Re: [VOTE] Release Apache Commons JEXL 3.6.3 based on RC1

My +1

Gary

On Wed, Jun 17, 2026 at 10:41=E2=80=AFAM Gary Gregory <[email protected]=
om> wrote:
>
> We have fixed a few bugs and added enhancements since the release of
> Apache Commons JEXL 3.6.2, so I would like to release Apache Commons
> JEXL 3.6.3.
>
> Apache Commons JEXL 3.6.3 RC1 is available for review here:
>     https://dist.apache.org/repos/dist/dev/commons/jexl/3.6.3-RC1 (svn
> revision 85287)
>
> The Git tag commons-jexl-3.6.3-RC1 commit for this RC is
> ff296eab9bfe2efb327a4446ee96f9e16cab9939, which you can browse here:
>     https://gitbox.apache.org/repos/asf?p=3Dcommons-jexl.git;a=3Dcommit;h=
=3Dff296eab9bfe2efb327a4446ee96f9e16cab9939
> You may checkout this tag using:
>     git clone https://gitbox.apache.org/repos/asf/commons-jexl.git
> --branch commons-jexl-3.6.3-RC1 commons-jexl-3.6.3-RC1
>
> Maven artifacts are here:
>     https://repository.apache.org/content/repositories/orgapachecommons-1=
949/org/apache/commons/commons-jexl3/3.6.3/
>
> These are the artifacts and their hashes:
>
> #Release SHA-512s
> #Wed Jun 17 14:34:22 UTC 2026
> commons-jexl-3.6.3-bin.tar.gz=3Dd73947bef46a52264eb23aee2806aeafaa14c15e3=
8cba91de6ef62d785cab57bde9a444a0c512fe21cf8df97fee3995ab26c95e64f11f38b953c=
4123f322beee
> commons-jexl-3.6.3-bin.zip=3D28ece525641a8abdc210bc360fe17805b03abcbffc18=
f145dc3169daa2bb1d6693b19f0de3dafb4d9094b662bc5132e662df8dcffc3b758283d36b8=
0f6fb9731
> commons-jexl-3.6.3-src.tar.gz=3D36277463bcb493092bc9d55ebf5dcf90ba2b2b2cf=
8ff0141accf08bedf53397c09e0d51f1a1baafb99aa91e42567af9735cfa99f21ba9f121f4f=
96d4005b9b07
> commons-jexl-3.6.3-src.zip=3D9833a66893c9871e8d52c897d822cf826e3e2158f593=
664db71c03a797d205598976ea36ae68dc6c58844f02ffe884ba1d94c18490e3155454c30c8=
c75e02254
> commons-jexl3-3.6.3-bom.json=3D476d36bc338fd408b71f6cc92ea83008fc1588a803=
b5e9b2928b30cac7bb732c483f3fbb2bf4c3f268f3c13a73cf03a8156c7cc92337ce818e452=
3f09ea47df7
> commons-jexl3-3.6.3-bom.xml=3Da7adc2e32dc6a60aae5279fce8a137055232712f66c=
77adca83f1ff0a2765c204d0256f1fea20776d54684a1762082a6c163b3cdf43e04208924b2=
5c4fd6454d
> commons-jexl3-3.6.3-javadoc.jar=3D98ec36548cc744c75fb6f9036462e1e4883dc7e=
32324d16f3ace952eb9cab00efd02e1f9d017fd9b42a3f70d9a3cae923a25f699da0565768c=
1a007c6ac37bda
> commons-jexl3-3.6.3-sources.jar=3D883a3aafca8f60998d86740866eece830645b5b=
1022f683b889b7efae33205ae023814ac4d45c8dafeb9676d33fe859d0eb9756be118c4f9db=
fa86c47840bcab
> commons-jexl3-3.6.3-test-sources.jar=3Dc3b36284956b31ad2dd99ae90dafeb6f54=
509d10439efa2d67d3827745e294370ebe2f5532ac6a1a0224a240de8e8832e0467bfb4800e=
c92f7d0be2c7baf7c49
> commons-jexl3-3.6.3-tests.jar=3D371c8fa2b0718c237d09399e18a271447123483e3=
9e8f00d0653b96c7283ebd6f58e4c315c412a7393cf957fc6487132bb1b39fd26b207d4e4c0=
a62798c1aaf2
> org.apache.commons_commons-jexl3-3.6.3.spdx.json=3Dcfad1fdd2046aaee1898f0=
6ebf60c2a2e6a38ebb3d8c0d8b6af2ab93a42ff66ffed63ccfdb67e30d5486a3847fb94b769=
8fbc13c4b2edaafcef77edbf1d1db0a
>
>
> I have tested this with 'mvn' and 'mvn clean install site' using:
>
> openjdk version "21.0.11" 2026-04-21
> OpenJDK Runtime Environment Homebrew (build 21.0.11)
> OpenJDK 64-Bit Server VM Homebrew (build 21.0.11, mixed mode, sharing)
>
> Apache Maven 3.9.16 (2bdd9fddda4b155ebf8000e807eb73fd829a51d5)
> Maven home: /opt/homebrew/Cellar/maven/3.9.16/libexec
> Java version: 21.0.11, vendor: Homebrew, runtime:
> /opt/homebrew/Cellar/openjdk@21/21.0.11/libexec/openjdk.jdk/Contents/Home
> Default locale: en_US, platform encoding: UTF-8
> OS name: "mac os x", version: "26.5.1", arch: "aarch64", family: "mac"
