SUSE-CU-2026:7560-1: Security update of bci/openjdk-devel
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Fri Jul 31 07:41:57 UTC 2026
SUSE Container Update Advisory: bci/openjdk-devel
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:7560-1
Container Tags : bci/openjdk-devel:25 , bci/openjdk-devel:25-sles15 , bci/openjdk-devel:25.0.4.0 , bci/openjdk-devel:25.0.4.0-9.30 , bci/openjdk-devel:latest
Container Release : 9.30
Severity : important
Type : security
References : 1199064 1200426 1221385 1221386 1264398 1264994 1267355 1272223
1272224 1272225 1272227 1272228 1272235 1272236 1272237 CVE-2022-25647
CVE-2024-23672 CVE-2024-24549 CVE-2025-48924 CVE-2026-41254 CVE-2026-46917
CVE-2026-46968 CVE-2026-47010 CVE-2026-47021 CVE-2026-47027 CVE-2026-47059
CVE-2026-47063 CVE-2026-60147
-----------------------------------------------------------------
The container bci/openjdk-devel was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2044-1
Released: Fri Jun 10 13:37:07 2022
Summary: Security update for google-gson
Type: security
Severity: important
References: 1199064,CVE-2022-25647
This update for google-gson fixes the following issues:
- CVE-2022-25647: Fixed deserialization of untrusted data (bsc#1199064).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:2060-1
Released: Mon Jun 13 15:26:16 2022
Summary: Recommended update for geronimo-specs
Type: recommended
Severity: moderate
References: 1200426
This recommended update for geronimo-specs provides the following fix:
- Ship geronimo-annotation-1_0-api to SUSE Manager server as it is now needed by google-gson.
(bsc#1200426)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2024:1345-1
Released: Thu Apr 18 19:15:51 2024
Summary: Security update for tomcat
Type: security
Severity: important
References: 1221385,1221386,CVE-2024-23672,CVE-2024-24549
This update for tomcat fixes the following issues:
- CVE-2024-24549: Fixed denial of service during header validation for HTTP/2 stream (bsc#1221386)
- CVE-2024-23672: Fixed denial of service due to malicious WebSocket client keeping connection open (bsc#1221385)
Other fixes:
- Update to Tomcat 9.0.87
* Catalina
+ Fix: Minor performance improvement for building filter chains. Based
on ideas from #702 by Luke Miao. (remm)
+ Fix: Align error handling for Writer and OutputStream. Ensure use of
either once the response has been recycled triggers a
NullPointerException provided that discardFacades is configured with
the default value of true. (markt)
+ Fix: 68692: The standard thread pool implementations that are configured
using the Executor element now implement ExecutorService for better
support NIO2. (remm)
+ Fix: 68495: When restoring a saved POST request after a successful FORM
authentication, ensure that neither the URI, the query string nor the
protocol are corrupted when restoring the request body. (markt)
+ Fix: 68721: Workaround a possible cause of duplicate class definitions
when using ClassFileTransformers and the transformation of a class also
triggers the loading of the same class. (markt)
+ Fix: The rewrite valve should not do a rewrite if the output is
identical to the input. (remm)
+ Update: Add a new valveSkip (or VS) rule flag to the rewrite valve to
allow skipping over the next valve in the Catalina pipeline. (remm)
+ Fix: Correct JPMS and OSGi meta-data for tomcat-enbed-core.jar by
removing reference to org.apache.catalina.ssi package that is no longer
included in the JAR. Based on pull request #684 by Jendrik Johannes.
(markt)
+ Fix: Fix ServiceBindingPropertySource so that trailing \r\n sequences
are correctly removed from files containing property values when
configured to do so. Bug identified by Coverity Scan. (markt)
+ Add: Add improvements to the CSRF prevention filter including the
ability to skip adding nonces for resource name and subtree URL patterns.
(schultz)
+ Fix: Review usage of debug logging and downgrade trace or data dumping
operations from debug level to trace. (remm)
+ Fix: 68089: Further improve the performance of request attribute
access for ApplicationHttpRequest and ApplicationRequest. (markt)
+ Fix: 68559: Allow asynchronous error handling to write to the
response after an error during asynchronous processing. (markt)
* Coyote
+ Fix: Improve the HTTP/2 stream prioritisation process. If a stream
uses all of the connection windows and still has content to write, it
will now be added to the backlog immediately rather than waiting until
the write attempt for the remaining content. (markt)
+ Fix: Make asynchronous error handling more robust. Ensure that once
a connection is marked to be closed, further asynchronous processing
cannot change that. (markt)
+ Fix: Make asynchronous error handling more robust. Ensure that once
the call to AsyncListener.onError() has returned to the container, only
container threads can access the AsyncContext. This protects against
various race conditions that woudl otherwise occur if application threads
continued to access the AsyncContext.
+ Fix: Review usage of debug logging and downgrade trace or data
dumping operations from debug level to trace. In particular, most of the
HTTP/2 debug logging has been changed to trace level. (remm)
+ Fix: Add support for user provided SSLContext instances configured
on SSLHostConfigCertificate instances. Based on pull request #673
provided by Hakan Altındağ. (markt)
+ Fix: Improve the Tomcat Native shutdown process to reduce the likelihood
of a JVM crash during Tomcat shutdown. (markt)
+ Fix: Partial fix for 68558: Cache the result of converting to String
for request URI, HTTP header names and the request Content-Type value to
improve performance by reducing repeated byte[] to String conversions.
(markt)
+ Fix: Improve error reporting to HTTP/2 clients for header processing
errors by reporting problems at the end of the frame where the error was
detected rather than at the end of the headers. (markt)
+ Fix: Remove the remaining reference to a stream once the stream has
been recycled. This makes the stream eligible for garbage collection
earlier and thereby improves scalability. (markt)
* Jasper
+ Add: Add support for specifying Java 22 (with the value 22) as the
compiler source and/or compiler target for JSP compilation. If used with
an Eclipse JDT compiler version that does not support these values, a
warning will be logged and the default will used. (markt)
+ Fix: 68546: Generate optimal size and types for JSP imports maps, as
suggested by John Engebretson. (remm)
+ Fix: Review usage of debug logging and downgrade trace or data
dumping operations from debug level to trace. (remm)
* Cluster
+ Fix: Avoid updating request count stats on async. (remm)
* WebSocket
+ Fix: Correct a regression in the fix for 66508 that could cause an
UpgradeProcessor leak in some circumstances. (markt)
+ Fix: Review usage of debug logging and downgrade trace or data dumping
operations from debug level to trace. (remm)
+ Fix: Ensure that WebSocket connection closure completes if the
connection is closed when the server side has used the proprietary
suspend/resume feature to suspend the connection. (markt)
* Web applications
+ Add: Add support for responses in JSON format from the examples
application RequestHeaderExample. (schultz)
* Other
+ Add: Improvements to French translations. (remm)
+ Add: Improvements to Japanese translations by tak7iji. (markt)
+ Update: Update Checkstyle to 10.13.0. (markt)
+ Update: Update JSign to 6.0. (markt)
+ Update: Add strings for debug level messages. (remm)
+ Update: Update Tomcat Native to 1.3.0. (markt)
+ Add: Improvements to French translations. (remm)
+ Add: Improvements to Japanese translations by tak7iji. (markt)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3331-1
Released: Tue Jul 28 11:36:53 2026
Summary: Security update for java-25-openjdk
Type: security
Severity: important
References: 1264398,1264994,1267355,1272223,1272224,1272225,1272227,1272228,1272235,1272236,1272237,CVE-2026-41254,CVE-2026-46917,CVE-2026-46968,CVE-2026-47010,CVE-2026-47021,CVE-2026-47027,CVE-2026-47059,CVE-2026-47063,CVE-2026-60147
This update for java-25-openjdk fixes the following issues:
Update to upstream tag jdk-25.0.4+7 (July 2026 CPU).
Security issues fixed:
- CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in `CubeSize` (bsc#1264994).
- CVE-2026-46917: unauthenticated attacker with network access via TLS can cause a partial denial of service
(bsc#1272223).
- CVE-2026-46968: unauthenticated attacker with network access via TLS can gain unauthorized creation, deletion or
modification access to critical data(bsc#1272224).
- CVE-2026-47010: unauthenticated attacker with network access via multiple protocols can gain unauthorized update,
insert or delete access to some data (bsc#1272225).
- CVE-2026-47021: unauthenticated attacker with network access via multiple protocols can cause a partial denial of
service (bsc#1272227).
- CVE-2026-47027: unauthenticated attacker with network access via multiple protocols can cause a partial denial of
service (bsc#1272228).
- CVE-2026-47059: unauthenticated attacker with network access via multiple protocols can cause a partial denial of
service (bsc#1272235).
- CVE-2026-47063: unauthenticated attacker with network access via multiple protocols can gain unauthorized creation,
deletion or modification access to critical data (bsc#1272236).
- CVE-2026-60147: unauthenticated attacker with network access via multiple protocols can gain unauthorized update,
insert, delete and read access to some(bsc#1272237).
Other updates and bugfixes:
- Errors from update-alternatives when installing java-25-openjdk (bsc#1267355).
