3:12 p.m.
För kännedom.
Begin forwarded message:
From: Scott Cantor via announce <announce(a)shibboleth.net>
Subject: Shibboleth Identity Provider V5.2.3 now available
Date: 18 June 2026 at 15:02:50 GMT+2
The Shibboleth Project has released a patch version of the IdP software to refresh a
number of libraries with open CVEs, including Spring, which announced a large number of
them last week, as well as ldaptive/netty and logback (which had gotten pretty out of
date).
We don't think any of them were all that impactful if at all, but releasing was much
less work than a detailed triage of everything.
For Jetty plugin adopters, it looks as though the logging libraries are not (yet) getting
updated inside the Jetty plugin configuration the way we expected, so that's something
we'll check into and get fixed, it can be done manually for the moment.
-- Scott