Hi all, I am cancelling the vote for Apache Burr (Incubating) 0.43.0 RC0. The licensing issues identified during review have been addressed. A new RC1 candidate has been prepared, and I will start a fresh vote in a separate thread.
Thanks to everyone who reviewed RC0. Jernej On Mon, Aug 3, 2026 at 6:24 AM Jernej Frank <[email protected]> wrote: > Thanks Jared for spotting this. > > Let’s cancel this vote, get your PRs in and we will make an RC1 with a > separate vote threat shortly. > > Best, > Jernej > > > On 3 Aug 2026, at 06:20, Stefan Krawczyk <[email protected]> > wrote: > > > > Thanks Jarek! > > > >> On Sun, Aug 2, 2026 at 6:59 PM Jarek Potiuk <[email protected]> wrote: > >> > >> Following up on my -1 with fixes rather than just complaints. Two PRs, > >> both against main: > >> > >> #868 -- the blocker plus two papercuts > >> - LICENSE-wheel now lists all 130 npm packages compiled into the > >> tracking UI bundle (MIT 115, ISC 9, Apache-2.0 3, BSD-3-Clause 2, > >> PSF 1), generated from the build sourcemap rather than by hand, so > >> it cannot silently drift. NOTICE unchanged -- none of the 130 ships > >> a NOTICE file. > >> - release-validation.yml gains a --check step. RAT excludes > >> burr/tracking/server/build/**, so nothing was inspecting the only > >> content the wheel adds over the sdist; now something is. > >> - The botocore-above-importorskip fix, so `pytest tests/` runs for > >> voters without the [bedrock] extra. > >> - /api/v0/version off pkg_resources and onto importlib.metadata. > >> > >> All 29 checks green. > >> > >> #869 -- the npm advisories, stacked on #868 > >> 16 advisories down to 2. The one that actually mattered was > >> mdast-util-to-hast (unsanitized class attribute, 28 modules in the > >> bundle, reached via react-markdown when it renders trace and chat > >> content). The rest were build-time only. > >> > >> The 2 remaining are react-router, still in range at 7.18.2; the only > >> fix is a major bump to 8.3.0. The advisory is about RSC mode and the > >> UI is a static client-side SPA with no RSC or server actions, so it > >> isn't reachable -- I'd suggest doing that upgrade deliberately rather > >> than as part of a release repair, but it is the PPMC's call. > >> > >> Two things I found while fixing the above that were not in my original > >> review: > >> > >> 1. The UI test suite has never run in CI. ui.yml builds, lints and > >> formats but never invokes vitest, so App.test.tsx -- the only UI > >> test -- executes nowhere, and it has been failing on newer Node with > >> no signal. Fixed in the second PR. > >> > >> 2. The cause of that failure is a real robustness bug, not a test > >> artifact: useTheme accessed window.localStorage behind only a > >> `typeof window` guard. Where storage is unreachable -- sandboxed > >> iframe, storage disabled, or Node's own localStorage global > >> shadowing jsdom's -- it throws during the initial useState and takes > >> down the entire App render, not just the theme. Also fixed there. > >> > >> Still open from my review, needing a PPMC decision rather than a patch: > >> website/public/logos/taskhuman.svg is a third-party company mark in the > >> voted source archive with no recorded provenance or permission, and RAT > >> skips it because **/*.svg is excluded. Someone who knows the history > >> should confirm permission exists, or it should come out. Happy to file > >> an issue if that is easier to track. > >> > >> If both land I am glad to re-verify an RC1 quickly -- the whole check is > >> scripted on my end now, including a byte-for-byte rebuild of the wheel's > >> UI bundle from the source tarball. > >> > >> Jarek Potiuk > >> >
