UnratedFix available
Pulsar 5.0.0 security-related dependency updates
Pulsar 5.0.0 includes security-tagged upgrades to Async HTTP Client, Netty Reactive Streams, lz4-java, and zstd-jni. The release notes do not specify vulnerabilities or severity.
Announced Group revision 1
Original source ↗github-apache-pulsar
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
[fix][sec] Upgrade Async HTTP Client to 3.0.14 and Netty Reactive Streams to 2.0.20 (#26764) [fix][sec] Upgrade at.yawk.lz4:lz4-java to 1.11.4 (#26758) [fix][sec] Upgrade zstd-jni to 1.5.7-20 (#26766)
Async HTTP Client
Upgrade Async HTTP Client to 3.0.14
- Affected versions
- Not stated in this extraction
- Fixed versions
- 3.0.14
Upgrade Async HTTP Client to 3.0.14
- Prerequisites
- Not stated in this extraction
Netty Reactive Streams
Upgrade Async HTTP Client to 3.0.14 and Netty Reactive Streams to 2.0.20
- Affected versions
- Not stated in this extraction
- Fixed versions
- 2.0.20
Netty Reactive Streams to 2.0.20
- Prerequisites
- Not stated in this extraction
at.yawk.lz4:lz4-java
Upgrade at.yawk.lz4:lz4-java to 1.11.4
- Affected versions
- Not stated in this extraction
- Fixed versions
- 1.11.4
Upgrade at.yawk.lz4:lz4-java to 1.11.4
- Prerequisites
- Not stated in this extraction
zstd-jni
Upgrade zstd-jni to 1.5.7-20
- Affected versions
- Not stated in this extraction
- Fixed versions
- 1.5.7-20
Upgrade zstd-jni to 1.5.7-20
- Prerequisites
- Not stated in this extraction
Publisher severity
No explicit severity was extracted.
- Event
- #77447 · Revision 1
- Added to Heist Feed
- Publisher date