Repository navigation
Do we have an ETA for tag/release 3.7.10 #4843
Description
Hi,
Our toolings are flagging this ApplicationInsights-Java with at least the 3 following vulnerabilities which are transitive via:
- sonatype-2026-005959 (jackson-databind)
- sonatype-2026-005866 / CVE-2026-75596 (Netty)
- CVE-2026-68497 (jackson-databind)
Those vulnerabilities are classified as High and are breaking our builds.
I also see that:
- Bump the all-dependencies group with 8 updates #4839 resolves the jackson ones.
- Looking at the the code base on
master, it seems that we are also on non vulnerable version of Netty.
Is there any timeline so can we expect a new tag/release published on Maven given that the last one was in June?
Thank you for your time. :)
Activity
xiang17 commentedon Sep 2, 2026
The Netty package is also on latest since #4828.
Yes, a new release is coming soon within this week or next week. It was blocked earlier because I was waiting on a bug fix in the upstream. The new upstream version was released last Friday and I just incorporated it: #4821.
YouriTjang commentedon Sep 14, 2026
Hi xiang17 any update on the new release?
Tbh, in order to keep up with the current speed with which vulnerabilities are found, releases need to happen way more often
ildyria commentedon Sep 15, 2026
And another vulnerability in the shaded dependency poped up, this time on Jackson-core: CVE-2026-68498
The fix is in 2.22.2 which also already present in the main branch: #4839
Really looking forward to that release :)
xiang17 commentedon Sep 21, 2026
3.7.10 has been released on September 18, Friday: https://github.com/microsoft/ApplicationInsights-Java/releases/tag/3.7.10