Another point is we have not announced the 2.9.0 release yet. This will make users feel confused that a new release from the Pulsar community with the serious problem(log4j bug) but after the log4j has fixed the issue and provided the new release.
I think we'd better contain the fix in 2.9.0 and 2.9.0 also has a critical bug https://github.com/apache/pulsar/pull/12993 which will lead the topic stop to provide services for more than 5min. It looks like, hey, we have a new release here but it has critical security issues and known serious bugs which will seriously affect the core features. >From the perspective of release, yes, the release vote has closed. But I believe that users will not care about this matter, they only care about the quality of the products we provided. I would like to hear your views. Regards, Penghui On Sun, Dec 12, 2021 at 6:26 PM Enrico Olivelli <eolive...@gmail.com> wrote: > I am starting 2.9.1 on Monday > > Enrico > > Il Dom 12 Dic 2021, 02:19 陳智弘 <thomasec...@gmail.com> ha scritto: > > > Totally agree > > > > PengHui Li <peng...@apache.org> 於 2021年12月12日 週日 08:28 寫道： > > > > > +1 > > > > > > Penghui > > > > > > Matteo Merli <mme...@apache.org>于2021年12月11日 周六15:28写道： > > > > > > > At this point, if 2.9.0 is non stable, I think we should fast-forward > > > > to 2.9.1 which will include security fix. Though, we should start > > > > 2.9.1 right now. > > > > > > > > > > > > -- > > > > Matteo Merli > > > > <mme...@apache.org> > > > > > > > > On Fri, Dec 10, 2021 at 11:23 PM Michael Marshall < > > mmarsh...@apache.org> > > > > wrote: > > > > > > > > > > +1 - thanks Enrico. > > > > > > > > > > - Michael > > > > > > > > > > On Sat, Dec 11, 2021 at 1:11 AM Lari Hotari <lhot...@apache.org> > > > wrote: > > > > > > > > > > > > +1 > > > > > > > > > > > > la 11. jouluk. 2021 klo 9.07 Enrico Olivelli < > eolive...@gmail.com> > > > > > > kirjoitti: > > > > > > > > > > > > > Hello folks, > > > > > > > Yesterday we committed the release notes for 2.9.0. > > > > > > > I just have to publish a couple of other artifacts and update > the > > > > website > > > > > > > before announcing 2.9.0. > > > > > > > My plan is to complete the procedure next week. > > > > > > > > > > > > > > In the meantime, early next week, I believe it is time to > prepare > > > > the first > > > > > > > RC of 2.9.1, due to the log4j bug. > > > > > > > > > > > > > > If you are aware of problems on branch-2.9 or things to be > > > > cherry-picked > > > > > > > because they are blocker please let me know. > > > > > > > > > > > > > > Otherwise if branch-2.9 is stable I will cut the RC from what > we > > > > already > > > > > > > have now. > > > > > > > > > > > > > > I am volunteering as RM for 2.9.1 as I followed 2.9.0 and > release > > > is > > > > > > > basically non stable due to the bugs we discovered after > > completing > > > > the > > > > > > > VOTE and publishing the artifacts to dockerhub and Maven > > > > > > > > > > > > > > Best regards > > > > > > > > > > > > > > Enrico > > > > > > > > > > > > > > > > >