- Make post scripts less noisy (bsc#1267355).
- Use libalternatives instead of update-alternatives for distributions where libalternatives is available.
- Update to upstream tag jdk-25.0.4+7 (July 2026 CPU):
+ JDK-7184899: Test sun/java2d/X11SurfaceData/
/SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fail
+ JDK-8015444: java/awt/Focus/KeyStrokeTest.java sometimes
fails
+ JDK-8064922: [macos] Test javax/swing/JTabbedPane/4624207/
/bug4624207.java fails
+ JDK-8068293: [TEST_BUG] Test closed/com/sun/java/swing/plaf/
/motif/InternalFrame/4150591/bug4150591.java fails with
GTKLookAndFeel
+ JDK-8068310: [TEST_BUG] Test javax/swing/JColorChooser/
/Test4234761.java fails with GTKL&F
+ JDK-8144124: [macosx] The tabs can't be aligned when we
pressing the key of 'R','B','L','C' or 'T'.
+ JDK-8203004: UnixMultiResolutionSplashTest.java fails on
Ubuntu16.04
+ JDK-8213530: Test java/awt/Modal/ToFront/
/DialogToFrontModeless1Test.java fails on Linux
+ JDK-8221451: PIT: sun/java2d/X11SurfaceData/
/SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fails
+ JDK-8225787: java/awt/Window/GetScreenLocation/
/GetScreenLocationTest.java fails on Ubuntu
+ JDK-8241066: Shenandoah: fix or cleanup SH::do_full_collection
+ JDK-8261743: Shenandoah: enable String deduplication with
compact heuristics
+ JDK-8264851: Shenandoah: Rework control loop mechanics to use
timed waits
+ JDK-8278102: containers/docker/TestJcmd.java failed with
'RuntimeException: Could not find specified process'
+ JDK-8279196: Test: jdk/jfr/event/gc/stacktrace/
/TestG1OldAllocationPendingStackTrace.java timed out
+ JDK-8297191: [macos] Printing a page range with starting
page > 1 results in missing pages
+ JDK-8298823: [macos] java/awt/Mouse/EnterExitEvents/
/DragWindowTest.java continues to fail with 'No MouseReleased
event on label!'
+ JDK-8319326: GC: Make TestParallelRefProc use
createTestJavaProcessBuilder
+ JDK-8319540: GC: Make TestSelectDefaultGC use
createTestJavaProcessBuilder
+ JDK-8321303: Intermittent open/test/jdk/java/awt/
/KeyboardFocusmanager/ConsumeNextMnemonicKeyTypedTest/
/ConsumeNextMnemonicKeyTypedTest.java failure on Linux
+ JDK-8321687: Test vmTestbase/nsk/jvmti/scenarios/contention/
/TC03/tc03t002/TestDescription.java failed:
JVMTI_ERROR_THREAD_NOT_ALIVE
+ JDK-8323792: ThreadSnapshot::initialize can cause assert in
Thread::check_for_dangling_thread_pointer (possibility of
dangling Thread pointer)
+ JDK-8325482: Test that distinct seeds produce distinct traces
for compiler stress flags
+ JDK-8335355: Shenandoah: Fix race condition in gc/shenandoah/
/mxbeans/TestPauseNotifications.java
+ JDK-8339526: C2: store incorrectly removed for clone()
transformed to series of loads/stores
+ JDK-8340182: Java HttpClient does not follow default retry
limit of 3 retries
+ JDK-8341735: Rewrite the build/AbsPathsInImage.java test to
not load the entire file at once
+ JDK-8344345: test/hotspot/gtest/x86/x86-asmtest.py has
trailing whitespaces
+ JDK-8345631: TestRegionSamplingLogging.java
#generational-rotation intermittent fails
+ JDK-8347167: Reduce allocation in
com.sun.net.httpserver.Headers::normalize
+ JDK-8347938: Add Support for the Latest ML-KEM and ML-DSA
Private Key Encodings
+ JDK-8351010: Test java/io/File/GetXSpace.java failed: / usable
space 56380809216 > free space 14912244940
+ JDK-8352914: Shenandoah: Change definition of
ShenandoahSharedValue to int32_t to leverage platform atomics
+ JDK-8353115: GenShen: mixed evacuation candidate regions need
accurate live_data
+ JDK-8354650: [PPC64] Try to reduce register definitions
+ JDK-8355339: Test java/io/File/GetCanonicalPath.java failed:
The specified network name is no longer available
+ JDK-8357086: os::xxx functions returning memory size should
return size_t
+ JDK-8358600: Template-Framework Library: Template for
TestFramework test class
+ JDK-8358772: Template-Framework Library: Primitive Types
+ JDK-8359083: Test jdkCheckHtml.java should report
SkippedException rather than report fails when miss tidy
+ JDK-8359223: HttpClient: Remove leftovers from the
SecurityManager cleanup
+ JDK-8359412: Template-Framework Library: Operations and
Expressions
+ JDK-8359433: The final modifier on Windows L&F internal UI
classes prevents extending them in apps
+ JDK-8361339: Test gc/shenandoah/TestLargeObjectAlignment.java
#generational fails on macOS aarch64 with OOM: Java heap space
+ JDK-8361606: ConsumeNextMnemonicKeyTypedTest.java fails on
Windows: character typed with VK_A: a
+ JDK-8361699: C2: assert(can_reduce_phi(n->as_Phi())) failed:
Sanity: previous reducible Phi is no longer reducible before
SUT
+ JDK-8361726: Shenandoah: More detailed evacuation
instrumentation
+ JDK-8362428: Update IANA Language Subtag Registry to Version
2025-08-25
+ JDK-8363943: ARM32: Represent Registers as values
+ JDK-8363949: Incorrect jtreg header in
MonitorWithDeadObjectTest.java
+ JDK-8363986: Heap region in CDS archive is not at
deterministic address
+ JDK-8364315: Remove unused xml files from test/jaxp/javax/xml/
/jaxp/functional/javax/xml/transform/xmlfiles
+ JDK-8364657: Crash for SecureRandom.generateSeed(0) on Windows
x86-64
+ JDK-8364927: Add @requires annotation to
TestReclaimStringsLeaksMemory.java
+ JDK-8365057: Add support for java.util.concurrent lock
information to Thread.dump_to_file
+ JDK-8365379: SU3.applyInsets may produce wrong results
+ JDK-8365423: [macos26] java/awt/MenuBar/8007006/
/bug8007006.java fails on macOS 26
+ JDK-8365424: [macos26] java/awt/Frame/DisposeTest.java fails
on macOS 26
+ JDK-8365623: test/jdk/sun/security/pkcs11/tls/ tests skipped
without skip exception
+ JDK-8365625: Can't change accelerator colors in Windows L&F
+ JDK-8365792: GenShen: assertion 'Generations aren't
reconciled'
+ JDK-8366692: Several gc/shenandoah tests timed out
+ JDK-8366695: Test sun/jvmstat/monitor/MonitoredVm/
/MonitorVmStartTerminate.java timed out
+ JDK-8366852: java/awt/Choice/ChoiceMouseWheelTest/
/ChoiceMouseWheelTest.java test is failing
+ JDK-8367096: jdk/open/test/jdk/sun/security/pkcs11/ rsa, ec,
config, secmod and sslecc tests are skipping but showing as
pass
+ JDK-8367450: Shenandoah: Log the composition of the collection
set
+ JDK-8367451: GenShen: Remove the option to compute age census
during evacuation
+ JDK-8367473: Shenandoah: Make the detailed evacuation metrics
a runtime diagnostic option
+ JDK-8367485: os::physical_memory is broken in 32-bit JVMs when
running on 64-bit OSes
+ JDK-8367531: Template Framework: use scopes and tokens instead
of misbehaving immediate-return-queries
+ JDK-8367646: [GenShen] Control thread may overwrite gc
cancellation cause set by mutator
+ JDK-8367708: GenShen: Reduce total evacuation burden
+ JDK-8367709: GenShen: Dirty cards for objects that get
promoted by safepoint that intervenes between allocation and
stores
+ JDK-8367722: [GenShen] ShenandoahEvacuationStats is always
empty
+ JDK-8367949: JFR: MethodTrace double-counts methods that catch
their own exceptions
+ JDK-8368001: java/text/Format/NumberFormat/
/NumberRoundTrip.java timed out
+ JDK-8368015: Shenandoah: fix error in computation of average
allocation rate
+ JDK-8368041: Enhance TLS certificate handling
+ JDK-8368159: Significant performance overhead when started
with jdwp agent and unattached debugger
+ JDK-8368181: ProblemList java/awt/Dialog/ModalExcludedTest/
/ModalExcludedTest.java
