-1 for Jungtaek's additional suggestion because we voted to allow PMC to upgrade security-related dependency changes under the same rule.
https://lists.apache.org/thread/cqbxzvtyvpgfy8nqodjpo2ochfw01lzk [VOTE] Set a buffer time before we upgrade to the latest version of dependencies The following is the original vote content. > The proposal is: > For the apache/spark repo only, we can only upgrade third-party > dependencies (including Apache projects) to a version released at least > seven days ago. This covers Java, Python and all other dependencies. > Security upgrades are exempted and will be conducted by PMCs. AFAIK, the agent has been already helping us in the above context and Jungtaek's additional suggestion is only to ban the legit Apache Spark PMC security activities. Dongjoopn. --------------------------------------------------------------------- To unsubscribe e-mail: [email protected]
