Re: [VOTE] Release Apache Commons Codec 1.22.1 based on RC1

+1 checks out on all fronts.



> On Jul 26, 2026, at 8:19=E2=80=AFPM, Gary Gregory =
<[email protected]> wrote:
>=20
> We have fixed a 12 bugs since the release of Apache Commons Codec
> 1.22.0, so I would like to release Apache Commons Codec 1.22.1.
>=20
> Apache Commons Codec 1.22.1 RC1 is available for review here:
>    https://dist.apache.org/repos/dist/dev/commons/codec/1.22.1-RC1
> (svn revision 86254)
>=20
> The Git tag commons-codec-1.22.1-RC1 commit for this RC is
> dc8f6c832a30f524bf12a5ae7ab013e4ad7c088f, which you can browse here:
>    =
https://gitbox.apache.org/repos/asf?p=3Dcommons-codec.git;a=3Dcommit;h=3Dd=
c8f6c832a30f524bf12a5ae7ab013e4ad7c088f
> You may checkout this tag using:
>    git clone https://gitbox.apache.org/repos/asf/commons-codec.git
> --branch commons-codec-1.22.1-RC1 commons-codec-1.22.1-RC1
>=20
> Maven artifacts are here:
>    =
https://repository.apache.org/content/repositories/orgapachecommons-1954/c=
ommons-codec/commons-codec/1.22.1/
>=20
> These are the artifacts and their hashes:
>=20
> #Release SHA-512s
> #Mon Jul 27 00:12:38 UTC 2026
> =
commons-codec-1.22.1-bin.tar.gz=3D62e0c1baad7ae28f7d458ad79f6a3b2820acb9da=
fe56eefad5acdbc3183e6f0fc82bb0e31332ea43cd5da03b46e0c291802e4784bfea75c6a7=
33b1289279ae3b
> =
commons-codec-1.22.1-bin.zip=3D15d6639c7a5b1e0835ae0b43831717aed89bdc5782c=
ea218e581c3447a9b48b42b03632624d76733092725b260d98f78f52d848e224e4a8c8e921=
4b470d636bd
> =
commons-codec-1.22.1-bom.json=3D3a8991b770c0a309e6f552904cef5cbdf8bf5a08ae=
874080335f84a1fdafbbb06867a225bd04c37fc5a7a8835cdaee32397f79abf805430038ce=
a5dfdba37621
> =
commons-codec-1.22.1-bom.xml=3D35ae44a4044da51c2824ae387ea9e5a2c805fd85ab2=
a62ecf41ab869c98430402be4bcaeac9db6b0710f7b8d760d427e7ac99fd76af6b04aa20d0=
4abe8a9dbca
> =
commons-codec-1.22.1-javadoc.jar=3Dafe7ffbc2ca9d44964004a1d2eeb69426b66970=
c49152c994c01df46d8739f427cea8d938719cfa9eb38347b07e5b4b0d2fb111bec0b1f891=
a82f251505638d5
> =
commons-codec-1.22.1-sources.jar=3Dd253d10be72b389536897c61b5b54a20be88571=
ce240050f45d044286a905f5e11eddde5023c42a2ef3891b799996f39a26672eebec946f51=
af5800061ace125
> =
commons-codec-1.22.1-src.tar.gz=3D7b1ed7920282028b35c70b2bdd58e05097a83c80=
177d8a9b952da92be775b9ac0d06aff988b7d43c5f58646153b0a4282063c6c3576723d109=
d42efc3975a72c
> =
commons-codec-1.22.1-src.zip=3D533f12d752a744017e1b925c4cd995603bd071d2b94=
257e1adb21b0b8b59c97bf7515ea6a823cbfe0a03c98385a19c9f0a6b421418a319edf67c6=
eea54590ff5
> =
commons-codec-1.22.1-test-sources.jar=3Dbddb40ea9a26808a07af3845fae72d7528=
9e8dd4fc55754f86bcc97a4389640d68dc68a49880b3e9d9292faa07a0c512f2d6d1804580=
06b6f0857ffae0f8481e
> =
commons-codec-1.22.1-tests.jar=3Dc772592944848555f96df261c75dd0cb55b5be2b2=
626318a05703f93f1601dacec3224644a166fdbc70ddc7f9c6fc7c1521b04f658787e188e6=
32e08887ff072
> =
commons-codec_commons-codec-1.22.1.spdx.json=3Dac86ee3d890c7692bf7ee887324=
381a13cae7630c490bfe0f3fcb5bf42bf5b703f8cf00b1a8596f4fc58bdffc76d8a51ff55a=
5eeb23c6a59229ecfd0f39aada5
>=20
>=20
> I have tested this with 'mvn' and 'mvn clean install site' using:
>=20
> openjdk version "21.0.12" 2026-07-21
> OpenJDK Runtime Environment Homebrew (build 21.0.12)
> OpenJDK 64-Bit Server VM Homebrew (build 21.0.12, mixed mode, sharing)
>=20
> Apache Maven 3.9.16 (2bdd9fddda4b155ebf8000e807eb73fd829a51d5)
> Maven home: /opt/homebrew/Cellar/maven/3.9.16/libexec
> Java version: 21.0.12, vendor: Homebrew, runtime:
> =
/opt/homebrew/Cellar/openjdk@21/21.0.12/libexec/openjdk.jdk/Contents/Home
> Default locale: en_US, platform encoding: UTF-8
> OS name: "mac os x", version: "26.5.2", arch: "aarch64", family: "mac"
>=20
> Darwin Garys-MacBook-Pro.local 25.5.0 Darwin Kernel Version 25.5.0:
> Tue Jun  9 22:28:34 PDT 2026;
> root:xnu-12377.121.10~1/RELEASE_ARM64_T6041 arm64
>=20
> Docker version 29.4.3, build 055a478
>=20
>=20
> Details of changes since 1.22.0 are in the release notes:
>    =
https://dist.apache.org/repos/dist/dev/commons/codec/1.22.1-RC1/RELEASE-NO=
TES.txt
>    =
https://dist.apache.org/repos/dist/dev/commons/codec/1.22.1-RC1/site/chang=
es.html
>=20
> Site:
>    =
https://dist.apache.org/repos/dist/dev/commons/codec/1.22.1-RC1/site/index=
.html
>    (Note some *relative* links are broken and the 1.22.1 directories
> are not yet created - these will be OK once the site is deployed.)
>=20
> JApiCmp Report (compared to 1.22.0):
>    =
https://dist.apache.org/repos/dist/dev/commons/codec/1.22.1-RC1/site/japic=
mp.html
>=20
> RAT Report:
>    =
https://dist.apache.org/repos/dist/dev/commons/codec/1.22.1-RC1/site/rat-r=
eport.html
>=20
> KEYS:
>  https://downloads.apache.org/commons/KEYS
>=20
> Please review the release candidate and vote.
> This vote will close no sooner than 72 hours from now.
>=20
>  [ ] +1 Release these artifacts
>  [ ] +0 OK, but...
>  [ ] -0 OK, but really should fix...
>  [ ] -1 I oppose this release because...
>=20
> Thank you,
>=20
> Gary Gregory,
> Release Manager (using key 530AA5F25C25011F)
>=20
> The following is intended as a helper and refresher for reviewers.
>=20
> Validating a release candidate
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D
>=20
> These guidelines are NOT complete.
>=20
> Requirements: Git, Java, and Maven.
>=20
> You can validate a release from a release candidate (RC) tag as =
follows.
>=20
> 1a) Download and decompress the source archive from:
>=20
> https://dist.apache.org/repos/dist/dev/commons/codec/1.22.1-RC1/source
>=20
> 1b) Check out the RC tag from git (optional)
>=20
> This is optional,  as a reviewer must at least check source =
distributions.
>=20
> git clone https://gitbox.apache.org/repos/asf/commons-codec.git
> --branch commons-codec-1.22.1-RC1 commons-codec-1.22.1-RC1
> cd commons-codec-1.22.1-RC1
>=20
> 2) Checking the build
>=20
> All components should include a default Maven goal, such that you can
> run 'mvn' from the command line by itself.
>=20
> 2) Check Apache licenses
>=20
> This step is not required if the site includes a RAT report page,
> which you then must check.
> This check should be included in the default Maven build, but you can
> check it with:
>=20
> mvn apache-rat:check
>=20
> 3) Check binary compatibility
>=20
> This step is not required if the site includes a JApiCmp report page,
> which you then must check.
> This check should be included in the default Maven build, but you can
> check it with:
>=20
> mvn verify -DskipTests -P japicmp japicmp:cmp
>=20
> 4) Build the package
>=20
> This check should be included in the default Maven build, but you can
> check it with:
>=20
> mvn -V clean package
>=20
> You can record the Maven and Java version produced by -V in your VOTE =
reply.
> To gather OS information from a command line:
> Windows: ver
> Linux: uname -a
>=20
> 4b) Check reproducibility
>=20
> To check that a build is reproducible, run:
>=20
> mvn clean verify artifact:compare -DskipTests
> =
-Dreference.repo=3Dhttps://repository.apache.org/content/repositories/stag=
ing/
> '-Dbuildinfo.ignore=3D*/*.spdx.json'
>=20
> Note that this excludes SPDX files from the check.
>=20
> 5) Build the site for a single module project
>=20
> Note: Some plugins require the components to be installed instead of =
packaged.
>=20
> mvn site
> Check the site reports in:
> - Windows: target\site\index.html
> - Linux: target/site/index.html
>=20
> -the end-
>=20
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
>=20