Request for release timeline of Pulsar 4.0.2 (fix for CVE-2024-53990)

[zhaoyuanTian123]

It has been documented that Pulsar 4.0.2 will include a fix for CVE-2024-53990. We are requesting a clear expected release date for this version to plan our security updates accordingly

[lhotari]

It has been fixed by #23732 by upgrading to asynchttp client 2.12.4. You can see in GHSA-mfj5-cf8g-g2fv that 2.12.4 is a patched version. It seems that some security companies haven't accepted the fix. #25023 is pending to address that.
We don't have a specific date when that is released.

[lhotari]

Newest Pulsar release is 4.0.9 so the issue title doesn't make sense. Closing.