Sorry I was informed of a potential vulnerability/problem in new fromWKB in Spark 4.2, looking now at it.
Thanks Szehon On Mon, Jun 29, 2026 at 1:05 PM Allison Wang <[email protected]> wrote: > +1 > > On Mon, Jun 29, 2026 at 10:34 AM Max Gekk <[email protected]> wrote: > >> +1 >> >> On Mon, Jun 29, 2026 at 6:32 PM Xiao Li <[email protected]> wrote: >> > >> > +1 (binding) >> > >> > Verified on Linux (Ubuntu, JDK 17, Python 3.11): >> > >> > - Signatures: every artifact (source, the three binary distributions, >> the pyspark/pyspark_client/pyspark_connect tarballs, and SparkR) has a good >> GPG signature from the RM key 709226B910E0F10917123B6259B586ADA5A538D1, >> which is in KEYS. >> > - Checksums: SHA512 matches for all artifacts.- Tag/commit: v4.2.0-rc4 >> resolves to f92a807c06b, and the RELEASE metadata embedded in the binary >> distributions records the same git revision. >> > - Source build: compiled and packaged spark-core and its module >> dependencies from the source tarball with ./build/mvn on JDK 17 (BUILD >> SUCCESS). >> > - Binary distribution: ran SparkPi and a spark-shell Scala job (range >> aggregation + Spark SQL) — results correct. >> > - PySpark: pip-installed pyspark-4.2.0.tar.gz and ran DataFrame, Spark >> SQL, and a Python UDF in local mode — results correct. >> > >> > Thanks Huaxin for driving the release! >> > >> > Xiao >> > >> > Uroš Bojanić <[email protected]> 于2026年6月29日周一 09:12写道： >> >> >> >> +1 (non-binding) >> >> >> >> verified RC4 (tag v4.2.0-rc4, commit f92a807c06b) on macOS/arm64. >> >> >> >> - Good GPG signatures and SHA512 sums on all artifacts (source, three >> binaries, the PySpark/SparkR tarballs) against KEYS. >> >> - Built the full source tree from the tag with -Phive >> -Phive-thriftserver, got a clean BUILD SUCCESS across all 39 modules. >> >> - Ran quick smoke tests across every API surface: Java, Scala, SQL, >> and PySpark job from the bundled distro; all look good. >> >> - Sanity-checked the binary dist (RELEASE, LICENSE/NOTICE/licenses all >> present) and ran dev/check-license; RAT passes. >> >> - Diffed the docs against 4.1.0 and analyzed the changes (new pages, >> migration guides and version refs); all look good. >> >> >> >> Thank you Huaxin Gao! >> >> >> >> On 2026/06/27 00:21:32 [email protected] wrote: >> >> > Please vote on releasing the following candidate as Apache Spark >> version 4.2.0. >> >> > >> >> > The vote is open until Mon, 29 Jun 2026 18:21:31 PDT and passes if a >> majority +1 PMC votes are cast, with >> >> > a minimum of 3 +1 votes. >> >> > >> >> > [ ] +1 Release this package as Apache Spark 4.2.0 >> >> > [ ] -1 Do not release this package because ... >> >> > >> >> > To learn more about Apache Spark, please see >> https://spark.apache.org/ >> >> > >> >> > The tag to be voted on is v4.2.0-rc4 (commit f92a807c06b): >> >> > https://github.com/apache/spark/tree/v4.2.0-rc4 >> >> > >> >> > The release files, including signatures, digests, etc. can be found >> at: >> >> > https://dist.apache.org/repos/dist/dev/spark/v4.2.0-rc4-bin/ >> >> > >> >> > Signatures used for Spark RCs can be found in this file: >> >> > https://downloads.apache.org/spark/KEYS >> >> > >> >> > The staging repository for this release can be found at: >> >> > >> https://repository.apache.org/content/repositories/orgapachespark-1524/ >> >> > >> >> > The documentation corresponding to this release can be found at: >> >> > https://dist.apache.org/repos/dist/dev/spark/v4.2.0-rc4-docs/ >> >> > >> >> > The list of bug fixes going into 4.2.0 can be found at the following >> URL: >> >> > https://issues.apache.org/jira/projects/SPARK/versions/12356380 >> >> > >> >> > FAQ >> >> > >> >> > ========================= >> >> > How can I help test this release? >> >> > ========================= >> >> > >> >> > If you are a Spark user, you can help us test this release by taking >> >> > an existing Spark workload and running on this release candidate, >> then >> >> > reporting any regressions. >> >> > >> >> > If you're working in PySpark you can set up a virtual env and install >> >> > the current RC via "pip install >> https://dist.apache.org/repos/dist/dev/spark/v4.2.0-rc4-bin/pyspark-4.2.0.tar.gz >> " >> >> > and see if anything important breaks. >> >> > In the Java/Scala, you can add the staging repository to your >> project's resolvers and test >> >> > with the RC (make sure to clean up the artifact cache before/after so >> >> > you don't end up building with an out of date RC going forward). >> >> > >> >> > --------------------------------------------------------------------- >> >> > To unsubscribe e-mail: [email protected] >> >> > >> >> > >> >> >> >> --------------------------------------------------------------------- >> >> To unsubscribe e-mail: [email protected] >> >> >> >> --------------------------------------------------------------------- >> To unsubscribe e-mail: [email protected] >> >>
