Begin forwarded message:

From: Scott Cantor via announce <announce@shibboleth.net>

Subject: Shibboleth Identity Provider V5.2.2 now available

Date: 13 May 2026 at 22:05:50 CEST

To: announce@shibboleth.net

Cc: Scott Cantor <scott@restingparrotsoftware.com>

Reply-To: users@shibboleth.net

The Shibboleth Project has released V5.2.2 of the Identity Provider software (and OpenSAML). [1]

This patch release fixes a few bugs and regressions as well as addresses two security advisories that will be forthcoming. The advisories include mitigation advice for the many people undoubtedly running older versions of both the IdP and OpenSAML.

There are two IdP advisories and one separate advisory for OpenSAML targeted at consumers of that library, but that advisory is subsumed by the IdP advisory with respect to the IdP software.

The Release Notes are partially updated [2] and will mention the advisories [3] shortly.

As I noted yesterday, if you're using the new Jetty plugin, it's a good idea to update that along with this release because the original plugin combined with this one has some ugly logging side effects when downloading Jetty.

The MSI installer will be updated some time tomorrow, but as that is being discontinued in the near future, this would be good time to get off that train and accept that the standard upgrade process should be used.

-- Scott

[1] https://shibboleth.net/downloads/service-provider/latest5/
[2] https://shibboleth.atlassian.net/wiki/x/T4C0vg
[3] https://shibboleth.atlassian.net/wiki/x/27C0vg

--
To unsubscribe from this list send an email to announce-unsubscribe@shibboleth.net