I'd like to also point out my PR #312 to be before releasing a 2.0.3 for a couple of more CVEs.

Also interested in this. @dain @electrum could you jump in for the review please?

Also looking forward to a 2.0.3 release with this fix. We'd need it for Apache Pulsar.

any tentative date for the v2.0.3 out with the fix?

Hello, would it be possible to get some clear messaging about what is the plan and the timeline, please?

Apparently, this is biting a bunch not-so-low-profile projects as well as our tracer (DataDog/dd-trace-java#10633). A timeline would be greatly appreciated, so we can adjust our expectations.

Thanks very much in advance!

@wendigo thanks for merging this. Do you know what the plans are for a release of v2.0.3 that would include this?

@rmoff I can't merge it. I've asked @martint to do it

We just released 2.0.3. Thanks to @wendigo for adding the release automation.

🎁 Thank you very much to everyone involved! Hugely appreciated!

I submitted a modification to the advisory here: github/advisory-database#7065