+1
Thanks for putting this together, Andor. I evaluated the candidate using Claude
and found the following.
Verified:
* SHA-512 checksums for both source and binary tarballs.
* GPG signatures on both tarballs and on the staged Maven artifacts
(jar, pom, sources) — all good, signed with
3F7A1D16FA4217B1DC75E1C9FFE35B7F15DFA1BA,
which is present in the project KEYS file.
* The source tarball is byte-identical to the release-3.9.6-0 tag
(1461 files, zero diffs).
* The zookeeper-3.9.6.jar in the Maven staging repo is byte-identical
(same SHA-256) to the one in the binary tarball.
* The running server reports version 3.9.6-a355171b..., matching the tag commit.
* branch-3.9 contains only "Prepared 3.9.7-SNAPSHOT" after the tag, so
nothing was left out of the candidate.
* LICENSE/NOTICE and the set of bundled jars match released 3.9.5.
* Built from source on JDK 11: clean. Test suite: 3171 tests, 0 failures,
0 errors, 4 skipped (reproduced across two independent full runs).
* Standalone smoke test from the binary tarball: CRUD, ACL enforcement,
four-letter words, and AdminServer all behave correctly.
* Smoke tests using a three-node ensemble: quorum formed, writes on a follower
replicated to all members, killed the leader and re-election succeeded, data
survived,
writes continued on a 2/3 quorum, and the restarted member rejoined and
caught up on data written while it was down.
* zkCli works on JDK 8, 11 and 21 — no regression from the JLine 3.30.14
upgrade (ZOOKEEPER-5075).
Tested on macOS (arm64).
A couple of non-blocking observations, all release-notes hygiene:
1. The release notes omit five changes that are in the tag, because their
fixVersion is 3.10.0 or unset:
ZOOKEEPER-5083 - Upgrade Jackson-databind to 2.22.2 (security)
ZOOKEEPER-5085 - Remove unused vulnerable prototype.js (security,
still unresolved with no fixVersion)
ZOOKEEPER-4992 - Avoid overriding same-subject certs in PEM trust store
ZOOKEEPER-5050 - Enhanced AdminServer documentation (still unresolved
with no fixVersion)
ZOOKEEPER-5035 - Remove loggraph from contrib
The first two are security-relevant, so users scanning the notes for CVE
coverage would miss them.
2. ZOOKEEPER-5041 is listed in the release notes but is resolved as
"Won't Fix". The Netty CVE it describes was addressed by ZOOKEEPER-5056,
5077 and 5086, so it is probably worth dropping from the notes.
Both of the above are JIRA metadata and can be corrected without
a new candidate, since the notes are generated dynamically.
One test, QuorumZxidSyncTest, had its surefire fork die during the full
runs, but it is untouched by this release, sets no system-exit guard, and
passes consistently when run on its own. My machine was heavily loaded at
the time, so I am treating it as local resource pressure rather than
anything in the candidate.
-Flavio
> On 8 Sep 2026, at 18:00, Patrick Hunt <[email protected]> wrote:
>
> +1 lgtm. xsum/sig validate, licenses look right and was able to build fine.
>
> Thanks!
>
> Patrick
>
> On Thu, Sep 3, 2026 at 12:45 PM Andor Molnár <[email protected]> wrote:
>
>> Hi,
>>
>> This is a release candidate for 3.9.6.
>>
>> This is a minor release with bug- and security fixes.
>>
>> The full release notes is available at:
>>
>> https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310801&version=12356754
>>
>> *** Please download, test and vote by September 11th 2026, 23:59 UTC+0. ***
>>
>> Source files:
>>
>> https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.6-candidate-0/
>>
>> Maven staging repo:
>> https://repository.apache.org/content/repositories/orgapachezookeeper-1117/
>>
>> The release candidate tag in git to be voted upon: release-3.9.6-0
>> https://github.com/apache/zookeeper/tree/release-3.9.6-0
>>
>> ZooKeeper's KEYS file containing PGP keys we use to sign the release:
>> https://www.apache.org/dist/zookeeper/KEYS
>>
>> The staging version of the website is:
>>
>> https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.6-candidate-0/website/index.html
>>
>>
>> Should we release this candidate?
>>
>> Andor
>>
>>
>>
