This vote passes with the following binding +1 votes: - Henri Biestro (henrib) - Gary Gregory (ggregory) - Arnout Engelen (engelen)
Thank you all, Gary On Thu, Jul 2, 2026 at 4:04 PM Arnout Engelen <[email protected]> wrote: > > On Mon, Jun 29, 2026 at 1:10 AM Gary Gregory <[email protected]> wrote: > > For those of you following the bouncing ball on various mailing lists, > > this feature release should put the cap on the recent string of 3.6.x > > releases. > > > > We have added enhancements since the release of Apache Commons JEXL > > 3.6.4, so I would like to release Apache Commons JEXL 3.7.0. > > > > Apache Commons JEXL 3.7.0 RC1 is available for review here: > > https://dist.apache.org/repos/dist/dev/commons/jexl/3.7.0-RC1 (svn > > revision 85502) > > > > The Git tag commons-jexl-3.7.0-RC1 commit for this RC is > > 21827925ba6f4fff46ffe4c1f6c4fd41abc663a9, which you can browse here: > > Confirmed: > * the tag matches that rev > * the source .zip and .tar.gz with sha512sum > 16c2d884de119f0f84cc22efa6c013318875e1f8012063ab21d0d2663dea7b099a312e983a2aa62dce2490b2221fa3eea6cd536c524fd95f7d81fa3cd396f8f4 > and have no surprising differences with version control and gary's > F4DD59C90148BDC52BEB90A4530AA5F25C25011F signature matches > > > > > https://gitbox.apache.org/repos/asf?p=commons-jexl.git;a=commit;h=21827925ba6f4fff46ffe4c1f6c4fd41abc663a9 > > You may checkout this tag using: > > git clone https://gitbox.apache.org/repos/asf/commons-jexl.git > > --branch commons-jexl-3.7.0-RC1 commons-jexl-3.7.0-RC1 > > > > Maven artifacts are here: > > > > https://repository.apache.org/content/repositories/orgapachecommons-1952/org/apache/commons/commons-jexl3/3.7.0/ > > Building the jar from sources produces bit-by-bit the pom and jar > artifacts staged there with sha512sums > c20f76f9a75c0856e3704e888ec8142ce1aaa8e0b4844a36705d0887bd82d342a3d22a6a0283c384ad04331b1b711da65149f21ea4ea05f69442f7fbe43520bf > and > 0bfc96717569a124a32be24fde227355f9cbee3cc08e0f62d70fe277f000fb248f08381503ff9384cfe68a112cb5d3476e606cba037c709b20bd4134b444e8f7 > > mvn verify artifact:compare > -Dreference.repo=https://repository.apache.org/content/repositories/staging/ > shows only commons-jexl3-3.7.0.spdx.json which seems OK to me. > > > > These are the artifacts and their hashes: > > > > #Release SHA-512s > > #Sun Jun 28 22:55:18 UTC 2026 > > commons-jexl-3.7.0-bin.tar.gz=5ebbf8e30e6e42b2dda716c10b6a7c6156fb3cf63ce6c1f66552b541469cce707ad0d2ab82fb17bda184623b7fcf590bd58f25d621a8a82997c27f7c8a360445 > > commons-jexl-3.7.0-bin.zip=9681e21626b46d7e7a4c4e828ba18dd704a3b9db61e4e82cf1f6edfbb9ec678c6098204b9a8ccfaffd5738306792e170c0268f77c42ed5382e5eec92ac8f17c7 > > commons-jexl-3.7.0-src.tar.gz=710b7d2cb5820621b26ff52dadbfa107b2394ac5e0046e3004f35e1af6a065babaa1bbfb301c4f06ad949e15634631cf10abde9e963cdd41dc4e304343adb418 > > commons-jexl-3.7.0-src.zip=16c2d884de119f0f84cc22efa6c013318875e1f8012063ab21d0d2663dea7b099a312e983a2aa62dce2490b2221fa3eea6cd536c524fd95f7d81fa3cd396f8f4 > > commons-jexl3-3.7.0-bom.json=0ffd588566c846e96171f07aded54412d6a29dffd39c2c54e03e59c664ca2e02b1b3e0005084aa4cfb2da57b7bdabfd460f4b367179f21463514d25b9bb3e122 > > commons-jexl3-3.7.0-bom.xml=5468ad1cc20a8b57a9b295707dbb7b6e51a0d8fbf4a404cd91403b6c5736ba90cb7b6ae3f5e56d03c647490842bbdfa2c15bee77314a8d171b4fc5294110ea37 > > commons-jexl3-3.7.0-javadoc.jar=9f5511730238e260f4b1794d6adf506ceeeff54116a8cc86129f8294bccf8f97e8c024b087864d23ff71db031a6bf28f1503588152c3015bdf2ddc3aefbb0448 > > commons-jexl3-3.7.0-sources.jar=94e440855fe18e78311097a19e208fc73a4d6f345e3f1b7100d44545ee9633066855bbe068e2f101e0235f7ebbfda232ee3538d9fc057b1a3e37088a5f14caec > > commons-jexl3-3.7.0-test-sources.jar=4cafddf23c7b1e3f49eb03f6c33865f04ade050f90ed285bf6e048e99ee34afc00aeb8d62d81653f23c241e3f70dd08c57f219be5a152082fb7ea45a9d6bbb92 > > commons-jexl3-3.7.0-tests.jar=07b1d140fbae58769588539fa2c9e1e0bd57e8aedffebfd29aee18e20f6e4dea9048f785aedbc0276663a2cb9ecb050c1b3f18318fa30b2cadd918e32be227ae > > org.apache.commons_commons-jexl3-3.7.0.spdx.json=dd6bdb07be5fe9a4056d949b4300fcf55a8f66eb8eae8f99b429d93fc354ce90016c5898caa6094eb6b2bbfede89b29f7f83d7ed0affb2cc8f99f7af48154b9d > > > > I have tested this with 'mvn' and 'mvn clean install site' using: > > > > openjdk version "21.0.11" 2026-04-21 > > OpenJDK Runtime Environment Homebrew (build 21.0.11) > > OpenJDK 64-Bit Server VM Homebrew (build 21.0.11, mixed mode, sharing) > > > > Apache Maven 3.9.16 (2bdd9fddda4b155ebf8000e807eb73fd829a51d5) > > Maven home: /opt/homebrew/Cellar/maven/3.9.16/libexec > > Java version: 21.0.11, vendor: Homebrew, runtime: > > /opt/homebrew/Cellar/openjdk@21/21.0.11/libexec/openjdk.jdk/Contents/Home > > Default locale: en_US, platform encoding: UTF-8 > > OS name: "mac os x", version: "26.5.1", arch: "aarch64", family: "mac" > > > > Darwin Garys-MacBook-Pro.local 25.5.0 Darwin Kernel Version 25.5.0: > > Mon Apr 27 20:41:15 PDT 2026; > > root:xnu-12377.121.6~2/RELEASE_ARM64_T6041 arm64 > > > > Docker version 29.4.3, build 055a478 > > > > > > Details of changes since 3.6.4 are in the release notes: > > > > https://dist.apache.org/repos/dist/dev/commons/jexl/3.7.0-RC1/RELEASE-NOTES.txt > > > > https://dist.apache.org/repos/dist/dev/commons/jexl/3.7.0-RC1/site/changes.html > > I have not tested the artifacts in any projects. It's a little scary > the defaults are now so locked-down that there's a risk that the new > artifact will not be a drop-in replacement in some cases, but when it > does work it's clearly the safest choice, and when it doesn't it > prompts downstream users to make a deliberate choice. The changes is > also well-documented in the release notes, so I'm OK with it. > > This is my +1 > > > Kind regards, > > Arnout > Apache Commons PMC > > > Site: > > > > https://dist.apache.org/repos/dist/dev/commons/jexl/3.7.0-RC1/site/index.html > > (Note some *relative* links are broken and the 3.7.0 directories > > are not yet created - these will be OK once the site is deployed.) > > > > JApiCmp Report (compared to 3.6.4): > > > > https://dist.apache.org/repos/dist/dev/commons/jexl/3.7.0-RC1/site/japicmp.html > > > > RAT Report: > > > > https://dist.apache.org/repos/dist/dev/commons/jexl/3.7.0-RC1/site/rat-report.html > > > > KEYS: > > https://downloads.apache.org/commons/KEYS > > > > Please review the release candidate and vote. > > This vote will close no sooner than 72 hours from now. > > > > [ ] +1 Release these artifacts > > [ ] +0 OK, but... > > [ ] -0 OK, but really should fix... > > [ ] -1 I oppose this release because... > > > > Thank you, > > > > Gary Gregory, > > Release Manager (using key 530AA5F25C25011F) > > > > The following is intended as a helper and refresher for reviewers. > > > > Validating a release candidate > > ============================== > > > > These guidelines are NOT complete. > > > > Requirements: Git, Java, and Maven. > > > > You can validate a release from a release candidate (RC) tag as follows. > > > > 1a) Download and decompress the source archive from: > > > > https://dist.apache.org/repos/dist/dev/commons/jexl/3.7.0-RC1/source > > > > 1b) Check out the RC tag from git (optional) > > > > This is optional, as a reviewer must at least check source distributions. > > > > git clone https://gitbox.apache.org/repos/asf/commons-jexl.git > > --branch commons-jexl-3.7.0-RC1 commons-jexl-3.7.0-RC1 > > cd commons-jexl-3.7.0-RC1 > > > > 2) Checking the build > > > > All components should include a default Maven goal, such that you can > > run 'mvn' from the command line by itself. > > > > 2) Check Apache licenses > > > > This step is not required if the site includes a RAT report page, > > which you then must check. > > This check should be included in the default Maven build, but you can > > check it with: > > > > mvn apache-rat:check > > > > 3) Check binary compatibility > > > > This step is not required if the site includes a JApiCmp report page, > > which you then must check. > > This check should be included in the default Maven build, but you can > > check it with: > > > > mvn verify -DskipTests -P japicmp japicmp:cmp > > > > 4) Build the package > > > > This check should be included in the default Maven build, but you can > > check it with: > > > > mvn -V clean package > > > > You can record the Maven and Java version produced by -V in your VOTE reply. > > To gather OS information from a command line: > > Windows: ver > > Linux: uname -a > > > > 4b) Check reproducibility > > > > To check that a build is reproducible, run: > > > > mvn clean verify artifact:compare -DskipTests > > -Dreference.repo=https://repository.apache.org/content/repositories/staging/ > > '-Dbuildinfo.ignore=*/*.spdx.json' > > > > Note that this excludes SPDX files from the check. > > > > 5) Build the site for a single module project > > > > Note: Some plugins require the components to be installed instead of > > packaged. > > > > mvn site > > Check the site reports in: > > - Windows: target\site\index.html > > - Linux: target/site/index.html > > > > -the end- > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: [email protected] > > For additional commands, e-mail: [email protected] > > > > > -- > Arnout Engelen > ASF Security Response > Apache Pekko PMC member, ASF Member > NixOS Committer > Independent Open Source consultant > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
