My +1
Regards, Cordialement, Emmanuel Lécharny www.worteks.com <http://www.iktek.com> Le lun. 19 oct. 2026 à 20:29, Gary Gregory <[email protected]> a écrit : > Since the project was never released (i don't see it on Maven Central), > security issues seem irrelevant. Setting it to dormant sounds reasonable to > me. > > Gary > > On Mon, Oct 19, 2026, 14:21 Thomas Wolf <[email protected]> wrote: > > > Hi all, > > > > the Vysper project https://github.com/apache/mina-vysper is in disarray. > > > > * The last release was 0.7.0 in 2013. > > * The last substantial commits were in 2019 (never released). > > * There is no Jenkins job for CI. > > * There is no Github workflow for CI. > > * The root POM looks very outdated. > > * Attempts to contact the last maintainer have been unfruitful. > > * It appears that no release was ever done from the git repository. > > > > We have now two security vulnerability reports against Vysper. Which > > means we either do something about them (they both appear to be valid > > reports), or we just accept and publish them as "unsupported when > > assigned". > > > > I would like to officially declare Vysper to be "dormant" and not > > actively maintained. It never made it to a 1.0.0 release, and > > there is apparently nobody who would be able to take care of reported > > security vulnerabilities. > > > > Please voice your opinion on this. > > > > If you don't want the project to be declared dormant, please point > > out an alternate way to maintain the project. Note that security > > vulnerabilities in an active project should be fixed within 90 days > > and a release containing the fix would need to be published. > > > > If we can agree that the project should be declared "dormant" I'd > > update the MINA web site and the Github README to state so, and > > would accept and publish the two CVEs as "unsupported when assigned". > > > > Cheers, > > > > Thomas > > (PMC Chair) > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: [email protected] > > For additional commands, e-mail: [email protected] > > > > >
