Release notes from bookkeeper

v4.17.4-rc1

2026-07-09T01:34:51Z

[maven-release-plugin] copy for tag v4.17.4-rc1

v4.17.4-rc0

2026-06-30T08:33:18Z

[maven-release-plugin] copy for tag v4.17.4-rc0

Release 4.18.0

2026-07-10T16:01:45Z

Release 4.18.0 is a major feature release. It introduces structured logging across the whole
code base (BP-69), migrates the wire protocol serialization to LightProto and the native I/O
library to Rust, and raises the minimum required Java version to 17. It also includes many
improvements, bug fixes and dependency/CVE updates.

Apache BookKeeper users are encouraged to upgrade to 4.18.0. Please review the
breaking changes and known issues below before upgrading.

Highlights

Structured logging (BP-69) — All BookKeeper logging has been converted from SLF4J
format strings to slog, a structured logging API where each event carries typed key/value
attributes (e.g. ledgerId, entryId). Logger context is propagated through client
operations, so all events related to the same ledger are automatically tagged.
Attributes are rendered by log4j2 in both plain-text and JSON output, with an example
configuration for OpenTelemetry-compatible JSON logs.
PR #4751,
#4754,
#4755,
#4756,
#4757,
#4758,
#4765,
#4766,
#4767,
#4770
LightProto serialization — The BookKeeper wire protocol, metadata formats and stream
storage protos have been migrated from protobuf-java to LightProto, which parses and
serializes directly on Netty buffers with no intermediate allocations, reducing GC pressure
on the hot path. PR #4779,
#4780,
#4781,
#4783
Native I/O library rewritten in Rust — The native-io library used for direct I/O on
the bookie has been migrated from C to Rust. PR #4738
Java 17 baseline — Java 17 or later is now required to build and run BookKeeper.
PR #4446
Bookie decommission cleans up the cookie (BP-68) — The decommission admin API now
deletes the bookie cookie from the metadata store, so a decommissioned bookie id can be
reused without manual cleanup. PR #4500,
#4592
ZooKeeper read throttling during re-replication (BP-66) — Re-replication can now
throttle its ZooKeeper reads, protecting the metadata store from read storms when many
ledgers are being recovered. PR #4258
Batch reads of unconfirmed entries (BP-62) — batchReadUnconfirmedAsync is now
exposed on ReadHandle. PR #4739

Breaking Changes

Java 17+ is required for building and running BookKeeper (previously Java 11)
PR #4446
The default value of readOnlyModeOnAnyDiskFullEnabled changed to true: a bookie now
transitions to read-only as soon as any ledger disk is full, instead of only when all disks
are full. Set it back to false to restore the previous behavior.
PR #4520
The bookkeeper-slogger module has been removed, superseded by the slog structured
logging API (BP-69) PR #4764
Removed the deprecated, misspelled method setAllocatorPoolingConcurrenncy — use
setAllocatorPoolingConcurrency instead PR #4431
Removed the deprecated class MathUtils PR #4274

Known Issues

PR #4730 (read thread blocking fix in
sendResponseAndWait), included in this release, was found to potentially cause a deadlock
on the bookie read path. It has been reverted in
PR #4830, which will be part of 4.18.1.

Features

Support TCP keep-alive configuration for the bookie server PR #4762
New client API to check whether the BookKeeper client is connected to the metadata service PR #4342
Migrate from Yahoo DataSketches to Apache DataSketches 7.0.1 (KLL) PR #4774
Allow configuring log4j2 AsyncLogger PR #4269

Improvements

Bookie

Add total_entry_log_space_bytes metric PR #4507
Enrich GC metrics to better analyze GC behavior and the time spent in each phase PR #4384
Add metric for RocksDB getLastEntryInLedger to help identify bottlenecks PR #4529
Set ThreadFactory for the Executor in EntryLoggerAllocator PR #4562
Add temp dir property for the native library PR #4533
Apply the WRITE_BUFFER_WATER_MARK setting to child channels in the bookie Netty server PR #4337
Skip wasted optimistic cache insertion in SingleDirectoryDbLedgerStorage when the write lock is held PR #4306
Log only overridden configuration settings at BookieServer startup PR #4768
Remove unused journal time tracking PR #4006

