Getting pre-commit builds working would be very welcome. Updating the docker-based build to do this would be doubly good, as it would mean that any developer could then easily make a release. Right now one has to install all the requirements for every language to make a release. These dependencies are supposedly documented in the BUILD.txt file, but that file is now out of date. Having the build dependencies tested with each PR should help us keep them up to date so that we can release more easily and often.
Thanks, Doug On Mon, Sep 24, 2018 at 10:14 AM Driesprong, Fokko <[email protected]> wrote: > Hi all, > > Let me cut right to the chase, the lack of activity on the Apache Avro > master makes me a bit sad. I believe Avro is a format that many people > happly use, and will be used in the future (at least I hope). > > Therefore we need: > > - *Continue the development of features:* For example, I'd like to see > the following PR merged, and since Joda has been deprecated a long while > ago: https://github.com/apache/avro/pull/309 > - *Update the dependencies:* Within the codebase there are quite some > known CVE's. It is aways a race to keep up to date, but we should in > order > to stay secure. For example, The Apache Velocity template engine is old, > and pulls in an old version of apache-commons which has known security > problems, eg. CVE-2015-6420, CVE-2017-15708. I've created a PR for this: > https://github.com/apache/avro/pull/332 > - *Automate stuff: *I'm happy to set up a Travis to run some CI tasks > for each PR. This relieves on the committers since they don't have to > run > the testsuite every time a small change is introduced. Let me know if > this > sounds interesting, and I'm happy to set it up. > > Looking at the PR's and tickets, a lot of people are putting effort in > making PR's and adding features to Avro. It is a pity that the Avro project > seems to stall. I'm happy to help if that is necessary to start the > development cycle again. > > Cheers, Fokko >
