Hi PJ, and everyone, Thank you, PJ, for bringing this up! I completely agree—I was actually just drafting a summary to kick off our graduation readiness discussion when your email came in.
Apache Fesod (Incubating) has been incubating since September 17, 2025. Below is a summary of our progress over the past year to help the community review our status and prepare the Maturity Model assessment. **Releases and development** - We have published four Apache incubating releases: 2.0.0, 2.0.1, 2.0.2, and 2.1.0. The most recent release, 2.1.0-incubating, was published on October 7, 2026 [1]. - The 2.1.0-incubating release included 110 merged pull requests covering features, fixes, documentation, tests, and build improvements [2]. - The 2.1.0 release went through multiple release candidates. Community members reviewed artifacts and reported their checks on the dev list, while mentors and IPMC members raised issues for the community to address [3][4]. **Community growth** - Since entering incubation, we have welcomed three new committers: Zhongqiang Gong, Jing Yang, and Nikita Kuprins [5][6][7]. - Jing Yang was subsequently invited to join the PPMC and was announced as a new PPMC member in October 2026 [8]. - We are continuing to follow the work of several other contributors who have made substantial contributions. We intend to recognize sustained contributions through the usual community process when appropriate. - Contributors have participated in release verification and project discussions. For example, the community discussed changes to CI approval settings, requested assistance from ASF Infrastructure, and confirmed the outcome on the dev list [9]. **Outreach** - On August 9, 2026, I participated in Community Over Code Asia 2026 as a PPMC member of Apache Fesod (Incubating). The session used the project's release practices as a case study to share our experience of running an incubating project [10]. **Security** - We have worked with security reporters and the ASF Security Team on reported vulnerabilities and published advisories. For example, CVE-2026-49328 was addressed in 2.0.2-incubating, and the reported DNS rebinding bypass, CVE-2026-107460, was addressed in 2.1.0-incubating [11][12]. **Branding and open legal question** - Our podling name search has been approved under PODLINGNAMESEARCH-246 [13]. - LEGAL-737 remains open and discusses how to handle Alibaba copyright notices in EasyExcel-derived source files. The issue includes a clarification of the scope of the software grant and feedback from mentors [14]. The related project issue is tracked in issue #1106 [15]. - We have already discussed this matter with our mentors, and we plan to reach out directly to the VP, Legal Affairs in the near future for final confirmation, ensuring it is fully resolved before moving to a graduation vote. - Given that the ASF has established precedents for handling similar copyright scenarios in the past, I believe this does not block us from starting our graduation readiness discussion and preparing the Maturity Model in parallel. I would appreciate our mentors' and the community's views on whether any further action is needed on this front. **Next steps** Following PJ's suggestion, our immediate next step will be to draft the Apache Project Maturity Model assessment [16] on our wiki/website based on the items above and share it on the dev list for review. In the meantime, please share your thoughts if you see any other areas—such as committer diversity, governance, branding, or infrastructure—where more work is needed before we move toward graduation. [1] https://fesod.apache.org/docs/download/ [2] https://fesod.apache.org/blog/2026/10/07/apache-fesod-2-1-0-incubating-released/ [3] https://lists.apache.org/thread.html/pvqm5m5vo984s7oc85c7j0yjgovwtjyr [4] https://lists.apache.org/thread.html/99zzwqt93g0912y35lo21jts5jk8sy6x [5] https://lists.apache.org/thread.html/wvdphtzbm7grnx6x0tp1ccnbvmpg42t5 [6] https://lists.apache.org/thread.html/jj5bd2l0zocpbb8zq7mgvrp92hw8n82m [7] https://lists.apache.org/thread.html/v5f1jvo6c9hmgcyyl5gqy0mj8rmfykz4 [8] https://lists.apache.org/thread.html/7mn38yxkozczswc5fqjrkfxd25bn3cjf [9] https://lists.apache.org/thread.html/d0s8kkshdvdy65fd2jrdf438oxo1c97l [10] https://asia.communityovercode.org/sessions/incubator-1187157.html [11] https://fesod.apache.org/blog/2026/06/11/cve-2026-49328/ [12] https://fesod.apache.org/blog/2026/10/14/cve-2026-107460/ [13] https://issues.apache.org/jira/browse/PODLINGNAMESEARCH-246 [14] https://issues.apache.org/jira/browse/LEGAL-737 [15] https://github.com/apache/fesod/issues/1106 [16] https://community.apache.org/apache-way/apache-project-maturity-model.html Best, Shuxin Pan --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
