+1 binding On Sat, Sep 6, 2025 at 12:18 AM Oscar Westra van Holthe - Kind < [email protected]> wrote:
> Hi everyone, > > After cherry-picking almost all commits from main (up to "AVRO-3088: [C++] > Rename CMake package name to avro-cpp (#3477)"), I've created a RC0 of Avro > 1.12.1. > The "almost" is the maven-javadoc-plugin: I've undone the upgrade to > version 3.11.3, as that caused the build to fail. > > *I'd like to propose to release this RC0 as the official Apache > Avro 1.12.1 release.* > > The commit id is > > https://github.com/apache/avro/commit/https://github.com/apache/avro/commit/9110c693767c1dde2665b2b57939333478b12036 > This corresponds to the tag: release-1.12.1-rc0: > https://github.com/apache/avro/tree/release-1.12.1-RC0 > > The release tarball, signature, and checksums are here (revision r79089): > https://dist.apache.org/repos/dist/dev/avro/avro-1.12.1-rc0/ > The Maven artefacts are staged here: > > https://repository.apache.org/content/repositories/orgapacheavro-1043/org/apache/avro/ > > You can find the KEYS file here: > https://dist.apache.org/repos/dist/release/avro/KEYS > > This release includes the following security fixes: > * Prevent class with empty Java package being trusted by > SpecificDatumReader (#3311) > * Remove the default serializable packages and deprecated the property to > introduce org.apache.avro.SERIALIZABLE_CLASSES instead (#3376) > * java-[key-]class allowed packages must be packages (#3453) > > In addition, this release includes approx. 200 changes & 170 version > changes. The full list is here: > https://github.com/apache/avro/compare/release-1.12.0...release-1.12.1-rc0 > > > Please download, verify, and test. This vote will remain open for at least > 72 hours. > > [ ] +1 Release this as Apache Avro 1.11.5 > [ ] 0 > [ ] -1 Do not release this because... > > > Kind regards, > Oscar > > -- > > ✉️ Oscar Westra van Holthe - Kind <[email protected]>🌐 > https://github.com/opwvhk/ >