Client

Eliminate unnecessary synchronization on LedgerHandle.getLength() PR #4516
Optimize bounded batch reads by predicting the entry count PR #4741
Improve host address resolution logic for bookie id PR #4588
Rename the client high-priority thread pool PR #4496

Tools

readledger command reads all entries from a bookie when first and last entry ids are not provided PR #4692
Optimize ListActiveLedgersCommand PR #4602
Improve bookie CLI usage information for the --help option PR #4241

Bug Fixes

Bookie

Fix bookie startup failure caused by IOException: Recovery log <id> is missing PR #4740
Prevent double flush due to a race condition in SingleDirectoryDbLedgerStorage PR #4305
Fix RocksDB configuration path handling on Windows PR #4407
Fix endless loop in BufferedChannel read PR #4506
Fix ArrayIndexOutOfBoundsException in ConcurrentLongHashMap PR #4771
Add workaround for ZOOKEEPER-3825 (numeric IPs and DNS names resolving to multiple numeric IPs) with Java 17 support PR #4719
Fix async log appender swallowing error logs when the bookie fails to start PR #4475
Fix SingleThreadExecutor to reject new tasks while a drainTo is in progress and the queue is empty PR #4488

Client

Fix batch reads hanging after digest mismatch retries are ignored PR #4789
Fix WriteSet use-after-recycle in sequence reads PR #4788
Fix NPE in PendingAddOp.maybeTimeout() when clientCtx is null after recycling PR #4760
Fix race condition NPE in V3 response handling during timeout check PR #4737
Fix bookie WatchTask getting stuck PR #4481
Fix sanity check in asyncBatchReadEntries PR #4579
Add strict hostname resolution and loopback check for the advertised address PR #4595
Use the instance slog logger in LedgerHandle.batchReadUnconfirmedAsync PR #4782
Change log level to debug for parameter checks in batch read PR #4485

Others

Fix IllegalThreadStateException in ComponentStarter shutdown hook PR #4733
Fix potential jetcd-core shading problem PR #4526
Fix potential class conflict during the jetcd-core-shaded shading process PR #4532
Fix wrong configuration key in getHttpServerTrustStorePassword PR #4301
Fix exception message formatting in RocksdbKVStore PR #4448
Fix permission denied error in the Docker image PR #4464
Fix options for the sanity test command being ignored PR #4691
Fix duplicated ZooKeeper call in DistributedLog getLogSegmentNames PR #4050
Fix the pid check in bookkeeper-daemon.sh start/stop PR #3113

Build, CI and Tests

Introduce /bkbot command to control CI workflow runs via PR comments PR #4673, #4674, #4746
Upgrade website to Docusaurus 3, built with Node 24 PR #4723
Add Java 21 (LTS) compatibility check and Java 21/Windows daily builds PR #4350, #4292
Add typo check to CI and fix existing typos PR #4375
Improve CI caching for old release downloads and Maven artifacts, improve error logs PR #4722
Remove OWASP dependency check from CI PR #4717
Add javadoc support for pom-only shaded modules PR #4787

Dependency updates

Upgrade Netty to 4.2.14.Final, addressing CVEs PR #4744, #4775, #4799
Upgrade Vert.x to 4.5.25 to address CVE-2026-6860 PR #4790
Upgrade Jetty from 9.4.57 to 12.1.7 PR #4710
Upgrade RocksDB to 9.9.3 PR #4580
Upgrade ZooKeeper from 3.9.3 to 3.9.5 PR #4667, #4721
Upgrade protobuf and gRPC to latest versions; scope gRPC dependencies via grpc-bom PR #4716, #4784
Upgrade OpenTelemetry libraries to 1.61.0 / 2.27.0 PR #4773
Upgrade jctools to 4.0.6 (jctools-core-jdk11) PR #4656, #4776
Upgrade Lombok to 1.18.32 for Java 22 support PR #4267
Upgrade BouncyCastle from 1.75 to 1.78, bc-fips from 1.0.2.4 to 1.0.2.5 PR #4295, #4366
Upgrade commons-io from 2.7 to 2.17.0 PR #4509
Use slf4j-bom and log4j-bom in dependencyManagement PR #4346
Remove unused commons-lang dependency PR #4654
Upgrade os-maven-plugin to support RISC-V 64 PR #4515

Details

Full list of changes: https://github.com/apache/bookkeeper/pulls?q=is%3Apr+milestone%3A4.18.0+is%3Aclosed

Release 4.17.3

2026-01-20T08:34:51Z

4.17.3

Release 4.17.3 includes multiple bug fixes and few dependency updates.

Apache BookKeeper users are encouraged to upgrade to 4.17.3 if you are using 4.17.x.
The technical details of this release are summarized below.

Bugs

Fix: Garbage collection stuck on corrupt entry log file PR #4544
[fix] Failed read entries after multiple decommissioning PR #4613
[fix]BK stays at read_only state even if the disk is empty PR #4640
Bring back the old public method name which removed from #4640 PR #4682
[fix]compile error of the file native_io_jni.c for the env jdk11 & windows PR #4665
Only stop Gc for the fill disk for DbLedgerStorage PR #4661
[fix]Wrong error code(-102) when opening a deleted ledger PR #4657
Log all the error in the GarbageCollectorThread PR #4649

Improvements

support equalsAndHashcode for BookieServerInfo PR #4686
Supports configuring TCP Keepalive related parameters in Bookie Client. PR #4683
add rate limit for zk read rate in gc. PR #4645

Dependency updates

Upgrade netty to 4.1.130 Final PR #4699
[security] Replace net.jpountz.lz4:lz4 with at.yawk.lz4:lz4-java PR #4696
Upgrade OpenTelemetry to 1.56.0, Otel instrumentation to 2.21.0 and Otel semconv to 1.37.0 PR #4690
Exclude commons-collections from dependencies PR #4689
Remove commons-configuration2 and commons-beanutils from top level dependencies PR #4648

Full Changelog: release-4.17.2...release-4.17.3

Release 4.17.2

2025-07-05T22:23:01Z

Release 4.17.2 includes multiple bug fixes and few dependency updates.

Apache BookKeeper users are encouraged to upgrade to 4.17.2 if you are using 4.17.x.
The technical details of this release are summarized below.

Highlights

Bugs

Fix a NPE bug after refactor recycler of BookieClient PR #4610
Fix Memory Leak In Netty Recycler of Bookie Client PR #4609
Fix the data loss issue that caused by the wrong entry log header PR #4607
Fix the coredump that occurs when calling KeyValueStorageRocksDB.count after rocksdb has been closed PR #4581
Fix and improve locating RocksDB config files PR #4560
[fix] Write stuck due to pending add callback by multiple threads PR #4557
Fix SST files not being cleaned up in the locations folder PR #4555
Fix tune-runner-vm action to run correctly on ubuntu-24.04 image PR #4536
[cli] Fix: recover command doesn't accept rate limit parameter PR #4535
fix pendingDeletedLedgers do not remove ledger error PR #4525
Fix region aware placement policy disk weight dose not update. PR #4522
Fix check read failed entry memory leak issue. PR #4513
[fix] remove in address2Region while bookie left to get correct rack info PR #4504
fix: install netcat-openbsd instead of netcat in test image build PR #4476
[fix][ci] Fix OWASP Dependency Check download by using NVD API key PR #4473
Fix ReadOnlyLedgerHandle leak issue when checkAllLedgers. PR #4468
fix[rocksdb]: fix error rocksdb default config for CFOptions PR #4466
[fix] Fix data lost after when writing ledger and deleting legder execute concurrency PR #4462
[BugFix] Fix to prevent resource leaks in 3 classes PR #4449
Correct RackawareEnsemblePlacementPolicyImpl defaultRack when the bookie is not available. PR #4439
Fix the completionObjects leak problem. PR #4285
Issue 2161: set metrics endpoint content-type PR #4208

