Thanks Kevin, let me look into that. I also found a behavioral change, which I believe is problematic. PR 3575 changes how we emit statistics: https://github.com/apache/parquet-java/pull/3575. When there is one or more row-groups that don't have bounds we don't produce statistics at the file level. The PR changes this by always emitting the null-values (which will automatically produce file-level stats). In Iceberg we rely on the fact when statistics are null when one or more row-groups don't have stats: https://github.com/apache/iceberg/pull/17321#discussion_r3641772062. I think this behavioral change cause downstream issues which I think we should avoid as it might introduce correctness issues.
I took the liberty of creating a PR to revert that specific change: https://github.com/apache/parquet-java/pull/3688. Please chime in to let me know your thoughts. Kind regards, Fokko On 2026/07/22 21:43:03 Kevin Liu wrote: > I found a potential issue with the license and notice files that might be a > release blocker. > > Many of the jars lack license files, notice files, or both. > Out of 59 staged JARs: > - 40 lack both files > - 2 lack LICENSE > - 10 lack NOTICE > The remaining 7 contain both, but their contents might be incomplete or > outdated. > > Here's the script I used to verify and the result from the audit: > https://gist.github.com/kevinjqliu/2f899c085abb2716b13c220d4f52a677?permalink_comment_id=6271325#gistcomment-6271325 > > I also found that the NOTICE file's copyright year is out of date ( > https://github.com/apache/parquet-java/blob/83c2c80d49c57b1ae180df45229ee01dbceddc1e/NOTICE#L3 > ) > > This is my first time verifying a parquet-java release, so please let me > know if there's anything I'm missing. > > Best, > Kevin Liu > > On Wed, Jul 22, 2026 at 1:30 PM Steve Loughran <[email protected]> wrote: > > > +1 non-binding. > > > > I only audited the tarball and the maven artifacts, not the code; leaving > > that to others. I was answering the question "did the release-manager place > > anything malicious in the nexus artifacts", which is something you should > > be doing for all releases these days. > > > > Verified the RC1 source tarball and staged Maven artifacts: > > * Source tarball SHA-512 OK; GPG signature good (Fokko Driesprong, key 2F37 > > FE05 5E54 7EDD ACD9 A633 B13C 6981 6C5E 13EF). Signed Fokko's key BTW, as > > nobody else has. > > * Extracted source matches tag apache-parquet-1.18.0-rc1 exactly > > * All 15 staged modules (104 artifacts): SHA-1/MD5 checksums match and > > every GPG signature is good > > * Rebuilt from the tag with JDK 11 (mvn clean package): parquet-encoding > > and parquet-jackson jars are byte-identical to the release; the rest differ > > only in bytecode traceable to a javac string-concat idiom (String.valueOf + > > makeConcatWithConstants). > > * No structural differences (no added/removed classes, methods, or fields) > > and no new suspicious API calls in any jar. > > > > For anyone who wants to do that jar comparison, Auditor: > > https://github.com/steveloughran/auditor > > This disassembles the binary and looks at the bytecodes, so doesn't require > > a byte for byte match. Give it to claude to validate (as done here) and > > it'll analyse why there there's a mismatch. > > > > steve > > > > > > On Mon, 20 Jul 2026 at 15:30, Fokko Driesprong <[email protected]> > > wrote: > > > > > Hi everyone, > > > > > > I propose the following RC to be released as official Apache Parquet > > > 1.18.0 release. > > > > > > - The commit id is [5e2ad0969c7f411613671c5ef054d399995de5f9]( > > > > > https://github.com/apache/parquet-java/tree/5e2ad0969c7f411613671c5ef054d399995de5f9 > > > ) > > > - This corresponds to the tag: [apache-parquet-1.18.0-rc1]( > > > > > https://github.com/apache/parquet-java/releases/tag/apache-parquet-1.18.0-rc1 > > > ) > > > > > > The release tarball, signature, and checksums are here: > > > > > > - > > > > > https://dist.apache.org/repos/dist/dev/parquet/apache-parquet-1.18.0-rc1/ > > > > > > You can find the KEYS file here: > > > > > > - https://downloads.apache.org/parquet/KEYS > > > > > > You can find the changelog here: > > > > > > - > > > > > https://github.com/apache/parquet-java/releases/tag/apache-parquet-1.18.0-rc1 > > > > > > Binary artifacts are staged in Nexus here: > > > > > > - > > https://repository.apache.org/content/groups/staging/org/apache/parquet/ > > > > > > Please download, verify, and test. > > > > > > Please vote in the next 72 hours. > > > > > > [ ] +1 Release this as Apache Parquet 1.18.0 > > > [ ] +0 > > > [ ] -1 Do not release this because... > > > > > > Kind regards, > > > Fokko Driesprong > > >
