Re: [DISCUSS] Core Implementation for PIP-379: Key_Shared Draining Hashes for Improved Message Ordering - Reviews Needed

2024-10-04 Thread Rajan Dhabalia
Hi Lari, Thank you for your work but I have a simple question about why we should rush for specific PR and why it's necessary to keep a particular PR part of ongoing release. I know multiple PRs that tried to address critical bugs on this similar issue and they were again blocked without solid rea

Re: [DISCUSS] PIP-385 Add rate limit semantics to pulsar protocol and Java client

2024-10-04 Thread Rajan Dhabalia
Hi Girish, I have gone through the proposal and you mentioned few problems as a motivation of this improvements >> Noisy neighbors - Even if one topic is exceeding the quota, since the entire channel read is paused, all topics sharing the same connect (for example - using the same java client obj

Re: [DISCUSS] PIP-385 Add rate limit semantics to pulsar protocol and Java client

2024-10-04 Thread Lari Hotari
Great work on this proposal, Girish! This improvement addresses a crucial aspect of Pulsar's functionality. You're effectively bridging an important gap in Pulsar's producer flow control. This addition will improve the ability to set and meet SLAs across various Pulsar use cases, which is inval

Re: [DISCUSS] Core Implementation for PIP-379: Key_Shared Draining Hashes for Improved Message Ordering - Reviews Needed

2024-10-04 Thread Lari Hotari
This is a friendly reminder about the urgent need for review of PR #23352, the first part of implementing "PIP-379: Key_Shared Draining Hashes for Improved Message Ordering". PR: https://github.com/apache/pulsar/pull/23352 Target: 4.0.0-preview.2 release, scheduled for Monday Oct 7th. Your prom

Re: [VOTE] PIP-379: Key_Shared Draining Hashes for Improved Message Ordering

2024-10-04 Thread Lari Hotari
Hello all, The vote to approve "PIP-379: Key_Shared Draining Hashes for Improved Message Ordering" is now closed. The vote PASSED with 3 binding +1 and 3 non-binding +1 votes: - Matteo Merli (binding) - Enrico Olivelli (binding) - Apurva Telang (non-binding) - Nicoló Boschi (binding) - ZhangJia

Re: [VOTE] PIP-384: ManagedLedger interface decoupling

2024-10-04 Thread Lari Hotari
Hello all, The vote to approve PIP-384 is now closed. The vote PASSED with 4 binding +1 votes: - Rajan Dhabalia - Matteo Merli - Enrico Olivelli - PengHui Li -Lari On 2024/10/01 16:36:16 Lari Hotari wrote: > Hi, > > I'd like to start the voting thread for PIP-384: ManagedLedger interface > d

[VOTE] Release Apache Pulsar Helm Chart 3.6.0 based on 3.6.0-candidate-1

2024-10-04 Thread Lari Hotari
Hello Apache Pulsar Community, This is a call for the vote to release the Apache Pulsar Helm Chart version 3.6.0. Release notes for 3.6.0-candidate-1: https://github.com/apache/pulsar-helm-chart/releases/tag/pulsar-3.6.0-candidate-1 The release candidate is available at: https://dist.apache.org/

[ANNOUNCE] Apache Pulsar 3.3.2 released with important security fix for CVE-2024-47561

2024-10-04 Thread Lari Hotari
The Apache Pulsar team is proud to announce Apache Pulsar version 3.3.2. This release includes an important security fix for an RCE vulnerability in Avro Java SDK <1.11.4, CVE-2024-47561. The Avro Java SDK is included in Pulsar's server-side components as well as in the Pulsar Java client. All Pul

[ANNOUNCE] Apache Pulsar 3.0.7 released with important security fix for CVE-2024-47561

2024-10-04 Thread Lari Hotari
The Apache Pulsar team is proud to announce Apache Pulsar version 3.0.7. This release includes an important security fix for an RCE vulnerability in Avro Java SDK <1.11.4, CVE-2024-47561. The Avro Java SDK is included in Pulsar's server-side components as well as in the Pulsar Java client. All Pul

