New release? 🤔

[kloczek]

cyrus-sasl-2.1.28...master shows +250 commits since last release which was +2 years ago.
Do you have any plans to release new version soon? 🤔

[dilyanpalauzov]

Same question at https://cyrus.topicbox.com/groups/devel/T66fe90bb03c0fd20/.

[Neustradamus]

I hope to see a new version before Debian 13 freeze.

[Neustradamus]

Dear @cyrusimap team, @rjbs, @@quanah, @hyc, @ksmurchison, @rsto, @brong, @ksuther, @xfbs, @minichma, @ajaysusarla, @bosim, @tntclaus, @elliefm, @robn, @tintou, @ajacoutot, @dbnicholson, @guimard, @landgraf, @dilyanpalauzov, @gnb, @suiryc, @wolfsage,

It is possible to have the new release build like it was requested several times by people?

• Cyrus SASL
• Cyrus IMAPD

We need improvements and a better security!

Thanks in advance.

[rjbs]

@Neustradamus At-ing every contributor you can think of us a good way to get blocked. Stop it.

[Neustradamus]

@rjbs: Sorry but people wait since 3 years (soon) a new cyrus-sasl with improvements and more security!

• Latest Cyrus-SASL 2.1.28 (2022-02-22)

Detail: I am not the author of this ticket.

In more, for example, some devs wait the new Cyrus-SASL build to add features in Cyrus-IMAPD.

We can cited @GuidoKiener for example with this PR who has done a good job (since 2023-12-16) with this PR and has answered quickly to cyrusimap team and more one year after, it has not been merged yet...

• RFC 9266: Channel Bindings for TLS 1.3 #4191 cyrus-imapd#4772

After Debian 13 (2025) which arrives after Debian 12 (2023), it will be Debian 14 (2027).

Security improvements since 2.1.28 has not price, it is really important.

Note: A lot of projects have already created new release builds recently before Debian 13 freeze.

[tintou]

@Neustradamus Please double check before doing so because I have nothing to do with this project

[mistotebe]

@Neustradamus since you are so keen to help 2.2 released, maybe the way to achieve it is by helping progress the tasks that are assigned to it? Have a look at the list here: https://github.com/cyrusimap/cyrus-sasl/milestone/5

[Neustradamus]

@mistotebe: I think that all which are not ready now, can be reported in another version.

2.2.0 is NOW needed (latest Cyrus-SASL 2.1.28 is very old, 2022-02-22, soon 3 years) before Debian 13 freeze, next Debian will be in 2027 in two years (if no 2.2.0 NOW, 5 years without security improvements? It is not possible! Security is important).

Please look here for example: https://www.bleepingcomputer.com/news/security/over-3-million-mail-servers-without-encryption-exposed-to-sniffing-attacks/

Note: Can you close this one like @GuidoKiener has requested if #823 is merged here:

• RFC 9266: Channel Bindings for TLS 1.3 support #742 (comment)

[Neustradamus]

@mistotebe and @cyrusimap team: Of course, a new Cyrus-IMAPD (2025) must have the new one Cyrus-SASL for security reasons.