+1 (non-binding) - verified signature and checksums of the source release; SHA3 digests match the ATR manifest - verified signatures and SHA-1 checksums of all 22 staged Maven artifacts (2.2 and 2.3 variants), all signed with BC6CD4EF03758201DFC0A0371527796026E7062F from KEYS - source tarball matches tag v5.1.0-rc1, no binaries apart from the migration test snapshots - LICENSE/NOTICE present in the source and in every jar; RAT clean - flink-sql-connector-kafka bundles exactly the classes of kafka-clients 4.2.0, all relocated, as declared in its NOTICE - built from source with JDK 21, and with JDK 11 (-Drelease): the rebuilt flink-connector-kafka jar matches the staged 5.1.0-2.2 jar, apart from javac patch-level differences in string concatenation - staged jars are Java 11 bytecode, built with JDK 11.0.32 - every JIRA key in the commits since v5.0.0 is resolved with fixVersion kafka-5.1.0, and every issue in that fixVersion has a commit - no public or protected API removed since 5.0.0; the only @PublicEvolving change is KafkaDatasetFacet now extending DatasetConfigFacet (FLINK-39608) - CI on the tag is green; website PR looks right
Non-blocking notes, none of them regressions: 1. FLINK-39822 is still open (an umbrella), but its commit ab6182e9 is in this release with no fixVersion. 2. The README lists Java 11 and "mvn clean package -DskipTests", which fails on JDK 11 with "invalid target release: 17": flink-connector-parent 2.0.0 sets target 17 by default. It needs -Pjava11-target or -Drelease, as AGENTS.md says. Same in 5.0.0. 3. The 5.1.0-2.3 parent POM declares flink.version 2.2.1, as 5.0.0-2.2 declared 2.1.0. The Flink dependencies are provided, so the impact is small. 4. kafka-clients 4.2.0 brings lz4-java 1.10.1, which has open advisories (e.g. GHSA-mcr4-qmvw-px4g, GHSA-xx22-p4ch-683r). It is not bundled; FLINK-41116 (kafka-clients 4.4.0) would take it to 1.11.2. Sylwester On Mon, Oct 26, 2026 09:30 PM, [email protected] wrote: > +1 (binding) (snuyanzin) Sergey Nuyanzin > > +1 (binding) > > checked signatures/checksums > built from sources > checked tags > checked LICENSE/NOTICE > > > however I still have a number of nit-picks > > 1. There are lots of warnings/annotations in GHA CI [1] > 2. ATR does not show java version with what binaries were built > 3. ATR does not show type of key used for signing, especially given the > fact that for some users there are several keys in KEYS file > 4. ATR creates a wrong impression that it verifies for signature/checksums > however this is not true since it does it only for 3 files and didn't do it > for a bunch of others (for instance [2]) > > [1] > https://github.com/apache/flink-connector-kafka/actions/runs/40353173833 > [2] > https://repository.apache.org/content/repositories/orgapacheflink-1946/org/apache/flink/flink-connector-kafka-python/5.1.0-2.2/ > > -- > Sergey Nuyanzin (snuyanzin) > > This email was sent by [email protected] on the Apache Trusted > Releases platform >
