New tagged release when?

[bertold]

The library has a vulnerable component in the latest release. The main branch already have the update. When can we expect a new tagged release?

[hannahkm]

Hello! Could you clarify which component has the vulnerability? If the fix is already in the main branch, it's likely that the fix is already included in v2.7.0-rc.2. This release is still in process, but if you need an urgent workaround, you can use this release candidate. The full release should be available within the next 1.5 weeks. Thank you!

[bertold]

Thank you, @hannahkm , for the quick response. The currently tagged version - 2.6.0 released almost a month ago - has a vulnerable go.opentelemetry.io/otel component. It would be really nice not having to wait a month to patch a vulnerable component especially in the days when supply chain security has moved up to the #3 spot on the latest OWASP Top-10 list. Is there a possibility to expedite component only updates for security issues to reduce this type risk in the future? Thank you. 🙏

PS: I also recommend this site from Socket to look at all the vulnerable components.

[hannahkm]

Got it, thank you for the clarification! This fix is included in v2.7.0-rc.2 and will go out in the full version. We're also working on improving our release processes, and I will raise the issue of vulnerability patch releases to our team internally so we can avoid this in the future. Thank you for bringing this to our attention!