+ JDK-8368307: Shenandoah: get_next_bit_impl should special case
weak and strong mark bits
+ JDK-8368499: GenShen: Do not collect age census during evac
when adaptive tenuring is disabled
+ JDK-8368501: Shenandoah: GC progress evaluation does not use
generation
+ JDK-8368524: Tests are skipped and shown as passed in test/
/jdk/sun/security/pkcs11/Cipher/KeyWrap
+ JDK-8368681: Shenandoah: Add documentation comments for
ShenandoahAllocationRate
+ JDK-8369128: ProblemList jdk/jfr/event/profiling/
/TestCPUTimeSampleQueueAutoSizes.java in Xcomp configs
+ JDK-8369132: Disable vmTestbase/gc/vector/CircularListLow and
LinearListLow with SerialGC
+ JDK-8369133: Disable gc/g1/TestShrinkAuxiliaryDataRunner.java
with UseLargePages option
+ JDK-8369251: Opensource few tests
+ JDK-8369561: sun/java2d/OpenGL/DrawBitmaskImage.java#id0:
Incorrect color for first pixel (actual=ff000000)
+ JDK-8369683: Exclude runtime/Monitor/
/MonitorWithDeadObjectTest.java#DumpThreadsBeforeDetach on
Alpine Linux debug
+ JDK-8369736: Add management interface for AOT cache creation
+ JDK-8369817: [TESTBUG] EmptyPath::toString is ignored
+ JDK-8369912: [TESTBUG] testlibrary_tests/template_framework/
/examples/TestExpressions.java fails with ArithmeticException:
/ by zero - forgot to respect Expression.info
+ JDK-8369950: TLS connection to IPv6 address fails with BCJSSE
due to IllegalArgumentException
+ JDK-8370370: Add still more cases to WorstCaseTests
+ JDK-8370489: Some compiler tests miss the @key randomness
+ JDK-8370502: C2: segfault while adding node to IGVN worklist
+ JDK-8370521: GenShen: Various code cleanup related to
promotion
+ JDK-8370939: C2: SIGSEGV in SafePointNode::verify_input when
processing MH call from
Compile::process_late_inline_calls_no_inline()
+ JDK-8371284: GenShen: Avoid unnecessary card marking
+ JDK-8371381: [Shenandoah] Setting ergo flags should use
FLAG_SET_ERGO
+ JDK-8371503: RETAIN_IMAGE_AFTER_TEST do not work for some
tests
+ JDK-8371792: Refactor barrier loop tests out of TestIfMinMax
+ JDK-8371893: [macOS] use dead_strip linker option to reduce
binary size
+ JDK-8372272: Hotspot shared lib loading - add load attempts to
Events::log
+ JDK-8372351: Add 2 WISeKey roots
+ JDK-8372380: Make hs_err reporting more robust for unattached
threads
+ JDK-8372513: Shenandoah: ShenandoahMaxRegionSize can produce
an unaligned heap alignment
+ JDK-8372851: Modify java/io/File/GetXSpace.java to print path
on failure of native call
+ JDK-8372861: Genshen: Override parallel_region_stride of
ShenandoahResetBitmapClosure to a reasonable value for better
parallelism
+ JDK-8373039: Remove Incorrect Asserts in
shenandoahScanRemembered
+ JDK-8373120: Virtual thread stuck in BLOCKED state
+ JDK-8373239: Test java/awt/print/PrinterJob/PageRanges.java
fails with incorrect selection of printed pages
+ JDK-8373275: Improve DTLS handshaking
+ JDK-8373515: Migrate 'test/jdk/java/net/httpclient/' to
null-safe 'SimpleSSLContext' methods
+ JDK-8373579: Problem list compiler/runtime/Test7196199.java
+ JDK-8373650: Test 'javax/swing/JMenuItem/6458123/
/ManualBug6458123.java' fails because the check icons are not
aligned properly as expected
+ JDK-8373676: Test javax/net/ssl/HttpsURLConnection/
/SubjectAltNameIP.java fails on a machine without IPV6
+ JDK-8373690: Unexpected Keystore message using
jdk.crypto.disabledAlgorithms
+ JDK-8373714: Shenandoah: Register heuristic penalties
following a degenerated GC
+ JDK-8373718: jdk/internal/misc/VM/RuntimeArguments.java test
fails in Virtual threads mode
+ JDK-8373796: Refactor java/net/httpclient/
/ThrowingPublishers*.java tests to use JUnit5
+ JDK-8373847: Test javax/swing/JMenuItem/MenuItemTest/
/bug6197830.java failed because The test case automatically
fails when clicking any items in the “Nothing†menu in all
four windows (Left-to-right)-Menu Item Test and
(Right-to-left)-Menu Item Test
+ JDK-8373866: Refactor java/net/httpclient/
/ThrowingSubscribers*.java tests to use JUnit5
+ JDK-8373893: Refactor networking http server tests to use
JUnit
+ JDK-8373913: Refactor serialization tests to use JUnit
+ JDK-8373928: 4 Dangling pointer defect groups in java.c
+ JDK-8374001: sun/security/ skip without Exceptions
+ JDK-8374058: Enhance JPEG handling
+ JDK-8374168: Resolve disabled warnings in JDWP agent
+ JDK-8374304: MultiResolutionSplashTest.java fails in CI:
'Image with wrong resolution is used for splash screen!'
+ JDK-8374322: TestMemoryWithSubgroups.java fails Permission
denied
+ JDK-8374343: Fix SIGSEGV when lib/modules is unreadable
+ JDK-8374449: Shenandoah: Leaf locks used by Shenandoah need
lower ranks
+ JDK-8374506: Incorrect positioning of arrow icon in parent
JMenu in Windows L&F
+ JDK-8374712: AOTMappedHeapWriter::relocate_field_in_buffer
should use CompressedOops::narrow_oop_cast
+ JDK-8374727: Audio configuration Platform class - use nio for
getting endianness of the underlying platform
+ JDK-8374744: Enable dumping of APX EGPRs (R16–R31) in JVM
fatal error logs
+ JDK-8374769: PPC: MASM::pop_cont_fastpath() should reset
_cont_fastpath if SP == _cont_fastpath
+ JDK-8374888: Implement internal test cache to help
UserIterCount test performance
+ JDK-8374998: Failing os::write - remove bad file
+ JDK-8375065: Update LCMS to 2.18
+ JDK-8375177: Gtest
os_linux.decoder_get_source_info_valid_vm fails with
-ffunction-sections
+ JDK-8375294: (fs) Files.copy can fail with EOPNOTSUPP when
copy_file_range not supported
+ JDK-8376031: HttpsURLConnection.getServerCertificates() throws
'java.lang.IllegalStateException: connection not yet open' for
the HEAD method
+ JDK-8376104: C2 crashes in PhiNode::Ideal(PhaseGVN*, bool)
accessing NULL pointer
+ JDK-8376151: Test javax/swing/JFileChooser/4966171/
/bug4966171.java is failing with OOME
+ JDK-8376152: Test javax/sound/sampled/Clip/bug5070081.java
timed out then completed
+ JDK-8376185: NoSuchFieldError thrown after a record with type
annotation retransformed
+ JDK-8376233: Clean up code in Desktop native peer
+ JDK-8376287: Crashes when using -XX:ObjArrayMarkingStride=0
+ JDK-8376402: Dependencies::print_statistics() and
AbstractClassHierarchyWalker::print_statistics() are not
called from PRODUCT code
+ JDK-8376684: Compile OpenJDK in headless mode without required
X11 libraries
+ JDK-8376956: Add JVMTI phase entering/setting to hserr event
log
+ JDK-8376969: Shenandoah: GC state getters should be inlineable
+ JDK-8376970: Shenandoah: Verifier should do basic verification
before touching oops
+ JDK-8377158: Enhance XBM image support
+ JDK-8377167: javax/imageio/ReadAbortTest.java throw NPE when
x11 unavailable
+ JDK-8377498: Improve HttpServer handling
+ JDK-8377512: AOT cache creation fails with invalid native
pointer
+ JDK-8377602: Create automated test for PageRange
+ JDK-8377727: Ghost caret and focus appear in non‑editable
text fields
+ JDK-8377833: Enhance Jar file processing
+ JDK-8377907: (process) Race in ProcessBuilder can cause JVM
hangs
+ JDK-8377910: Minor cleanup of java/io/FileDescriptor/
/Sharing.java
+ JDK-8377932: AOT cache is not rejected when JAR file has
changed
+ JDK-8377944: LowMemoryTest2.java#id1 intermittent fails OOME:
Metaspace
+ JDK-8377949: TestZRelocationSetEvent.java intermittent fails
OOME
+ JDK-8378083: Mark shenandoah/generational/
/TestOldGrowthTriggers.java as flagless
+ JDK-8378201: [OGL] glXMakeContextCurrent() drops the buffers
