Begin forwarded message: From: Scott Cantor via announce <announce(a)shibboleth.net> Subject: Shibboleth Identity Provider V5.2.3 now available Date: 18 June 2026 at 15:02:50 GMT+2 The Shibboleth Project has released a patch version of the IdP software to refresh a number of libraries with open CVEs, including Spring, which announced a large number of them last week, as well as ldaptive/netty and logback (which had gotten pretty out of date). We don't think any of them were all that impactful if at all, but releasing was much less work than a detailed triage of everything. For Jetty plugin adopters, it looks as though the logging libraries are not (yet) getting updated inside the Jetty plugin configuration the way we expected, so that's something we'll check into and get fixed, it can be done manually for the moment. -- Scott