dependabot[bot] opened a new pull request, #17232: URL: https://github.com/apache/pinot/pull/17232
Bumps [org.apache.pulsar:pulsar-bom](https://github.com/apache/pulsar) from 4.0.7 to 4.0.8. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/apache/pulsar/releases";>org.apache.pulsar:pulsar-bom's releases</a>.</em></p> <blockquote> <h2>v4.0.8</h2> <h4>2025-11-17</h4> <h3>Library updates</h3> <ul> <li>[fix] Update gRPC to 1.75.0 (<a href="https://redirect.github.com/apache/pulsar/pull/24813";>#24813</a>)</li> <li>[improve][misc] Upgrade Netty to 4.1.128.Final (<a href="https://redirect.github.com/apache/pulsar/pull/24911";>#24911</a>)</li> <li>[improve][ml] Upgrade Oxia client to 0.7.0 (<a href="https://redirect.github.com/apache/pulsar/pull/24824";>#24824</a>)</li> <li>[fix][sec] Added Exclusions for tomcat-embed-core and derby and override mina-core to remediate CVEs (<a href="https://redirect.github.com/apache/pulsar/pull/24949";>#24949</a>)</li> <li>[fix][sec] Bump io.vertx:vertx-web from 4.5.10 to 4.5.22 (<a href="https://redirect.github.com/apache/pulsar/pull/24889";>#24889</a>)</li> <li>[fix][sec] Override commons-beanutils and commons-configuration2 to remediate CVEs (<a href="https://redirect.github.com/apache/pulsar/pull/24936";>#24936</a>)</li> <li>[fix][sec] Override kafka-clients in kinesis-kpl-shaded to remediate CVE-2024-31141 and CVE-2025-27817 (<a href="https://redirect.github.com/apache/pulsar/pull/24935";>#24935</a>)</li> <li>[fix][sec] Override nimbus-jose-jwt to remediate CVE-2023-52428 and CVE-2025-53864 (<a href="https://redirect.github.com/apache/pulsar/pull/24937";>#24937</a>)</li> <li>[fix][sec] Update Hbase version to 2.6.3-hadoop3 and exclude Avro from hbase-client to remediate CVEs (<a href="https://redirect.github.com/apache/pulsar/pull/24953";>#24953</a>)</li> <li>[fix][sec] Upgrade BouncyCastle FIPS to 2.0.10 to remediate CVE-2025-8916 (<a href="https://redirect.github.com/apache/pulsar/pull/24923";>#24923</a>)</li> <li>[fix][sec] Upgrade hadoop3 version from 3.4.0 to 3.4.1 (<a href="https://redirect.github.com/apache/pulsar/pull/24950";>#24950</a>)</li> <li>[fix][sec] Upgrade Jetty to 9.4.58.v20250814 to address CVE-2025-5115 (<a href="https://redirect.github.com/apache/pulsar/pull/24897";>#24897</a>)</li> <li>[fix][sec] Upgrade Spring to 6.2.12 to remediate CVE-2025-22233 and CVE-2025-41249 (<a href="https://redirect.github.com/apache/pulsar/pull/24903";>#24903</a>)</li> <li>[improve][ci] Upgrade GitHub Actions workflows to use ubuntu-24.04 (<a href="https://redirect.github.com/apache/pulsar/pull/24841";>#24841</a>)</li> </ul> <h3>Broker</h3> <ul> <li>[fix][broker] Allow intermittent error from topic policies service when loading topics (<a href="https://redirect.github.com/apache/pulsar/pull/24829";>#24829</a>)</li> <li>[fix][broker] AvgShedder comparison error (<a href="https://redirect.github.com/apache/pulsar/pull/24954";>#24954</a>)</li> <li>[fix][broker] Avoid recursive update in ConcurrentHashMap during policy cache cleanup (<a href="https://redirect.github.com/apache/pulsar/pull/24939";>#24939</a>)</li> <li>[fix][broker] BacklogMessageAge is not reset when cursor mdPosition is on an open ledger (<a href="https://redirect.github.com/apache/pulsar/pull/24915";>#24915</a>)</li> <li>[fix][broker] Ensure LoadSheddingTask is scheduled after metadata service is available again (<a