+1 Jeff
> On Jun 25, 2026, at 4:39 PM, Gary Gregory <[email protected]> wrote: > > +1 > > I tested the source zip files for both versions. > > - ASC OK > - SHA512 OK > - Building 'mvn clean verify` OK > > Using: > > java version "1.8.0_481" > Java(TM) SE Runtime Environment (build 1.8.0_481-b10) > Java HotSpot(TM) 64-Bit Server VM (build 25.481-b10, mixed mode) > > Apache Maven 3.9.16 (2bdd9fddda4b155ebf8000e807eb73fd829a51d5) > Maven home: /opt/homebrew/Cellar/maven/3.9.16/libexec > Java version: 1.8.0_481, vendor: Oracle Corporation, runtime: > /Library/Java/JavaVirtualMachines/jdk-1.8.jdk/Contents/Home/jre > Default locale: en_US, platform encoding: UTF-8 > OS name: "mac os x", version: "26.5.1", arch: "aarch64", family: "mac" > > Darwin ****.local 25.5.0 Darwin Kernel Version 25.5.0: Mon Apr 27 > 20:41:15 PDT 2026; root:xnu-12377.121.6~2/RELEASE_ARM64_T6041 arm64 > > Docker version 29.4.3, build 055a478 > > Gary > > On Mon, Jun 22, 2026 at 6:07 PM Emmanuel Lecharny <[email protected]> > wrote: >> >> Ah, my bad, the links are: >> >> https://dist.apache.org/repos/dist/dev/mina/mina/mina-2.1.15/ >> https://dist.apache.org/repos/dist/dev/mina/mina/mina-2.0.31/ >> >> On Mon, Jun 22, 2026 at 4:22 PM Gary Gregory <[email protected]> wrote: >>> >>> https://dist.apache.org/repos/dist/dev/mina/mina/2.0.31/ >>> https://dist.apache.org/repos/dist/dev/mina/mina/2.1.15/ >>> >>> That's 404 >>> >>> Gary >>> >>> On Mon, Jun 22, 2026 at 8:22 AM Emmanuel Lecharny <[email protected]> >>> wrote: >>>> >>>> Hi, >>>> >>>> this double vote is for a release that fixes some missing back-ported >>>> code from 2.2.X branch >>>> The back-ported code fixes CVE-2026-47065: >>>> >>>> ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter >>>> Bypass via java.lang.reflect.Proxy >>>> >>>> Assessment: Fully addressed. >>>> >>>> When the serialised stream contains a TC_PROXYCLASSDESC (the marker >>>> for a java.lang.reflect.Proxy ), JDK’s >>>> ObjectInputStream.readProxyDesc() is dispatched. JDK then calls the >>>> default ObjectInputStream.resolveProxyClass(interfaces) >>>> implementation, which performs Class.forName(intf, false, >>>> latestUserDefinedLoader()) for EACH interface name and constructs the >>>> proxy class — bypassing the accepted classes list . >>>> >>>> >>>> The packages are available at : >>>> >>>> MINA 2.0.31 >>>> =========== >>>> >>>> https://repository.apache.org/content/repositories/orgapachemina-1148/org/apache/mina/ >>>> and >>>> https://dist.apache.org/repos/dist/dev/mina/mina/2.0.31/ >>>> >>>> [ ] +1 Release >>>> [ ] ± 0 Abstain >>>> [ ] -1 Do Not Release >>>> >>>> MINA 2.1.15 >>>> =========== >>>> >>>> https://repository.apache.org/content/repositories/orgapachemina-11498/org/apache/mina/ >>>> and >>>> https://dist.apache.org/repos/dist/dev/mina/mina/2.1.15/ >>>> >>>> [ ] +1 Release >>>> [ ] ± 0 Abstain >>>> [ ] -1 Do Not Release >>>> >>>> >>>> Thanks! >>>> -- >>>> Regards, >>>> Cordialement, >>>> Emmanuel Lécharny >>>> www.worteks.com >>>> >>>> --------------------------------------------------------------------- >>>> To unsubscribe, e-mail: [email protected] >>>> For additional commands, e-mail: [email protected] >>>> >>> >>> --------------------------------------------------------------------- >>> To unsubscribe, e-mail: [email protected] >>> For additional commands, e-mail: [email protected] >>> >> >> >> -- >> Regards, >> Cordialement, >> Emmanuel Lécharny >> www.worteks.com >> >> --------------------------------------------------------------------- >> To unsubscribe, e-mail: [email protected] >> For additional commands, e-mail: [email protected] >> > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
