Bump org.apache.pulsar:pulsar-client-all from 4.2.0 to 4.2.1

[dependabot]

Bumps org.apache.pulsar:pulsar-client-all from 4.2.0 to 4.2.1.

Release notes

Sourced from org.apache.pulsar:pulsar-client-all's releases.

v4.2.1

2026-04-27

Library updates

• [fix][sec] Upgrade BouncyCastle to 1.84 (CVE-2026-5588, CVE-2026-0636) (#25569)
• [fix][sec] Upgrade Jetty to address CVE-2026-2332 (#25527)
• [fix][sec] Upgrade Jetty to address CVE-2026-5795 (#25532)
• [fix][sec] Upgrade to async-http-client 2.14.5 to address CVE-2026-40490 (#25546)
• [fix][sec] Upgrade to Netty 4.1.132.Final to address CVEs (#25399)
• [fix][sec] Upgrade log4j to 2.25.4 to address CVE-2026-34477, CVE-2026-34478, CVE-2026-34480, CVE-2026-34481
• [fix] Upgrade Jetty to 12.1.6 to fix CVE-2026-1605 (#25485)

Broker

• [fix][broker] Change the schema incompatible log from ERROR to WARN level (#25483)
• [fix][broker] Fix backlog clearing for unloaded namespace bundles (#25272)
• [fix][broker] Lower log level of DrainingHashesTracker not-found entry to DEBUG (#25558)
• [fix][broker] Prevent timed-out producer creation from racing with retry (#25460)
• [fix][broker] pulsar admin stats internal with metadata command (#25557)
• [fix][broker] Revert "[improve][broker] Enhance advertised address resolution with fallback to localhost (#25238)" (#25523)
• [fix][broker] Unthrottle producers immediately when publish rate limiting is disabled (#25502)
• [fix][broker]Namespaces can be created with may empty replication_clusters policy (#25551)
• [fix][admin] Refactor namespace migration operation to async in rest api (#25478)
• [improve][broker] Close connection when close consumer write fails (#25520)
• [improve][broker] Use full bundle name for namespace bundle destination affinity in ModularLoadManagerImpl (#25518)

Client

• [fix][client] Fix thread-safety and refactor MessageCryptoBc key management (#25400)

Pulsar IO and Pulsar Functions

• [fix][io] Restore lz4 compression with Kafka IO connector after #25198 exclusion

Others

• [improve][common] Optimize TopicName.get() to reduce lock contention on cache lookup (#25367)
• [improve][broker] Improve the performance of TopicName constructor (#24463)

Tests & CI

• [fix][ci] Ensure discard_max_bytes is set to 0 only for existing block devices (#25510)
• [fix][test] Extend SameAuthParamsLookupAutoClusterFailoverTest phase timeouts (#25563)
• [fix][test] Fix flaky BrokerRegistryIntegrationTest port binding race (#25463)
• [fix][test] Fix flaky ExtensibleLoadManagerImpl client reconnection tests: PulsarClientException$AlreadyClosedException: Client already closed (#25509)
• [fix][test] Fix flaky ExtensibleLoadManagerTest.startBroker timeout (#25500)
• [fix][test] Fix flaky OffloadPrefixTest.testPositionOnEdgeOfLedger race with ledger rollover (#25561)
• [fix][test] Fix flaky ServerCnxTest.testCreateProducerTimeoutThenCreateSameNamedProducerShouldFail (#25497)
• [fix][test] Fix flaky testLoadBalancerServiceUnitTableViewSyncer (#25427)

... (truncated)

Commits

• aabd80b Release 4.2.1
• 1fb3a6b [fix][sec] Upgrade BouncyCastle to 1.84 (CVE-2026-5588, CVE-2026-0636) (#25569)
• ec45e06 [improve][broker] Use full bundle name for namespace bundle destination affin...
• 8342786 [fix][test] Flaky SameAuthParamsLookupAutoClusterFailoverTest (#25566)
• ff7054f [fix][test] Fix flaky OffloadPrefixTest.testPositionOnEdgeOfLedger race with ...
• 8fbe0f2 [fix][test] Extend SameAuthParamsLookupAutoClusterFailoverTest phase timeouts...
• 1ee8793 [fix][test] Relax BrokerRegistryIntegrationTest broker-close threshold (#25562)
• 3504964 [fix][broker] pulsar admin stats internal with metadata command (#25557)
• 7de4480 [fix][test] Fix flaky BrokerRegistryIntegrationTest port binding race (#25463)
• 4787e22 [fix][test] Recreate EventLoop in PublishRateLimiterTest setup (#25560)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)