Some gRPC releases are missing in Maven Central

[Yaroslav Brahintes]

Some gRPC releases are missing in Maven Central. For example:

• CVE-2023-32731 fixes that had been released in v1.54.2
• CVE-2023-1428 fixes that had been released in v1.52.2

Wondering if there's a specific reason why we shouldn't publish them to Maven? Also, could you recommend a good place for us to pull fixed patch versions without needing to upgrade minor versions

[sanjay...@google.com]

Your links to v1.52.2 and v1.54.2 are for the releases of grpc core (C/C++). For grpc-java (which is what you will find on Maven central) you can find the releases at https://github.com/grpc/grpc-java/releases. The "Grpc core" in Maven central is just the grpc-core artifact of grpc-java and not to be confused with the grpc core repository for C/C++.

[Yaroslav Brahintes]

Thanks, my bad

Is there a chance those security patches will be release for java version as well 1.54.2 and 1.52.2?

[Sanjay Pujare]

No. Based on my understanding of the CVEs, those vulnerabilities only exist in the grpc C/C++ code base so there is no question of releasing patches for grpc Java.

--
You received this message because you are subscribed to a topic in the Google Groups "grpc.io" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/grpc-io/Y81gl6AP3Qw/unsubscribe.
To unsubscribe from this group and all its topics, send an email to grpc-io+u...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/grpc-io/1c0d755c-6ef7-4ccb-a238-2bd9bb9e1824n%40googlegroups.com.

[Yaroslav Brahintes]

Thanks for hint, Sanjay. Cheers!