Update pulsar.version to v4.1.1

[renovate]

Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs from Renovate will soon appear from 'Mend'. Learn more here.

This PR contains the following updates:

Package	Change	Age	Confidence
org.apache.pulsar:pulsar-broker	4.1.0 -> 4.1.1
org.apache.pulsar:testmocks	4.1.0 -> 4.1.1
org.apache.pulsar:bouncy-castle-bc	4.1.0 -> 4.1.1
org.apache.pulsar:pulsar-client-admin-api	4.1.0 -> 4.1.1
org.apache.pulsar:pulsar-client-api	4.1.0 -> 4.1.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

apache/pulsar (org.apache.pulsar:pulsar-broker)

v4.1.1

Compare Source

2025-09-27

Library updates

• [fix][sec] Upgrade Netty to 4.1.127.Final to address CVEs (#​24717)
• [improve][build] Upgrade Lombok to 1.18.42 to fully support JDK25 (#​24763)
• [improve][build] Upgrade Apache Parent POM to version 35 (#​24742)
• [improve][build] Upgrade Mockito, AssertJ and ByteBuddy to fully support JDK25 (#​24764)
• [improve][build] Upgrade SpotBugs to a version that supports JDK25 (#​24768)
• [feat][misc] upgrade oxia version to 0.6.2 (#​24689)
• [improve][io] Upgrade to Debezium 3.2.2 (#​24712)

Broker

• [fix][broker] Key_Shared subscription doesn't always deliver messages from the replay queue after a consumer disconnects and leaves a backlog (#​24736)
• [fix][broker] Ensure KeyShared sticky mode consumer respects assigned ranges (#​24730)
• [fix][broker] First entry will be skipped if opening NonDurableCursor while trimmed ledger is adding first entry. (#​24738)
• [fix][broker] Fix cannot shutdown broker gracefully by admin api (#​24731)
• [fix][broker] Fix memory leak when metrics are updated in a thread other than FastThreadLocalThread (#​24719)
• [fix][broker] Prevent unexpected recycle failure in dispatcher's read callback (#​24741)
• [fix][broker]Fix never recovered metadata store bad version issue if received a large response from ZK (#​24580)
• [fix][ml]Fix EOFException after enabled topics offloading (#​24753)
• [fix][broker] Fix NPE and annotate nullable return values for ManagedCursorContainer (#​24706)
• [fix][broker]Dispatcher did unnecessary sort for recentlyJoinedConsumers and printed noisy error logs (#​24634)
• [fix][broker]Fix dirty reading of namespace level offload thresholds (#​24696)
• [fix][ml] Negative backlog & acked positions does not exist & message lost when concurrently occupying topic owner (#​24722)
• [improve][broker] If there is a deadlock in the service, the probe should return a failure because the service may be unavailable (#​23634)
• [improve][broker] Allow deletion of empty persistent topics regardless of retention policy (#​24733)
• [improve][broker] PIP-402: Optionally prevent role/originalPrincipal logging (#​23386)
• [improve][broker] Reduce unnecessary MessageMetadata parsing by caching the parsed instance in the broker cache (#​24682)
• [improve][ml] Improve cache insert performance by removing exists check since it's already covered by putIfAbsent (#​24699)

Client

• [fix][client] Avoid recycling the same ConcurrentBitSetRecyclable among different threads (#​24725)
• [fix][client] Fix receiver queue auto-scale without memory limit (#​24743)
• [fix][client]TopicListWatcher not closed when calling PatternMultiTopicsConsumerImpl.closeAsync() method (#​24698)
• [fix][client] rollback TopicListWatcher retry behavior (#​24752)
• [fix][client] Exclude io.prometheus:simpleclient_caffeine from client-side dependencies (#​24761)
• [improve][client] PIP-407 Add newMessage with schema and transactions (#​23942)

Pulsar IO and Pulsar Functions

• [fix][io] Improve Kafka Connect source offset flushing logic (#​24654)
• [feat][fn] Fallback to using STATE_STORAGE_SERVICE_URL in PulsarMetadataStateStoreProviderImpl.init (#​24721)

Others

• [fix][misc] Fix compareTo contract violation for NamespaceBundleStats, TimeAverageMessageData and ResourceUnitRanking (#​24772)
• [fix] Exclude commons-lang dep from bookkeeper (#​24749)

Tests & CI

• [fix][test] Flaky-test: BrokerServiceTest.testShutDownWithMaxConcurrentUnload (#​24769)
• [fix][broker] Fix testServiceConfigurationRetentionPolicy unit test (#​24756)
• [fix][broker]Fix the wrong logic of the test PartitionCreationTest.testCreateMissedPartitions (#​24683)
• [improve][build] Disable javadoc build failure (#​24594)
• [fix][ci] Fix CI for Java 25 including upgrade of Gradle Develocity Maven extension (#​24767)

For the complete list, check the full changelog.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.