Thanks Flavio for the thorough validation. Let me fix the release notes issue. I think we don’t necessarily have to create a new RC for that.
Regards, Andor > On Sep 9, 2026, at 11:35, Flavio Junqueira <[email protected]> wrote: > > +1 > > Thanks for putting this together, Andor. I evaluated the candidate using > Claude and found the following. > > Verified: > > * SHA-512 checksums for both source and binary tarballs. > * GPG signatures on both tarballs and on the staged Maven artifacts > (jar, pom, sources) — all good, signed with > 3F7A1D16FA4217B1DC75E1C9FFE35B7F15DFA1BA, > which is present in the project KEYS file. > * The source tarball is byte-identical to the release-3.9.6-0 tag > (1461 files, zero diffs). > * The zookeeper-3.9.6.jar in the Maven staging repo is byte-identical > (same SHA-256) to the one in the binary tarball. > * The running server reports version 3.9.6-a355171b..., matching the tag > commit. > * branch-3.9 contains only "Prepared 3.9.7-SNAPSHOT" after the tag, so > nothing was left out of the candidate. > * LICENSE/NOTICE and the set of bundled jars match released 3.9.5. > * Built from source on JDK 11: clean. Test suite: 3171 tests, 0 failures, > 0 errors, 4 skipped (reproduced across two independent full runs). > * Standalone smoke test from the binary tarball: CRUD, ACL enforcement, > four-letter words, and AdminServer all behave correctly. > * Smoke tests using a three-node ensemble: quorum formed, writes on a follower > replicated to all members, killed the leader and re-election succeeded, data > survived, > writes continued on a 2/3 quorum, and the restarted member rejoined and > caught up on data written while it was down. > * zkCli works on JDK 8, 11 and 21 — no regression from the JLine 3.30.14 > upgrade (ZOOKEEPER-5075). > > Tested on macOS (arm64). > > A couple of non-blocking observations, all release-notes hygiene: > > 1. The release notes omit five changes that are in the tag, because their > fixVersion is 3.10.0 or unset: > > ZOOKEEPER-5083 - Upgrade Jackson-databind to 2.22.2 (security) > ZOOKEEPER-5085 - Remove unused vulnerable prototype.js (security, > still unresolved with no fixVersion) > ZOOKEEPER-4992 - Avoid overriding same-subject certs in PEM trust store > ZOOKEEPER-5050 - Enhanced AdminServer documentation (still unresolved > with no fixVersion) > ZOOKEEPER-5035 - Remove loggraph from contrib > > The first two are security-relevant, so users scanning the notes for CVE > coverage would miss them. > > 2. ZOOKEEPER-5041 is listed in the release notes but is resolved as > "Won't Fix". The Netty CVE it describes was addressed by ZOOKEEPER-5056, > 5077 and 5086, so it is probably worth dropping from the notes. > > Both of the above are JIRA metadata and can be corrected without > a new candidate, since the notes are generated dynamically. > > One test, QuorumZxidSyncTest, had its surefire fork die during the full > runs, but it is untouched by this release, sets no system-exit guard, and > passes consistently when run on its own. My machine was heavily loaded at > the time, so I am treating it as local resource pressure rather than > anything in the candidate. > > -Flavio > > >> On 8 Sep 2026, at 18:00, Patrick Hunt <[email protected]> wrote: >> >> +1 lgtm. xsum/sig validate, licenses look right and was able to build fine. >> >> Thanks! >> >> Patrick >> >> On Thu, Sep 3, 2026 at 12:45 PM Andor Molnár <[email protected]> wrote: >> >>> Hi, >>> >>> This is a release candidate for 3.9.6. >>> >>> This is a minor release with bug- and security fixes. >>> >>> The full release notes is available at: >>> >>> https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310801&version=12356754 >>> >>> *** Please download, test and vote by September 11th 2026, 23:59 UTC+0. *** >>> >>> Source files: >>> >>> https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.6-candidate-0/ >>> >>> Maven staging repo: >>> https://repository.apache.org/content/repositories/orgapachezookeeper-1117/ >>> >>> The release candidate tag in git to be voted upon: release-3.9.6-0 >>> https://github.com/apache/zookeeper/tree/release-3.9.6-0 >>> >>> ZooKeeper's KEYS file containing PGP keys we use to sign the release: >>> https://www.apache.org/dist/zookeeper/KEYS >>> >>> The staging version of the website is: >>> >>> https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.6-candidate-0/website/index.html >>> >>> >>> Should we release this candidate? >>> >>> Andor >>> >>> >>> >
