Re: [VOTE] Release Apache Commons FileUpload 2.0.0-M5 based on RC1

My +1

Gary


On Sun, Feb 8, 2026, 13:48 Gary Gregory <[email protected]> wrote:

> We have fixed a few bugs and added enhancements since the release of
> Apache Commons FileUpload 2.0.0-M4, so I, and by user request, would
> like to release Apache Commons FileUpload 2.0.0-M5.
>
> Apache Commons FileUpload 2.0.0-M5 RC1 is available for review here:
>     https://dist.apache.org/repos/dist/dev/commons/fileupload/2.0.0-M5-RC1
> (svn revision 82363)
>
> The Git tag commons-fileupload-2.0.0-M5-RC1 commit for this RC is
> afa905f3bb90539def3d378193ba009a835fd179, which you can browse here:
>
> https://gitbox.apache.org/repos/asf?p=commons-fileupload.git;a=commit;h=afa905f3bb90539def3d378193ba009a835fd179
> You may checkout this tag using:
>     git clone https://gitbox.apache.org/repos/asf/commons-fileupload.git
> --branch
> <https://gitbox.apache.org/repos/asf/commons-fileupload.git--branch>
> commons-fileupload-2.0.0-M5-RC1
> commons-fileupload-2.0.0-M5-RC1
>
> Maven artifacts are here:
>
> https://repository.apache.org/content/repositories/orgapachecommons-1921/org/apache/commons/commons-fileupload2/2.0.0-M5/
>
> These are the artifacts and their hashes:
>
> File:
> ./commons-fileupload2-jakarta-servlet5/target/commons-fileupload2-jakarta-servlet5-2.0.0-M5.jar
>   SHA1:   587c1f43464a6de0222c2118c086510352df5f6d
>   SHA512:
> f2c39a2360b6bb4bb27ff5de97d24fa87385da612c3621f07014b2acb85f70d2c626655f0b5e3ee7b1b738b48ab978b11253e4f42b24a5bec77e9755afe51644
>
> File:
> ./commons-fileupload2-jakarta-servlet5/target/commons-fileupload2-jakarta-servlet5-2.0.0-M5-test-sources.jar
>   SHA1:   2488a097bb7cefc1d6cd5f6f343bbbecf737ed52
>   SHA512:
> 91c373ce2551900cd58e62ab20e45a481245ca046c96864fa182adf8a78a6ea2e6148d0c81716562e95a9ea630b8b4bf66c3c59d878ea9413d1a088f9d1ad353
>
> File:
> ./commons-fileupload2-jakarta-servlet5/target/commons-fileupload2-jakarta-servlet5-2.0.0-M5-tests.jar
>   SHA1:   fa7740aaf00c0c8bae444ecfc0159eb772abc1a2
>   SHA512:
> 7397064739c2f7b3c4c1b22ba0ddd422254ae0ee9342ee4b1688dd91c461932fd94d7b94f2c2c4e09ce8121a4c643b364a1a9fbc59f6d19ab7e0d2a3702a66c7
>
> File:
> ./commons-fileupload2-jakarta-servlet5/target/commons-fileupload2-jakarta-servlet5-2.0.0-M5-javadoc.jar
>   SHA1:   db96145c2760911a1ff7d8b52d746b06f7d91a85
>   SHA512:
> e180ca7f51672c224447e07c4091c06bd063d467d9e6bf9d257d5a9c7fce31f61bf831f4b9ae68410cafed18072109071a0466f179ecb5256f1602c7377079e3
>
> File:
> ./commons-fileupload2-jakarta-servlet5/target/commons-fileupload2-jakarta-servlet5-2.0.0-M5-sources.jar
>   SHA1:   f93e13b2ed7776dbe03ee471f9e5238870febbe2
>   SHA512:
> 1199bc8e4394c63a73fe847384bc5df04dd4ef7dc06b6c386a4028c6ffecb8208ce289aae02ee378113784fc01e1ed5c5fdd8556367b6fa690f1d4ca607bda36
>
> File:
> ./commons-fileupload2-javax/target/commons-fileupload2-javax-2.0.0-M5.jar
>   SHA1:   98be2e5f1ed5e21e096b7e82d841b21a1ecd0e1c
>   SHA512:
> fd39df2f544a48d5d32e52679941aa0a98fad872aa7b611855e81b0bb66e054b06d6cd7d3d59ac53f1493125eda4c67ca7d376082ca38e17d1aab171dbb808da
>
> File:
> ./commons-fileupload2-javax/target/commons-fileupload2-javax-2.0.0-M5-javadoc.jar
>   SHA1:   1865506a270d4996dbdbca6df6d46e3711c8adcb
>   SHA512:
> 21722adbf6fe61fc6dcc004c3a08bccb8f7fa1bbca504db4be5fca1f6ecd209751b8a14c985ab0847ffa280df14398dc3f55feddacb910f0a95c88a0e2912f8e
>
> File:
> ./commons-fileupload2-javax/target/commons-fileupload2-javax-2.0.0-M5-sources.jar
>   SHA1:   0ba58aac6425630b37d2b98a583ae9e1a9498d7a
>   SHA512:
> 0aec4dae853a2c3d11422e4504c87bc6b1e9636a2a1a2f75b9918540d398372f2e7787390492fe595d1742768e8f6bebd6e53f6fd7f9bc73bf87a26438bd1d66
>
> File:
> ./commons-fileupload2-javax/target/commons-fileupload2-javax-2.0.0-M5-tests.jar
>   SHA1:   4ac1675cc2c1e6e5e2d64d66703025b51bb0da8b
>   SHA512:
> 832f64736296371a89ccb5175a447f91dd96b4039e572d100b0482c4749803b0e6a448f199be0e1c2530a8f0209dd0b3e1f99237e94f186047708fe3f7936f76
>
> File:
> ./commons-fileupload2-javax/target/commons-fileupload2-javax-2.0.0-M5-test-sources.jar
>   SHA1:   1cc8d29858f28899b2bc267b8fd68f124d8da76f
>   SHA512:
> 132c377960638a5f5ba5a1bdcfb5e2acaf7adb1d076074733b04816391dca9e59d1556fff7d551fa38229a8dd4c3dc18a2ebbe7341cea2d641cc96c651076d87
>
> File:
> ./commons-fileupload2-portlet/target/commons-fileupload2-portlet-2.0.0-M5-test-sources.jar
>   SHA1:   2d992a05e01022cb1f492bc786ab2a3c14c2d76a
>   SHA512:
> 9e31324a690d874ea3006de4e35fe92dd07ec5fe32c6ba49ab6248a374a96eeee458b6cf6525693291e35f253e850e7be88d8daf11f499c65bb7c29b29b451a0
>
> File:
> ./commons-fileupload2-portlet/target/commons-fileupload2-portlet-2.0.0-M5-javadoc.jar
>   SHA1:   e55bdd4ac61dc6a9b84a9373c3b8b0e2ac3d1c1f
>   SHA512:
> a036f7205445e028d241aec3429c707ef961136b812db6349ee526d5e262ce67be45cc0057e0ffd71f969501e9f5fae98bad43b326a631af86e513d4c462dc1e
>
> File:
> ./commons-fileupload2-portlet/target/commons-fileupload2-portlet-2.0.0-M5.jar
>   SHA1:   840c0a41231c76a30468903888f40be54e2611a6
>   SHA512:
> 66202ea4d0a0208e858a88bdbe61d41bf1fc55217e67b94d7eccd1c61393b8980c685c65489af7680eb7deb2d8fc39fddc84aac059591ec04e3e48ddd2a69425
>
> File:
> ./commons-fileupload2-portlet/target/commons-fileupload2-portlet-2.0.0-M5-sources.jar
>   SHA1:   d6c78abc65bd1d91d8f8fd0f41f73b873dcf78c0
>   SHA512:
> cdda07256d54a22aa38c858664624f0517b1ecde33d68df2ee86e12e168d5b08d3aea09cd4373079e0b6cc6a0a58797cb13861eea0970672ec735f8dcd23a835
>
> File:
> ./commons-fileupload2-portlet/target/commons-fileupload2-portlet-2.0.0-M5-tests.jar
>   SHA1:   8e8d3922984f419d59cb2b4b0f2e101df3876e75
>   SHA512:
> 04a8ae0b70fd89cd2a61b2ff378e6fab2d359628af3446205287b0cd55960368b29c63db38dfda2e1c2e522a3d89a302d510f02e56222475cc9bae1ed6006453
>
> File:
> ./commons-fileupload2-core/target/commons-fileupload2-core-2.0.0-M5-test-sources.jar
>   SHA1:   0fc46d3ba8545f82f70c09302da9f1f16e7ef7f9
>   SHA512:
> 5de68bea35733cabdce0ffd01e5cc951641fe447623ac27232154076a264c1e2a33432d0f7dc69a5c7cd1cf5574f4908f1d766ca57d17922f6f6a5dbe58034d2
>
> File:
> ./commons-fileupload2-core/target/commons-fileupload2-core-2.0.0-M5-tests.jar
>   SHA1:   5ddd4cf8c01bb8edb41410bde075dd5349d75112
>   SHA512:
> 0c9f72b6c2f89ee0e59d0e8210fde61ccecd8a8ea7841c472b719306278ebb98482c7519556c218191d7dda12de2e2c64feae929ec0766484251c56b09550609
>
> File:
> ./commons-fileupload2-core/target/commons-fileupload2-core-2.0.0-M5.jar
>   SHA1:   bfabb601638301c1b85891e4deaa2ae233a7138e
>   SHA512:
> 56be7862a99b606a3a4cadd417f0d25dd6d699b4b065204e3745625bbc6afc9dad0f482b4a79f7dc9d347b335bc2ed813e5389e8ab3b8a9ecd5d572bed21fa6d
>
> File:
> ./commons-fileupload2-core/target/commons-fileupload2-core-2.0.0-M5-sources.jar