Improvements

Adjust DNS cache expiration in tests to reduce test timeout failures PR #4586
Change the new ensemble log to info level PR #4566
Add documentation to bk_server.conf about RocksDB config PR #4561
Reduce metadataLock contention in LedgerHandle PR #4549
[improve] when rackaware failed to choose a bookie, print out the list of ensemble. PR #4482
Ensure that formatVersion is specified for all RocksDB databases PR #4559
Set default format_version to 5 for RocksDB databases PR #4480
[improve] Optimize reorderReadSequence to Check WriteSet PR #4478
Update Release Script Instructions and Python Publishing Scripts PR #4458
Enable ZooKeeper client to establish connection in read-only mode PR #4244
Allocator support exitOnOutOfMemory config. PR #3984

Dependency updates

Upgrade commons-beanutils to 1.11.0 to address CVE-2025-48734 PR #4608
Migrate deprecated commons-configuration 1.x to commons-configuration 2.x PR #4604
Upgrade Jetty to 9.4.57.v20241219 to mitigate CVE-2024-6763 PR #4600
Upgrade Netty to 4.1.121.Final PR #4597
Upgrade to grpc 1.72.0 PR #4591
Upgrade OpenTelemetry version and align versions using BOMs PR #4589
Upgrade Netty to 4.1.119, tcnative to 2.0.70 and io_uring to 0.0.26 PR #4584
Upgrade Apache Commons libraries to compatible versions PR #4582
Bump vertx.version from 4.5.7 to 4.5.11 to address CVE-2024-8391 PR #4545
Upgrade to Netty 4.1.115.Final to address CVE-2024-47535 PR #4524
Upgrade Zookeeper to 3.9.3 to address CVE-2024-51504 PR #4523
Upgrade gRPC to 1.70.0 PR #4512
Upgrade protobuf to 3.25.5 to address CVE-2024-7254 PR #4508
Upgrade to Netty 4.1.113.Final and netty-tcnative 2.0.66.Final PR #4502
Bump grpc from 1.56.0 to 1.64.0 to address CVE list PR #4344

Details

https://github.com/apache/bookkeeper/pulls?q=is%3Apr+label%3Arelease%2F4.17.2+is%3Amerged+

Release 4.16.7

2025-07-03T09:19:05Z

Release 4.16.7 includes multiple bug fixes and few dependency updates.

Apache BookKeeper users are encouraged to upgrade to 4.16.7 if you are using 4.16.x.
The technical details of this release are summarized below.

Highlights

Bugs

Fix the data loss issue that caused by the wrong entry log header PR #4607
Fix the coredump that occurs when calling KeyValueStorageRocksDB.count after rocksdb has been closed PR #4581
Fix and improve locating RocksDB config files PR #4560
[fix] Write stuck due to pending add callback by multiple threads PR #4557
Fix SST files not being cleaned up in the locations folder PR #4555
Fix tune-runner-vm action to run correctly on ubuntu-24.04 image PR #4536
[cli] Fix: recover command doesn't accept rate limit parameter PR #4535
fix pendingDeletedLedgers do not remove ledger error PR #4525
Fix region aware placement policy disk weight dose not update. PR #4522
Fix check read failed entry memory leak issue. PR #4513
[fix] remove in address2Region while bookie left to get correct rack info PR #4504
fix: install netcat-openbsd instead of netcat in test image build PR #4476
[fix][ci] Fix OWASP Dependency Check download by using NVD API key PR #4473
fix[rocksdb]: fix error rocksdb default config for CFOptions PR #4466
[fix] Fix data lost after when writing ledger and deleting legder execute concurrency PR #4462
[BugFix] Fix to prevent resource leaks in 3 classes PR #4449
Correct RackawareEnsemblePlacementPolicyImpl defaultRack when the bookie is not available. PR #4439
Fix the completionObjects leak problem. PR #4285

