [improve][broker] Support OpenID multi-role authorization and improve proxy authentication defaults ([#26549](https://github.com/apache/pulsar/pull/26549))
+- [improve][broker]Reduce the lock range of SimpleCache to enhance performance ([#25293](https://github.com/apache/pulsar/pull/25293))
+- [fix][txn] Do not fail topic deletion when the aborted txn snapshot cannot be cleared ([#26431](https://github.com/apache/pulsar/pull/26431))
+- [fix][txn] Fix X-Pulsar-txn-uncommitted header semantics and add X-Pulsar-txn-consumable for peek messages ([#26073](https://github.com/apache/pulsar/pull/26073))
+- [fix][txn] Improve transaction admin checks ([#26773](https://github.com/apache/pulsar/pull/26773))
+- [fix][txn] Prevent queued snapshot writes from stalling ([#26565](https://github.com/apache/pulsar/pull/26565))
+- [fix][txn] Stop the pending ack replay loop from spinning forever ([#26369](https://github.com/apache/pulsar/pull/26369))
+- [improve][ml] Avoid capturing cache insertion arguments ([#26524](https://github.com/apache/pulsar/pull/26524))
+- [improve][ml] Parse message metadata at entry cache insert time instead of under the wrapper write lock ([#26463](https://github.com/apache/pulsar/pull/26463))
+- [improve][ml] Share read-permit release callbacks within a batch ([#26523](https://github.com/apache/pulsar/pull/26523))
+- [feat][broker] PIP-441:Add broker-level metrics for non-recoverable data skips ([#24726](https://github.com/apache/pulsar/pull/24726))
+- [Fix][broker]Get a fenced error when loading a topic that does not allowed the cluster to access ([#26276](https://github.com/apache/pulsar/pull/26276))
+
+### Client
+
+- [fix][client] Apply no-memory-limit producer queue defaults at producer creation ([#26342](https://github.com/apache/pulsar/pull/26342))
+- [fix][client] Avoid exception in ConsumerImpl hasMessageAvailable before first receive ([#25857](https://github.com/apache/pulsar/pull/25857))
+- [fix][client] Complete table view refresh after applying messages ([#26566](https://github.com/apache/pulsar/pull/26566))
+- [fix][client] Defer op cmd release to the write event loop on send timeout ([#26456](https://github.com/apache/pulsar/pull/26456))
+- [fix][client] Divide the across-partitions budget only when it was set explicitly ([#26384](https://github.com/apache/pulsar/pull/26384))
+- [fix][client] Don't close a shared DNS resolver group's address resolver when a client closes ([#26723](https://github.com/apache/pulsar/pull/26723))
+- [fix][client] Drop a send receipt for a removed producer, not the connection ([#26618](https://github.com/apache/pulsar/pull/26618))
+- [fix][client] Enable TableView compacted reads for short topic names ([#26626](https://github.com/apache/pulsar/pull/26626))
+- [fix][client] Fix buffer ownership on the send failure paths ([#26455](https://github.com/apache/pulsar/pull/26455))
+- [fix][client] Fix incorrect topic in OTel spans for partitioned producers ([#25896](https://github.com/apache/pulsar/pull/25896))
+- [fix][client] Fix OpenTelemetryProducerInterceptor not executing due to eligible check ([#25585](https://github.com/apache/pulsar/pull/25585))
+- [fix][client] Flush acknowledgment groups at the combined size limit ([#26594](https://github.com/apache/pulsar/pull/26594))
+- [fix][client] Inject trace context into message properties for producer-consumer span correlation ([#25749](https://github.com/apache/pulsar/pull/25749))
+- [fix][client] Keep transactional and non-transactional messages in separate batches ([#26547](https://github.com/apache/pulsar/pull/26547))
+- [fix][client] Prevent duplicate cleanup and leaks on producer send failures ([#26641](https://github.com/apache/pulsar/pull/26641))
+- [fix][client] Release connections opened after close ([#26733](https://github.com/apache/pulsar/pull/26733))
+- [fix][client] Release the command header when send serialization fails ([#26492](https://github.com/apache/pulsar/pull/26492))