>
> Darwin Garys-MacBook-Pro.local 25.5.0 Darwin Kernel Version 25.5.0:
> Mon Apr 27 20:41:15 PDT 2026;
> root:xnu-12377.121.6~2/RELEASE_ARM64_T6041 arm64
>
> Docker version 29.4.3, build 055a478
>
>
> Details of changes since 3.6.2 are in the release notes:
>     https://dist.apache.org/repos/dist/dev/commons/jexl/3.6.3-RC1/RELEASE=
-NOTES.txt
>     https://dist.apache.org/repos/dist/dev/commons/jexl/3.6.3-RC1/site/ch=
anges.html
>
> Site:
>     https://dist.apache.org/repos/dist/dev/commons/jexl/3.6.3-RC1/site/in=
dex.html
>     (Note some *relative* links are broken and the 3.6.3 directories
> are not yet created - these will be OK once the site is deployed.)
>
> JApiCmp Report (compared to 3.6.2):
>     https://dist.apache.org/repos/dist/dev/commons/jexl/3.6.3-RC1/site/ja=
picmp.html
>
> RAT Report:
>     https://dist.apache.org/repos/dist/dev/commons/jexl/3.6.3-RC1/site/ra=
t-report.html
>
> KEYS:
>   https://downloads.apache.org/commons/KEYS
>
> Please review the release candidate and vote.
> This vote will close no sooner than 72 hours from now.
>
>   [ ] +1 Release these artifacts
>   [ ] +0 OK, but...
>   [ ] -0 OK, but really should fix...
>   [ ] -1 I oppose this release because...
>
> Thank you,
>
> Gary Gregory,
> Release Manager (using key 530AA5F25C25011F)
>
> The following is intended as a helper and refresher for reviewers.
>
> Validating a release candidate
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D
>
> These guidelines are NOT complete.
>
> Requirements: Git, Java, and Maven.
>
> You can validate a release from a release candidate (RC) tag as follows.
>
> 1a) Download and decompress the source archive from:
>
> https://dist.apache.org/repos/dist/dev/commons/jexl/3.6.3-RC1/source
>
> 1b) Check out the RC tag from git (optional)
>
> This is optional,  as a reviewer must at least check source distributions=
.
>
> git clone https://gitbox.apache.org/repos/asf/commons-jexl.git
> --branch commons-jexl-3.6.3-RC1 commons-jexl-3.6.3-RC1
> cd commons-jexl-3.6.3-RC1
>
> 2) Checking the build
>
> All components should include a default Maven goal, such that you can
> run 'mvn' from the command line by itself.
>
> 2) Check Apache licenses
>
> This step is not required if the site includes a RAT report page,
> which you then must check.
> This check should be included in the default Maven build, but you can
> check it with:
>
> mvn apache-rat:check
>
> 3) Check binary compatibility
>
> This step is not required if the site includes a JApiCmp report page,
> which you then must check.
> This check should be included in the default Maven build, but you can
> check it with:
>
> mvn verify -DskipTests -P japicmp japicmp:cmp
>
> 4) Build the package
>
> This check should be included in the default Maven build, but you can
> check it with:
>
> mvn -V clean package
>
> You can record the Maven and Java version produced by -V in your VOTE rep=
ly.
> To gather OS information from a command line:
> Windows: ver
> Linux: uname -a
>
> 4b) Check reproducibility
>
> To check that a build is reproducible, run:
>
> mvn clean verify artifact:compare -DskipTests
> -Dreference.repo=3Dhttps://repository.apache.org/content/repositories/sta=
ging/
> '-Dbuildinfo.ignore=3D*/*.spdx.json'
>
> Note that this excludes SPDX files from the check.
>
> 5) Build the site for a single module project
>
> Note: Some plugins require the components to be installed instead of pack=
aged.
>
> mvn site
> Check the site reports in:
> - Windows: target\site\index.html
> - Linux: target/site/index.html
>
> -the end-