Hi everyone, After cherry-picking almost all commits from main (up to "AVRO-3088: [C++] Rename CMake package name to avro-cpp (#3477)"), I've created a RC0 of Avro 1.12.1. The "almost" is the maven-javadoc-plugin: I've undone the upgrade to version 3.11.3, as that caused the build to fail.
*I'd like to propose to release this RC0 as the official Apache Avro 1.12.1 release.* The commit id is https://github.com/apache/avro/commit/https://github.com/apache/avro/commit/9110c693767c1dde2665b2b57939333478b12036 This corresponds to the tag: release-1.12.1-rc0: https://github.com/apache/avro/tree/release-1.12.1-RC0 The release tarball, signature, and checksums are here (revision r79089): https://dist.apache.org/repos/dist/dev/avro/avro-1.12.1-rc0/ The Maven artefacts are staged here: https://repository.apache.org/content/repositories/orgapacheavro-1043/org/apache/avro/ You can find the KEYS file here: https://dist.apache.org/repos/dist/release/avro/KEYS This release includes the following security fixes: * Prevent class with empty Java package being trusted by SpecificDatumReader (#3311) * Remove the default serializable packages and deprecated the property to introduce org.apache.avro.SERIALIZABLE_CLASSES instead (#3376) * java-[key-]class allowed packages must be packages (#3453) In addition, this release includes approx. 200 changes & 170 version changes. The full list is here: https://github.com/apache/avro/compare/release-1.12.0...release-1.12.1-rc0 Please download, verify, and test. This vote will remain open for at least 72 hours. [ ] +1 Release this as Apache Avro 1.11.5 [ ] 0 [ ] -1 Do not release this because... Kind regards, Oscar -- ✉️ Oscar Westra van Holthe - Kind <[email protected]>🌐 https://github.com/opwvhk/
