Forwarding from the superset dev list where I was asking them what was going on with their releases. 
> We have yet to come up with our first Apache release. We're having issues
> wrapping our heads around how to come up with our LICENSE file given the
> JS bundle along with our Python application, it seems like we'll have to
> come up with either a programmatic way to extract the LICENSE info, or ship
> the application without the JS deps, and provide instruction has to how to
> fetch and build the package deps, which isn't very convenient. We also have
> some minor deps on GPL lib, one of which we need to get clarity as to how
> to to handle them. It's related to the "chardet" sub dependency of the Pypi
> requests library.
Thanks for explaining the situation. If you need help with LICENSE And NOTICE issues you can always ask on the incubator general list, there’s a number of experienced people who could help there.
> Clearly we need to come up with a plan for our first Apache release. I'll
> bring this up at the next committer meeting (this upcoming Friday)
I’m not involved in your project and not familiar with how it operates, but "next committer meeting” rings alarm bells for me. At Apache things are done asynchronously on the mailing list to allow everyone to participate no mater what time zone they are in and to provide a permanent archive of all important decisions. I suggest you discuss this on the mailing list.
On your mailing list I see only one mention of a committer meeting and it includes a link to a private google doc which I cannot view.  This is concerning. I note that one of your mentors also has concerns about these meetings.
Even with the explanation above you still seem to be making releases that are not in line with ASF policy. I see 50+ releases here  that appear to be ALv2 releases (although they may not be because of the GPL issue you mention) of an Apache incubating project.  At the very least it need to be made very clear on those pages that these releases are not offical releases.
Can you please include in your upcoming podling report what actions you are going to take to fix this situation and the expected timeframe in which it will be done. Can the mentors of the project please help this project be more in line with Apache release policy. As an incubating project it not expected you get everything right but this would need to be corrected before graduation to a TLP.
Note that in order to make a release with GPL issues you would most likely need permission from VP Legal, I know of one occasion where this was granted to a podling on the condition it was fixed in the next release.
I also note that you have been in the incubator for almost 2 years. I'm sorry but IMO that should be long enough to sort these types of issues out. From a quick search I can find nothing on your mailing list that indicates there is effort in fixing this or that it was even a concern. You have mentioned making an first release in board reports (and there some mentor comments) but IMO this should of been flagged a long time ago.
Do other IPMC members have anything to add here? Does anyone think I have misread the situation?