What is the 1.54.0 release timeline?

[chetangudisagar]

What is the release timeline for 1.54.0? It's been more than a month since 1.53.0 was released (Feb 10, 2023).
This netty issue CVE-2022-41881 is fixed in #9784.
This PR was not included in 1.53.0.
So users who want to mitigate the issue have no means to fix it until you release 1.54.0 or any version that includes the PR.
As per the compatibility table, only 1.54.x has the support for netty 4.1.87.

[temawi]

We are almost ready to release v1.54.0 - it should be coming out in the next couple of days.

[ejona86]

You don't need to wait for the 1.54.0 release. The CVE does not impact gRPC, as gRPC does not use the class. There's two cases:

1. You are using grpc-netty. Add an explicit dependency on the newer versions of netty/tcnative in your project.
2. You are using grpc-netty-shaded. It is safe to use as-is. If that is insufficient, swap to grpc-netty.

[ejona86]

v1.54.0 is also released now. Seems there's plenty of easy options now.