Bump org.apache.pulsar:pulsar-bom from 4.1.1 to 4.2.0 in /modules/pulsar

[dependabot]

Bumps org.apache.pulsar:pulsar-bom from 4.1.1 to 4.2.0.

Release notes

Sourced from org.apache.pulsar:pulsar-bom's releases.

v4.2.0

2026-04-01

Approved PIPs

• PIP-434: Expose Netty channel configuration WRITE_BUFFER_WATER_MARK to pulsar conf and pause receive requests when channel is unwritable
• PIP-437: Granular and Fixed-Delay Policies for Message Delivery
• PIP-439: Adding Transaction Support to Pulsar Functions Through Managed Transaction Wrapping
• PIP-442: Add memory limits for CommandGetTopicsOfNamespace and CommandWatchTopicList on Broker and Proxy
• PIP-443: Stop using Netty Recycler in new code
• PIP-444: Rate limit for deleting ledger to alleviate the zk pressure.
• PIP-446: Support Native OpenTelemetry Tracing in Pulsar Java Client
• PIP-447: Customizable Prometheus Labels for Topic Metrics
• PIP-452: Customizable topic listing of namespace with properties
• PIP-453: Improve the metadata store threading model
• PIP-454: Metadata Store Migration Framework
• PIP-464: Deprecate legacy Jackson JsonSchema format for SchemaType.JSON

Library updates

• [improve][broker] Upgrade bookkeeper to 4.17.3 (#25166)
• [improve][ml] Upgrade Oxia client to 0.7.0 (#24824)
• [fix][sec] Added Exclusions for tomcat-embed-core and derby and override mina-core to remediate CVEs (#24949)
• [fix][sec] Bump at.yawk.lz4:lz4-java from 1.9.0 to 1.10.1 in /pulsar-common (#25045)
• [fix][sec] Bump github.com/dvsekhvalnov/jose2go from 1.6.0 to 1.7.0 in /pulsar-function-go (#24987)
• [fix][sec] Bump google.golang.org/grpc from 1.60.0 to 1.79.3 in /pulsar-function-go (#25353)
• [fix][sec] Bump io.vertx:vertx-web from 4.5.10 to 4.5.22 (#24889)
• [fix][sec] Bump org.apache.solr:solr-core from 9.8.0 to 9.10.1 in /pulsar-io/solr (#25175)
• [fix][sec] Bump org.apache.zookeeper:zookeeper from 3.9.4 to 3.9.5 (#25303)
• [fix][sec] Eliminate commons-collections dependency (#25024)
• [fix][sec] Exclude org.lz4:lz4-java and standardize on at.yawk.lz4-java to remediate CVE-2025-12183 and CVE-2025-66566 (#25198)
• [fix][sec] Override commons-beanutils and commons-configuration2 to remediate CVEs (#24936)
• [fix][sec] Override kafka-clients in kinesis-kpl-shaded to remediate CVE-2024-31141 and CVE-2025-27817 (#24935)
• [fix][sec] Override msgpack-core to 0.9.11 to address CVE-2026-21452 (#25233)
• [fix][sec] Override nimbus-jose-jwt to remediate CVE-2023-52428 and CVE-2025-53864 (#24937)
• [fix][sec] Update Hbase version to 2.6.3-hadoop3 and exclude Avro from hbase-client to remediate CVEs (#24953)
• [fix][sec] Upgrade aircompressor to 2.0.3 to resolve CVE-2025-67721 (#25256)
• [fix][sec] Upgrade BouncyCastle FIPS to 2.0.10 to remediate CVE-2025-8916 (#24923)
• [fix][sec] Upgrade hadoop3 version from 3.4.0 to 3.4.1 (#24950)
• [fix][sec] Upgrade Jackson version to 2.18.6 (#25264)
• [fix][sec] Upgrade Jetty to 9.4.58.v20250814 to address CVE-2025-5115 (#24897)
• [fix][sec] Upgrade jose4j to 0.9.6 to address CVE-2024-29371 (#25095)
• [fix][sec] Upgrade log4j to 2.25.3 to address CVE-2025-68161 (#25102)
• [fix][sec] Upgrade Netty to 4.1.127.Final to address CVEs (#24717)
• [fix][sec] Upgrade Netty to 4.1.130.Final (#25078)
• [fix][sec] Upgrade OpenSearch to 2.19.4 to remediate CVE-2025-9624 (#25206)
• [fix][sec] Upgrade Python protobuf version to 6.33.5 to address CVE-2026-0994 (#25250)
• [fix][sec] Upgrade Spring to 6.2.12 to remediate CVE-2025-22233 and CVE-2025-41249 (#24903)
• [fix][sec] Upgrade vertx to address CVE-2026-1002 (#25152)
• [fix][build] Fix Eclipse/VSCode support after Jetty 12 upgrade (#25169)

... (truncated)

Commits

• de34788 Release 4.2.0
• 19ef1fc [improve][offload] Bump hadoop to 3.4.3 and hbase to 2.6.4 (#25396)
• 0163ce8 [cleanup] Convert 12 test classes to SharedPulsarBaseTest (#25392)
• 08d89a2 [improve][broker] PIP-464: Strict Avro schema validation for SchemaType.JSON ...
• 78281fd [improve][pip] PIP-464: Deprecate legacy Jackson JsonSchema format for Schema...
• 7e5839c [cleanup] Convert 30 test classes to SharedPulsarBaseTest (#25381)
• 3bc834f [fix][client] Fix stale Healthy state in SameAuthParamsLookupAutoClusterFailo...
• ce3429c [fix][test] Fix flaky OneWayReplicatorUsingGlobalZKTest.cleanup (#25389)
• ba851d3 [feat][bookkeeper] add certs refresh (#25370)
• 953d092 [fix][test] Fix flaky PersistentStickyKeyDispatcherMultipleConsumersClassicTe...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)