Hi everyone, Please review and vote on release candidate #1 for Apache Paimon Rust 0.5.0.
[ ] +1 Approve the release [ ] +0 No opinion [ ] -1 Do not approve (please provide specific comments) Source candidate, signature, and SHA-512 checksum: https://dist.apache.org/repos/dist/dev/paimon/paimon-rust-0.5.0-rc1/ Git tag: https://github.com/apache/paimon-rust/tree/v0.5.0-rc1 Git commit: 370428b053da5692fad3cf9db32f95e62d72ab98 KEYS for signature verification: https://downloads.apache.org/paimon/KEYS Verification instructions: https://github.com/apache/paimon-rust/blob/v0.5.0-rc1/docs/src/release/verifying-a-release-candidate.md Changes since 0.4.0: https://github.com/apache/paimon-rust/compare/v0.4.0...v0.5.0-rc1 Release validation workflow: https://github.com/apache/paimon-rust/actions/runs/40314807343 The automated release workflows are currently waiting for GitHub-hosted Linux runners. The source commit passed all 16 project CI checks before the candidate was tagged: https://github.com/apache/paimon-rust/actions/runs/40205637621 The vote is on the signed source artifacts linked above. The release workflow results and language-specific candidate artifacts will be available as the queued builds complete. Local validation completed: dependency report verification, dependency license checks, all-feature packaging and compilation of both Rust crates, paimon publication dry run, signed tag and source signature verification, and SHA-512 verification. The staged source artifacts were downloaded and compared byte for byte with the local originals. The following pre-existing dependency advisory alerts remain open for review in this candidate: - thrift 0.17.0 via parquet 58.4.0: https://github.com/advisories/GHSA-2f9f-gq7v-9h6m - Python binding pyo3 0.28.3: https://github.com/advisories/GHSA-36hh-v3qg-5jq4 and https://github.com/advisories/GHSA-chgr-c6px-7xpp - Go binding klauspost/compress 1.17.11: https://github.com/advisories/GHSA-259r-337f-4rfw These dependency alerts have not been fixed or dismissed in this candidate. Initial source inspection found that the Go binding imports zstd rather than the affected s2 API, and found no direct use of the affected PyO3 APIs in the Python binding. This is not a complete transitive reachability audit. The vote will be open for at least 72 hours. Thanks, Jingsong Lee