Improvements

Adjust DNS cache expiration in tests to reduce test timeout failures PR #4586
Change the new ensemble log to info level PR #4566
Add documentation to bk_server.conf about RocksDB config PR #4561
Reduce metadataLock contention in LedgerHandle PR #4549
[improve] when rackaware failed to choose a bookie, print out the list of ensemble. PR #4482
Ensure that formatVersion is specified for all RocksDB databases PR #4559
Set default format_version to 5 for RocksDB databases PR #4480
[improve] Optimize reorderReadSequence to Check WriteSet PR #4478
Update Release Script Instructions and Python Publishing Scripts PR #4458
Enable ZooKeeper client to establish connection in read-only mode PR #4244
Improve auto-recovery noise log when some bookie down. PR #4118
Allocator support exitOnOutOfMemory config. PR #3984

Dependency updates

Upgrade Jetty to 9.4.57.v20241219 to mitigate CVE-2024-6763 PR #4600
Upgrade Netty to 4.1.121.Final PR #4597
Upgrade Netty to 4.1.119, tcnative to 2.0.70 and io_uring to 0.0.26 PR #4584
Upgrade Apache Commons libraries to compatible versions PR #4582
Bump vertx.version from 4.5.7 to 4.5.11 to address CVE-2024-8391 PR #4545
Upgrade to Netty 4.1.115.Final to address CVE-2024-47535 PR #4524
Upgrade Zookeeper to 3.9.3 to address CVE-2024-51504 PR #4523
Upgrade protobuf to 3.25.5 to address CVE-2024-7254 PR #4508
Upgrade to Netty 4.1.113.Final and netty-tcnative 2.0.66.Final PR #4502

Details

https://github.com/apache/bookkeeper/pulls?q=is%3Apr+label%3Arelease%2F4.16.7+is%3Amerged+

Release 4.17.1

2024-06-26T13:44:50Z

Release 4.17.1 includes multiple bug fixes and few dependency updates.

Apache BookKeeper users are encouraged to upgrade to 4.17.1 if you are using 4.17.x.
The technical details of this release are summarized below.

Highlights

Bugs

Fix TimedRunnable log NPE PR #4425
Fix Auditor ignoring bookies shut down before Auditor start PR #4419
Fix lost prometheus metric in OrderedExecutor PR #4374
Fix: resource leak when JournalChannel is not fully initialized PR #4340
Fix: bookie http endpoint info always return 0.0.0.0 PR #4325
Fix disk weight ensemble infinite loop bug PR #4324
Fix guava shade error in distributedlog PR #4319
Fix ThreadRegistry#register behavior to ensure correct Prom metrics PR #4300
Fix: reference counting (retain/release) in PerChannelBookieClient PR #4293
Fix ByteBuf release/retain in PerChannelBookClient PR #4289
Tests: miss test log in prometheus-metrics-provider module PR #4279
Fixed creation of temporary dir in NativeUtils PR #4262
Fix ArrayIndexOutOfBoundsException caused by optimistic lock PR #4066
Prevent bookie shutdown due to rest api when bookie prohibits readOnlyMode PR #3972
Fix wrong implementation for percentile in bookkeeper-benchmark PR #3864

Improvements

Adjust Log Level for LedgerFencedException in WriteEntryProcessor PR #4327
Improve: change scheduleAtFixedRate to scheduleWithFixedDelay in GarbageCollectorThread PR #4296
Remove unused code from ByteBufVisitor PR #4383
Use vertx blockingHandlers to run Bookkeeper http handlers which could be blocking PR #4266

Dependency updates

Bump jetcd from 0.5.0 to 0.7.7 PR #3849
Bump netty from 4.1.107.Final to 4.1.108.Final to address CVE list PR #4426
Bump jackson from 2.13.4.20221013 to 2.17.1 to address CVE list PR #4345
Upgrade vertx-core to 4.5.7 to address CVE-2024-1300 PR #4265

Details

https://github.com/apache/bookkeeper/pulls?q=is%3Apr+label%3Arelease%2F4.17.1+is%3Amerged+

Release 4.16.6

2024-06-26T13:44:09Z

Release 4.16.6 includes multiple bug fixes and few dependency updates.

