Since the project was never released (i don't see it on Maven Central), security issues seem irrelevant. Setting it to dormant sounds reasonable to me.
Gary On Mon, Oct 19, 2026, 14:21 Thomas Wolf <[email protected]> wrote: > Hi all, > > the Vysper project https://github.com/apache/mina-vysper is in disarray. > > * The last release was 0.7.0 in 2013. > * The last substantial commits were in 2019 (never released). > * There is no Jenkins job for CI. > * There is no Github workflow for CI. > * The root POM looks very outdated. > * Attempts to contact the last maintainer have been unfruitful. > * It appears that no release was ever done from the git repository. > > We have now two security vulnerability reports against Vysper. Which > means we either do something about them (they both appear to be valid > reports), or we just accept and publish them as "unsupported when > assigned". > > I would like to officially declare Vysper to be "dormant" and not > actively maintained. It never made it to a 1.0.0 release, and > there is apparently nobody who would be able to take care of reported > security vulnerabilities. > > Please voice your opinion on this. > > If you don't want the project to be declared dormant, please point > out an alternate way to maintain the project. Note that security > vulnerabilities in an active project should be fixed within 90 days > and a release containing the fix would need to be published. > > If we can agree that the project should be declared "dormant" I'd > update the MINA web site and the Github README to state so, and > would accept and publish the two CVEs as "unsupported when assigned". > > Cheers, > > Thomas > (PMC Chair) > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > >
