New Release ?

[kashifest]

Is there any timeline when we will have a new release? The last release was in March and still uses older golang versions which is susceptible to multiple CVEs and the main branch has gone far ahead. It will be really nice if we can expect a release now.

[kashifest]

Current CVEs reported on latest release:
CVE-2021-44716, golang: net/http: limit growth of header canonicalization,https://avd.aquasec.com/nvd/cve-2021-44716
CVE-2022-27664, golang: net/http: handle server errors after sending GOAWAY, https://avd.aquasec.com/nvd/cve-2022-27664

[kashifest]

/cc @milosgajdos

[milosgajdos]

There is no immediate plan for a new release -- but there is a Project milestone that contains a list of issues we'd like to get fixed for the RC at least: https://github.com/distribution/distribution/milestone/22

[kashifest]

ok, I would still hope for a patch release to atleast get rid of the CVEs meanwhile ?

[milosgajdos]

That makes sense. We'll get to it -- I believe @wy65701436 is attempting to update Go in #3808

Once that's sorted we'll do a patch release

[kitemongerer]

Are there any updates on when a new release will be cut?

[tristanmorgan]

#3808 has been replaced by #3812 and still in progress.

[flavianmissi]

If there's going to be a patch release, could we add #2815 to it? it was added to the 2.8 milestone, but it doesn't seem like it made into the release.
I'm not sure what the backport process is around here, but I'd be happy to help out with 2815 if necessary.

[davidspek]

@flavianmissi I created a PR to backport that change into 2.8. See #3893

[davidspek]

@flavianmissi Just thought I'd let you know it is now included in release 2.8.2.

[tianouya-db]

@davidspek is there a plan to backport this fix to earlier versions, e.g. 2.7?

[davidspek]

@tianouya-db There’s currently no plan to backport the fix to earlier versions. Currently we’re putting all effort into the release of v3.

[milosgajdos]

Closing, we've just made the first v3 release https://github.com/distribution/distribution/releases/tag/v3.0.0-alpha.1