href="https://redirect.github.com/apache/pulsar/pull/24838";>#24838</a>)</li> <li>[fix][broker] ExtensibleLoadManager: handle SessionReestablished and Reconnected events to re-register broker metadata (<a href="https://redirect.github.com/apache/pulsar/pull/24932";>#24932</a>)</li> <li>[fix][broker] Fix bug in PersistentMessageExpiryMonitor which blocked further expirations (<a href="https://redirect.github.com/apache/pulsar/pull/24941";>#24941</a>)</li> <li>[fix][broker] fix getMaxReadPosition in TransactionBufferDisable should return latest (<a href="https://redirect.github.com/apache/pulsar/pull/24898";>#24898</a>)</li> <li>[fix][broker] Fix incorrect topic loading latency metric and timeout might not be respected (<a href="https://redirect.github.com/apache/pulsar/pull/24785";>#24785</a>)</li> <li>[fix][broker] Fix stack overflow caused by race condition when closing a connection (<a href="https://redirect.github.com/apache/pulsar/pull/24934";>#24934</a>)</li> <li>[fix][broker] Fix totalAvailablePermits not reduced when removing consumer from non-persistent dispatcher (<a href="https://redirect.github.com/apache/pulsar/pull/24885";>#24885</a>)</li> <li>[fix][broker] Fix wrong behaviour when using namespace.allowed_clusters, such as namespace deletion and namespace policies updating (<a href="https://redirect.github.com/apache/pulsar/pull/24860";>#24860</a>)</li> <li>[fix][broker] Flaky-test: ExtensibleLoadManagerImplTest.testDisableBroker (<a href="https://redirect.github.com/apache/pulsar/pull/24770";>#24770</a>)</li> <li>[fix][broker] Flaky-test: TopicTransactionBufferTest.testMessagePublishInOrder (<a href="https://redirect.github.com/apache/pulsar/pull/24826";>#24826</a>)</li> <li>[fix][broker] Run ResourceGroup tasks only when tenants/namespaces registered (<a href="https://redirect.github.com/apache/pulsar/pull/24859";>#24859</a>)</li> <li>[fix][broker] Stop to retry to read entries if the replicator has terminated (<a href="https://redirect.github.com/apache/pulsar/pull/24880";>#24880</a>)</li> <li>[fix][broker] Trigger topic creation event only once for non-existent topic (<a href="https://redirect.github.com/apache/pulsar/pull/24802";>#24802</a>)</li> <li>[fix][broker] Use <code>poll</code> instead <code>remove</code> to avoid <code>NoSuchElementException</code> (<a href="https://redirect.github.com/apache/pulsar/pull/24933";>#24933</a>)</li> <li>[fix][broker]Leaving orphan schemas and topic-level policies after partitioned topic is deleted by GC (<a href="https://redirect.github.com/apache/pulsar/pull/24971";>#24971</a>)</li> <li>[fix][broker]Transactional messages can never be sent successfully if concurrently taking transaction buffer snapshot (<a href="https://redirect.github.com/apache/pulsar/pull/24945";>#24945</a>)</li> <li>[fix][admin] Set local policies overwrites "number of bundles" passed during namespace creation (<a href="https://redirect.github.com/apache/pulsar/pull/24762";>#24762</a>)</li> <li>[fix][ml] Fix <code>getNumberOfEntries</code> may point to deleted ledger (<a href="https://redirect.github.com/apache/pulsar/pull/24852";>#24852</a>)</li> <li>[fix][ml] Fix ledger trimming race causing cursor to point to deleted ledgers (<a href="https://redirect.github.com/apache/pulsar/pull/24855";>#24855</a>)</li> <li>[fix]Fixed getChildren('/') on Oxia based provider (<a href="https://redirect.github.com/apache/pulsar/pull/24863";>#24863</a>)</li> <li>[improve][broker] Add