Kafka

Hi Omnia, Several vulnerabilities have been identified in the libraries included in the Kafka 4.4.0 release candidate (RC). Considering the number and severity of these vulnerabilities, could you please consider upgrading the affected libraries to the specified fixed versions as part of Kafka 4.4.0 itself? Upgrading these dependencies before the final Kafka 4.4.0 release would help address the identified security findings and avoid additional remediation activities after release. The details are provided below: 1. Jetty Current version: 12.0.37 Recommended version: 12.0.39 Vulnerabilities addressed: CVE-2026-12611 CVE-2026-19203 CVE-2026-19204 2. Jackson Current version: 2.21.6 Recommended version: 2.21.7 Vulnerabilities addressed: CVE-2026-91776 CVE-2026-91777 CVE-2026-89425 CVE-2026-89407 3. zstd-jni Current version: 1.5.6-10 Recommended version: 1.5.7-20 Vulnerabilities addressed: CVE-2026-87795 CVE-2026-87825 CVE-2026-90560 CVE-2026-87824 CVE-...

Hmm, I think we could have been dropping each other but I also have triggered 4.4 RC1 couple of times so it could be the re-triggering path caused issue to 4.4 RC. I will trigger new RC today and hopefully this will fix it for 4.4.0 Sent from my iPhone > On 23 Sep 2026, at 22:21, Jakub Scholz <jakub@scholz.cz> wrote: > > Hi Omnia, > > Thanks for the RC. > > There seems to be the same problems as with the 4.2.2 RC and the staged > Maven artifacts seem to be missing in the staging repo. (I wonder if for > some reason both RCs were dropped by the Maven repo or if there is some > issue with doing two releases in parallel and you are overwriting each > other 🤔) > > Thanks > Jakub > >> On Tue, Sep 22, 2026 at 4:10 PM Omnia Ibrahim <o.g.h.ibrahim@gmail.com> >> wrote: >> >> Hello Kafka users, developers and client-developers, >> >> This is the 2nd candidate for release ...

Hi Vivek, Because of the process for releasing versions in the ASF, we can't really give you an exact date until the very same day the release happens (or in some cases a couple of days before). Each Release Candidate is proposed and must be validated by the community and maintainers. Currently, we are testing RC1 and it seems there are some problems. So probably another release candidate needs to be created. Best, On Thu, Sep 24, 2026 at 11:10 AM Vivek Agarwal B via users < users@kafka.apache.org> wrote: > Hi Matthias, > > I believe we should now have confirmation of the exact release date for > Kafka 4.4.0. Could you please share the confirmed date? > > Regards > Vivek > > -----Original Message----- > From: Matthias J. Sax <mjsax@apache.org> > Sent: 17 September 2026 05:59 > To: Mayank Maheshwari M <mayank.m.maheshwari@ericsson.com>; Vivek Agarwal > B <vivek.b.agarwal@ericsson.com>; users@k...

Hi Matthias, I believe we should now have confirmation of the exact release date for Kafka 4.4.0. Could you please share the confirmed date? Regards Vivek -----Original Message----- From: Matthias J. Sax <mjsax@apache.org> Sent: 17 September 2026 05:59 To: Mayank Maheshwari M <mayank.m.maheshwari@ericsson.com>; Vivek Agarwal B <vivek.b.agarwal@ericsson.com>; users@kafka.apache.org Cc: Ashish Verma V <ashish.v.verma@ericsson.com> Subject: Re: Kafka 4.4.0 formal release date -- Important No updates... We are waiting for RC2. But today, a potentially new blocker bug was found... On 9/16/26 5:27 AM, Mayank Maheshwari M wrote: > Hi @Matthias J. Sax, > > Unfortunately, I have not been able to follow the development mailing list to monitor the progress, as you suggested, due to security constraints at Ericsson. > > I understand that you previously mentioned the Kafka release may require approximately two more weeks. As noted ...

Hi Omnia, Thanks for the RC. There seems to be the same problems as with the 4.2.2 RC and the staged Maven artifacts seem to be missing in the staging repo. (I wonder if for some reason both RCs were dropped by the Maven repo or if there is some issue with doing two releases in parallel and you are overwriting each other 🤔) Thanks Jakub On Tue, Sep 22, 2026 at 4:10 PM Omnia Ibrahim <o.g.h.ibrahim@gmail.com> wrote: > Hello Kafka users, developers and client-developers, > > This is the 2nd candidate for release of Apache Kafka 4.4.0. > > Apache Kafka 4.4.0 is a minor release that includes 26 KIPs spanning > improvements to all components. > > Release notes for the 4.4.0 release: > https://dist.apache.org/repos/dist/dev/kafka/4.4.0-rc1/RELEASE_NOTES.html > > Please download, test and vote by Friday, September 25, 2026, 12:30pm BST > (4:30am PT) > > Kafka's KEYS file containing PGP keys we use to sign th...

Hi Omnia I tested the 4.4 branch and encountered a test failure, but it is unrelated to 4.4 branch. see https://issues.apache.org/jira/browse/KAFKA-21146 for details Best, Chia-Ping Omnia Ibrahim <o.g.h.ibrahim@gmail.com> 於 2026年9月23日週三 下午6:18寫道： > Adding both users and Kafka-clients > > > On 23 Sep 2026, at 11:11, Omnia Ibrahim <o.g.h.ibrahim@gmail.com> wrote: > > > > Here is the report for system testing > > > > > https://confluent-open-source-kafka-branch-builder-system-test-results.s3-us-west-2.amazonaws.com/trunk/2026-09-22--001.1442301f-18b4-4a90-a790-4f8550f93d20--1790111851--apache--4.4--812f9108eb/report.html > > The two failed test cases are same as the one mentioned in 4.3.1 RC2 so > not new issue > > > >> On 22 Sep 2026, at 15:09, Omnia Ibrahim <o.g.h.ibrahim@gmail.com> > wrote: > >> > >> Hello Kafka users, developers and client-developers, ...

Adding both users and Kafka-clients > On 23 Sep 2026, at 11:11, Omnia Ibrahim <o.g.h.ibrahim@gmail.com> wrote: > > Here is the report for system testing > > https://confluent-open-source-kafka-branch-builder-system-test-results.s3-us-west-2.amazonaws.com/trunk/2026-09-22--001.1442301f-18b4-4a90-a790-4f8550f93d20--1790111851--apache--4.4--812f9108eb/report.html > The two failed test cases are same as the one mentioned in 4.3.1 RC2 so not new issue > >> On 22 Sep 2026, at 15:09, Omnia Ibrahim <o.g.h.ibrahim@gmail.com> wrote: >> >> Hello Kafka users, developers and client-developers, >> >> This is the 2nd candidate for release of Apache Kafka 4.4.0. >> >> Apache Kafka 4.4.0 is a minor release that includes 26 KIPs spanning improvements to all components. >> >> Release notes for the 4.4.0 release: >> https://dist.apache.org/repos/dist/dev/kafka/4.4.0-rc1/RELEASE_NOTES.html...