Patch Release for Netty Vuln

[ZachChuba]

Hi,

My organization has a very low risk tolerance policy, and currently there is no pulsar version available that addresses the most recent netty high severity vulnerability GHSA-4g8c-wm8x-jfhw. Netty version is already upgraded in master, but we're waiting for a 4.0.3 release with the patch included. Unfortunately, my organization cares more about existence of a vulnerability than the likelihood and impact of exploitability.

Thanks.

[lhotari]

@ZachChuba The releases that include Netty 4.1.118 with the fix for CVE-2025-24970 are currently in the release voting stage. Please participate in validating the release candidate versions. This is also a valuable way to contribute to the Apache Pulsar OSS project.

These are the release voting threads on the dev mailing list:

• [VOTE] Release Apache Pulsar 3.0.10 based on 3.0.10-candidate-1
• [VOTE] Release Apache Pulsar 3.3.5 based on 3.3.5-candidate-1
• [VOTE] Release Apache Pulsar 4.0.3 based on 4.0.3-candidate-1

The instructions to join the dev mailing list are available on the contact page.

I'll proceed with the releases as soon as the mandatory 3 binding votes are reached. In the Apache Pulsar project, we follow the ASF release policy and its release approval.

[lhotari]

Latest update:
3.3.5-candidate-2 and 4.0.3-candidate-2 have now been made ready for voting. 3.0.10-candidate-1 voting continues.

These are the release voting threads on the dev mailing list:

• [VOTE] Release Apache Pulsar 3.0.10 based on 3.0.10-candidate-1
• [VOTE] Release Apache Pulsar 3.3.5 based on 3.3.5-candidate-2
• [VOTE] Release Apache Pulsar 4.0.3 based on 4.0.3-candidate-2