Hi Apache Geode Dev Community, As we prepare the upcoming Apache Geode 2.0.4 release over the coming weeks, I'd like your help shaping the release notes. Below is my current draft. Please review it and reply with any fixes, improvements, or features you think deserve a highlight, especially anything merged since 2.0.3 that users should know about.
2.0.4 Apache Geode 2.0.4 is a maintenance release that addresses published CVEs and defects. Highlights -Jackson: Upgraded from 2.21.6 to 2.21.7 to address CVE-2026-89407 (GEODE-10664, #8107). -Jetty: Upgraded from 12.0.37 to 12.0.39 to address CVE-2026-19203 (GEODE-10665, #8107). -JLine: Upgraded from 3.26.3 to 3.30.17 to address CVE-2026-77421 (GEODE-10666, #8107). -Bouncy Castle: Upgraded from 1.85 to 1.86 to address CVE-2026-17507, CVE-2026-17508 and CVE-2026-18036 (GEODE-10680, #8125). -Hibernate Validator: Upgraded from 8.0.2.Final to 8.0.6.Final (GEODE-10681, #8127). When suggesting an item, it helps to include: -The JIRA ticket (GEODE-XXXXX) and PR number -A one-line, user-facing description of the change -Any upgrade notes or behavior changes users should be aware of If there are fixes still in flight that you believe should land in 2.0.4, please flag them as well so we can plan accordingly. Please share your suggestions by November 4th, so there's time to finalize the notes before the release candidate. Best regards, Jinwoo Hwang (he/him/his) Apache Geode / SAS® Research and Development http://JinwooHwang.com<http://jinwoohwang.com/>
