Hi, I'm not opposing making another 3.9 bugfix release but I think we should clarify our position regarding 3.9. 3.9.0 was released 2 years ago and it's not marked as supported anymore.
I understand there's been a lot of CVEs published recently. However considering the current trends it's likely there will be more, so will we consider making a 3.9.4 release? The reason I'm raising this is to set clear expectations for our users, and to balance our workload as maintaining extra releases has a cost. Thanks, Mickael On Mon, Nov 2, 2026 at 2:32 PM Gaurav Narula <[email protected]> wrote: > > Thanks for taking the initiative Chia-Ping! > > I had refrained from commenting until now, having contributed to some of the > aforementioned fixes, thinking my position would have had some bias but after > the recent CVE announcements I strongly believe we should have a 3.9.3. > > Looking forward to the release plan! > > Regards, > Gaurav > > > On 2 Nov 2026, at 12:58, Chia-Ping Tsai via dev <[email protected]> > > wrote: > > > > Hi all, > > > > We are going to backport the CVE fixes to 3.9 and I believe that is a good > > reason to make a 3.9.3 release. > > > > Hence, I will start the release plan for 3.9.3 and open another thread once > > the plan is ready. > > > > Best, > > Chia-Ping > > > > On 2026-10-25 13:19 UTC Chia-Ping Tsai wrote: > >> Hi all, > >> > >> There are some critical bugs related to ZK migration, so I’d like to > >> open a discussion for the 3.9.3 release. > >> > >> KAFKA-20960: Block ZK-to-KRaft migration finalization until brokers > >> re-register (merged) > >> https://github.com/apache/kafka/commit/ea11d59ecda2ec57be0f1ef83a554ef5d3b82770 > >> > >> KAFKA-21142: Fix partition creation when handling snapshot delta > >> during migration (merged) > >> https://github.com/apache/kafka/commit/daebfbd9b37c913937d5adfc2e493fe825e3da3a > >> > >> KAFKA-21062: Handle BADVERSION on /migration writes (under review) > >> https://github.com/apache/kafka/pull/23639 > >> > >> My sense is that ZK migration is the only official way to encourage > >> users to get into KRaft, so keeping it working is a strong reason to > >> do a release. > >> > >> I haven’t finished reviewing the last one yet, but it would be good to > >> make sure the release will happen. Otherwise, my tokens will be > >> totally wasted :) > >> > >> Any thoughts? > >> >
