Thanks Chia, I have cherry-picked KAFKA-20840 <https://issues.apache.org/jira/browse/KAFKA-20840>, KAFKA-20936 <https://issues.apache.org/jira/browse/KAFKA-20936>and KAFKA-20815 <https://issues.apache.org/jira/browse/KAFKA-20815> to the 4.2 branch and updated the Jiras to reflect this in the plan.
https://github.com/apache/kafka/commit/c5b7c420ac98430dd0cf476f05a1f95e8dfc3057 https://github.com/apache/kafka/commit/60b90583bf578af155811f35e467ef954625d971 https://github.com/apache/kafka/commit/7b2e8eded11916a4f462b29c7ee167b0a8ecaa9e Regards, Apoorv Mittal On Wed, Sep 2, 2026 at 4:55 PM Chia-Ping Tsai <[email protected]> wrote: > Hi Apoorv > > grype on 4.2 shows these dependency CVEs not yet on the 4.2.2 plan: > > jline 3.30.4 -> 3.30.14 CVE-2026-56740/56741 > jetty 12.0.34 -> 12.0.37 CVE-2026-10050/10051/8384/6790 > lz4-java 1.10.1 -> 1.11.2 CVE-2026-59949 > > Should we fix them for 4.2.2? > > Best, > Chia-Ping > > > Chia-Ping Tsai <[email protected]> 於 2026年9月2日週三 下午10:18寫道： > > > Hi Apoorv > > > > thanks for the plan. It is great! > > > > typo: Septmber > > > > > > Bill Bejeck <[email protected]> 於 2026年9月2日週三 下午9:46寫道： > > > >> Thanks for volunteering Apoorv! > >> > >> It's +1 from me for the release plan. > >> > >> -Bill > >> > >> On Tue, Sep 1, 2026 at 11:08 AM Apoorv Mittal <[email protected] > > > >> wrote: > >> > >> > Hi all, > >> > > >> > I’ll be the release manager for the 4.2.2 bug fix release. > >> > > >> > Here's the 4.2.2 release plan > >> > < > >> > > >> > > >> > https://cwiki.apache.org/confluence/spaces/KAFKA/pages/451971202/Release+Plan+4.2.2 > >> > >. > >> > > >> > The code freeze date will be on Tuesday 15 September 2026 (I kept it 2 > >> > weeks from now as there is only 1 outstanding issue currently to be > >> > resolved and 4.3.2 release to follow shortly as well). > >> > > >> > The first release candidate will follow shortly after that. > >> > > >> > Please let me know if you have any concerns about the schedule. > >> > > >> > Regards, > >> > Apoorv Mittal > >> > > >> > > >
