Release notes for Gerrit 2.5.3
==============================

Gerrit 2.5.3 is now available:

link:http://code.google.com/p/gerrit/downloads/detail?name=gerrit-2.5.3.war[http://code.google.com/p/gerrit/downloads/detail?name=gerrit-2.5.3.war]

There are no schema changes from any of the 2.5.x versions.

However, if upgrading from a version older than 2.5, follow the upgrade
procedure in the 2.5 link:ReleaseNotes-2.5.html[Release Notes].

Security Fixes
--------------
* Patch vulnerabilities in OpenID client library
+
Installations using OpenID for authentication were vulnerable to a
number of attacks over the network.  The openid4java client library
was identified as the entry point.  In this release Gerrit updated to
the latest 0.9.8 release, which patches the known attack vectors.

No other changes since 2.5.2.