[X] +1 Release this as Apache Burr 0.43.0 (binding) [ ] +0 [ ] -1 Do not release this package because... (reason required)
Checklist for reference: [X] Download links are valid [X] Checksums and signatures are valid [X] LICENSE/NOTICE files exist [X] No unexpected binary files in source [X] All source files have ASF headers [X] Can compile from source Additional color: - Verified all three SHA-512 checksums and detached signatures. The artifacts and signed RC tag were signed by Jernej Frank with fingerprint 3959 450E 4AA8 9991 1547 112F 25CA 7FC3 4D7C 68C1. - Verified the signed v0.43.0-incubating-RC1 tag at commit 971a3530f15c8e3b7174623f4f399ede13d07378. A clean source extraction matched the tag exactly: 986 entries with no differences. - LICENSE, NOTICE, and DISCLAIMER metadata were present and consistent across the source, sdist, and wheel. - Apache RAT 0.17 reported zero issues for the source, sdist, and wheel. - Found no unexpected compiled objects, packaged archives, unsafe archive paths, or other unexplained binaries in the source artifact. The expected images and UI favicon were present. - Built the sdist and wheel from source with Flit 4.0.2. The rebuilt wheel matched the released wheel by content, and both released Python artifacts passed `twine check`. - Ran the Python suite on Python 3.12: 664 passed and 6 skipped. Two initial Graphviz tests failed because the `tests` extra does not install the separate documented `graphviz` extra; after installing `graphviz`, the affected test module passed 5/5. - The tracking UI production build and Vitest test passed. - Installed the released wheel in an isolated environment. Core execution worked, the CLI loaded, and the repository's official `scripts/ci_smoke_server.py` check passed, including server startup, UI serving, tracked application execution, and persistence. - Verified that LICENSE-wheel covers all 130 npm packages bundled into the compiled UI. Two non-blocking follow-ups: - The release verifier's strict sdist checksum comparison reports a false negative caused by gzip/tar timestamps. The rebuilt and released sdists contain the same 332 files with identical extracted contents. - The UI currently reports one npm audit advisory in the transitive build dependency nanoid 3.3.16 and has Prettier lint findings. Neither affected the successful source build, UI test, or released wheel/server smoke test. Cheers, Stefan On Sun, Aug 9, 2026 at 2:24 PM Jernej Frank <[email protected]> wrote: > Hi all, > > I propose the following RC to be released as the official Apache Burr > 0.43.0 release. > > Apache Burr is an effort undergoing incubation at The Apache Software > Foundation (ASF), sponsored by the Apache Incubator. Incubation is required > of all newly accepted projects until a further review indicates that the > infrastructure, communications, and decision making process have stabilized > in a manner consistent with other successful ASF projects. While incubation > status is not necessarily a reflection of the completeness or stability of > the code, it does indicate that the project has yet to be fully endorsed by > the ASF. > > The artifacts for this release candidate can be found at: > https://dist.apache.org/repos/dist/dev/incubator/burr/0.43.0-incubating-RC1 > > The PyPI release candidate package will be available upon > successful release. > > The Git tag to be voted upon is: > v0.43.0-incubating-RC1 > > Release artifacts are signed with the release manager's GPG key. The KEYS > file is available at: > https://downloads.apache.org/incubator/burr/KEYS > > Changelog summary: > - Bump to 0.43.0 > - Use UTF-8 for test case JSON files (#860) > - fix(testing): read test case json as utf-8 (#872) > - chore(deps): bump brace-expansion, eslint and eslint-config-next (#866) > - Fix the shipped npm advisories, and actually run the UI test suite (#869) > - chore(deps): bump ip-address from 10.2.0 to 10.4.0 in /website (#870) > - chore(deps): bump hono from 4.12.32 to 4.13.0 in /website (#871) > - chore(deps): bump fast-uri from 3.1.4 to 3.1.5 in /website (#873) > - ... plus 53 more commits in v0.42.0-incubating..HEAD > > Please download, verify, and test the release candidate. > > For detailed step-by-step instructions on how to verify this release, > please see the > "For Voters: Verifying a Release" section in the scripts/README.md file > within the > source archive. > > The vote will run for a minimum of 72 hours and close no earlier than: > 2026-08-12 21:22 UTC > > Please vote: > > [ ] +1 Release this as Apache Burr 0.43.0 > [ ] +0 > [ ] -1 Do not release this package because... (reason required) > > Only PPMC members have binding votes, but community votes are encouraged. > > Checklist for reference: > [ ] Download links are valid > [ ] Checksums and signatures are valid > [ ] LICENSE/NOTICE files exist > [ ] No unexpected binary files in source > [ ] All source files have ASF headers > [ ] Can compile from source > > On behalf of the Apache Burr PPMC, > Jernej Frank >