Re: [VOTE] Release Apache Pulsar 3.3.2 based on 3.3.2-candidate-1

2024-10-04 Thread Lari Hotari
Hello all, The vote to release Apache Pulsar version 3.3.2 based on 3.3.2-candidate-1 is now closed. The vote PASSED with 4 binding "+1" votes: "+1" Binding votes: - PengHui Li - Matteo Merli - Michael Marshall - Lari Hotari I'll continue with the release process and the release announcement

Re: [VOTE] Release Apache Pulsar 3.3.2 based on 3.3.2-candidate-1

2024-10-04 Thread Lari Hotari
+1 (binding) - Built from source - Checked the signatures of the source and binary release artifacts - Ran pulsar standalone - Checked producer and consumer - Verified the Cassandra connector - Verified the Stateful function -Lari On 2024/10/04 16:55:14 Lari Hotari wrote: > Hello Apache Pulsar C

Re: [VOTE] Release Apache Pulsar 3.0.7 based on 3.0.7-candidate-1

2024-10-04 Thread Lari Hotari
Hello all, The vote to release Apache Pulsar version 3.0.7 based on 3.0.7-candidate-1 is now closed. The vote PASSED with 4 binding "+1" votes: "+1" Binding votes: - PengHui Li - Matteo Merli - Michael Marshall - Lari Hotari I'll continue with the release process and the release announcement

Re: [VOTE] Release Apache Pulsar 3.3.2 based on 3.3.2-candidate-1

2024-10-04 Thread Michael Marshall
+ 1 - Verified signatures on 41 artifacts - Verified checksums on 41 artifacts - Confirmed that `mvn apache-rat:check` on unzipped source tarball found no issues - Unzipped binary tarball and started pulsar standalone successfully via `bin/pulsar standalone` - Michael On Fri, Oct 4, 2024 at 12:1

Re: [VOTE] Release Apache Pulsar 3.0.7 based on 3.0.7-candidate-1

2024-10-04 Thread Lari Hotari
+1 (binding) - Built from source - Checked the signatures of the source and binary release artifacts - Ran pulsar standalone - Checked producer and consumer - Verified the Cassandra connector - Verified the Stateful function -Lari On 2024/10/04 15:36:59 Lari Hotari wrote: > Hello Apache Pulsar C

Re: [VOTE] Release Apache Pulsar 3.0.7 based on 3.0.7-candidate-1

2024-10-04 Thread Michael Marshall
+ 1 - Verified signatures on 40 artifacts - Verified checksums on 40 artifacts - Confirmed that `mvn apache-rat:check` on unzipped source tarball found no issues - Unzipped binary tarball and started pulsar standalone successfully via `bin/pulsar standalone` - Michael On Fri, Oct 4, 2024 at 12:1

Re: [VOTE] Release Apache Pulsar 3.3.2 based on 3.3.2-candidate-1

2024-10-04 Thread Matteo Merli
+1 * Checked signatures * Checked standalone and produce/consume -- Matteo Merli On Fri, Oct 4, 2024 at 10:09 AM PengHui Li wrote: > +1 (binding) > > - Checked the signature of the binary release artifacts > - Start Pulsar standalone > - Verified Produce and Consume > - Verified Pulsar Func

Re: [VOTE] Release Apache Pulsar 3.0.7 based on 3.0.7-candidate-1

2024-10-04 Thread Matteo Merli
+1 * Checked signatures * Checked standalone and produce/consume -- Matteo Merli On Fri, Oct 4, 2024 at 9:12 AM PengHui Li wrote: > +1 (binding) > > - Checked the signature of the binary release artifacts > - Start Pulsar standalone > - Verified Produce and Consume > - Verified Pulsar Fun

