Apoorv, I know we are a couple of days past code freeze but I'd like to include this bug fix https://issues.apache.org/jira/browse/KAFKA-20416 into the 4.2.2 release. I have a PR https://issues.apache.org/jira/browse/KAFKA-20416 ready to go now and should be ready to cherry-pick soon.
Let me know if you agree about including this. -Bill On Thu, Sep 3, 2026 at 6:28 AM Apoorv Mittal <[email protected]> wrote: > Thanks Chia, > I have cherry-picked KAFKA-20840 > <https://issues.apache.org/jira/browse/KAFKA-20840>, KAFKA-20936 > <https://issues.apache.org/jira/browse/KAFKA-20936>and KAFKA-20815 > <https://issues.apache.org/jira/browse/KAFKA-20815> to the 4.2 branch and > updated the Jiras to reflect this in the plan. > > > https://github.com/apache/kafka/commit/c5b7c420ac98430dd0cf476f05a1f95e8dfc3057 > > https://github.com/apache/kafka/commit/60b90583bf578af155811f35e467ef954625d971 > > https://github.com/apache/kafka/commit/7b2e8eded11916a4f462b29c7ee167b0a8ecaa9e > > Regards, > Apoorv Mittal > > > On Wed, Sep 2, 2026 at 4:55 PM Chia-Ping Tsai <[email protected]> wrote: > > > Hi Apoorv > > > > grype on 4.2 shows these dependency CVEs not yet on the 4.2.2 plan: > > > > jline 3.30.4 -> 3.30.14 CVE-2026-56740/56741 > > jetty 12.0.34 -> 12.0.37 CVE-2026-10050/10051/8384/6790 > > lz4-java 1.10.1 -> 1.11.2 CVE-2026-59949 > > > > Should we fix them for 4.2.2? > > > > Best, > > Chia-Ping > > > > > > Chia-Ping Tsai <[email protected]> 於 2026年9月2日週三 下午10:18寫道： > > > > > Hi Apoorv > > > > > > thanks for the plan. It is great! > > > > > > typo: Septmber > > > > > > > > > Bill Bejeck <[email protected]> 於 2026年9月2日週三 下午9:46寫道： > > > > > >> Thanks for volunteering Apoorv! > > >> > > >> It's +1 from me for the release plan. > > >> > > >> -Bill > > >> > > >> On Tue, Sep 1, 2026 at 11:08 AM Apoorv Mittal < > [email protected] > > > > > >> wrote: > > >> > > >> > Hi all, > > >> > > > >> > I’ll be the release manager for the 4.2.2 bug fix release. > > >> > > > >> > Here's the 4.2.2 release plan > > >> > < > > >> > > > >> > > > >> > > > https://cwiki.apache.org/confluence/spaces/KAFKA/pages/451971202/Release+Plan+4.2.2 > > >> > >. > > >> > > > >> > The code freeze date will be on Tuesday 15 September 2026 (I kept > it 2 > > >> > weeks from now as there is only 1 outstanding issue currently to be > > >> > resolved and 4.3.2 release to follow shortly as well). > > >> > > > >> > The first release candidate will follow shortly after that. > > >> > > > >> > Please let me know if you have any concerns about the schedule. > > >> > > > >> > Regards, > > >> > Apoorv Mittal > > >> > > > >> > > > > > >