tests for using absolute FQDN for advertisedAddress and remove extra dot from brokerId (<a href="https://redirect.github.com/apache/pulsar/pull/24787";>#24787</a>)</li> <li>[improve][broker] Don't log an error when updatePartitionedTopic is called on a non-partitioned topic (<a href="https://redirect.github.com/apache/pulsar/pull/24943";>#24943</a>)</li> <li>[improve][broker] Optimize lookup result warn log (<a href="https://redirect.github.com/apache/pulsar/pull/24942";>#24942</a>)</li> <li>[improve][broker] Part-1 of PIP-434: Expose Netty channel configuration WRITE_BUFFER_WATER_MARK to pulsar conf and pause receive requests when channel is unwritable (<a href="https://redirect.github.com/apache/pulsar/pull/24423";>#24423</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/apache/pulsar/commit/2c519a386acbfaa2dbebcc484bb42ba18e4278d3";><code>2c519a3</code></a> Release 4.0.8</li> <li><a href="https://github.com/apache/pulsar/commit/d2560f36e6d09992a54b4fcf66b22c83d40e4b1c";><code>d2560f3</code></a> [fix][broker]Leaving orphan schemas and topic-level policies after partitione...</li> <li><a href="https://github.com/apache/pulsar/commit/ec4eef5ddae2ea9cff5a15b44ed42a8ed9228a2c";><code>ec4eef5</code></a> [fix][test] Made ProtobufNativeSchemaTest.testSchema order-independent (<a href="https://redirect.github.com/apache/pulsar/issues/24805";>#24805</a>)</li> <li><a href="https://github.com/apache/pulsar/commit/d90da78a419b4ff48ce3ab034f4e4a6fdee6a7c9";><code>d90da78</code></a> [improve][client] Deduplicate getTopicsUnderNamespace in BinaryProtoLookupSer...</li> <li><a href="https://github.com/apache/pulsar/commit/fa8bbf4d53a42d4bed378110f8ca22bf1356bf79";><code>fa8bbf4</code></a> [fix][test] Add Delta Tolerance in Double-Precision Assertions to Fix Roundin...</li> <li><a href="https://github.com/apache/pulsar/commit/f71ff1e485a796b7bfa1419b468e5ba96db5805e";><code>f71ff1e</code></a> [fix][test] Fixed ResponseBody Check in Test Helper (<a href="https://redirect.github.com/apache/pulsar/issues/24872";>#24872</a>)</li> <li><a href="https://github.com/apache/pulsar/commit/de4c613c95be35779f2642dc420f9ebe01ca533a";><code>de4c613</code></a> [fix][test] Fixed Nondeterministic Ordering in SchemaInfoTest (<a href="https://redirect.github.com/apache/pulsar/issues/24969";>#24969</a>)</li> <li><a href="https://github.com/apache/pulsar/commit/d0ff77ea3f83284900260018b83bed54b8bba1b1";><code>d0ff77e</code></a> [fix][client] Fix deduplication for getPartitionedTopicMetadata to include me...</li> <li><a href="https://github.com/apache/pulsar/commit/85e8b5d673469a5302ae1b4a27e5c843168240f4";><code>85e8b5d</code></a> [fix][broker]Transactional messages can never be sent successfully if concurr...</li> <li><a href="https://github.com/apache/pulsar/commit/421d64679dd38ecd2dd321317db1a7bc7e1c09db";><code>421d646</code></a> [fix][test] Fix flaky KeySharedSubscriptionBrokerCacheTest.testReplayQueueRea...</li> <li>Additional commits viewable in <a href="https://github.com/apache/pulsar/compare/v4.0.7...v4.0.8";>compare view</a></li> </ul> </details> <br /> <details> <summary>Most Recent Ignore Conditions Applied to This Pull Request</summary> | Dependency Name | Ignore Conditions | | --- | --- | | org.apache.pulsar:pulsar-bom | [>= 4.1.a0, < 4.2] | </details> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
