Oh, just saw 1.12.1 vote :) Thanks !
On Wed, Sep 17, 2025 at 4:24 PM Jean-Baptiste Onofré <j...@nanthrax.net> wrote: > > +1 (non binding) > > NB: I'm volunteer to do 1.12.1 release to include security > improvement. Thoughts ? > > Regards > JB > > On Thu, Sep 11, 2025 at 12:54 PM Oscar Westra van Holthe - Kind > <opw...@apache.org> wrote: > > > > Hi, > > > > I've cherry-picked the missing change for AVRO-4053 (doc consistency in > > velocity templates), and created a new RC. > > > > I'd like to propose to release this RC1 as the official Apache Avro 1.11.5 > > release. > > > > The commit id is > > https://github.com/apache/avro/commit/257db287e4cf3f3831013780e709226d4aa188d9 > > This corresponds to the tag: release-1.11.5-rc1: > > https://github.com/apache/avro/tree/release-1.11.5-RC1 > > > > The release tarball, signature, and checksums are here (revision r79245): > > https://dist.apache.org/repos/dist/dev/avro/avro-1.11.5-RC1/ > > The Maven artefacts are staged here: > > https://repository.apache.org/content/repositories/orgapacheavro-1045/ > > You can find the KEYS file here: > > https://dist.apache.org/repos/dist/release/avro/KEYS > > > > This release includes the following security fixes: > > * Prevent class with empty Java package being trusted by > > SpecificDatumReader (#3311) > > * Remove the default serializable packages and deprecated the property to > > introduce org.apache.avro.SERIALIZABLE_CLASSES instead (#3376) > > * java-[key-]class allowed packages must be packages (#3453) > > * doc consistency in velocity templates (#3150) > > > > Did I leave anything important out? > > > > > > Please download, verify, and test. This vote will remain open for at least > > 72 hours. > > > > [ ] +1 Release this as Apache Avro 1.11.5 > > [ ] 0 > > [ ] -1 Do not release this because... > > > > > > Kind regards, > > Oscar > > > > On Wed, 10 Sept 2025 at 16:32, Oscar Westra van Holthe - Kind < > > os...@westravanholthe.nl> wrote: > > > > > Hi, > > > > > > I'm adjusting my vote to -1, don't release, because we should include the > > > change for AVRO-4053 (doc consistency in velocity templates). > > > > > > I'll create a new RC shortly. > > > > > > > > > Kind regards, > > > Oscar > > > > > > > > > On Tue, 9 Sept 2025 at 10:06, Nándor Kollár <nkol...@apache.org> wrote: > > > > > >> +1 > > >> > > >> On 2025/09/07 18:05:18 Martin Grigorov wrote: > > >> > +1 to release > > >> > > > >> > On Sat, 6 Sep 2025 at 0:19, Oscar Westra van Holthe - Kind < > > >> > opw...@apache.org> wrote: > > >> > > > >> > > And a +1 from me > > >> > > > > >> > > We need only one more vote... > > >> > > > > >> > > > > >> > > Kind regards, > > >> > > Oscar > > >> > > > > >> > > On Wed, 3 Sept 2025 at 22:38, Driesprong, Fokko <fo...@driesprong.frl > > >> > > > >> > > wrote: > > >> > > > > >> > > > Hi Oscar, > > >> > > > > > >> > > > Thanks for running the release. This slipped through the cracks of > > >> my > > >> > > > mailbox. > > >> > > > > > >> > > > +1 from my end > > >> > > > > > >> > > > Kind regards, > > >> > > > Fokko > > >> > > > > > >> > > > Op wo 20 aug 2025 om 22:38 schreef Oscar Westra van Holthe - Kind < > > >> > > > opw...@apache.org>: > > >> > > > > > >> > > > > Hi everyone, > > >> > > > > > > >> > > > > It took a bit longer than anticipated (learning about Perl > > >> > > > > builds, > > >> > > among > > >> > > > > other things), but I've created a RC0 of Avro 1.11.5. > > >> > > > > I'd like to propose to release this RC0 as the official Apache > > >> Avro > > >> > > > 1.11.5 > > >> > > > > release. > > >> > > > > > > >> > > > > The commit id is > > >> > > > > > > >> > > > > > > >> > > > > > >> > > > > >> https://github.com/apache/avro/commit/a0d0130aea75b8319f251c3805f18a1776efa563 > > >> > > > > This corresponds to the tag: release-1.11.5-rc0: > > >> > > > > https://github.com/apache/avro/tree/release-1.11.5-RC0 > > >> > > > > > > >> > > > > The release tarball, signature, and checksums are here (revision > > >> > > r78771): > > >> > > > > https://dist.apache.org/repos/dist/dev/avro/avro-1.11.5-RC0/ > > >> > > > > The Maven artefacts are staged here: > > >> > > > > > > >> > > > > > > >> > > > > > >> > > > > >> https://repository.apache.org/content/repositories/orgapacheavro-1042/org/apache/avro/ > > >> > > > > > > >> > > > > You can find the KEYS file here: > > >> > > > > https://dist.apache.org/repos/dist/release/avro/KEYS > > >> > > > > > > >> > > > > This release includes the following security fixes: > > >> > > > > * Prevent class with empty Java package being trusted by > > >> > > > > SpecificDatumReader (#3311) > > >> > > > > * Remove the default serializable packages and deprecated the > > >> property > > >> > > to > > >> > > > > introduce org.apache.avro.SERIALIZABLE_CLASSES instead (#3376) > > >> > > > > * java-[key-]class allowed packages must be packages (#3453) > > >> > > > > > > >> > > > > Did I leave anything important out? > > >> > > > > > > >> > > > > > > >> > > > > Please download, verify, and test. This vote will remain open for > > >> at > > >> > > > least > > >> > > > > 72 hours. > > >> > > > > > > >> > > > > [ ] +1 Release this as Apache Avro 1.11.5 > > >> > > > > [ ] 0 > > >> > > > > [ ] -1 Do not release this because... > > >> > > > > > > >> > > > > > > >> > > > > Kind regards, > > >> > > > > Oscar > > >> > > > > > > >> > > > > -- > > >> > > > > ✉️ Oscar Westra van Holthe - Kind <opw...@apache.org> > > >> > > > > 🌐 https://github.com/opwvhk/ > > >> > > > > > > >> > > > > > >> > > > > >> > > > > >> > > -- > > >> > > > > >> > > ✉️ Oscar Westra van Holthe - Kind <opw...@apache.org>🌐 > > >> > > https://github.com/opwvhk/ > > >> > > > > >> > > > >> > > > > > > > > > -- > > > > > > ✉️ Oscar Westra van Holthe - Kind <os...@westravanholthe.nl> > > > > > > > > > > -- > > > > ✉️ Oscar Westra van Holthe - Kind <opw...@apache.org>🌐 > > https://github.com/opwvhk/
