Sure. Let's fix this. Someone volunteer to create PR?
fyi, I'll be out of town from Friday to next Tuesday, so the release might suffer some delay, apologies. Andor On Tue, 2024-10-08 at 10:02 +0200, Szalay-Bekő Máté wrote: > someone also created a related Jira ticket: > https://issues.apache.org/jira/browse/ZOOKEEPER-4868 > > On Tue, Oct 8, 2024 at 9:35 AM Szalay-Bekő Máté > <szalay.beko.m...@gmail.com> > wrote: > > > I am also checking the release, and the dependency-check maven task > > just > > failed for me: > > > > [ERROR] One or more dependencies were identified with > > vulnerabilities that > > have a CVSS score greater than or equal to '0.0': > > [ERROR] > > [ERROR] commons-io-2.11.0.jar: CVE-2024-47554(8.7) > > > > the CVE is a new one, about XmlStreamReader class: > > https://nvd.nist.gov/vuln/detail/CVE-2024-47554 > > > > I had no time to check the code if we use this from commons-io, but > > regardless I think we should consider a new RC. > > What do you think? > > > > Best Regards, > > Máté > > > > On Tue, Oct 8, 2024 at 12:37 AM tison <wander4...@gmail.com> wrote: > > > > > +1 (binding) > > > > > > - download link valid > > > - checksum matches > > > - signature valid > > > > > > gpg: Signature made 二 10/ 1 14:32:16 2024 MDT > > > gpg: using RSA key > > > 3F7A1D16FA4217B1DC75E1C9FFE35B7F15DFA1BA > > > gpg: issuer "an...@apache.org" > > > gpg: Good signature from "Andor Molnar <an...@apache.org>" > > > [unknown] > > > gpg: WARNING: The key's User ID is not certified with a trusted > > > signature! > > > gpg: There is no indication that the signature belongs > > > to the > > > owner. > > > Primary key fingerprint: 3F7A 1D16 FA42 17B1 DC75 E1C9 FFE3 5B7F > > > 15DF > > > A1BA > > > > > > - license and notice ok > > > - can build from sources > > > - play with binary doesn't fail > > > > > > Best, > > > tison. > > > > > > Andor Molnar <an...@apache.org> 于2024年10月7日周一 16:08写道： > > > > > > > > +1 (binding) > > > > > > > > - release notes looks good > > > > - signatures and checksum OK > > > > - Java and CPP build and unit tests passed on Ubuntu 24.04 with > > > > OpenJDK > > > > version "11.0.12" > > > > - spotbugs check OK > > > > - checkstyle check OK > > > > - owasp dependency check OK > > > > - quorum created successfully with quorum TLS and client TLS > > > > (both from > > > > source and binary) > > > > - some basic smoke tests OK (create, get, set, etc.) > > > > - zk-smoketests.py, zk-latencies.py OK > > > > > > > > Confirmed that full-build and unit tests doesn't work with JDK > > > > 17. Not > > > > a showstopper, but ticket should be opened if you want to > > > > support it. > > > > > > > > Andor > > > > > > > > > > > > > > > > > > > > On Tue, 2024-10-01 at 16:28 -0500, Andor Molnar wrote: > > > > > This is a release candidate for 3.9.3. > > > > > > > > > > This is a bugfix release for the 3.9 release line. Includes > > > > > important > > > > > dependency upgrades to address CVEs, several bug- and > > > > > performance > > > > > fixes. > > > > > > > > > > The full release notes is available at: > > > > > > > > > > > > > https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310801&version=12354432 > > > > > > > > > > *** Please download, test and vote by October 7th 2024, 23:59 > > > > > UTC+0. > > > > > *** > > > > > > > > > > Source files: > > > > > > > > https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.3-candidate-0/ > > > > > > > > > > Maven staging repo: > > > > > > > > https://repository.apache.org/content/groups/staging/org/apache/zookeeper/zookeeper/3.9.3/ > > > > > > > > > > The release candidate tag in git to be voted upon: release- > > > > > 3.9.3-0 > > > > > https://github.com/apache/zookeeper/tree/release-3.9.3-0 > > > > > > > > > > ZooKeeper's KEYS file containing PGP keys we use to sign the > > > > > release: > > > > > https://www.apache.org/dist/zookeeper/KEYS > > > > > > > > > > The staging version of the website is: > > > > > > > > https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.3-candidate-0/website/index.html > > > > > > > > > > > > > > > Should we release this candidate? > > > > > > > > > > Andor > > > > > > > > > > > > > > > > > > >