of the unbound drawable
+ JDK-8378417: Printing All pages results in NPE for 1.1
PrintJob
+ JDK-8378561: Mark gc/shenandoah/compiler/
/TestLinkToNativeRBP.java as /native
+ JDK-8378687: Improve delegation of HttpURLConnection
+ JDK-8378727: [macOS] Missing dispatch_release for semaphores
in CDesktopPeer
+ JDK-8378746: ZGC: jdk/jfr/event/gc/detailed/
/TestZRelocationSetGroupEvent.java intermittent OOME
+ JDK-8378764: fileStream::fileSize() fails for >2GB files on
Windows
+ JDK-8378774: Bump update version for OpenJDK: jdk-25.0.4
+ JDK-8378810: Enable missing FFM test via jtreg requires for
RISC-V
+ JDK-8378836: Enable linktime-gc by default on Linux ppc64le
+ JDK-8378878: Refactor java/nio/channels/
/AsynchronousSocketChannel test to use JUnit
+ JDK-8378888: jdk/incubator/vector/
/Float16OperationsBenchmark.java uses wrong package name
+ JDK-8379021: Shenandoah: Speedup ShenandoahSimpleBitMapTest
+ JDK-8379202: Support linktime-gc on Linux with clang
+ JDK-8379416: AIX build fails if system (not GNU) date tool is
in PATH
+ JDK-8379425: Windows and macOS should not allow unsupported
headless-only build
+ JDK-8379457: Test EATests.java#id0 ERROR: monitor list errors:
error_cnt=1
+ JDK-8379464: Enable missing stack walking test via jtreg
requires for RISC-V
+ JDK-8379499: [AIX] headless-only build of libjawt.so fails
+ JDK-8379515: draft-ietf-lamps-kyber-certificates is now
RFC 9935
+ JDK-8380011: Path-to-gcroots search should not trigger stack
overflows
+ JDK-8380041: PPC: remove POWER6 remnants
+ JDK-8380222: Refactor test/jdk/java/lang/Character TestNG
tests to JUnit
+ JDK-8380316: Test runtime/os/AvailableProcessors.java fails
Invalid argument
+ JDK-8380409: JVM crashes when -XX:AOTMode=create uses
app.aotconf generated with JVMTI agent
+ JDK-8380428: ProblemList containers/docker/
/TestJcmdWithSideCar.java on linux-all
+ JDK-8380431: Shenandoah: Concurrent modification of
stack-chunk objects during evacuation
+ JDK-8380474: Crash SEGV in ThreadIdTable::lazy_initialize
after JDK-8323792
+ JDK-8380565: PPC64: deoptimization stub should save vector
registers
+ JDK-8380663: Update jcmd man page to include AOT.end_recording
diagnostic command
+ JDK-8380672: Improve certification checking
+ JDK-8380846: GenShen: Remove the experimental option to
disable adaptive tenuring
+ JDK-8380947: Add pull request template
+ JDK-8381039: Enhance AWT ImagingLib
+ JDK-8381049: Enhance Jar handling
+ JDK-8381205: GHA: Upgrade Node.js 20 to 24
+ JDK-8381315: compiler/vectorapi/TestVectorReallocation.java
fails with -XX:UseAVX=1 after JDK-8380565
+ JDK-8381382: Shenandoah: assert(capacity > 0) failed: free
regions must have allocation capacity
+ JDK-8381519: Enhance Der Value Handling
+ JDK-8381796: Enhance Certificate parsing
+ JDK-8381871: GenShen: ShenandoahGCHeuristics flag not reset
after ignoring non-adaptive value
+ JDK-8381935: Improve numChunks range in the PPC64 CallAranger
+ JDK-8381937: Make exceptions in
Java_sun_security_mscapi_CKeyPairGenerator generateCKeyPair
more specific
+ JDK-8382018: test/jdk/java/nio/file/spi/
/SetDefaultProvider.java leaves a directory in /tmp
+ JDK-8382020: Time Zone Abbreviation Not Localized for
Non-English Locales
+ JDK-8382035: [ubsan] Under UBSAN builds, disable tests that
rely on simulated JVM crashes
+ JDK-8382090: Remove .rej and .orig from .gitignore
+ JDK-8382242: JFR: Metadata reconstruction invalidates
ConstantMap for java.lang.String
+ JDK-8382295: Shenandoah: wrong denominator in full gc summary
+ JDK-8382395: Disable stringop-overflow in
shenandoahGenerationalHeap.cpp
+ JDK-8382419: Add missed @key randomness after JDK-8370489
+ JDK-8382522: Disable stringop-overflow in
safepointMechanism.cpp
+ JDK-8382740: JFR: Disable jdk.OldObjectSample event for
generational ZGC
+ JDK-8382878: RISC-V: Missing InlineSkippedInstructionsCounter
in ZGC barriers stubs
+ JDK-8382932: [25u] Test java/lang/instrument/
/RetransformRecordTypeAnn/TestRetransformRecord.java‎ fails
with compilation error
+ JDK-8383161: [PPC64]
MachCallDynamicJavaNode::ret_addr_offset() needs adaptation
for COH
+ JDK-8383175: (tz) Update Timezone Data to 2026b
+ JDK-8383183: Shenandoah: Mangle trashed regions up to top
instead of end
+ JDK-8383354: Update LCMS to 2.19.1
+ JDK-8383473: Follow on from tzdata2026b time change to
include temporary hack BC time change
+ JDK-8383601: RISC-V:
ShenandoahBarrierSetAssembler::load_reference_barrier calls
'weak' on 'phantom' path
+ JDK-8383630: Fix iteration in tests doing class redefinition
+ JDK-8384043: [REDO] Incorrect handling of Hawaii_Aleutian
metazone
+ JDK-8384158: GHA: Downgrade Windows GHA runners to
windows-2022 temporarily
+ JDK-8384163: (so) SocketChannel.connect and finishConnect()
exception messages could be improved
+ JDK-8384223: RISC-V: entry_barrier_offset should consider
UseZtso
+ JDK-8384486: NTLM tests fail on Windows 11 and Windows Server
2025
+ JDK-8384495: Update Libpng to 1.6.58
+ JDK-8384540: [25u, 21u, 17u] Update GHA JDKs after Apr/26
updates
+ JDK-8384815: SelectOneKeyOutOfMany and PreferredKey fail after
expired test certificate
+ JDK-8384902: Update GIFlib to 6.1.3
+ JDK-8385390: Update FreeType to 2.14.3
+ JDK-8385490: Update HarfBuzz to 14.2.0
+ JDK-8386551: Windows build broken because of MSys2/Make update
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3390-1
Released: Tue Jul 28 17:39:03 2026
Summary: Security update for apache-commons-lang3, google-guice, maven, maven-resolver, xmvn
Type: security
Severity: important
References: CVE-2025-48924
This update for apache-commons-lang3, google-guice, maven, maven-resolver, xmvn fixes the following issues:
apache-commons-lang3 was updated to 3.20.0:
* New features:
+ Add SystemProperties.getPath(String, Supplier<Path>)
+ Add JavaVersion.JAVA_25
+ Add JavaVersion.JAVA_26
+ Add SystemUtils.IS_JAVA_25
+ Add SystemUtils.IS_JAVA_26
+ Add MutablePair.ofNonNull(Map.Entry)
+ Add TimedSemaphore.builder(), Builder, and deprecate
constructors
+ LANG-1504: Adding labels and history to split StopWatch
* Fixed Bugs:
+ Optimize ObjectToStringComparator.compare() method
+ [javadoc] Improve StringUtils Javadoc
+ Fix internal inverted logic in private isEnum() method and
correct its usage in getFirstEnum()
+ Use accessors in ToStringStyle so subclasses can effectively
override them
+ 'LocaleUtils.toLocale(String)' for a 2 letter country code
now returns a value instead of throwing an
'IllegalArgumentException'
+ Fix typo in StringUtils.trunctate() IllegalArgumentException
message and test assertion messages
+ Fix test fixture in
ReflectionDiffBuilderTest.testTransientFieldDifference()
+ LANG-1789: NullPointerException when generating
NoSuchMethodException in MethodUtils
+ LANG-1786: Map deprecated TimeZone short IDs and avoid JRE
WARNINGs to the console
+ LANG-1792: TypeUtils.toString() skips angle brackets for Class
type
+ Mention JDK 25 LTS as a tested version in the release notes
* Changes:
+ Bump org.apache.commons:commons-parent from 88 to 92
Update to 3.19.0:
* New features:
+ Add ArrayUtils.SOFT_MAX_ARRAY_LENGTH
+ Add SystemUtils.IS_OS_NETWARE
+ Add MethodUtils.getAccessibleMethod(Class, Method)
+ Add documentation to site for CVE-2025-48924
ClassUtils.getClass(...) can throw a StackOverflowError on
very long inputs
+ Add StringUtils.indexOfAny(CharSequence, int, char...)
