diff --git a/apache-pulsar.yaml b/apache-pulsar.yaml
index 97e12349a52..084d9d0ce1e 100644
--- a/apache-pulsar.yaml
+++ b/apache-pulsar.yaml
@@ -1,7 +1,7 @@
 package:
   name: apache-pulsar
   version: "4.0.6"
-  epoch: 1
+  epoch: 2 # GHSA-3p8m-j85q-pgmj
   description: Pulsar is a distributed pub-sub messaging platform with a very flexible messaging model and an intuitive client API.
   copyright:
     - license: Apache-2.0
@@ -51,6 +51,9 @@ pipeline:
       tar -zxf ./distribution/server/target/${{package.name}}-${{package.version}}-bin.tar.gz -C ${dest} --strip-components=1
       rm -rf ${dest}/bin/*.cmd
 
+      # Remove windows jar/DLLs from boringssl
+      find ${dest} -name '*boringssl*windows*' -exec rm {} \;
+
   - uses: strip
 
 subpackages:
diff --git a/apache-pulsar/pombump-properties.yaml b/apache-pulsar/pombump-properties.yaml
index 81e4d1b2100..a9743fc64b1 100644
--- a/apache-pulsar/pombump-properties.yaml
+++ b/apache-pulsar/pombump-properties.yaml
@@ -1,3 +1,3 @@
 properties:
   - property: netty.version
-    value: "4.1.124.Final"
+    value: "4.1.125.Final"