[VOTE] Release Apache Commons Codec 1.21.0 based on RC1

We have fixed build bugs and added one enhancement since the release
of Apache Commons Codec 1.20.0, so I would like to release Apache
Commons Codec 1.21.0.

Apache Commons Codec 1.21.0 RC1 is available for review here:
    https://dist.apache.org/repos/dist/dev/commons/codec/1.21.0-RC1
(svn revision 82073)

The Git tag commons-codec-1.21.0-RC1 commit for this RC is
91c44048f2751ef89567cd50ff04851da4f56e3f, which you can browse here:
    https://gitbox.apache.org/repos/asf?p=commons-codec.git;a=commit;h=91c44048f2751ef89567cd50ff04851da4f56e3f
You may checkout this tag using:
    git clone https://gitbox.apache.org/repos/asf/commons-codec.git
--branch commons-codec-1.21.0-RC1 commons-codec-1.21.0-RC1

Maven artifacts are here:
    https://repository.apache.org/content/repositories/orgapachecommons-1912/commons-codec/commons-codec/1.21.0/

These are the artifacts and their hashes:

#Release SHA-512s
#Fri Jan 23 14:17:56 UTC 2026
commons-codec-1.21.0-bin.tar.gz=2131daec9fd83af950b1d9e6a437967ae919947fb1a51180f88e9e1b4420966d31a87872a18f40f6a7771692973f363b894771b2c7adb298300cbeb3a1d74232
commons-codec-1.21.0-bin.zip=cbc3ab9a17c8b41c20c01d7ac2807fb429b6dce4dbea8d48bd581743f8ab08c629709bf4ad2f40017920cf240c2a4402efaa7b252b22233458f0d5e91483b4f2
commons-codec-1.21.0-bom.json=cf4d1975f1cbf8ff3127f022c96f925fb74697b7769a2cd01ae2f0d2c5f0359f42f8d238628b3e6a8ff9609d8e18a636dd0228d8115fe5a517352967f27a0bca
commons-codec-1.21.0-bom.xml=9c68632f222ae3fa181e4c1fc9dce61dc560f18007dfebb089886cfd6eef64289aec013f05024fd667124e96b4fd9451efb81b9bfbd9238d0f4f6e60f7b595d2
commons-codec-1.21.0-javadoc.jar=3ebf93acdbe0735ecec06788c5d755b4a68c0368710ae7beae984a63e21db165f224129aff56a6603cedd2d0056c344f796f347a602ed09da72009a49b5595eb
commons-codec-1.21.0-sources.jar=4e73184d186400c1b813a65beeb36e14613e5c1217dcf4135df67ac479b2faee11e8f307dd334493b4a611180e041bc3316329314163445e8c3e6af313cb8a67
commons-codec-1.21.0-src.tar.gz=62521f0e0a35729d37cf8e297ea3ff14badfcd002497b57a2ce39ec11aa3f729a6f3357b8233a9162c2ff4e612072c6a0216549a74dd7d27ded4b844541f3e8e
commons-codec-1.21.0-src.zip=90a65da2e14231a1acead80d91fb93ea97ddb9998e90044b667d8b2b3f9816ab77b599d61e7b0590b1e801b1ab7a977c25c3bc6e3e465f9e48b266fb2927152d
commons-codec-1.21.0-test-sources.jar=54cf90ea680a95cc8c4bac2626b10e0ea5ed573383bca2f7e0261f1a8eea27fb8a5a41dade0ef645cd2395d5e9722f859f73c57bc9caf05180de9cb0e3c94b63
commons-codec-1.21.0-tests.jar=8ad7a6dd8b9a6c238b379f40f5e73908ca5923f1dd23a2a4142da02d33b3e2501d7637fe888fa46266e145b98facc92fd08082412af83a908e095023ea03b589
commons-codec_commons-codec-1.21.0.spdx.json=91beda80ea6225192a91a0493f3e64940bd0623e579fd8c6bcbc3168bba78b52e7371a44539f43ca13b8e4ee74a62b9421959395e9bccf6dc31ae890325b9db0