+ Add ConcurrentException.ConcurrentException(String)
+ Add DateUtils.toLocalDateTime(Date[, TimeZone])
+ Add DateUtils.toOffsetDateTime(Date[, TimeZone])
+ Add DateUtils.toZonedDateTime(Date[, TimeZone])
+ Add ByteConsumer
+ Add ByteSupplier
+ Add FailableByteConsumer
+ Add FailableByteSupplier
+ LANG-1784: Add Functions methods for null-safe mapping and
chaining
+ LANG-1784: Add Failable methods for null-safe mapping and
chaining
+ Add DoubleRange.fit(double)
+ Add IntegerRange.fit(int)
+ Add LongRange.fit(long)
+ Add DurationUtils.get(String, TemporalUnit, long)
+ Add DurationUtils.getMillis(String, long)
+ Add DurationUtils.getSeconds(String, long)
+ Add SystemProperties.getBoolean(Class, String, boolean)
+ Add SystemProperties.getInt(Class, String, int)
+ Add SystemProperties.getLong(Class, String, long)
* Fixed Bugs:
+ LANG-1778: MethodUtils.getMatchingMethod() doesn't respect the
hierarchy of methods
+ MethodUtils.getMethodObject(Class<?>, String, Class<?>...) now
returns null instead of throwing a NullPointerException, as it
does for other exception types
+ Reduce spurious failures in ArrayUtilsTest methods that test
ArrayUtils.shuffle() methods
+ MethodUtils cannot find or invoke a public method on a public
class implemented in its package-private superclass
+ AtomicSafeInitializer.get() can spin internally if the
FailableSupplier given to AbstractConcurrentInitializer
.AbstractBuilder.setInitializer(FailableSupplier) throws a
RuntimeException
+ LANG-1783: WordUtils.containsAllWords?() may throw
PatternSyntaxException
+ LANG-1782: MethodUtils cannot find or invoke vararg methods
without providing vararg types or values
+ MethodUtils cannot find or invoke vararg methods of interface
types
+ MethodUtils cannot find or invoke vararg methods when widening
primitive types following the JLS 5.1.2. Widening Primitive
Conversion
+ LANG-1597: Invocation fails because matching varargs method
found but then discarded
+ Don't check accessibility twice in MemberUtils
.setAccessibleWorkaround(T)
+ LANG-1774: Improve handling of ClassUtils
.getShortCanonicalName() for invalid input
+ LANG-1720: Improve Javadocs for Conversion
+ Fix CalendarUtils.toLocalDate() Javadoc return type
description
+ Fix the method name in Javadoc examples for CharUtils.isHex()
+ Deprecate NumberUtils.compare(byte, byte) in favor of
Byte.compare(byte, byte)
+ Deprecate NumberUtils.compare(int, int) in favor of
Integer.compare(int, int)
+ Deprecate NumberUtils.compare(long, long) in favor of
Long.compare(long, long)
+ Deprecate NumberUtils.compare(short, short) in favor of
Short.compare(short, short)
+ Deprecate obsolete system property constant
SystemProperties.AWT_TOOLKIT
+ Deprecate obsolete system property constant
SystemProperties.JAVA_AWT_FONTS
+ Deprecate obsolete system property constant
SystemProperties.JAVA_AWT_GRAPHICSENV
+ Deprecate obsolete system property constant
SystemProperties.JAVA_AWT_HEADLESS
+ Deprecate obsolete system property constant
SystemProperties.JAVA_AWT_PRINTERJOB
+ Deprecate obsolete system property constant
SystemProperties.JAVA_COMPILER
+ Deprecate obsolete system property constant
SystemProperties.JAVA_ENDORSED_DIRS
+ Deprecate obsolete system property constant
SystemProperties.JAVA_EXT_DIRS
+ Deprecate method for obsolete system property constant
SystemProperties.getAwtToolkit()
+ Deprecate method for obsolete system property constant
SystemProperties.getJavaAwtFonts()
+ Deprecate method for obsolete system property constant
SystemProperties.getJavaAwtGraphicsenv()
+ Deprecate method for obsolete system property constant
SystemProperties.getJavaAwtHeadless()
+ Deprecate method for obsolete system property constant
SystemProperties.getJavaAwtPrinterjob()
+ Deprecate method for obsolete system property constant
SystemProperties.getJavaCompiler()
+ Deprecate method for obsolete system property constant
SystemProperties.getJavaEndorsedDirs()
+ Deprecate method for obsolete system property constant
SystemProperties.getJavaExtDirs()
+ Deprecate method for obsolete system property constant
SystemUtils.isJavaAwtHeadless()
+ Deprecate constants for obsolete system property
SystemUtils.JAVA_AWT_FONTS
+ Deprecate constants for obsolete system property
SystemUtils.JAVA_AWT_GRAPHICSENV
+ Deprecate constants for obsolete system property
SystemUtils.JAVA_AWT_HEADLESS
+ Deprecate constants for obsolete system property
SystemUtils.JAVA_AWT_PRINTERJOB
+ Deprecate constants for obsolete system property
SystemUtils.JAVA_COMPILER
+ Deprecate constants for obsolete system property
SystemUtils.JAVA_ENDORSED_DIRS
+ Deprecate constants for obsolete system property
SystemUtils.JAVA_EXT_DIRS
+ [javadoc] General improvements
+ [javadoc] Fix thrown exception documentation for
MethodUtils.getMethodObject(Class<?>, String, Class<?>...)
+ [javadoc] Strings::equalsAny: CI doc string should show it's
insensitive
+ [javadoc] General Javadoc improvements
+ LANG-1780: [javadoc] Fix Strings Javadoc
+ [javadoc] Fix typo in Javadoc of Strings instances
+ [javadoc] Fix Javadocs in ClassUtils
+ [javadoc] Fix @deprecated link for StringUtils#startsWithAny
+ Replace old feather logotype with new oak logotype
* Changes:
+ [test] Bump org.apache.commons:commons-text from 1.13.1 to
1.14.0
+ Bump org.apache.commons:commons-parent from 85 to 88
Update to 3.18.0:
- Fix component version in default.properties to 3.12
* Add and use LocaleUtils.toLocale(Locale) to avoid NPEs.
* Add FailableShortSupplier, handy for JDBC APIs.
* Add JavaVersion.JAVA_17.
* Add StringUtils.substringBefore(String, int).
* Add Range.INTEGER.
* Add DurationUtils.
* Correct implementation of RandomUtils.nextLong(long, long).
* Update maven-surefire-plugin 2.22.2 -> 3.0.0-M5.
* Bump junit-bom from 5.7.0 to 5.7.1.
* Ignored exception 'ignored', should not be called so.
* Change array style from 'int a[]' to 'int[] a'.
google-guice was updated to fix:
- Fix build with Java 25
- Add alias to com.google.inject:guice::classes artifact, needed
by maven 4.x
maven-resolver-supplier was updated to upstream version 1.9.27:
* Bug Fixes
+ Sync TrackingFileManager with 2.x
Update to upstream version 1.9.26:
* New features and improvements
+ GH-1773: Treat 410 Gone as 404 Not Found
+ GH-1737: Revert partially parallel upload change
* Bug Fixes
+ GH-1768; Drastically simplify auth caching
+ [1.9.x] Bug: GH-1703 Locally cached artifacts defy RRF
* Documentation updates
+ Clarify that HTTP Transport uses Apache HTTP Client
* Dependency updates
+ Bump org.redisson:redisson from 3.52.0 to 4.2.0
+ Bump commons-codec:commons-codec from 1.20.0 to 1.21.0
+ Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.26
to 1.27
+ Bump org.apache.maven:maven-parent from 46 to 47
+ Bump com.github.siom79.japicmp:japicmp-maven-plugin from
0.25.0 to 0.25.4
+ Bump mavenVersion from 3.9.11 to 3.9.12
- Update to upstream version 1.9.25
* New features and improvements
+ Add scope support for trusted checksums
+ Name mappers cleanup and new GAECV mapper
+ Proper metadata locking support
+ Ability to augment metadata nature for version range request
* Bug Fixes
+ TrackingFileManager changes
+ Maven filters daemon friendly
+ Remove hack from Basic connector
+ Fix locking issues
* Documentation updates
+ Updated the documentation to reflect the current list of name
mappers
* Maintenance
+ Mild backport: support same properties as Resolver 2.x
+ Maven resolver lockrepro
+ Bugfix: Java 25 broke test
* Dependency updates
+ Bump com.github.siom79.japicmp:japicmp-maven-plugin from
0.23.1 to 0.25.0
+ Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.24
to 1.26
+ Bump commons-codec:commons-codec from 1.18.0 to 1.20.0
+ Bump org.redisson:redisson from 3.50.0 to 3.52.0