Apache BookKeeper users are encouraged to upgrade to 4.16.6 if you are using 4.16.x.
The technical details of this release are summarized below.

Highlights

Bugs

Fix TimedRunnable log NPE PR #4425
Fix Auditor ignoring bookies shut down before Auditor start PR #4419
Fix lost prometheus metric in OrderedExecutor PR #4374
Fix: resource leak when JournalChannel is not fully initialized PR #4340
Fix: bookie http endpoint info always return 0.0.0.0 PR #4325
Fix disk weight ensemble infinite loop bug PR #4324
Fix guava shade error in distributedlog PR #4319
Fix ThreadRegistry#register behavior to ensure correct Prom metrics PR #4300
Fix: reference counting (retain/release) in PerChannelBookieClient PR #4293
Fix ByteBuf release/retain in PerChannelBookClient PR #4289
Tests: miss test log in prometheus-metrics-provider module PR #4279
Fix ArrayIndexOutOfBoundsException caused by optimistic lock PR #4066
Prevent bookie shutdown due to rest api when bookie prohibits readOnlyMode PR #3972
Fix wrong implementation for percentile in bookkeeper-benchmark PR #3864

Improvements

Adjust Log Level for LedgerFencedException in WriteEntryProcessor PR #4327
Improve: change scheduleAtFixedRate to scheduleWithFixedDelay in GarbageCollectorThread PR #4296
Remove unused code from ByteBufVisitor PR #4383
Use vertx blockingHandlers to run Bookkeeper http handlers which could be blocking PR #4266

Dependency updates

Bump jetcd from 0.5.0 to 0.7.7 PR #3849
Bump netty from 4.1.94.Final to 4.1.108.Final to address CVE list PR #4426
Bump jackson from 2.13.4.20221013 to 2.17.1 to address CVE list PR #4345
Upgrade vertx-core to 4.5.7 to address CVE-2024-1300 PR #4265

Details

https://github.com/apache/bookkeeper/pulls?q=is%3Apr+label%3Arelease%2F4.16.6+is%3Amerged+

Release 4.17.0

2024-06-18T16:20:01Z

Release 4.17.0 includes multiple important features, improvements, bug fixes and some dependencies CVE fixes.

The technical details of this release are summarized below.

Breaking Changes

No breaking changes. Some defaults are different, but overall there are no compatibility concerns.

Features

BP-62 Batch Read API

Notable changes

Enable reorder read sequence for bk client by default PR #4139
Fix some metrics generated by prometheus client without type info PR #3927
Fix arbitrary file upload vulnerability with httpServerEnabled PR #3982
Enable kv logs in log4j configuration PR #3986
Make compatible between DefaultEntryLogger and DirectEntryLogger PR #4041

Bookie

Fix bug of negative JournalQueueSize PR #4077
Fix compaction throttle imprecise PR #3192
Fix data lost when configured multiple ledger directories PR #3329
Try to use jdk api to create hardlink when rename file when compaction. PR #3876
[feature] [server] add dbStorage_readAheadCacheBatchBytesSize properties when read ahead entries PR #3895
Fix keys leak in EntryLocationIndex when ledgersToDelete is empty PR #3903
Fix garbage collection blocked by runtime exception PR #3901
Skip sync the RocksDB when no changes PR #3904
Enable PCBC completionObjects autoShrink to reduce memory usage and gc PR #3913
[Fix] Recycle dropping read-write requests when various exceptions happened PR #3912
Fix ledger replicated failed blocks bookie decommission process PR #3917
Support skip invalid journal record in replying journal stage PR #3956
Avoid compaction to trigger extra flushes DbLedgerStorage PR #3959
Fix memory leak of direct memory in direct memory entry logger. PR #3983
Unify ByteBufAllocator for the DirectIO component PR #3985
Print compaction progress PR #4071
Optimize bookie decommission check wait interval PR #4070
Fix trigger GC not work PR #3998
Allow to set max operation numbers in a single rocksdb batch PR #4044
Add read failed log for ledger checker. PR #4010
Fix read write request leak when executor throw RejectedExecutionException PR #4024
Improve DefaultEntryLogger read performance. PR #4038

