Any plan or schedule for the next version?

[fs523577192]

The latest version 2.26.1 has been flagged by Sonatype to have 9.2 critical vulnerability sonatype-2026-006746 for more than 2 months (as of today 02 Nov 2026).

It seems that "vulnerability" is fixed in #4365 and #4274. May I know whether there is any plan or schedule to release it (in the next version)?

Although it is not a CVE and I believe most of the application will not pass untrusted object into Log4j ObjectMessage, ObjectArrayMessage, etc. and let Log4j deserialize it, our company's security policy demands us to get rid of it. And it will take much time and effort for us to prove that this "vulnerability" is not expoitable in our applications and for the security team to review our evidences. It will save our lives if we can upgrade to a new version without this sonatype-2026-006746.

[ramanathan1504]

@fs523577192
Thanks for raising this. Both fixes (#4365, #4274) are merged and will ship in 2.26.2, which we're planning to release before the Christmas holidays. Once they're out, the release notes will list the changes, and you can point Sonatype to them to update their advisory.