Plan to release etcd v3.4.36

[ivanvc]

What would you like to be added?

The etcd patch release criteria has been met for our release-3.4 stable release branch so we should release v3.4.36.

The list of commits included since the previous release is: v3.4.35...release-3.4:

• [3.4] Backport updating release script to use ssh #18888
• [3.4] fix runtime error: comparing uncomparable type #18936
• [3.4] Bump Go to 1.22.10 #19005
• [3.4] Fix release_notes.tpl.txt by adding a space between Docker image name and version #19162
• [3.4] Avoid deadlock in etcd.Close when stopping during bootstrapping #19166
• [3.4] Bump golang.org/x/crypto and golang.org/x/net #19197
• [3.4] Bump go toolchain to 1.22.11 #19212
• [3.4] mvcc: restore tombstone index if it's first revision #19251
• [3.4] Update golang toolchain to 1.22.12 #19337
• [3.4] Fix(ci): upgrade artifact actions to v4 #19369
• [3.4] Update golang toolchain to 1.23.6 #19429

Work in progress CHANGELOG is: https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.4.md#v3436-tbc

List of pull requests we still need to backport from main to release-3.4 before the patch release is issued:

• [3.4] dependency: Bump golang.org/x/crypto from v0.32.0 to v0.35.0 #19477

Release team

GitHub handle	Role
@ivanvc	Release lead
@jmhbnz	Release advisor

Why is this needed?

Regular patch releases are vital to ensure our users have bug-free and secure software.

[ivanvc]

It'd be good to do this release soon. @jmhbnz, will you be around/have availability next week? Else, I can gather a release team.

[jmhbnz]

It'd be good to do this release soon. @jmhbnz, will you be around/have availability next week? Else, I can gather a release team.

I am travelling currently but will be home Tuesday next week if we can wait till then. Happy to be release lead or release advisor as needed.

[ivanvc]

I think it would be reasonable to do it next Wednesday, February 19th, PT. As you'll be returning, I can be the lead, so I'll prepare for it.

[ivanvc]

Sorry for the late notice, but is anyone interested in being a shadow for a release tomorrow at 11 am PT?

cc. @Elbehery, @ArkaSaha30, @stackbaek, @ghouscht, @henrybear327.

[ivanvc]

@jmhbnz / @ahrtr, should we delay the release by one week? There will be an update to golang.org/x/crypto due to CVE-2025-22869 next Monday. Although we should not be impacted by it (as the vulnerability is in golang.org/x/crypto/ssh), we do have the golang.org/x/crypto dependency, and that may trigger some vulnerability analysis tools (i.e., Trivy).

Quoting the announcement from the golang mailing list

Hello gophers,

We plan to issue a security fix for the package golang.org/x/crypto/ssh in the golang.org/x/crypto module during US business hours on Monday, February 24.

This will cover the following CVEs:

CVE-2025-22869

Following our security policy, this is the pre-announcement of the fix.

Thanks,
The Go team

[ahrtr]

should we delay the release by one week?

OK to delay the release to me. thx

[jmhbnz]

should we delay the release by one week?

Agree, one more week should be ok.

[ivanvc]

We'll do the release next Tuesday at 11 am PT.

Please reach out if you want to be a release shadow.