v3.5.0-RC1

[nafg]

What's Changed

Bugs fixed 🐛️

• Support referencing group keys in nested query, closes groupBy does not allow group key in the nested query #2422 by @OlegYch in Support referencing group keys in nested query, closes #2422 #2877

Chores 🛠

• Update logback-classic to 1.3.12 by @scala-steward in Update logback-classic to 1.3.12 #2864
• Update actions/setup-java action to v4 by @renovate in Update actions/setup-java action to v4 #2866
• Update logback-classic to 1.3.13 by @scala-steward in Update logback-classic to 1.3.13 #2867
• Update logback-classic to 1.3.14 by @scala-steward in Update logback-classic to 1.3.14 #2870
• Update dependency org.postgresql:postgresql to v42.7.1 by @renovate in Update dependency org.postgresql:postgresql to v42.7.1 #2873
• Update dependency sbt/sbt to v1.9.8 by @renovate in Update dependency sbt/sbt to v1.9.8 #2875
• Update dependency org.slf4j:slf4j-api to v2.0.10 by @renovate in Update dependency org.slf4j:slf4j-api to v2.0.10 #2881
• Update slf4j-api to 2.0.11 by @scala-steward in Update slf4j-api to 2.0.11 #2884
• Update dependency com.mysql:mysql-connector-j to v8.3.0 by @renovate in Update dependency com.mysql:mysql-connector-j to v8.3.0 #2885
• Update dependency com.lightbend.paradox:sbt-paradox to v0.10.6 by @renovate in Update dependency com.lightbend.paradox:sbt-paradox to v0.10.6 #2886
• Update ts-graphviz/setup-graphviz action to v2 by @renovate in Update ts-graphviz/setup-graphviz action to v2 #2887
• Update dependency org.slf4j:slf4j-api to v2.0.12 by @renovate in Update dependency org.slf4j:slf4j-api to v2.0.12 #2888
• Only run inliner in CI by @mdedetrich in Only run inliner in CI #2889

Full Changelog: v3.5.0-M5...v3.5.0-RC1

---

This discussion was created from the release v3.5.0-RC1.

[JustinPihony]

Hi @nafg, this release covers a vulnerability fix, so I am curious if there is a timeline for the final release? That way it can be planned :)

[nafg]

Hi sorry not sure I understood. Do you mean that there are security issues in 3.4.1 that 3.5.0 fixes?

Are you using RC1?

When do you want it released? ;)

[sebastian-alfers]

Hi @nafg, I think Justin refers to https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36944. A final release would be appreciated as soon as you think it is ready :)

[nafg]

IIUC if your build uses 2.13.9+ you would not be affected regardless of Slick version.

That said I can push the button any time but it would be good to hear that a few people have tested RC1 in production.

[mdedetrich]

Just wanted to state that at least for Pekko I have updated all of the relevant sbt projects to Slick 3.5.0-RC1 and everything seems to be working good so far

[mkurz]

New play-slick releases published:

• 5.3.0-RC1
• 6.1.0-RC1

[nafg]

@mdedetrich great, have you published it?

@mkurz great, do you want to report back with feedback from users of those releases if there are any Slick issues?

I can release final whenever people think I should.

[mdedetrich]

@mdedetrich great, have you published it?

We haven't published it yet but this can be discussed, either as snapshots or as a milestone. Generally speaking we only merge a PR once its ready which would imply a 3.5.0 full release but ill ask.

Note that making a milestone has non trivial effort from our part, i.e. we have to do a formal Apache release which requires multiple votes with a lazy majority so if you want to do this then it will take a bit of time.

[mdedetrich]

See apache/pekko-persistence-jdbc#44 (comment) and apache/pekko-connectors#223 (comment)

[mdedetrich]

So just got feedback and for various reasons (both technical and process wise) its going to be complicated for us to make a snapshot/release with this RC, more specifically

• We don't want to have RC's/milestones as dependency versions in our deployable releases branches. In other words our release branches (such as main) should always be in a releasable state which by implication means that we don't want RC's/milestones as dependency versions in those branches.
• Creating a release process for a milestone is quite involved

People are always able to checkout the git repo themselves and publish their own snapshot to test it themselves. We can manually publish a snapshot with -RC1 if necessary/asked for.

[Lukah0173]

v3.5.0-RC1 is working well for us 👍

Also eager for the release as we are awaiting Pekko Persistence JDBC to follow from this.

[jtjeferreira]

I tried v3.5.0-RC1 in akka/akka-persistence-jdbc#775

I had to increase the timeout of a test, but I am not sure why (see this commit)

[nafg]

Do you think there's an issue in Slick that needs to be fixed before the final release?

[jtjeferreira]

It isn't worth delaying the release

[fabienfoerster]

Hello, first of all thanks for all the work and the support for Scala 3.

Not sure where all the conversations ended, are we waiting for something before publishing a final release ?

[nafg]

It's released! #2908