+- [fix][client] Release the reserved memory only once when failing a send in a terminal state ([#26476](https://github.com/apache/pulsar/pull/26476))
+- [fix][client] Restore OAuth2 HTTP client after deserialization ([#26324](https://github.com/apache/pulsar/pull/26324))
+- [fix][client] Stop tracking ack timeouts on non-persistent topics ([#26548](https://github.com/apache/pulsar/pull/26548))
+- [improve][client] Avoid eager broker metadata allocation for outgoing messages ([#26521](https://github.com/apache/pulsar/pull/26521))
+- [improve][client] Avoid unused send-stat snapshots for default callbacks ([#26519](https://github.com/apache/pulsar/pull/26519))
+- [improve][client] Coalesce message listener drain scheduling ([#26531](https://github.com/apache/pulsar/pull/26531))
+- [fix][client] Fix incorrect topic in OTel spans for multi-topic consumers
+- [fix][client] Remove the dead letter candidate entry using the entry-level message id
+
+### Pulsar IO and Pulsar Functions
+
+- [fix][fn] Allow retainKeyOrdering on Go functions ([#26421](https://github.com/apache/pulsar/pull/26421))
+- [fix][fn] Apply the worker connectors list checks to the deprecated functions connectors endpoint ([#26745](https://github.com/apache/pulsar/pull/26745))
+- [fix][fn] Bound function package downloads from BookKeeper and stop SchedulerManager.close() from hanging on a stuck scheduling round ([#26556](https://github.com/apache/pulsar/pull/26556))
+- [fix][fn] Check packages permission for function, source and sink package URLs ([#26771](https://github.com/apache/pulsar/pull/26771))
+- [fix][fn] Check produce permission on the input topic when triggering functions ([#26777](https://github.com/apache/pulsar/pull/26777))
+- [fix][fn] Honour negativeAckRedeliveryDelayMs in the Go function runtime ([#26415](https://github.com/apache/pulsar/pull/26415))
+- [fix][fn] Honour negativeAckRedeliveryDelayMs in the Python function runtime ([#26413](https://github.com/apache/pulsar/pull/26413))
+- [fix][fn] Honour producerSpec batching configuration in the Go function runtime ([#26393](https://github.com/apache/pulsar/pull/26393))
+- [fix][fn] Honour producerSpec batching configuration in the Python function runtime ([#26392](https://github.com/apache/pulsar/pull/26392))
+- [fix][fn] Honour retainOrdering and retainKeyOrdering in the Go function runtime ([#26414](https://github.com/apache/pulsar/pull/26414))
+- [fix][fn] Remove deprecated github.com/golang/protobuf dependency from pulsar-function-go ([#26587](https://github.com/apache/pulsar/pull/26587))
+- [fix][fn] Return descriptive errors for unknown JSON properties ([#26441](https://github.com/apache/pulsar/pull/26441))
+- [fix][fn] Validate package name components and storage paths consistently ([#26768](https://github.com/apache/pulsar/pull/26768))
+- [improve][fn] Standardize log4j2 Root logger configuration to use system property ([#26121](https://github.com/apache/pulsar/pull/26121))
+
+### Others
+
+- [fix][ws] Check dead letter topic permission for WebSocket consumers ([#26772](https://github.com/apache/pulsar/pull/26772))
+- [fix][cli] Apply PULSAR_MEM and PULSAR_GC in bin/pulsar-perf ([#26465](https://github.com/apache/pulsar/pull/26465))
+- [fix][cli] Avoid inheriting broker initial heap settings in tools ([#26736](https://github.com/apache/pulsar/pull/26736))
+- [fix][cli] Correct admin command documentation generation ([#26649](https://github.com/apache/pulsar/pull/26649))
+- [fix][cli] pulsar-perf: register subcommand classes with picocli instead of instances ([#26467](https://github.com/apache/pulsar/pull/26467))
+- [fix][cli] Set --enable-native-access=ALL-UNNAMED for the CLI tools on Java 24+ ([#26365](https://github.com/apache/pulsar/pull/26365))
+- [fix][cli][branch-4.2] Don't pass unset pulsar-perf pending-message options to the producer ([#26371](https://github.com/apache/pulsar/pull/26371))
+- [fix][misc] Remove unnecessary " {}" suffix from log lines when there are no context attributes ([#26285](https://github.com/apache/pulsar/pull/26285))
