Hi Máté! I try to summarize the Jetty situation - or at least my understanding.
Jetty 9.x, 10.x and 11.x release lines are End Of Life / unsupported. Jetty 12.x is stable / supported line but it requires Java 17 as minimum Java version. Supporting Java 17 on master required us to drop support for Java 8 (ZOOKEEPER-5039). After we made Java 17 the min. supported version on master, Jetty has been upgraded there to 12.1.12 (ZOOKEEPER-5038). On branch-3.9 and branch-3.8 branches we have to keep Java 8 compatibility so unfortunately we cannot upgrade Jetty there. I think since we cannot upgrade Jetty on these branches, then it makes sense to suppress those Jetty CVE-s. Best Regards, Dávid Szalay-Bekő Máté <[email protected]> ezt írta (időpont: 2026. okt. 9., P, 9:50): > +1 (binding) > > OWASP is still failing for me because of jetty 9.4.58 (e.g. > CVE-2025-11143). > I don't know the strategy regarding the major Jetty upgrade (unfortunately, > I haven't had time to follow the mailing list recently). Could someone > summarize it quickly? > (If we agreed to postpone the Jetty upgrade until ZooKeeper 4 or ZooKeeper > 3.10, then we should suppress these CVEs: CVE-2025-11143, CVE-2026-2332, > CVE-2026-5795, CVE-2026-10050, CVE-2026-6790, because they are currently > breaking OWASP) > > I did the following tests for the release candidate: > - verified checksum and gpg signature of the artifacts > - I built the source code (incl. the C-client, using -Pfull-build) on > Ubuntu 22.04.5 using OpenJDK 8u402, maven 3.9.6 and GCC version 11.4.0 > - all the java unit tests passed for me > - all the C-client tests passed too > - I also built and executed unit tests for zkpython > - I also built the java code (without -Pfull-build) using other JDK > versions: 11.0.28, 17.0.16, 21.0.8, 23.0.2 (but didn't run the tests this > time, just used 'clean install -DskipTests') > - checkstyle and spotbugs passed > - apache-rat passed > - fatjar built > - I executed quick rolling-upgrade tests without SSL (using > https://github.com/symat/zk-rolling-upgrade-test): > - rolling upgrade from 3.6.4 to 3.9.7 RC0 > - rolling upgrade from 3.7.2 to 3.9.7 RC0 > - rolling upgrade from 3.8.7 to 3.9.7 RC0 > - rolling upgrade from 3.8.8 RC0 to 3.9.7 RC0 > - rolling upgrade from 3.9.6 to 3.9.7 RC0 > - checked the uploaded documentation ( > > https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.7-candidate-0/website/index.html > ) > - compared generated release notes ( > > https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.7-candidate-0/website/releasenotes.html > ) > with Jira ( > > https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310801&version=12357529 > ) > > On Thu, Oct 8, 2026 at 4:28 PM Dávid Paksy <[email protected]> wrote: > > > +1 (non-binding) > > > > - verified checksum and gpg signatures > > - checked license and notice are in place > > - built the source code (incl. the C-client, using -Pfull-build) on > > Ubuntu 24.04.5 using Temurin 1.8.0_492, Maven 3.8.8, GCC version 13.3.0 > > - spotbugs, checkstyle is successful > > - unit tests were successful > > - Also built the source with other Java versions (without -Pfull-build) > > 17.0.19, 21.0.11 > > - Started a 3-node ZooKeeper quorum locally without TLS, with AdminServer > > and PrometheusMetricsProvider, connected to it using zkCli.sh, basic CRUD > > operations are successful, checked logs - looks OK > > > > Dávid > > > > Andor Molnár <[email protected]> ezt írta (időpont: 2026. okt. 6., K, > > 20:15): > > > > > Hi, > > > > > > This is a release candidate for 3.9.7. > > > This is a minor release with bug- and security fixes. > > > > > > The full release notes is available at: > > > > > > > > > https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310801&version=12357529 > > > > > > *** Please download, test and vote by October 15th 2026, 23:59 UTC+0. > *** > > > > > > Source files: > > > > > > > > > https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.7-candidate-0/ > > > > > > Maven staging repo: > > > > > > https://repository.apache.org/content/repositories/orgapachezookeeper-1119/ > > > > > > The release candidate tag in git to be voted upon: release-3.9.7-0 > > > https://github.com/apache/zookeeper/tree/release-3.9.7-0 > > > > > > ZooKeeper's KEYS file containing PGP keys we use to sign the release: > > > https://www.apache.org/dist/zookeeper/KEYS > > > > > > The staging version of the website is: > > > > > > > > > https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.7-candidate-0/website/index.html > > > > > > > > > Should we release this candidate? > > > > > > Andor > > >