+ Bump com.google.guava:guava from 33.4.8-jre to 33.5.0-jre
+ Bump com.google.code.gson:gson from 2.13.1 to 2.13.2
+ Bump jettyVersion from 9.4.57.v20241219 to 9.4.58.v20250814
+ Bump mavenVersion from 3.9.10 to 3.9.11
- Update to upstream version 1.9.24
* New features and improvements
+ Metadata type out of coordinates
+ RFC9457 implementation
+ Intern context strings
* Maintenance
+ Align plexus-util version with Maven
+ Align guice version with Maven
+ Enable Github Issues (1.9.x branch)
- Build also maven-resolver-supplier package in separate spec file
- Add dependency on objectweb-asm to build with sisu 0.9.0.M4
- Update to upstream version 1.9.23
* Bug
+ MRESOLVER-659: NPE in trusted checksum post processor if
* Improvement
+ MRESOLVER-680: Disable checksum by default for .sigstore.json
as well
+ MRESOLVER-703: HTTP transport should expose config for max
redirects
- Upgrade to upstream version 1.9.22
* Bug
+ MRESOLVER-572: Resolver-Supplier unusable in OSGi runtimes
+ MRESOLVER-574: Invalid Cookie set under proxy conditions
+ MRESOLVER-586: In typical setups, DefaultArtifact copies the
same maps over and over again
+ MRESOLVER-587: Memory consumption improvements
* New Feature
+ MRESOLVER-571: Import o.e.aether packages with the exact same
version in OSGi metadata
* Improvement
+ MRESOLVER-570: Remove excessive strictness of OSGi dependency
metadata
* Task
+ MRESOLVER-576: Allow co-release of Resolver 1.x and 2.x
- Upgrade to upstream version 1.9.20
* Bug
+ MRESOLVER-483: PreorderNodeListGenerator bug: may print
trailing ':'
+ MRESOLVER-522: File locking threads not entering critical
region were 'oversleeping'
+ MRESOLVER-547: BF collector always copies artifacts, even
when it should not
* Improvement
+ MRESOLVER-536: Skip setting last modified time when FS does
not support it
- Add dependency on plexus-xml where relevant
* this will be needed for smooth upgrade to plexus-utils 4.0.0
- Upgrade to upstream version 1.9.18
* Bug
+ MRESOLVER-372: Sporadic AccessDeniedEx on Windows
+ MRESOLVER-441: Undo FileUtils changes that altered non-Windows
execution path
* Improvement
+ MRESOLVER-396: Native transport should retry on HTTP 429
(Retry-After)
* Task
+ MRESOLVER-397: Deprecate Guice modules
+ MRESOLVER-405: Get rid of component name string literals, make
them constants and reusable
+ MRESOLVER-433: Expose configuration for inhibiting
Expect-Continue handshake in 1.x
+ MRESOLVER-435: Refresh download page
+ MRESOLVER-437: Resolver should not override given HTTP
transport default use of expect-continue handshake
- Upgrade to upstream version 1.9.15
* Bug
+ MRESOLVER-373: Remove lock upgrading code
+ MRESOLVER-375: Several key aspects are broken in provided and
trusted checksum feature
+ MRESOLVER-376: StackOverflowError at
BfDependencyCollector.processDependency
+ MRESOLVER-380: Lock diagnostic: attempted lock step is
recorded, but on failed attempt is not removed
+ MRESOLVER-393: Transport HTTP does not retain last modified as
sent by remote end
* Improvement
+ MRESOLVER-220: Modify signaling for unsupported operations
+ MRESOLVER-382: Define local outgoing (bind) address
+ MRESOLVER-385: Reduce default value for
aether.connector.http.connectionMaxTtl
* Task
+ MRESOLVER-378: Update parent POM to 40
+ MRESOLVER-381: Undo MRESOLVER-373 as it was fixed by other
means
+ MRESOLVER-386: Make all injected ctors public, deprecate all
def ctors
+ MRESOLVER-388: Transport HTTP old codec proper override
- Upgrade to upstream version 1.9.12
* Bug
+ [MRESOLVER-371] Unjustified WARNING log added by
MRESOLVER-364
+ [MRESOLVER-361] Unreliable TCP and retries on upload
+ [MRESOLVER-357] ConflictResolver STANDARD verbosity
misbehaves
+ [MRESOLVER-352] Duplicate METADATA_DOWNLOADING event is
being sent
* Improvement
+ [MRESOLVER-360] disable checksum by default for .sigstore
in addition to .asc
* New Feature
+ [MRESOLVER-370] Lock factory should dump lock states on
failure
+ [MRESOLVER-353] Make aether.checksums.algorithms settable
per remote repository
* Task
+ [MRESOLVER-366] Upgrade build plugins
+ [MRESOLVER-364] Revert MRESOLVER-132
+ [MRESOLVER-359] Make build be explicit about build time
requirements
+ [MRESOLVER-356] Remove Guava (is unused)
+ [MRESOLVER-354] Document expected checksums
- Upgrade to upstream version 1.9.8
* Bug
+ [MRESOLVER-345] Conflict resolution in verbose mode is
sensitive to version ordering
+ [MRESOLVER-348] SslConfig httpSecurityMode change is not
detected
+ [MRESOLVER-339] Preemptive Auth broken when default ports used
+ [MRESOLVER-325] [REGRESSION] Suddenly seeing I/O errors under
windows aborting the build
+ [MRESOLVER-330] Static name mapper is unusable with file-lock
factory
+ [MRESOLVER-314] Getting 'IllegalArgumentException: Comparison
method violates its general contract!'
+ [MRESOLVER-316] DF collector enters endless loop when
collecting org.webjars.npm:musquette:1.1.1
+ [MRESOLVER-298] javax.inject should be provided or optional
+ [MRESOLVER-305] Evaluate blocked repositories also when
retrieving metadata
+ [MRESOLVER-309] PrefixesRemoteRepositoryFilterSource aborts
the build while it should not
+ [MRESOLVER-313] Artifact file permissions are 0600 and not
implicitly set by umask
+ [MRESOLVER-296] FileProcessor.write( File, InputStream ) is
defunct
+ [MRESOLVER-292] Documented and used param names mismatch
+ [MRESOLVER-294] Fix JapiCmp configuration and document it
+ [MRESOLVER-285] File locking on Windows knows to misbehave
+ [MRESOLVER-246] m-deploy-p will create hashes for hashes
+ [MRESOLVER-265] Discrepancy between produced and recognized
checksums
+ [MRESOLVER-241] Resolver checksum calculation should be driven
by layout
+ [MRESOLVER-242] When no remote checksums provided by layout,
transfer inevitably fails/warns
+ [MRESOLVER-250] Usage of descriptors map in DataPool prevents
gargabe collection
* New Feature
+ [MRESOLVER-32] Support parallel artifact/metadata uploads
+ [MRESOLVER-319] Support parallel deploy
+ [MRESOLVER-297] Chained LRM
+ [MRESOLVER-167] Support forcing specific repositories for
artifacts
+ [MRESOLVER-268] Apply artifact checksum verification for any
resolved artifact
+ [MRESOLVER-274] Introduce Remote Repository Filter feature
+ [MRESOLVER-275] Introduce trusted checksums source
+ [MRESOLVER-276] Resolver post-processor
+ [MRESOLVER-278] BREAKING: Introduce RepositorySystem shutdown
hooks
+ [MRESOLVER-236] Make it possible to resolve .asc on a 'fail'
respository.
* Improvement
+ [MRESOLVER-346] Too eager locking
+ [MRESOLVER-347] Better connection pool configuration (reuse,
max TTL, maxPerRoute)
+ [MRESOLVER-349] Adapter when locking should 'give up and
retry'
+ [MRESOLVER-350] Get rid of commons-lang dependency
+ [MRESOLVER-327] Make tranport-http obey system properties
regarding proxy settings
+ [MRESOLVER-340] Make WebDAV 'dance' disabled by default
+ [MRESOLVER-341] Add option for preemptive PUT Auth
+ [MRESOLVER-315] Implement preemptive authentication feature
for transport-http
+ [MRESOLVER-328] The transport-http should be able to ignore
cert errors
+ [MRESOLVER-337] Real cause when artifact not found with
repository filtering
+ [MRESOLVER-287] Get rid of deprecated finalize methods
+ [MRESOLVER-317] Improvements for BF collector
+ [MRESOLVER-318] Cleanup redundant code and centralize executor
handling
+ [MRESOLVER-303] Make checksum detection reusable
+ [MRESOLVER-290] Improve file handling resolver wide
+ [MRESOLVER-7] Download dependency POMs in parallel in BF
collector
+ [MRESOLVER-266] Simplify adapter creation and align
configuration for it
+ [MRESOLVER-269] Allow more compact storage of provided
checksums
+ [MRESOLVER-273] Create more compact File locking layout/mapper