+- [fix][misc][branch-4.2] Pass webServiceTlsCiphers to Jetty factory ([#26423](https://github.com/apache/pulsar/pull/26423))
+- [improve][cli] Default the pulsar-perf client memory limit to half of the JVM max direct memory ([#26491](https://github.com/apache/pulsar/pull/26491))
+- [improve][cli] pulsar-perf: cut latency histogram memory ~100x, fix range units and static stats state ([#26466](https://github.com/apache/pulsar/pull/26466))
+- [fix][misc][branch-4.2] Use correct log4j pattern for Log4j test configs
+- [fix][Client] permit leak in chunked message discard path ([#26661](https://github.com/apache/pulsar/pull/26661))
+- [fix][common] Handle synchronous failures from future suppliers ([#25939](https://github.com/apache/pulsar/pull/25939))
+- [fix] Fix cursor deadlock when skipping non-recoverable entries during mark-delete persistence ([#26570](https://github.com/apache/pulsar/pull/26570))
+- [fix] Fix ManagedLedgerImpl's pendingAddEntries leak. ([#25240](https://github.com/apache/pulsar/pull/25240))
+
+### Tests & CI
+
+- [improve][ci][branch-4.2] Upgrade GitHub Actions built-in action versions
+- [fix][test] Allow for CLI startup in function integration tests ([#26564](https://github.com/apache/pulsar/pull/26564))
+- [fix][test] Avoid blocking common-pool workers in ledger shutdown test ([#26560](https://github.com/apache/pulsar/pull/26560))
+- [fix][test] Await both DLQ producers in multi-consumer test ([#26561](https://github.com/apache/pulsar/pull/26561))
+- [fix][test] Await reader reconnect after seek() to fix flaky TopicReaderTest assertions ([#26141](https://github.com/apache/pulsar/pull/26141))
+- [fix][test] Cover scheduler shutdown membership-lock deadlock ([#26557](https://github.com/apache/pulsar/pull/26557))
+- [fix][test] Fix flaky AdminApiTest caused by leaked brokerShutdownTimeoutMs ([#26249](https://github.com/apache/pulsar/pull/26249))
+- [fix][test] Fix flaky IsolatedBookieEnsemblePlacementPolicyTest by awaiting the initial rack config load ([#26429](https://github.com/apache/pulsar/pull/26429))
+- [fix][test] Fix flaky NonDurableCursorTest.subscribeToEarliestPositionWithDeferredDeletion ([#26747](https://github.com/apache/pulsar/pull/26747))
+- [fix][test] Fix flaky OneWayReplicatorDeduplicationTest.testDeduplication ([#26737](https://github.com/apache/pulsar/pull/26737))
+- [fix][test] Fix flaky RawReaderTest.testPauseAndResumeWithUnloading ([#26690](https://github.com/apache/pulsar/pull/26690))
+- [fix][test] Fix OneWayReplicatorSchemaValidationEnforcedTest racing the replicator's remote topic creation ([#26382](https://github.com/apache/pulsar/pull/26382))
+- [fix][test] Isolate mutable broker fixtures between test methods ([#26563](https://github.com/apache/pulsar/pull/26563))
+- [fix][test] Isolate token CLI test output from background logging ([#26657](https://github.com/apache/pulsar/pull/26657))
+- [fix][test] Join assignment tailer before asserting its last message ID ([#26536](https://github.com/apache/pulsar/pull/26536))
+- [fix][test] Make consistent hashing consumer selection test deterministic ([#26534](https://github.com/apache/pulsar/pull/26534))
+- [fix][test] Preserve class loading in broker interceptor fixtures ([#26567](https://github.com/apache/pulsar/pull/26567))
+- [improve][ci] Configure SSH access action default and update Upterm ([#26575](https://github.com/apache/pulsar/pull/26575))
+- [improve][ci] Run the Python function instance tests in CI ([#26399](https://github.com/apache/pulsar/pull/26399))
+- [fix][build][branch-4.2] Add missing package-info file
+- [fix][ci][branch-4.2] Use an ASF-approved docker/setup-qemu-action version
+- [fix][test] Fix import order in authorization test
+- [fix][test][branch-4.2] Adapt pulsar-perf pending-limit test to the [#26342](https://github.com/apache/pulsar/pull/26342) backport
+- [fix][test][branch-4.2] Create the CLI test producer only once CmdProduce asks for it
+- [fix][test][branch-4.x] Explicitly disable memory limit when testing pending-message defaults
+