+1 (binding) I did the following tests for the release candidate: - verified checksum and gpg signature of the artifacts - I built the source code (incl. the C-client, using -Pfull-build) on Ubuntu 22.04.5 using OpenJDK 8u402, maven 3.9.6 and GCC version 11.4.0 - all the java unit tests passed for me - all the C-client tests passed too - I also built and executed unit tests for zkpython - I also built the java code (without -Pfull-build) using other JDK versions: 11.0.28, 17.0.16, 21.0.8, 23.0.2 (but didn't run the tests this time, just used 'clean install -DskipTests') - checkstyle and spotbugs passed - apache-rat passed - fatjar built - I executed quick rolling-upgrade tests without SSL (using https://github.com/symat/zk-rolling-upgrade-test): - rolling upgrade from 3.6.4 to 3.8.7 RC0 - rolling upgrade from 3.7.2 to 3.8.7 RC0 - rolling upgrade from 3.8.6 to 3.8.7 RC0 - rolling upgrade from 3.8.7 RC0 to 3.9.5 - rolling upgrade from 3.8.7 RC0 to 3.9.6 RC0 - checked the uploaded documentation ( https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.8.7-candidate-0/website/index.html ) - compared generated release notes ( https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.8.7-candidate-0/website/releasenotes.html) with Jira ( https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310801&version=12356710 )
nit: I found some older CVEs failing for jetty 9.4.58 (see https://ci-hadoop.apache.org/view/ZooKeeper/job/zookeeper-multi-branch-owasp/job/branch-3.8/157/console) , but since jetty 9 is EOL (and the later security patches are only available with extended support AFAICT - https://jetty.org/security.html), I guess we can not really do anything about it. Maybe we could suppress these CVEs later: - CVE-2025-11143 - CVE-2026-2332 - CVE-2026-5795 - CVE-2026-10050 - CVE-2026-6790 It is strange, that these doesn't always cause problems in the OWASP jenkins runs (e.g. runs on branch-3.8.7 are green, when they shouldn't be green: https://ci-hadoop.apache.org/view/ZooKeeper/job/zookeeper-multi-branch-owasp/job/branch-3.8.7/ ). I fear there is some problem with the job configuration. Best regards, Máté On Wed, Sep 9, 2026 at 8:47 PM Andor Molnár <[email protected]> wrote: > I’ve updated the release notes page based on Flavio’s validation at the > other release. > > > https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.8.7-candidate-0/website/releasenotes.html > > Regards, > Andor > > > > > On Sep 8, 2026, at 10:54, Patrick Hunt <[email protected]> wrote: > > > > +1 lgtm. xsum/sig validate, licenses look right and was able to build > fine. > > > > Minor nit: there is a license file for which there is no jar, might be > > worth cleaning up for the next release/rc... > > jetty-client-9.4.58.v20250814.LICENSE.txt > > > > Thanks! > > > > Patrick > > > > > > On Thu, Sep 3, 2026 at 11:16 AM Andor Molnár <[email protected]> wrote: > > > >> Hi, > >> > >> This is a release candidate for 3.8.7 > >> > >> This is a minor release with bug- and security fixes. > >> > >> The full release notes is available at: > >> > >> > >> > https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310801&version=12356710 > >> > >> *** Please download, test and vote by September 11th 2026, 23:59 UTC+0. > *** > >> > >> Source files: > >> > >> > https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.8.7-candidate-0/ > >> > >> Maven staging repo: > >> > https://repository.apache.org/content/repositories/orgapachezookeeper-1116/ > >> > >> The release candidate tag in git to be voted upon: release-3.8.7-0 > >> https://github.com/apache/zookeeper/tree/release-3.8.7-0 > >> > >> ZooKeeper's KEYS file containing PGP keys we use to sign the release: > >> https://www.apache.org/dist/zookeeper/KEYS > >> > >> The staging version of the website is: > >> > >> > https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.8.7-candidate-0/website/index.html > >> > >> > >> Should we release this candidate? > >> > >> Andor > >> > >> > >> > >