>   SHA1:   4ebf57ea50b6936622d0cbec3d6d0c2b1f6c9c34
>   SHA512:
> b4fdd6c5bbca95b71e523b3b344a440fa12010e1203e47772eecfbd35a6ae68c29675352468ff97a387efc9a2798dabd55fee498b7d571c99cd8491fbc56c279
>
> File:
> ./commons-fileupload2-core/target/commons-fileupload2-core-2.0.0-M5-javadoc.jar
>   SHA1:   774f1a27139a9ad1301b68f834566c8ea26241d7
>   SHA512:
> 83b8e00af49e0eff0ea584316af7931294706a0e12b91031edf41b34222e0caeb4814ead8b7f0f20b6c59c5834c1b59c6a249f57d75b1d81f586492f338480e6
>
> File:
> ./commons-fileupload2-jakarta-servlet6/target/commons-fileupload2-jakarta-servlet6-2.0.0-M5-sources.jar
>   SHA1:   ceccf579c689794d818cfa2540a92372c2195618
>   SHA512:
> 113402ee5c968db717b434986a0bea32850f1200204cc5ec4e0372869d11425c7384fb4580674eda04f8ea4c88c289f910b26f5bb094ee02e9ec916f7b779eb1
>
> File:
> ./commons-fileupload2-jakarta-servlet6/target/commons-fileupload2-jakarta-servlet6-2.0.0-M5-javadoc.jar
>   SHA1:   474a0f46d67eb8eb2b0f02da87e315b608384518
>   SHA512:
> 29c059db7dd672a5798061f723d37f43c4267dc302b618dc990e5bbfea5c76b794d2ea185be3f4ba879b4b5d0b3c3f07eece2b9305684caffb6ea35ea4828280
>
> File:
> ./commons-fileupload2-jakarta-servlet6/target/commons-fileupload2-jakarta-servlet6-2.0.0-M5.jar
>   SHA1:   d20835e2ef6e38ac370f4d2cba5c690146cb8be5
>   SHA512:
> 3a8d310760db705f41973e06cb5e438b9a680da7d5628098b15fed663408203390a2292b2a4ba56d8a8923bb6ba8947b8f1ec2ef6987022c62f03832b4aa7b76
>
> File:
> ./commons-fileupload2-jakarta-servlet6/target/commons-fileupload2-jakarta-servlet6-2.0.0-M5-tests.jar
>   SHA1:   8063b2a686c9ff4a6c4e7dfed239d56faeeb8144
>   SHA512:
> b915cda6e40fd10bd6d57f252d85a3dad59a8224e88892da02e8508ece1d8f01d606346d165f5b14adfe32fda716bf6af90f065197f2238a5ea70c3a68ca4845
>
> File:
> ./commons-fileupload2-jakarta-servlet6/target/commons-fileupload2-jakarta-servlet6-2.0.0-M5-test-sources.jar
>   SHA1:   f38bf5d21f39c52ffc1e95e6c759c6a7decd096d
>   SHA512:
> 08cd7c313ac6bc16b6f4ef10f1a71dbe15b79c5c6f71a2f7d0fd4306caaaab0dfd97b8a57d026dc8e14cf858439da69eaa68724116457443c5f4f439ae4edf8b
>
>
> I have tested this with 'mvn' and 'mvn clean install site' using:
>
> openjdk version "17.0.18" 2026-01-20
> OpenJDK Runtime Environment Homebrew (build 17.0.18+0)
> OpenJDK 64-Bit Server VM Homebrew (build 17.0.18+0, mixed mode, sharing)
>
> Apache Maven 3.9.12 (848fbb4bf2d427b72bdb2471c22fced7ebd9a7a1)
> Maven home: /opt/homebrew/Cellar/maven/3.9.12/libexec
> Java version: 17.0.18, vendor: Homebrew, runtime:
> /opt/homebrew/Cellar/openjdk@17/17.0.18/libexec/openjdk.jdk/Contents/Home
> Default locale: en_US, platform encoding: UTF-8
> OS name: "mac os x", version: "26.2", arch: "aarch64", family: "mac"
>
> Darwin Garys-MacBook-Pro.local 25.2.0 Darwin Kernel Version 25.2.0:
> Tue Nov 18 21:09:56 PST 2025;
> root:xnu-12377.61.12~1/RELEASE_ARM64_T6041 arm64
>
> Docker version 29.2.0, build 0b9d198
>
>
> Details of changes since 2.0.0-M4 are in the release notes:
>
> https://dist.apache.org/repos/dist/dev/commons/fileupload/2.0.0-M5-RC1/RELEASE-NOTES.txt
>
> https://dist.apache.org/repos/dist/dev/commons/fileupload/2.0.0-M5-RC1/site/changes.html
>
> Site:
>
> https://dist.apache.org/repos/dist/dev/commons/fileupload/2.0.0-M5-RC1/site/index.html
>     (Note some *relative* links are broken and the 2.0.0-M5
> directories are not yet created - these will be OK once the site is
> deployed.)
