Plan to release v3.5.19

[ivanvc]

What would you like to be added?

The etcd patch release criteria has been met for our release-3.5
stable branch, so we should release v3.5.19.

We have addressed the following CVEs, since the last release:

• go.mongodb.org/mongo-driver (indirect): CVE-2021-20329: Moderate ¹
• github.com/golang/glog (indirect) CVE-2024-45339: Moderate ¹
• golang.org/x/crypto (direct, but not affected): CVE-2025-22869: Not yet rated.
• golang stdlib 1.22.11: CVE-2025-22866: Not yet rated (NIST) / High (GitHub).

Work in progress CHANGELOG is: https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.5.md#v3519-tbc

The list of commits included since the previous release is: v3.5.18...release-3.5:

• [3.5] backport: tools: add mixed read-write performance evaluation scripts #19275
• [3.5] add learner check to readyz #19280
• [3.5] Add more info into log for learner member operations #19330
• [3.5] Bump go.mongodb.org/mongo-driver and github.com/golang/glog to address two CVEs #19320
• [3.5] Update golang toolchain to 1.22.12 #19336
• [3.5] Fix a performance regression due to uncertain compaction sleep interval #19405
• [3.5] Update golang toolchain to 1.23.6 #19430
• [3.5] dependency: Bump golang.org/x/crypto from v0.32.0 to v0.35.0 #19478

Outstanding tasks before releasing this version:

• [3.5] Backport fix tx buffer inconsistency if there are unordered key writes in one tx #18861
• [3.5]: use RLock in Demoted method for read-only access to expiry #19445
• Go v1.23.7
• golang.org/x/net v0.36.0(?)

Release team

GitHub handle	Role
@ivanvc	TBD

Why is this needed?

Regular patch releases are vital to ensure our users have bug-free and secure software.

Footnotes

1. from tool dependencies (not included in the released images). ↩ ↩²

[ivanvc]

Hi, @ahrtr. I was thinking of doing a tandem release again next week. Should either of the outstanding tasks be considered a blocker for v3.5.19?

[ahrtr]

Should either of the outstanding tasks be considered a blocker for v3.5.19?

No blockers.

[ivanvc]

Same note from #19489 (comment).

According to the golang mailing list, Go v1.23.7 will be released next Tuesday, March 4th, along with a new golang.org/x/net version to address CVE-2025-22870. It would be great to ship our latest versions with these version bumps. So, tentatively the releases are due on Wednesday, March 5th.