Re: [VOTE] Release Apache Pulsar 3.3.2 based on 3.3.2-candidate-1

2024-10-04 Thread PengHui Li
+1 (binding) - Checked the signature of the binary release artifacts - Start Pulsar standalone - Verified Produce and Consume - Verified Pulsar Function and Stateful Function - Verified the Cassandra connector Regards, Penghui On Fri, Oct 4, 2024 at 9:55 AM Lari Hotari wrote: > Hello Apache Pu

[VOTE] Release Apache Pulsar 3.3.2 based on 3.3.2-candidate-1

2024-10-04 Thread Lari Hotari
Hello Apache Pulsar Community, This is a call for the vote to release the Apache Pulsar version 3.3.2 based on 3.3.2-candidate-1. Included changes since the previous release: https://github.com/apache/pulsar/compare/v3.3.1...v3.3.2-candidate-1 *** Please download, test and vote on this release.

Re: [VOTE] Release Apache Pulsar 3.0.7 based on 3.0.7-candidate-1

2024-10-04 Thread PengHui Li
+1 (binding) - Checked the signature of the binary release artifacts - Start Pulsar standalone - Verified Produce and Consume - Verified Pulsar Function and Stateful Function - Verified the Cassandra connector Regards, Penghui On Fri, Oct 4, 2024 at 8:37 AM Lari Hotari wrote: > Hello Apache Pu

[VOTE] Release Apache Pulsar 3.0.7 based on 3.0.7-candidate-1

2024-10-04 Thread Lari Hotari
Hello Apache Pulsar Community, This is a call for the vote to release the Apache Pulsar version 3.0.7 based on 3.0.7-candidate-1. Included changes since the previous release: https://github.com/apache/pulsar/compare/v3.0.6...v3.0.7-candidate-1 *** Please download, test and vote on this release.

[DISCUSS] PIP-385 Add rate limit semantics to pulsar protocol and Java client

2024-10-04 Thread Girish Sharma
Hello Pulsar Community, I would like to propose a new improvement for Pulsar protocol related to rate limiting that the broker imposes to maintain quality of service. This proposal adds a new binary protocol command pair and corresponding server and java client changes. With the new protocol comma

Re: [DISCUSS] Expediting Pulsar releases 3.0.7 and 3.3.2 due to critical RCE vulnerability in Avro Java SDK <1.11.4, CVE-2024-47561

2024-10-04 Thread Michael Marshall
Thank you, Lari. I support the rushed timeline so our users can upgrade sooner. - Michael On Fri, Oct 4, 2024 at 7:21 AM Lari Hotari wrote: > I have triggered Pulsar CI builds for the pulsar-ci [1] and > pulsar-ci-flaky [2] workflows for `branch-3.0` and `branch-3.3`. I'll > proceed with the re

Re: [DISCUSS] Expediting Pulsar releases 3.0.7 and 3.3.2 due to critical RCE vulnerability in Avro Java SDK <1.11.4, CVE-2024-47561

2024-10-04 Thread Lari Hotari
I have triggered Pulsar CI builds for the pulsar-ci [1] and pulsar-ci-flaky [2] workflows for `branch-3.0` and `branch-3.3`. I'll proceed with the release process [3] for 3.0.7 and 3.3.2 once there are successful build results from the Pulsar CI builds. The release vote will be handled in an ex

Re: [DISCUSS] Expediting Pulsar releases 3.0.7 and 3.3.2 due to critical RCE vulnerability in Avro Java SDK <1.11.4, CVE-2024-47561

2024-10-04 Thread Enrico Olivelli
Il giorno gio 3 ott 2024 alle ore 22:59 Lari Hotari ha scritto: > Dear Pulsar Community, > > There's a critical 9.3/10 level RCE vulnerability in Avro Java SDK > <1.11.4, CVE-2024-47561. > More details can be found in these resources: > - https://github.com/advisories/GHSA-r7pg-v2c8-mfg3 > - http