I’ve updated the release notes page here: https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.6-candidate-0/website/releasenotes.html
Andor > On Sep 9, 2026, at 11:41, Andor Molnár <[email protected]> wrote: > > Thanks Flavio for the thorough validation. > > Let me fix the release notes issue. I think we don’t necessarily have to > create a new RC for that. > > Regards, > Andor > > > > >> On Sep 9, 2026, at 11:35, Flavio Junqueira <[email protected]> >> wrote: >> >> +1 >> >> Thanks for putting this together, Andor. I evaluated the candidate using >> Claude and found the following. >> >> Verified: >> >> * SHA-512 checksums for both source and binary tarballs. >> * GPG signatures on both tarballs and on the staged Maven artifacts >> (jar, pom, sources) — all good, signed with >> 3F7A1D16FA4217B1DC75E1C9FFE35B7F15DFA1BA, >> which is present in the project KEYS file. >> * The source tarball is byte-identical to the release-3.9.6-0 tag >> (1461 files, zero diffs). >> * The zookeeper-3.9.6.jar in the Maven staging repo is byte-identical >> (same SHA-256) to the one in the binary tarball. >> * The running server reports version 3.9.6-a355171b..., matching the tag >> commit. >> * branch-3.9 contains only "Prepared 3.9.7-SNAPSHOT" after the tag, so >> nothing was left out of the candidate. >> * LICENSE/NOTICE and the set of bundled jars match released 3.9.5. >> * Built from source on JDK 11: clean. Test suite: 3171 tests, 0 failures, >> 0 errors, 4 skipped (reproduced across two independent full runs). >> * Standalone smoke test from the binary tarball: CRUD, ACL enforcement, >> four-letter words, and AdminServer all behave correctly. >> * Smoke tests using a three-node ensemble: quorum formed, writes on a >> follower >> replicated to all members, killed the leader and re-election succeeded, data >> survived, >> writes continued on a 2/3 quorum, and the restarted member rejoined and >> caught up on data written while it was down. >> * zkCli works on JDK 8, 11 and 21 — no regression from the JLine 3.30.14 >> upgrade (ZOOKEEPER-5075). >> >> Tested on macOS (arm64). >> >> A couple of non-blocking observations, all release-notes hygiene: >> >> 1. The release notes omit five changes that are in the tag, because their >> fixVersion is 3.10.0 or unset: >> >> ZOOKEEPER-5083 - Upgrade Jackson-databind to 2.22.2 (security) >> ZOOKEEPER-5085 - Remove unused vulnerable prototype.js (security, >> still unresolved with no fixVersion) >> ZOOKEEPER-4992 - Avoid overriding same-subject certs in PEM trust store >> ZOOKEEPER-5050 - Enhanced AdminServer documentation (still unresolved >> with no fixVersion) >> ZOOKEEPER-5035 - Remove loggraph from contrib >> >> The first two are security-relevant, so users scanning the notes for CVE >> coverage would miss them. >> >> 2. ZOOKEEPER-5041 is listed in the release notes but is resolved as >> "Won't Fix". The Netty CVE it describes was addressed by ZOOKEEPER-5056, >> 5077 and 5086, so it is probably worth dropping from the notes. >> >> Both of the above are JIRA metadata and can be corrected without >> a new candidate, since the notes are generated dynamically. >> >> One test, QuorumZxidSyncTest, had its surefire fork die during the full >> runs, but it is untouched by this release, sets no system-exit guard, and >> passes consistently when run on its own. My machine was heavily loaded at >> the time, so I am treating it as local resource pressure rather than >> anything in the candidate. >> >> -Flavio >> >> >>> On 8 Sep 2026, at 18:00, Patrick Hunt <[email protected]> wrote: >>> >>> +1 lgtm. xsum/sig validate, licenses look right and was able to build fine. >>> >>> Thanks! >>> >>> Patrick >>> >>> On Thu, Sep 3, 2026 at 12:45 PM Andor Molnár <[email protected]> wrote: >>> >>>> Hi, >>>> >>>> This is a release candidate for 3.9.6. >>>> >>>> This is a minor release with bug- and security fixes. >>>> >>>> The full release notes is available at: >>>> >>>> https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310801&version=12356754 >>>> >>>> *** Please download, test and vote by September 11th 2026, 23:59 UTC+0. *** >>>> >>>> Source files: >>>> >>>> https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.6-candidate-0/ >>>> >>>> Maven staging repo: >>>> https://repository.apache.org/content/repositories/orgapachezookeeper-1117/ >>>> >>>> The release candidate tag in git to be voted upon: release-3.9.6-0 >>>> https://github.com/apache/zookeeper/tree/release-3.9.6-0 >>>> >>>> ZooKeeper's KEYS file containing PGP keys we use to sign the release: >>>> https://www.apache.org/dist/zookeeper/KEYS >>>> >>>> The staging version of the website is: >>>> >>>> https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.6-candidate-0/website/index.html >>>> >>>> >>>> Should we release this candidate? >>>> >>>> Andor >>>> >>>> >>>> >> >