+ [MRESOLVER-284] BREAKING: Some Sisu parameters needs to be
bound
+ [MRESOLVER-286] Improve basic connector closed state handling
+ [MRESOLVER-240] Using breadth-first approach to resolve Maven
dependencies
+ [MRESOLVER-247] Avoid unnecessary dependency resolution by a
Skip solution based on BFS
+ [MRESOLVER-248] Make DF and BF collector implementations
coexist
* Task
+ [MRESOLVER-326] Resolver transport-http should retry on
failures
+ [MRESOLVER-331] Make DefaultTrackingFileManager write directly
to tracking files
+ [MRESOLVER-333] Distinguish better resolver errors for
artifact availability
+ [MRESOLVER-320] Investigate slower resolving speeds as
reported by users
+ [MRESOLVER-291] Undo MRESOLVER-284
+ [MRESOLVER-279] Simplify and improve trusted checksum sources
+ [MRESOLVER-281] Update configurations page with new elements
+ [MRESOLVER-282] Drop PartialFile
+ [MRESOLVER-230] Make supported checksum algorithms extensible
+ [MRESOLVER-231] Extend “smart checksum†feature
+ [MRESOLVER-234] Introduce “provided†checksums feature
+ [MRESOLVER-237] Make all checksum mismatches handled same
+ [MRESOLVER-239] Update and sanitize dependencies
+ [MRESOLVER-244] Deprecate FileTransformer API
+ [MRESOLVER-245] Isolate Hazelcast tests
* Dependency upgrade
+ [MRESOLVER-311] Upgrade Parent to 39
+ [MRESOLVER-293] Update dependencies, align with Maven
+ [MRESOLVER-272] Update parent POM to 37, remove plugin version
overrides, update bnd
+ [MRESOLVER-280] Upgrade invoker, install, deploy, require
maven 3.8.4+
+ [MRESOLVER-251] Upgrade Redisson to 3.17.5
+ [MRESOLVER-249] Update Hazelcast to 5.1.1 in
named-locks-hazelcast module
- Add an alias for the wagon connector
- Build against the standalone JavaEE modules unconditionally
- Remove the javax.annotation:javax.annotation-api dependency on
distribution versions that do not incorporate the JavaEE modules
- Add the glassfish-annotation-api jar to the build classpath
- Upgrade to upstream version 1.7.3
* Bug
+ [MRESOLVER-96] - Dependency Injection fails after upgrading
to Maven 3.6.2
+ [MRESOLVER-153] - resolver-status.properties file is corrupted
due to concurrent writes
+ [MRESOLVER-171] - Resolver fails when compiled on Java 9+ an
run on Java 8 due to JDK API breakage
+ [MRESOLVER-189] - Using semaphore-redisson followed by
rwlock-redisson on many parallel build of the same project
triggers redisson error
* New Feature
+ [MRESOLVER-90] - HTML content in POM: Maven should validate
content before storing in local repo
+ [MRESOLVER-145] - Introduce more SyncContext implementations
* Improvement
+ [MRESOLVER-103] - Replace deprecated HttpClient classes
+ [MRESOLVER-104] - maven-resolver-demo-maven-plugin uses
reserved artifactId
+ [MRESOLVER-147] - Upgrade to Java 8
+ [MRESOLVER-148] - Use vanilla Guice 4 instead of forked
Guice 3
+ [MRESOLVER-156] - Active dependency management for Google
Guice/Guava
+ [MRESOLVER-168] - add DEBUG message when downloading an
artifact from repositories
+ [MRESOLVER-193] - Properly type lock key names in Redis
+ [MRESOLVER-197] - Minors improvements (umbrella)
+ [MRESOLVER-204] - Add a SessionData#computeIfAbsent method
+ [MRESOLVER-214] - Remove clirr configuration
* Task
+ [MRESOLVER-141] - Review index-based access to collections
+ [MRESOLVER-151] - Enforce a checksum policy to be provided
explicitly
+ [MRESOLVER-152] - Perform null checks when interface
contracts require it
+ [MRESOLVER-154] - Move SyncContextFactory interface to SPI
module
+ [MRESOLVER-155] - Make TrackingFileManager member of
DefaultUpdateCheckManager
+ [MRESOLVER-158] - Simplify SimpleDigest class
+ [MRESOLVER-159] - Mark singleton components as Sisu Singletons
+ [MRESOLVER-160] - Deprecate ServiceLocator
+ [MRESOLVER-162] - Restore binary compatibility broken by
MRESOLVER-154
+ [MRESOLVER-170] - Deprecate org.eclipse.aether.spi.log
+ [MRESOLVER-172] - Make TrackingFileManager shared singleton
component
+ [MRESOLVER-173] - Drop deprecated AetherModule
+ [MRESOLVER-174] - Use all bindings in UTs and tests
+ [MRESOLVER-175] - Drop SyncContextFactory delegates in favor
of a selector approach
+ [MRESOLVER-177] - Move pre-/post-processing of metadata from
ResolveTask to DefaultMetadataResolver
+ [MRESOLVER-183] - Don't require optional dependencies for
Redisson
+ [MRESOLVER-184] - Destroy Redisson semaphores if not used
anymore
+ [MRESOLVER-186] - Update Maven version in Resolver Demo
Snippets
+ [MRESOLVER-188] - Improve documentation on using the named
locks with redis/hazelcast (umbrella)
+ [MRESOLVER-190] - [Regression] Revert MRESOLVER-184
+ [MRESOLVER-191] - Document how to analyze lock issues
+ [MRESOLVER-196] - Document named locks configuration options
+ [MRESOLVER-219] - Implement NamedLock with advisory file
locking
+ [MRESOLVER-227] - Refactor NamedLockFactorySelector to a
managed component
+ [MRESOLVER-232] - Make SimpleNamedLockFactorySelector logic
reusable
* Sub-task
+ [MRESOLVER-198] - Replace assert by simpler but equivalent
calls
+ [MRESOLVER-199] - Java 8 improvements
+ [MRESOLVER-200] - Simplify conditions with the same result
and avoid extra validations
+ [MRESOLVER-201] - Make variables final whenever possible
+ [MRESOLVER-202] - Use isEmpty() instead length() <= 0
* Dependency upgrade
+ [MRESOLVER-185] - Upgrade Redisson to 3.15.6
* Change of API and incompatible with maven-resolver < 1.7
- Upgrade to upstream version 1.6.3
* Bug
+ [MRESOLVER-153] - resolver-status.properties file is corrupted
due to concurrent writes
+ [MRESOLVER-171] - Resolver fails when compiled on Java 9+ and
run on Java 8 due to JDK API breakage
* Improvement
+ [MRESOLVER-168] - add DEBUG message when downloading an
artifact from repositories
* Task
+ [MRESOLVER-177] - Move pre-/post-processing of metadata from
ResolveTask to DefaultMetadataResolver
* Needed for maven 3.8.4
- Do not build/run the tests against the legacy guava20 package
- Upgrade to upstream version 1.6.2
* Sub-task
+ [MRESOLVER-139] - Make SimpleDigest use SHA-1 or MD5 only
+ [MRESOLVER-140] - Default to SHA-1 and MD5 hashing algorithms
* Bug
+ [MRESOLVER-25] - Resume support is broken under high
concurrency
+ [MRESOLVER-114] - ArtifactNotFoundExceptions when building in
parallel
+ [MRESOLVER-129] - Exclusion has no setters
+ [MRESOLVER-137] - Make OSGi bundles reproducible
+ [MRESOLVER-138] - MRESOLVER-56 introduces severe performance
regression
* New Feature
+ [MRESOLVER-109] - AndDependencySelector should override
toString
+ [MRESOLVER-115] - Make checksum algorithms configurable
+ [MRESOLVER-123] - Provide a global locking sync context by
default
+ [MRESOLVER-131] - Introduce a Redisson-based
SyncContextFactory
+ [MRESOLVER-165] - Add support for mirror selector on
external:http:*
+ [MRESOLVER-166] - Add support for blocked
repositories/mirrors
* Improvement
+ [MRESOLVER-56] - Support SHA-256 and SHA-512 as checksums
+ [MRESOLVER-116] - Add page with all supported configuration
options
+ [MRESOLVER-125] - Use type conversions returning primitives
+ [MRESOLVER-127] - Don't use boolean for property
'aether.updateCheckManager.sessionState'
+ [MRESOLVER-136] - Migrate from maven-bundle-plugin to
bnd-maven-plugin
* Task
+ [MRESOLVER-119] - Turn log messages to SLF4J placeholders
+ [MRESOLVER-130] - Move GlobalSyncContextFactory to a separate
module
+ [MRESOLVER-132] - Remove synchronization in
TrackingFileManager
* Dependency upgrade
+ [MRESOLVER-105] - Update Plexus Components
+ [MRESOLVER-106] - Update HttpComponents
+ [MRESOLVER-107] - Update Wagon Provider API to 3.4.0
+ [MRESOLVER-108] - Update mockito-core to 2.28.2
+ [MRESOLVER-117] - Upgrade SLF4J to 1.7.30
+ [MRESOLVER-118] - Upgrade Sisu Components to 0.3.4
* Needed for maven 3.8.x
- Set buildshell to bash for '<<<'.