Client

[Bug] Always one orphan ledger is created PR #3813
Fix checksum calculation bug when the payload is a CompositeByteBuf with readerIndex > 0 PR #4196
Fix no known bookies after reset racks for all BKs PR #4128
Fix issue with binary compatibility with older grpc versions at runtime in the client PR #3997
Entry write support local node region aware placement policy PR #4063
Rackaware placement policy support local node awareness by hostname PR #4057
Use netty-bom for aligning netty library versions, add epoll for linux-aarch_64 PR #4204

AutoRecovery

Make AutoRecovery enable stickyReadS as default. PR #4125
Support retry logic for auto recovery PR #3799 0
Fix auditor elector executor block problem. PR #4165
Fix the autorecovery failed replicate by add entry fenced error PR #4163
Fix auditor thread leak problem. PR #4162
AutoRecovery supports batch read PR #4211

Others

Added CLI command to start state store service without a bookie PR #2648
Add ensemble relocation command which adheres to placement policy PR #2931
Tuning pool concurrency PR #3432
Issue 4136: Fix logging configurations are broken in docker image PR #4137
[release] Force to use linux/amd64 to build release PR #4060

Dependency changes

Upgraded notable dependencies and address CVEs, including:

Upgrade snappy-java to address multiple CVEs PR #3993
Upgrade grpc and protobuf to address CVE-2023-32732 PR #3992
Upgrade Zookeeper to 3.8.3 to address CVE-2023-44981 PR #4112
Upgrade Netty to 4.1.107.Final and io_uring to 0.0.25.Final PR #4224
Bump org.apache.commons:commons-compress from 1.21 to 1.26.0 PR #4214
Update datasketches version from 0.8.3 to 3.2.0 PR #3264
Issue 3567: Upgrade rocksdb version to avoid checksum mismatch error PR #3568
fix(sec): upgrade commons-codec to 1.13 PR #3508
Remove avro, hadoop-auth and jersey-json dependencies from hadoop-common to resolve CVE-2019-10202, CVE-2023-1370 and CVE-2022-45685 PR #3911
Upgrade docker base image to resolve CVE-2023-0286 PR #3916
Upgrade bc-fips to 1.0.2.4 to fix CVE-2022-45146 PR #3915
Upgrade jetty version to 9.4.51.v20230217 PR #3937
Bump guava version from 31.0.1-jre to 32.0.1-jre PR #4008

Details

https://github.com/apache/bookkeeper/pulls?q=is%3Apr+milestone%3A4.17.0+is%3Aclosed

Release 4.16.5

2024-04-11T13:47:00Z

Release 4.16.5 includes multiple bug fixes and few dependency updates.

Apache BookKeeper users are encouraged to upgrade to 4.16.5 if you are using 4.16.x.
The technical details of this release are summarized below.

Highlights

Bugs

Fixed creation of temporary dir in NativeUtils PR #4262
Fix error stack track may expose to external user PR #4223
Add filename check for unTar PR #4222
Fix uncontrolled data used in path expression PR #4221
Set metrics endpoint content-type PR #4208
Fix checksum calculation bug when the payload is a CompositeByteBuf with readerIndex > 0 PR #4205
Fix yaml and dockerfile PR #4186

Dependency updates

Bump org.apache.commons:commons-compress from 1.21 to 1.26.0 PR #4214

Details

https://github.com/apache/bookkeeper/pulls?q=is%3Apr+label%3Arelease%2F4.16.5+is%3Amerged+