I made a fix for this, it would be great to get it into the release. https://github.com/apache/spark/pull/56875
Thanks Huaxin! Szehon On Mon, Jun 29, 2026 at 4:54 PM Szehon Ho <[email protected]> wrote: > Sorry I was informed of a potential vulnerability/problem in new fromWKB > in Spark 4.2, looking now at it. > > Thanks > Szehon > > On Mon, Jun 29, 2026 at 1:05 PM Allison Wang <[email protected]> > wrote: > >> +1 >> >> On Mon, Jun 29, 2026 at 10:34 AM Max Gekk <[email protected]> wrote: >> >>> +1 >>> >>> On Mon, Jun 29, 2026 at 6:32 PM Xiao Li <[email protected]> wrote: >>> > >>> > +1 (binding) >>> > >>> > Verified on Linux (Ubuntu, JDK 17, Python 3.11): >>> > >>> > - Signatures: every artifact (source, the three binary distributions, >>> the pyspark/pyspark_client/pyspark_connect tarballs, and SparkR) has a good >>> GPG signature from the RM key 709226B910E0F10917123B6259B586ADA5A538D1, >>> which is in KEYS. >>> > - Checksums: SHA512 matches for all artifacts.- Tag/commit: v4.2.0-rc4 >>> resolves to f92a807c06b, and the RELEASE metadata embedded in the binary >>> distributions records the same git revision. >>> > - Source build: compiled and packaged spark-core and its module >>> dependencies from the source tarball with ./build/mvn on JDK 17 (BUILD >>> SUCCESS). >>> > - Binary distribution: ran SparkPi and a spark-shell Scala job (range >>> aggregation + Spark SQL) — results correct. >>> > - PySpark: pip-installed pyspark-4.2.0.tar.gz and ran DataFrame, Spark >>> SQL, and a Python UDF in local mode — results correct. >>> > >>> > Thanks Huaxin for driving the release! >>> > >>> > Xiao >>> > >>> > Uroš Bojanić <[email protected]> 于2026年6月29日周一 09:12写道： >>> >> >>> >> +1 (non-binding) >>> >> >>> >> verified RC4 (tag v4.2.0-rc4, commit f92a807c06b) on macOS/arm64. >>> >> >>> >> - Good GPG signatures and SHA512 sums on all artifacts (source, three >>> binaries, the PySpark/SparkR tarballs) against KEYS. >>> >> - Built the full source tree from the tag with -Phive >>> -Phive-thriftserver, got a clean BUILD SUCCESS across all 39 modules. >>> >> - Ran quick smoke tests across every API surface: Java, Scala, SQL, >>> and PySpark job from the bundled distro; all look good. >>> >> - Sanity-checked the binary dist (RELEASE, LICENSE/NOTICE/licenses >>> all present) and ran dev/check-license; RAT passes. >>> >> - Diffed the docs against 4.1.0 and analyzed the changes (new pages, >>> migration guides and version refs); all look good. >>> >> >>> >> Thank you Huaxin Gao! >>> >> >>> >> On 2026/06/27 00:21:32 [email protected] wrote: >>> >> > Please vote on releasing the following candidate as Apache Spark >>> version 4.2.0. >>> >> > >>> >> > The vote is open until Mon, 29 Jun 2026 18:21:31 PDT and passes if >>> a majority +1 PMC votes are cast, with >>> >> > a minimum of 3 +1 votes. >>> >> > >>> >> > [ ] +1 Release this package as Apache Spark 4.2.0 >>> >> > [ ] -1 Do not release this package because ... >>> >> > >>> >> > To learn more about Apache Spark, please see >>> https://spark.apache.org/ >>> >> > >>> >> > The tag to be voted on is v4.2.0-rc4 (commit f92a807c06b): >>> >> > https://github.com/apache/spark/tree/v4.2.0-rc4 >>> >> > >>> >> > The release files, including signatures, digests, etc. can be found >>> at: >>> >> > https://dist.apache.org/repos/dist/dev/spark/v4.2.0-rc4-bin/ >>> >> > >>> >> > Signatures used for Spark RCs can be found in this file: >>> >> > https://downloads.apache.org/spark/KEYS >>> >> > >>> >> > The staging repository for this release can be found at: >>> >> > >>> https://repository.apache.org/content/repositories/orgapachespark-1524/ >>> >> > >>> >> > The documentation corresponding to this release can be found at: >>> >> > https://dist.apache.org/repos/dist/dev/spark/v4.2.0-rc4-docs/ >>> >> > >>> >> > The list of bug fixes going into 4.2.0 can be found at the >>> following URL: >>> >> > https://issues.apache.org/jira/projects/SPARK/versions/12356380 >>> >> > >>> >> > FAQ >>> >> > >>> >> > ========================= >>> >> > How can I help test this release? >>> >> > ========================= >>> >> > >>> >> > If you are a Spark user, you can help us test this release by taking >>> >> > an existing Spark workload and running on this release candidate, >>> then >>> >> > reporting any regressions. >>> >> > >>> >> > If you're working in PySpark you can set up a virtual env and >>> install >>> >> > the current RC via "pip install >>> https://dist.apache.org/repos/dist/dev/spark/v4.2.0-rc4-bin/pyspark-4.2.0.tar.gz >>> " >>> >> > and see if anything important breaks. >>> >> > In the Java/Scala, you can add the staging repository to your >>> project's resolvers and test >>> >> > with the RC (make sure to clean up the artifact cache before/after >>> so >>> >> > you don't end up building with an out of date RC going forward). >>> >> > >>> >> > >>> --------------------------------------------------------------------- >>> >> > To unsubscribe e-mail: [email protected] >>> >> > >>> >> > >>> >> >>> >> --------------------------------------------------------------------- >>> >> To unsubscribe e-mail: [email protected] >>> >> >>> >>> --------------------------------------------------------------------- >>> To unsubscribe e-mail: [email protected] >>> >>>
