Hi all, the Vysper project https://github.com/apache/mina-vysper is in disarray.
* The last release was 0.7.0 in 2013. * The last substantial commits were in 2019 (never released). * There is no Jenkins job for CI. * There is no Github workflow for CI. * The root POM looks very outdated. * Attempts to contact the last maintainer have been unfruitful. * It appears that no release was ever done from the git repository. We have now two security vulnerability reports against Vysper. Which means we either do something about them (they both appear to be valid reports), or we just accept and publish them as "unsupported when assigned". I would like to officially declare Vysper to be "dormant" and not actively maintained. It never made it to a 1.0.0 release, and there is apparently nobody who would be able to take care of reported security vulnerabilities. Please voice your opinion on this. If you don't want the project to be declared dormant, please point out an alternate way to maintain the project. Note that security vulnerabilities in an active project should be fixed within 90 days and a release containing the fix would need to be published. If we can agree that the project should be declared "dormant" I'd update the MINA web site and the Github README to state so, and would accept and publish the two CVEs as "unsupported when assigned". Cheers, Thomas (PMC Chair) --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