>
> JApiCmp Report (compared to 2.0.0-M4):
>     There are no JApiCmp reports. See the release notes for API changes.
>
> RAT Report:
>
> https://dist.apache.org/repos/dist/dev/commons/fileupload/2.0.0-M5-RC1/site/rat-report.html
>
> KEYS:
>   https://downloads.apache.org/commons/KEYS
>
> Please review the release candidate and vote.
> This vote will close no sooner than 72 hours from now.
>
>   [ ] +1 Release these artifacts
>   [ ] +0 OK, but...
>   [ ] -0 OK, but really should fix...
>   [ ] -1 I oppose this release because...
>
> Thank you,
>
> Gary Gregory,
> Release Manager (using key 530AA5F25C25011F)
>
> The following is intended as a helper and refresher for reviewers.
>
> Validating a release candidate
> ==============================
>
> These guidelines are NOT complete.
>
> Requirements: Git, Java, and Maven.
>
> You can validate a release from a release candidate (RC) tag as follows.
>
> 1a) Download and decompress the source archive from:
>
>
> https://dist.apache.org/repos/dist/dev/commons/fileupload/2.0.0-M5-RC1/source
>
> 1b) Check out the RC tag from git (optional)
>
> This is optional,  as a reviewer must at least check source distributions.
>
> git clone https://gitbox.apache.org/repos/asf/commons-fileupload.git
> --branch
> <https://gitbox.apache.org/repos/asf/commons-fileupload.git--branch>
> commons-fileupload-2.0.0-M5-RC1
> commons-fileupload-2.0.0-M5-RC1
> cd commons-fileupload-2.0.0-M5-RC1
>
> 2) Checking the build
>
> All components should include a default Maven goal, such that you can
> run 'mvn' from the command line by itself.
>
> 2) Check Apache licenses
>
> This step is not required if the site includes a RAT report page,
> which you then must check.
> This check should be included in the default Maven build, but you can
> check it with:
>
> mvn apache-rat:check
>
> 3) Check binary compatibility
>
> This step is not required if the site includes a JApiCmp report page,
> which you then must check.
> This check should be included in the default Maven build, but you can
> check it with:
>
> mvn verify -DskipTests -P japicmp japicmp:cmp
>
> 4) Build the package
>
> This check should be included in the default Maven build, but you can
> check it with:
>
> mvn -V clean package
>
> You can record the Maven and Java version produced by -V in your VOTE
> reply.
> To gather OS information from a command line:
> Windows: ver
> Linux: uname -a
>
> 4b) Check reproducibility
>
> To check that a build is reproducible, run:
>
> mvn clean verify artifact:compare -DskipTests
> -Dreference.repo=
> https://repository.apache.org/content/repositories/staging/
> '-Dbuildinfo.ignore=*/*.spdx.json'
>
> Note that this excludes SPDX files from the check.
>
> 5) Build the site for a single module project
>
> Note: Some plugins require the components to be installed instead of
> packaged.
>
> mvn site
> Check the site reports in:
> - Windows: target\site\index.html
> - Linux: target/site/index.html
>
> 6) Build the site for a multi-module project
>
> mvn site
> mvn site:stage
> Check the site reports in:
> - Windows: target\site\index.html
> - Linux: target/site/index.html
>
> Note that the project reports are created for each module.
> Modules can be accessed using the 'Project Modules' link under
> the 'Project Information' menu (see <path-to-site>/modules.html).
>
> -the end-
>