I am voting +1 as per policy ( https://www.apache.org/foundation/voting.html#ReleaseVotes), which should get us over the line, but I've asked Jernej to take a quick look as well to bolster the binding votes one further:
[x] +1 Release this package as Apache burr 0.42.0-incubating [ ] +0 No opinion [ ] -1 Do not release this package because... Verification checklist: [x] Download links are valid [x] Checksums and signatures are valid [x] LICENSE/NOTICE/DISCLAIMER files exist [x] No unexpected binary files in source [x] All source files have ASF headers (or correct MIT attribution) [x] Can compile from source Thanks, Elijah On Sat, May 2, 2026 at 10:14 AM Stefan Krawczyk <[email protected]> wrote: > [x] +1 Release this package as Apache burr 0.42.0-incubating > > [ ] +0 No opinion > > [ ] -1 Do not release this package because... > > > > Verification checklist: > > [x] Download links are valid > > [x] Checksums and signatures are valid > > [x] LICENSE/NOTICE/DISCLAIMER files exist > > [x] No unexpected binary files in source > > [x] All source files have ASF headers (or correct MIT attribution) > > [x] Can compile from source > > > > Additional checks: > > > > > * • *GPG signatures valid for all 3 artifacts (signed by > [email protected], > key BB8B72B34AB9A664A109AA17A76CF4C80E4E5355) > > > * • *SHA512 checksums match for all 3 artifacts > > > > * • *Git tag v0.42.0-incubating-RC3 points to commit > 7c64f50619a47332badbe152d2ca1992fd422026 as stated > > > * • *Built wheel from source archive — identical file list (219 files) and > size to distributed wheel > > > * • **pytest tests/* passes: 539 passed, 4 skipped, 0 failures > > > > * • **burr* server starts from fresh install of distributed wheel (HTTP > 200) > > > > * • *RC2 fixes confirmed: *tests/__init__.py* present, > *hello-world-counter* > example in wheel > > > Cheers, > > > Stefan > > On Wed, Apr 29, 2026 at 6:54 AM Jarek Potiuk <[email protected]> wrote: > > > +1 (binding) > > > > Verification checklist: > > > > [x] Download links are valid > > [x] Checksums and signatures are valid (SHA-512 + GPG against KEYS, > > Elijah's key BB8B72B34AB9A664A109AA17A76CF4C80E4E5355) > > [x] LICENSE/NOTICE/DISCLAIMER files exist and look correct > > (DISCLAIMER is the standard incubator text; NOTICE attributes ASF > > and says "Apache Burr (Incubating)") > > [x] No unexpected binary files in source (only doc/example PNG/SVG/GIF > > assets, all RAT-excluded) > > [x] All source files have ASF headers (or correct MIT attribution). > > Apache RAT 0.15 on the src tarball: 675 files, 0 unapproved. > > Same on sdist: 314 files, 0 unapproved. The MIT files PJ flagged > > in RC1 (deep-researcher prompts.py / utils.py, button.tsx) now > > correctly carry MIT attribution rather than ASF headers. > > [x] Can compile from source. Built a wheel from the sdist via > > `pip install apache-burr-0.42.0-incubating-sdist.tar.gz` (flit > > backend, Python 3.14). Installed the convenience wheel with > > [learn] extras in a fresh venv; `burr` starts the server and > > /api/v0/projects returns the four bundled demo projects, so the > > RC2 issue with the wheel missing tests/__init__.py and the > > examples package is no longer reproducible. > > [x] Git tag v0.42.0-incubating-RC3 resolves to > > 7c64f50619a47332badbe152d2ca1992fd422026, matching the > > announcement. Source tarball matches the git tree at the tag > > (only diff: the BentoBurr submodule placeholder under > > examples/deployment/bentoml/, which is expected from `git archive`). > > > > Non-blocking observations for the PPMC's consideration; none of these > > change my +1, but flagging in case you want to address them in the > > final or in a 0.42.1 follow-up: > > > > 1. Sdist license metadata is narrower than sdist contents. > > pyproject.toml's `license-files = ["LICENSE-wheel", "NOTICE", > > "DISCLAIMER"]` makes PKG-INFO declare only LICENSE-wheel as a > > License-File. But the sdist ships website/src/components/ui/*.tsx > > (Magic UI + shadcn/ui, MIT) which LICENSE-wheel does not attribute > > - the full LICENSE (which does cover them) sits at sdist root but > > isn't declared in PKG-INFO. A human inspecting the sdist sees both > > files and is fine; tooling that consumes PEP 639 metadata only sees > > LICENSE-wheel. Easy fix would be either adding LICENSE to > > license-files or excluding website/ from the sdist. > > > > 2. The convenience wheel bundles a webpack-built > > burr/tracking/server/build/static/js/main.ed8889c0.js (~1.7 MB) > > that includes React, React-DOM, react-is, scheduler, > > use-sync-external-store, @remix-run/router, React Router DOM, and > > Prism, all MIT. The webpack-emitted main.ed8889c0.js.LICENSE.txt > > sidecar contains only banner comments; LICENSE-wheel in the wheel's > > dist-info/licenses/ does not enumerate these npm dependencies. The > > strictest reading of ASF policy on bundled binaries would want each > > listed in LICENSE-wheel. The deep-researcher fix from RC1 > > (PR #726) addressed the same class of issue for Python, so it > > would be consistent to extend it to the npm bundle. > > > > 3. There is a leftover `v0.42.0` git tag from 2026-02-15 ("Bumps > > version to 0.42.0") that predates the incubator release process for > > this version and points at a different commit than > > v0.42.0-incubating-RC3. It does not affect this vote, but > > suggesting cleanup before publishing the final release tag so > > downstream tooling doesn't get confused. > > > > Thanks for the work on this RC and for the careful response to the > > RC1/RC2 feedback. > > > > Jarek Potiuk > > > > On Wed, Apr 29, 2026 at 2:49 PM André Ahlert <[email protected]> wrote: > > > > > Hello everyone! > > > > > > +1 (non-binding) > > > > > > Checked: > > > Git tag > > > RC2 blockers fix > > > pip install of the wheel from the dist/ RC3 path with [learn] extras > > > succeeds > > > > > > Did not verify: GPG signature chain against KEYS, full RAT run, sdist > > > build-from-source. > > > > > > Thanks for the work on this. > > > > > > André Ahlert > > > @andreahlert > > > > > > Em dom., 26 de abr. de 2026 às 17:04, < > [email protected]> > > > escreveu: > > > > > > > Hi all, > > > > > > > > This is a call for a vote on releasing Apache burr 0.42.0-incubating > > > > release candidate 3. > > > > > > > > RC2 received a binding -1 from Stefan Krawczyk for two issues with > the > > > > convenience wheel: the burr server wouldn't start from a fresh > install > > > > (missing burr.examples.hello-world-counter from the wheel), and > > > > pytest tests/ failed for missing tests/__init__.py. Both fixed in RC3 > > > > (#745). RC3 also fixes a stray newline in the burr/examples symlink > > > > that broke RAT and Linux tarball extraction (#748). > > > > > > > > Notable changes since 0.41.0: > > > > - Bedrock integration: BedrockAction and BedrockStreamingAction > (#677) > > > > - Remove phone-home telemetry per ASF policy > > > > - Add override_state_values support to initialize_from > > > > - Add comparison and identity operators to when() conditions > > > > - Add AST-based linter for undeclared state reads in function actions > > > > (#656) > > > > - Add flexible_api decorator to fix mypy override errors (#683) > > > > - Support async with on async persister factory methods (#681) > > > > - Graceful stream shutdown on exceptions in streaming actions (#680) > > > > - Enable Burr UI to be added to existing FastAPI app (#671) > > > > - Add toggle to show/hide input nodes in graph view > > > > - Implement counter app demo in Burr UI (#675) > > > > - Add Next.js landing page for burr.apache.org (#679) > > > > - Add ecosystem page (#661) > > > > - Cloud native AWS deployment support (#666) > > > > - Fix pydantic warnings and minimum pins to pydantic >=2.0 (#668) > > > > - Release-validation CI: builds artifacts, runs Apache RAT, and > > > > end-to-end smoke tests the wheel from a fresh venv on every PR > > > > - Licensing cleanup: correct MIT attribution for third-party files, > > > > proper basename-based RAT excludes > > > > > > > > The artifacts for this release candidate can be found at: > > > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/burr/0.42.0-incubating-RC3 > > > > > > > > The Git tag to be voted upon is: v0.42.0-incubating-RC3 > > > > With hash: 7c64f50619a47332badbe152d2ca1992fd422026 > > > > > > > > GPG keys: https://downloads.apache.org/incubator/burr/KEYS > > > > > > > > The artifacts include: > > > > - Full source archive (git archive) > > > > - Wheel (binary distribution with UI and bundled examples) > > > > - Sdist (source for building wheel) > > > > > > > > Verification instructions: > > > > https://github.com/apache/burr/blob/main/scripts/README.md > > > > > > > > Quick test: > > > > svn export > > > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/burr/0.42.0-incubating-RC3/ > > > > burr-rc3 > > > > < > > > > > > https://dist.apache.org/repos/dist/dev/incubator/burr/0.42.0-incubating-RC3/burr-rc3 > > > > > > > > cd burr-rc3 > > > > pip install "apache_burr-0.42.0-py3-none-any.whl[learn]" > > > > burr > > > > > > > > The vote will run for a minimum of 72 hours. > > > > > > > > [ ] +1 Release this package as Apache burr 0.42.0-incubating > > > > [ ] +0 No opinion > > > > [ ] -1 Do not release this package because... > > > > > > > > Verification checklist: > > > > [ ] Download links are valid > > > > [ ] Checksums and signatures are valid > > > > [ ] LICENSE/NOTICE/DISCLAIMER files exist > > > > [ ] No unexpected binary files in source > > > > [ ] All source files have ASF headers (or correct MIT attribution) > > > > [ ] Can compile from source > > > > > > > > Thanks, > > > > Elijah > > > > > > > > > >
