Dependency refresh ahead of 5.0.0-M2 — 13 PRs up for review 📦 I've opened 13 PRs that bring the version catalog up to date. The goal is to get our dependencies current before we cut 5.0.0-M2, which I'd like to release as soon as the remaining PIP-478 PRs are merged. All 13 are labelled

area/dependency

and attached to the 5.0.0-M2 milestone. They're independent of each other — each only touches

gradle/libs.versions.toml

plus the matching

LICENSE.bin.txt

entries, so they can be reviewed and merged in any order. Routine bumps — should be quick reviews • Jersey 3.1.12 — github.com/apache/pulsar/pull/26347 • Apache Commons (codec, collections4, logging) — github.com/apache/pulsar/pull/26348 • OkHttp 5.5.0 / Okio 3.18.1 — github.com/apache/pulsar/pull/26352 • Dropwizard Metrics 4.2.39 / HdrHistogram 2.2.2 — github.com/apache/pulsar/pull/26353 • gRPC 1.83.1 / Protobuf 4.35.1 — github.com/apache/pulsar/pull/26356 • Data structures: fastutil, jctools, RoaringBitmap, hppc, zstd, lz4 — github.com/apache/pulsar/pull/26357 • Networking / infra clients: Vert.x, Curator, Thrift, jclouds, k8s client, AWS SDK — github.com/apache/pulsar/pull/26358 • Misc tooling and utility libraries — github.com/apache/pulsar/pull/26359 • Gradle plugins, and moves us off the deprecated

com.github.ben-manes.versions

plugin id to

io.github.ben-manes.versions

— github.com/apache/pulsar/pull/26350 Worth a closer look 👀 BouncyCastle 1.85 + FIPS 2.1.x — github.com/apache/pulsar/pull/26349 BC-FJA 2.1.x is a different FIPS 140-3 certified module than 2.0.x (Certificate #4943). Anyone running Pulsar in FIPS mode may need to re-validate. Also introduces a separate version ref for

bcprov

, since BC shipped a provider-only 1.85.2 that wasn't released for bcpkix/bctls. Jakarta / servlet APIs — github.com/apache/pulsar/pull/26354 Raises

javax.servlet-api

3.1 → 4.0.1 to match what the Jetty ee8 environment actually implements. That widens the PIP-472

AdditionalServlet

plugin SPI from Servlet 3.1 to 4.0. Existing plugins keep working, but it's effectively a one-way door, so I'd like a second opinion. Gson 2.14.0 — github.com/apache/pulsar/pull/26355 Real behaviour changes: duplicate JSON object keys are now rejected (previously last-key-wins), and

java.time

types get built-in adapters instead of going through reflection. We parse user-supplied JSON in function/connector config, the admin CLI and the k8s runtime. Test libraries — github.com/apache/pulsar/pull/26351 WireMock moves 2.35.1 → 3.13.2, which also changes coordinates (

com.github.tomakehurst:wiremock-jre8-standalone

was discontinued; 3.x is

org.wiremock:wiremock-standalone

). Also adds a

byte-buddy-agent

catalog entry so it can't drift apart from

byte-buddy

— Mockito needs both in lockstep for the inline mock maker. Deliberately not upgraded, in case you're wondering why the version bot still flags them: • Java 17 baseline — we target Java 17, and I checked the actual class file versions in the jars: hppc 0.11.1 is Java 21 (capped at 0.10.0), datasketches-java 8.x is Java 21 / 9.x is Java 25, datasketches-memory 5.x+ is Java 21. So datasketches 7.0.1 / memory 4.1.0 are already the newest Java-17 builds. • Jakarta EE 10 / Jetty 12.1 —

jetty-ee10

12.1.12 pins

jakarta.servlet-api

6.0.0, so Servlet 6.1,

<http://jakarta.ws.rs|jakarta.ws.rs>

4.0,

jakarta.annotation

3.0, Bean Validation 3.1 and Jersey 4.x all stay out; they'd drag us to EE 11. • Jackson stays on the 2.21 LTS line — 2.22 was tried in #26101 and reverted in #26166. • Testcontainers stays at 1.21.4 — that already is the latest 1.x; 2.0 is a new major. • guice stays at 5.1.0 — TestNG 7.12.0 declares it, and Guice 7 switches to

jakarta.inject

. jclouds is the only consumer that needs Guice 7 and

jclouds-shaded

already forces it locally. • Avro 1.12.1 postponed, and RocksDB left to BookKeeper. Two things I split out rather than sneaking in: • lightproto 0.8.0 will get its own PR. Diffing the regenerated sources shows it rewrites our serialization path (Unsafe → scratch buffer, per-message

_scratch

byte[], bitfield presence tracking) and generates a class into the

io.netty.buffer

package to skip Netty's bounds checks — its own javadoc notes it creates a JPMS split package. That deserves benchmarks and a focused review, not a plugin bump. • The Prometheus simpleclient → client_java migration is not in scope here. simpleclient 0.16.0 is the final release, but 64 files across 12 modules use it, and BookKeeper's

prometheus-metrics-provider

plus ZooKeeper's provider both hard-depend on it. I'm looking at restoring a Pulsar-owned

bookkeeper-prometheus-metrics-provider

module on client_java 1.x as the first step — happy to discuss the approach if anyone has opinions. Each PR was verified locally with

./gradlew sanityCheck

and

./gradlew checkBinaryLicense

, plus targeted test runs where behaviour could shift (BC-FIPS suite, the WireMock-based tests, the Mockito inline-mock-maker tests, and the Gson-heavy modules). Please review. 🙏