Roll VERSION and update NEWS for release

Signed-off-by: Ralph Castain <rhc@pmix.org>

NEWS

@@ -1,6 +1,6 @@
 Copyright (c) 2015-2020 Intel, Inc.  All rights reserved.
 Copyright (c) 2017-2020 IBM Corporation.  All rights reserved.
-Copyright (c) 2021      Nanook Consulting  All rights reserved.
+Copyright (c) 2021-2023 Nanook Consulting.  All rights reserved.
 $COPYRIGHT$
 
 Additional copyrights may follow
@@ -22,6 +22,24 @@ example, a bug might be fixed in the master, and then moved to
 multiple release branches.
 
 
+3.1.7 -- 12 Sep 2023
+--------------------
+Warning:: CVE-2023-41915
+
+A security issue was reported by François Diakhate (CEA)
+which is addressed in the PMIx v4.2.6 and v5.0.1 releases.
+(Older PMIx versions may be vulnerable, but are no longer
+supported.)
+
+A filesystem race condition could permit a malicious user
+to obtain ownership of an arbitrary file on the filesystem
+when parts of the PMIx library are called by a process
+running as uid 0. This may happen under the default
+configuration of certain workload managers, including Slurm.
+
+ - PR #3157: Do not follow links when doing "chown"
+
+
 3.1.6 -- 04 Jan 2021
 ----------------------
  - PR #1669: Silence unnecessary error log message

VERSION

@@ -17,15 +17,15 @@
 
 major=3
 minor=1
-release=6
+release=7
 
 # greek is used for alpha or beta release tags.  If it is non-empty,
 # it will be appended to the version number.  It does not have to be
 # numeric.  Common examples include a1 (alpha release 1), b1 or (beta release 1).
 # The only requirement is that it must be entirely printable ASCII
 # characters and have no white space.
 
-greek=rc2
+greek=a1
 
 # If repo_rev is empty, then the repository version number will be
 # obtained during "make dist" via the "git describe --tags --always"
@@ -77,7 +77,7 @@ date="Aug 10, 2020"
 # Version numbers are described in the Libtool current:revision:age
 # format.
 
-libpmix_so_version=4:27:2
+libpmix_so_version=4:28:2
 libpmi_so_version=1:1:0
 libpmi2_so_version=1:0:0