Bump org.apache.pulsar:pulsar-bom from 4.0.12 to 4.0.13

[dependabot]

Bumps org.apache.pulsar:pulsar-bom from 4.0.12 to 4.0.13.

Release notes

Sourced from org.apache.pulsar:pulsar-bom's releases.

v4.0.13

2026-08-03

Library updates

• [fix][sec][branch-4.0] Upgrade Hadoop to 3.5.0 (#26195)
• [fix][sec][branch-4.0] Upgrade Jackson version to 2.18.9 (#26187)
• [fix][sec][branch-4.0] Upgrade Netty to 4.1.136.Final (#26170)
• [fix][ci] Upgrade sandboxed-trivy-action to approved sha (#26169)
• [improve][meta] Upgrade Oxia client to 0.8.0 (#25964)
• [improve][meta] Upgrade Oxia client to 0.9.4 (#26193)
• [improve][monitor][branch-4.0] Upgrade OpenTelemetry libraries (#26165)
• [improve][build] Upgrade docker base image Alpine to 3.24 (#26225)
• [improve][build] Upgrade slog to 0.10.0 (#26226)
• [improve][misc] Upgrade Jetty to 12.1.11 (#26233)
• [improve][misc] Upgrade to Alpine 3.23 (#25180)

Broker

• [fix][broker] Check deliverAt before containsMessage in bucket addMessage (#26230)
• [fix][broker] Fix getEstimatedSizeSinceMarkDeletePosition throw IllegalArgumentException (#26184)
• [fix][broker] Fix bucket delayed message index metrics reset on scrape (#26171)
• [fix][broker] Fix delayed message index data loss when trimming overlapping bucket snapshots (#26240)
• [fix][broker] Fix incorrect listener URLs returned by ModularLoadManager lookups (#26245)
• [fix][broker] Fix Key_Shared delivery stall when look-ahead triggers at the end of the topic (#26236)
• [fix][broker] Fix silently dropped acknowledgement failures in PulsarMetadataEventSynchronizer (#26237)
• [fix][broker] Fix TableViewLoadDataStoreImpl close deadlock that stalls broker shutdown (#26243)
• [fix][broker] Prevent completing replicated snapshot before marker publish (#26119)
• [fix][broker] Prevent partition expansion from inheriting delayed-delivery bucket state (#26179)
• [fix][broker] Prevent stale read completions from stranding Failover subscriptions (#26174)
• [fix][broker] Prevent stale service unit callbacks from dropping active lookup and cleanup jobs (#26146)
• [fix][broker] Prevent stale topic unload cleanup from removing active cache entries (#26145)
• [fix][broker] Read subscription properties directly from cursor (#26159)
• [fix][broker] Release entry on GetLastMessageId when parseMessageMetadata throws (#26089)
• [fix][broker] Trigger max read position callback for messages published during transaction buffer recovery (#26234)
• [fix][broker][branch-4.2] Fix admin API HTTP 400 FAIL_ON_TRAILING_TOKENS when a broker interceptor is loaded (#26223)
• [fix][ml] Preserve ledger entries/size when transformLedgerInfo callback completes after a concurrent close (#26228)
• [fix][meta] Complete handleMetadataEvent future exceptionally when the initial get fails (#26199)
• [fix][meta] Fix NPE in shouldIgnoreEvent when MetadataEvent options is null (#26200)
• [fix][meta] Fix RocksdbMetadataStore instanceId not advancing across restarts (#26218)
• [fix][meta] Record get op stats on the correct completion branch in AbstractMetadataStore (#26201)
• [improve][broker] Skip system cursor when check inactive cursor. (#26149)
• [improve][broker][branch-4.0] Trace the asynchronous tasks in logs when loading topics (#26163) (#26224)
• [improve][offload] Support credentials from offload policies for S3 and Aliyun OSS drivers (#26232)

Client

• [fix][client] Fix lookup permit double-release, waiting queue starvation and timeout-response races in ClientCnx (#26143)
• [fix][client] Fix lookup request semaphore not release problem (#25038)
• [fix][client] Fix UnAckedMessageRedeliveryTracker to skip cancelled timeouts (#26043)

... (truncated)

Commits

• 31b9ab7 Release 4.0.13
• 574b8ae [fix][broker] Release entry on GetLastMessageId when parseMessageMetadata thr...
• 5f4210b [fix][broker] Prevent stale service unit callbacks from dropping active looku...
• 15dac45 [fix][broker] Fix TableViewLoadDataStoreImpl close deadlock that stalls broke...
• 41c60d3 [fix][client] Fix unAckedMessageTracker cleanup on multi-topics batch ack (#2...
• 5320d30 [fix][fn] Forward source message properties in Python runtime (#26191)
• 0713eef [fix][broker] Fix silently dropped acknowledgement failures in PulsarMetadata...
• a297521 [fix][broker] Fix delayed message index data loss when trimming overlapping b...
• d4dfe91 [fix][broker] Fix incorrect listener URLs returned by ModularLoadManager look...
• c281a42 [fix][build][branch-4.0] Fix spotbugs failure in OffloadPoliciesImpl
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
org.apache.pulsar:pulsar-bom	[>= 4.1.a0, < 4.2]
org.apache.pulsar:pulsar-bom	[>= 4.2.a0, < 4.3]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)