[VOTE] Batch backport release candidates for v3.0–v9.0

[Xuanwo]

Batch backport release vote

This Discussion covers six independently votable stable release candidates containing the same two corruption-safety fixes:

• #8138 — bounds-check the length prefix in VariableFullZipDecoder::unzip
• #8144 — reject out-of-bounds variable-width offsets during decode

The fixes were backported by #8152, #8153, #8155, #8156, #8157, and #8158. Each candidate is immutable: the release link and commit below identify the exact source being voted on.

Candidates

Release line	Backport	Candidate and commit	Artifact workflows
release/v3.0	#8152	v3.0.2-rc.1 · 6d7031b	Python ✅ · Java ✅ · Buf ✅
release/v4.0	#8153	v4.0.2-rc.1 · 0f42222	Python ✅ · Java ✅ · Buf ✅
release/v6.1	#8155	v6.1.0-rc.2 · 24ecc6b	Python ✅ · Java ✅ · Buf ✅
release/v7.1	#8156	v7.1.0-rc.2 · 9f1d239	Python ✅ · Java ✅ · Buf ✅
release/v8.0	#8157	v8.0.1-rc.1 · bef286f	Python ✅ · Java ✅ · Buf ✅
release/v9.0	#8158	v9.0.1-rc.1 · 052eb9e	Python ✅ · Java ✅ · Buf ✅

All 18 in-scope artifact workflows completed successfully. All Python candidates are visible in the Fury index, and all Java candidate POMs are visible in Maven Central.

Testing

Test the release lines relevant to you and scope your vote accordingly.

Python example (use the PEP 440-normalized version for the selected candidate):

pip install --pre --extra-index-url https://pypi.fury.io/lance-format/ "pylance==9.0.1rc1"

Java example:

<dependency>
  <groupId>org.lance</groupId>
  <artifactId>lance-core</artifactId>
  <version>9.0.1-rc.1</version>
</dependency>

Rust example:

[dependencies]
lance = { git = "https://github.com/lance-format/lance", tag = "v9.0.1-rc.1" }

Voting

Each candidate is an independent stable-release decision. Cast each vote as a top-level comment, not as a reply. Examples:

• +1 (binding): all candidates
• +1 (binding): v8.0.1-rc.1, v9.0.1-rc.1
• 0: v4.0.2-rc.1
• -1 (binding): v6.1.0-rc.2 — <reason>

An unscoped vote applies to all candidates. Each candidate requires 3 binding +1 votes from PMC members and no valid binding -1 veto. A -1 vote must include justification. Non-binding votes are welcome.

Although patch releases have no minimum voting period, this batch uses one common window because it also includes major/minor stable releases. The vote will remain open until at least 2026-08-06 10:00 UTC (2026-08-06 03:00 PDT). Eligible candidates may then be promoted independently.

If one candidate needs a replacement RC, only that release line needs renewed confirmation; unaffected candidates may proceed after the common window.

Scope

• release/v5.0 is intentionally excluded from this vote.
• release/v6.0 and release/v7.0 are intentionally excluded in favor of release/v6.1 and release/v7.1.
• v10 follows its separate release vote.
• v7.1.0-rc.2 supersedes the v7.1.0-rc.1 vote.

After the vote, approved candidates will be promoted directly on their release branches and their stable artifacts will be verified independently.

Why v5.0 is excluded

v5.0.0 never completed a stable release: only beta and RC tags exist, the v5.0.0-rc.1 vote received no votes, and no stable Python, Java, or Rust artifacts were published. The release line has since been superseded by later major versions. Publishing v5.0.0-rc.2 now would be a delayed first stable v5 release rather than a backport release for an established stable version, so it is outside this vote. The v5.0.0-rc.2 prerelease remains available as an immutable historical candidate.

[BubbleCal]

+1

[westonpace]

+1

[wjones127]

+1

[Xuanwo]

Final result

The batch vote passed with three binding PMC +1 votes and no vetoes. All six stable releases have been published and independently verified:

Stable release	Release branch	Next development version	PyPI	Maven Central	crates.io	BSR
v3.0.2	release/v3.0	3.0.3-beta.0	verified	verified	verified	verified
v4.0.2	release/v4.0	4.0.3-beta.0	verified	verified	verified	verified
v6.1.0	release/v6.1	6.1.1-beta.0	verified	verified	verified	verified
v7.1.0	release/v7.1	7.1.1-beta.0	verified	verified	verified	verified
v8.0.1	release/v8.0	8.0.2-beta.0	verified	verified	verified	verified
v9.0.1	release/v9.0	9.0.2-beta.0	verified	verified	verified	verified

Verification covered signed annotated tags, non-prerelease GitHub Releases, six wheels per PyPI version, Maven POM/JAR artifacts, every versioned workspace crate plus the top-level lance crate, and successful BSR publishing.

Publishing recovery notes:

• crates.io rate-limited the initial concurrent batch. v4.0.2 and v6.1.0 completed through serialized retries; v7.1.0, v8.0.1, and v9.0.1 completed through serialized recovery runs from their unchanged stable tags with exact already-published exclusions: v7.1.0, v8.0.1, v9.0.1.
• The v3.0.2 Windows wheel exceeded its 60-minute job timeout once. Only the missing Windows job was rerun, and all six v3.0.2 wheels are now available: successful run.
• The automatically generated Cargo failure issues were resolved with recovery evidence and closed.

v5.0 is intentionally excluded: v5.0.0 never completed a stable release, only beta/RC artifacts existed, and the line has been superseded. v5.0.0-rc.2 remains immutable prerelease history.