I have tested this with 'mvn' and 'mvn clean install site' using:

openjdk version "25.0.1" 2025-10-21
OpenJDK Runtime Environment Homebrew (build 25.0.1)
OpenJDK 64-Bit Server VM Homebrew (build 25.0.1, mixed mode, sharing)

Apache Maven 3.9.12 (848fbb4bf2d427b72bdb2471c22fced7ebd9a7a1)
Maven home: /opt/homebrew/Cellar/maven/3.9.12/libexec
Java version: 25.0.1, vendor: Homebrew, runtime:
/opt/homebrew/Cellar/openjdk/25.0.1/libexec/openjdk.jdk/Contents/Home
Default locale: en_US, platform encoding: UTF-8
OS name: "mac os x", version: "26.2", arch: "aarch64", family: "mac"

Darwin Garys-MacBook-Pro.local 25.2.0 Darwin Kernel Version 25.2.0:
Tue Nov 18 21:09:56 PST 2025;
root:xnu-12377.61.12~1/RELEASE_ARM64_T6041 arm64

Docker version 29.1.3, build f52814d


Details of changes since 1.20.0 are in the release notes:
    https://dist.apache.org/repos/dist/dev/commons/codec/1.21.0-RC1/RELEASE-NOTES.txt
    https://dist.apache.org/repos/dist/dev/commons/codec/1.21.0-RC1/site/changes.html

Site:
    https://dist.apache.org/repos/dist/dev/commons/codec/1.21.0-RC1/site/index.html
    (Note some *relative* links are broken and the 1.21.0 directories
are not yet created - these will be OK once the site is deployed.)

JApiCmp Report (compared to 1.20.0):
    https://dist.apache.org/repos/dist/dev/commons/codec/1.21.0-RC1/site/japicmp.html

RAT Report:
    https://dist.apache.org/repos/dist/dev/commons/codec/1.21.0-RC1/site/rat-report.html

KEYS:
  https://downloads.apache.org/commons/KEYS

Please review the release candidate and vote.
This vote will close no sooner than 72 hours from now.

  [ ] +1 Release these artifacts
  [ ] +0 OK, but...
  [ ] -0 OK, but really should fix...
  [ ] -1 I oppose this release because...

Thank you,

Gary Gregory,
Release Manager (using key 530AA5F25C25011F)

The following is intended as a helper and refresher for reviewers.

Validating a release candidate
==============================

These guidelines are NOT complete.

Requirements: Git, Java, and Maven.

You can validate a release from a release candidate (RC) tag as follows.

1a) Download and decompress the source archive from:

https://dist.apache.org/repos/dist/dev/commons/codec/1.21.0-RC1/source

1b) Check out the RC tag from git (optional)

This is optional,  as a reviewer must at least check source distributions.

git clone https://gitbox.apache.org/repos/asf/commons-codec.git
--branch commons-codec-1.21.0-RC1 commons-codec-1.21.0-RC1
cd commons-codec-1.21.0-RC1

2) Checking the build

All components should include a default Maven goal, such that you can
run 'mvn' from the command line by itself.

2) Check Apache licenses

This step is not required if the site includes a RAT report page,
which you then must check.
This check should be included in the default Maven build, but you can
check it with:

mvn apache-rat:check

3) Check binary compatibility

This step is not required if the site includes a JApiCmp report page,
which you then must check.
This check should be included in the default Maven build, but you can
check it with:

mvn verify -DskipTests -P japicmp japicmp:cmp

4) Build the package

This check should be included in the default Maven build, but you can
check it with:

mvn -V clean package

You can record the Maven and Java version produced by -V in your VOTE reply.
To gather OS information from a command line:
Windows: ver
Linux: uname -a

4b) Check reproducibility

To check that a build is reproducible, run:

mvn clean verify artifact:compare -DskipTests
-Dreference.repo=https://repository.apache.org/content/repositories/staging/
'-Dbuildinfo.ignore=*/*.spdx.json'

Note that this excludes SPDX files from the check.

5) Build the site for a single module project

Note: Some plugins require the components to be installed instead of packaged.

mvn site
Check the site reports in:
- Windows: target\site\index.html
- Linux: target/site/index.html

-the end-