2.3.3 release with updated Mina

[dafriz]

Are we open to making a new release of the 2.3.x branch?

#1203 updates Mina to a version that has resolved a coupe of critical CVEs.

Similar to the 2.3.2 release - a minor bump to save overriding mina in our own projects.

[chrjohn]

@dafriz thanks for the PR. We might do a 2.3.3 release, but I cannot commit on a timeline at the moment. Please also note that QFJ is not affected by this vulnerability since it does not use the affected IoBuffer#getObject() method.

[chrjohn]

@dafriz would 3.0.1 be an alternative?

[dafriz]

Not in the short term. A 2.3.3 patch release would be useful to remove the security issues from dependency tree with minimal other changes.

[peligroso]

Two critical CVE's in Mina. Last mina update since June 2

MINA 2.2.8, 2.1.13, 2.0.29 released posted on June, 2 2026
The MINA project is pleased to announce the MINA 2.2.8, 2.1.13 and 2.0.29 releases.

It fixed two CVE:

CVE-2026-47065: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232
CVE-2026-47321: Unbounded Decompression Amplification DoS in Apache Mina Zlib.inflate - ZDRES-231

Any chance we can adapt?

Kind regards/

[chrjohn]

There will be another release since there still is a problem in 2.2.8... apache/mina#52 (comment)

I will check if I can do a 2.3.3 release then, but 3.x has priority.

Cheers
Chris