+1 (binding)
Verification checklist:
[x] Download links are valid
[x] Checksums and signatures are valid (SHA-512 + GPG against KEYS,
Elijah's key BB8B72B34AB9A664A109AA17A76CF4C80E4E5355)
[x] LICENSE/NOTICE/DISCLAIMER files exist and look correct
(DISCLAIMER is the standard incubator text; NOTICE attributes ASF
and says "Apache Burr (Incubating)")
[x] No unexpected binary files in source (only doc/example PNG/SVG/GIF
assets, all RAT-excluded)
[x] All source files have ASF headers (or correct MIT attribution).
Apache RAT 0.15 on the src tarball: 675 files, 0 unapproved.
Same on sdist: 314 files, 0 unapproved. The MIT files PJ flagged
in RC1 (deep-researcher prompts.py / utils.py, button.tsx) now
correctly carry MIT attribution rather than ASF headers.
[x] Can compile from source. Built a wheel from the sdist via
`pip install apache-burr-0.42.0-incubating-sdist.tar.gz` (flit
backend, Python 3.14). Installed the convenience wheel with
[learn] extras in a fresh venv; `burr` starts the server and
/api/v0/projects returns the four bundled demo projects, so the
RC2 issue with the wheel missing tests/__init__.py and the
examples package is no longer reproducible.
[x] Git tag v0.42.0-incubating-RC3 resolves to
7c64f50619a47332badbe152d2ca1992fd422026, matching the
announcement. Source tarball matches the git tree at the tag
(only diff: the BentoBurr submodule placeholder under
examples/deployment/bentoml/, which is expected from `git archive`).
Non-blocking observations for the PPMC's consideration; none of these
change my +1, but flagging in case you want to address them in the
final or in a 0.42.1 follow-up:
1. Sdist license metadata is narrower than sdist contents.
pyproject.toml's `license-files = ["LICENSE-wheel", "NOTICE",
"DISCLAIMER"]` makes PKG-INFO declare only LICENSE-wheel as a
License-File. But the sdist ships website/src/components/ui/*.tsx
(Magic UI + shadcn/ui, MIT) which LICENSE-wheel does not attribute
- the full LICENSE (which does cover them) sits at sdist root but
isn't declared in PKG-INFO. A human inspecting the sdist sees both
files and is fine; tooling that consumes PEP 639 metadata only sees
LICENSE-wheel. Easy fix would be either adding LICENSE to
license-files or excluding website/ from the sdist.
2. The convenience wheel bundles a webpack-built
burr/tracking/server/build/static/js/main.ed8889c0.js (~1.7 MB)
that includes React, React-DOM, react-is, scheduler,
use-sync-external-store, @remix-run/router, React Router DOM, and
Prism, all MIT. The webpack-emitted main.ed8889c0.js.LICENSE.txt
sidecar contains only banner comments; LICENSE-wheel in the wheel's
dist-info/licenses/ does not enumerate these npm dependencies. The
strictest reading of ASF policy on bundled binaries would want each
listed in LICENSE-wheel. The deep-researcher fix from RC1
(PR #726) addressed the same class of issue for Python, so it
would be consistent to extend it to the npm bundle.
3. There is a leftover `v0.42.0` git tag from 2026-02-15 ("Bumps
version to 0.42.0") that predates the incubator release process for
this version and points at a different commit than
v0.42.0-incubating-RC3. It does not affect this vote, but
suggesting cleanup before publishing the final release tag so
downstream tooling doesn't get confused.
Thanks for the work on this RC and for the careful response to the
RC1/RC2 feedback.
Jarek Potiuk
On Wed, Apr 29, 2026 at 2:49 PM André Ahlert <[email protected]> wrote:
> Hello everyone!
>
> +1 (non-binding)
>
> Checked:
> Git tag
> RC2 blockers fix
> pip install of the wheel from the dist/ RC3 path with [learn] extras
> succeeds
>
> Did not verify: GPG signature chain against KEYS, full RAT run, sdist
> build-from-source.
>
> Thanks for the work on this.
>
> André Ahlert
> @andreahlert
>
> Em dom., 26 de abr. de 2026 às 17:04, <[email protected]>
> escreveu:
>
> > Hi all,
> >
> > This is a call for a vote on releasing Apache burr 0.42.0-incubating
> > release candidate 3.
> >
> > RC2 received a binding -1 from Stefan Krawczyk for two issues with the
> > convenience wheel: the burr server wouldn't start from a fresh install
> > (missing burr.examples.hello-world-counter from the wheel), and
> > pytest tests/ failed for missing tests/__init__.py. Both fixed in RC3
> > (#745). RC3 also fixes a stray newline in the burr/examples symlink
> > that broke RAT and Linux tarball extraction (#748).
> >
> > Notable changes since 0.41.0:
> > - Bedrock integration: BedrockAction and BedrockStreamingAction (#677)
> > - Remove phone-home telemetry per ASF policy
> > - Add override_state_values support to initialize_from
> > - Add comparison and identity operators to when() conditions
> > - Add AST-based linter for undeclared state reads in function actions
> > (#656)
> > - Add flexible_api decorator to fix mypy override errors (#683)
> > - Support async with on async persister factory methods (#681)
> > - Graceful stream shutdown on exceptions in streaming actions (#680)
> > - Enable Burr UI to be added to existing FastAPI app (#671)
> > - Add toggle to show/hide input nodes in graph view
> > - Implement counter app demo in Burr UI (#675)
> > - Add Next.js landing page for burr.apache.org (#679)
> > - Add ecosystem page (#661)
> > - Cloud native AWS deployment support (#666)
> > - Fix pydantic warnings and minimum pins to pydantic >=2.0 (#668)
> > - Release-validation CI: builds artifacts, runs Apache RAT, and
> > end-to-end smoke tests the wheel from a fresh venv on every PR
> > - Licensing cleanup: correct MIT attribution for third-party files,
> > proper basename-based RAT excludes
> >
> > The artifacts for this release candidate can be found at:
> >
> https://dist.apache.org/repos/dist/dev/incubator/burr/0.42.0-incubating-RC3
> >
> > The Git tag to be voted upon is: v0.42.0-incubating-RC3
> > With hash: 7c64f50619a47332badbe152d2ca1992fd422026
> >
> > GPG keys: https://downloads.apache.org/incubator/burr/KEYS
> >
> > The artifacts include:
> > - Full source archive (git archive)
> > - Wheel (binary distribution with UI and bundled examples)
> > - Sdist (source for building wheel)
> >
> > Verification instructions:
> > https://github.com/apache/burr/blob/main/scripts/README.md
> >
> > Quick test:
> > svn export
> >
> https://dist.apache.org/repos/dist/dev/incubator/burr/0.42.0-incubating-RC3/
> > burr-rc3
> > <
> https://dist.apache.org/repos/dist/dev/incubator/burr/0.42.0-incubating-RC3/burr-rc3
> >
> > cd burr-rc3
> > pip install "apache_burr-0.42.0-py3-none-any.whl[learn]"
> > burr
> >
> > The vote will run for a minimum of 72 hours.
> >
> > [ ] +1 Release this package as Apache burr 0.42.0-incubating
> > [ ] +0 No opinion
> > [ ] -1 Do not release this package because...
> >
> > Verification checklist:
> > [ ] Download links are valid
> > [ ] Checksums and signatures are valid
> > [ ] LICENSE/NOTICE/DISCLAIMER files exist
> > [ ] No unexpected binary files in source
> > [ ] All source files have ASF headers (or correct MIT attribution)
> > [ ] Can compile from source
> >
> > Thanks,
> > Elijah
> >
>