- Upgrade to upstream version 1.4.2
* Bug:
+ MRESOLVER-38 – SOE/OOME in DefaultDependencyNode.accept
* Improvements:
+ MRESOLVER-93 – PathRecordingDependencyVisitor to handle 3 cycles
+ MRESOLVER-102 – make build Reproducible
- Upgrade to upstream version 1.4.1
* Task
+ [MRESOLVER-92] - Revert MRESOLVER-7
* Bug
+ [MRESOLVER-86] - ResolveArtifactMojo from resolver example
uses plugin repositories to resolve dependencies
* New Feature
+ [MRESOLVER-10] - New 'TransitiveDependencyManager'
supporting transitive dependency management
+ [MRESOLVER-33] - New 'DefaultDependencyManager' managing
dependencies on all levels supporting transitive dependency
management
* Improvement
+ [MRESOLVER-7] - Download dependency POMs in parallel
+ [MRESOLVER-84] - Add support for 'release' qualifier
+ [MRESOLVER-87] - Refresh examples to use maven-resolver
artifacts for demo
+ [MRESOLVER-88] - Code style cleanup to use Java 7 features
- Initial packaging of maven-resolver 1.3.1
- Generate and customize the ant build files
maven-resolver was update to upstream version 1.9.27:
* Bug Fixes
+ Sync TrackingFileManager with 2.x
- Update to upstream version 1.9.26
* New features and improvements
+ GH-1773: Treat 410 Gone as 404 Not Found
+ GH-1737: Revert partially parallel upload change
* Bug Fixes
+ GH-1768; Drastically simplify auth caching
+ [1.9.x] Bug: GH-1703 Locally cached artifacts defy RRF
* Documentation updates
+ Clarify that HTTP Transport uses Apache HTTP Client
* Dependency updates
+ Bump org.redisson:redisson from 3.52.0 to 4.2.0
+ Bump commons-codec:commons-codec from 1.20.0 to 1.21.0
+ Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.26
to 1.27
+ Bump org.apache.maven:maven-parent from 46 to 47
+ Bump com.github.siom79.japicmp:japicmp-maven-plugin from
0.25.0 to 0.25.4
+ Bump mavenVersion from 3.9.11 to 3.9.12
- Update to upstream version 1.9.25
* New features and improvements
+ Add scope support for trusted checksums
+ Name mappers cleanup and new GAECV mapper
+ Proper metadata locking support
+ Ability to augment metadata nature for version range request
* Bug Fixes
+ TrackingFileManager changes
+ Maven filters daemon friendly
+ Remove hack from Basic connector
+ Fix locking issues
* Documentation updates
+ Updated the documentation to reflect the current list of name
mappers
* Maintenance
+ Mild backport: support same properties as Resolver 2.x
+ Maven resolver lockrepro
+ Bugfix: Java 25 broke test
* Dependency updates
+ Bump com.github.siom79.japicmp:japicmp-maven-plugin from
0.23.1 to 0.25.0
+ Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.24
to 1.26
+ Bump commons-codec:commons-codec from 1.18.0 to 1.20.0
+ Bump org.redisson:redisson from 3.50.0 to 3.52.0
+ Bump com.google.guava:guava from 33.4.8-jre to 33.5.0-jre
+ Bump com.google.code.gson:gson from 2.13.1 to 2.13.2
+ Bump jettyVersion from 9.4.57.v20241219 to 9.4.58.v20250814
+ Bump mavenVersion from 3.9.10 to 3.9.11
- Update to upstream version 1.9.24
* New features and improvements
+ Metadata type out of coordinates
+ RFC9457 implementation
+ Intern context strings
* Maintenance
+ Align plexus-util version with Maven
+ Align guice version with Maven
+ Enable Github Issues (1.9.x branch)
- Build also maven-resolver-supplier package in separate spec file
- Add dependency on objectweb-asm to build with sisu 0.9.0.M4
- Update to upstream version 1.9.23
* Bug
+ MRESOLVER-659: NPE in trusted checksum post processor if
* Improvement
+ MRESOLVER-680: Disable checksum by default for .sigstore.json
as well
+ MRESOLVER-703: HTTP transport should expose config for max
redirects
- Upgrade to upstream version 3.9.16
* Bug Fixes
+ Trim threadConfiguration to accept input surrounded with
spaces
+ Backport: Maven 3.10.x fixed plugin resolution
* Dependency updates
+ Bump org.codehaus.plexus:plexus-classworlds from 2.9.0 to
2.11.0
+ [3.9.x] Bump to parent POM 48
+ Bump commons-io:commons-io from 2.21.0 to 2.22.0
+ Bump com.google.guava:guava from 33.5.0-jre to 33.6.0-jre
+ Bump actions/cache from 5.0.4 to 5.0.5
- There is no need to link the jansi-native library into the tree,
since our jansi java library will load it from the system anyway
- Upgrade to upstream version 3.9.15
* Documentation updates
+ Use new Maven logos in documentation
+ document modelVersion only supported value: 4.0.0
* Dependency updates
+ Bump actions/upload-artifact from 7.0.0 to 7.0.1
+ Bump org.codehaus.plexus:plexus-utils from 3.6.0 to 3.6.1
+ Bump org.fusesource.jansi:jansi from 2.4.2 to 2.4.3
+ Bump actions/cache from 5.0.3 to 5.0.4
+ Bump actions/download-artifact from 8.0.0 to 8.0.1
- Upgrade to upstream version 3.9.14
* Bug Fixes
+ plexus-testing dependencies should be used in test scope
* Dependency updates
+ Bump actions/upload-artifact from 6.0.0 to 7.0.0
+ Bump actions/download-artifact from 7.0.0 to 8.0.0
- Upgrade to upstream version 3.9.13
* Bug Fixes
+ Bug: SecDispatcher is managed by legacy Plexus DI
+ [3.9.x] MavenPluginJavaPrerequisiteChecker: Handle 8/1.8
Java version in ranges as well
* Maintenance
+ Update Maven plugin versions in default-bindings.xml
+ Migrate to JUnit 5 - avoid using TestCase
* Dependency updates
+ Maven Resolver 1.9.27
+ Bump resolverVersion from 1.9.25 to 1.9.26
+ Bump version.sisu-maven-plugin from 0.9.0.M4 to 1.0.0
+ Bump actions/cache from 5.0.0 to 5.0.3
+ Bump org.apache.maven:maven-parent from 45 to 47
+ Bump actions/checkout from 6.0.1 to 6.0.2
+ Bump actions/setup-java from 5.1.0 to 5.2.0
+ Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.26
to 1.27
+ Bump org.codehaus.mojo:buildnumber-maven-plugin from 3.2.1
to 3.3.0
+ Bump org.codehaus.plexus:plexus-testing from 2.0.2 to 2.1.0
+ Bump org.ow2.asm:asm from 9.9 to 9.9.1
+ Bump actions/upload-artifact from 5.0.0 to 6.0.0
+ Bump actions/download-artifact from 6.0.0 to 7.0.0
- Specify required maven-resolver version since the
maven-resolver-provider requires methods added in 1.9.25
- Upgrade to upstream version 3.9.12
* New features and improvements
+ Apply resolver changes and improvements
+ Update formatting of prerequisites-requirements error to
improve readability
+ Allow a Maven plugin to require a Java version
+ Use MavenRepositorySystem in ProjectBuildingHelper instead
of deprecated RepositorySystem
+ Make maven.config use UTF8
+ Simplify prefix resolution
* Bug Fixes
+ Add default implementation for new method in
MavenPluginManager
+ Repository layout should be used in MavenRepositorySystem
+ Fix plugin prefix resolution when metadata is not available
from repository
+ Improve source root modification warning message
+ Bug: bad cache isolation between two sessions
+ Set Guice class loading to CHILD - avoid using terminally
deprecated methods
+ Avoid parsing MAVEN_OPTS (3.9.x)
* Documentation updates
+ clarify repository vs deployment repository
+ add maintained branches
* Maintenance
+ Add IntelliJ icon
+ Build by JDK 25
+ Deprecate org.apache.maven.repository.RepositorySystem in
3.9.x
* Build
+ Bump actions/download-artifact from 5.0.0 to 6.0.0
+ Bump actions/upload-artifact from 4.6.2 to 5.0.0
* Dependency updates
+ Bump actions/cache from 4.2.3 to 5.0.0
+ Bump resolverVersion from 1.9.24 to 1.9.25
+ Bump actions/checkout from 5.0.0 to 6.0.1
+ Bump actions/setup-java from 5.0.0 to 5.1.0
+ Bump commons-cli:commons-cli from 1.9.0 to 1.11.0
+ Bump org.codehaus.plexus:plexus-interpolation from 1.28 to
1.29
+ Bump commons-io:commons-io from 2.19.0 to 2.21.0
+ Bump xmlunitVersion from 2.10.3 to 2.11.0
+ Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.24
to 1.26
+ Bump org.ow2.asm:asm from 9.8 to 9.9
+ Bump com.google.guava:guava from 33.4.8-jre to 33.5.0-jre
- Upgrade to upstream version 3.9.11
* New features and improvements
+ Augment version range resolution used repositories
* Bug Fixes
+ Deduplicate filtered dependency graph
+ Move ensure in boundaries of project lock
* Maintenance
+ [MNGSITE-393] - remove references to Maven 2
+ Update CONTRIBUTING after GitHub issues enabled
+ Enable Github Issues
+ [MNG-8763] - Remove name from site bannerLeft
* Build
+ Pin GitHub action versions by hash
+ Build the project by JDK 21 as default
+ Use Maven 3.9.10 for build on GitHub
- Upgrade to upstream version 3.9.10
* Bug
+ MNG-8096: Inconsistent dependency resolution behaviour for
concurrent multi-module build can cause failures
+ MNG-8169: MINGW support requires
--add-opens java.base/java.lang=ALL-UNNAMED
+ MNG-8170: Maven 3.9.8 contains weird native library for Jansi
on Windows/arm64
+ MNG-8211: Maven should fail builds that use CI Friendly
versions but have no values set
+ MNG-8248: WARNING: A restricted method in java.lang.System has
been called
+ MNG-8256: ProjectDependencyGraph bug: in case of filtering,
non-direct module links are lost
+ MNG-8315: Failure of mvn.cmd if a .mvn directory is located at
drive root
+ MNG-8396: Maven takes forever to resume
+ MNG-8711: 'Duplicate artifact' in LifecycleDependencyResolver
* Improvement
+ MNG-8370: Introduce maven.repo.local.head
+ MNG-8399: JDK 24+ issues warning about usage of
sun.misc.Unsafe
+ MNG-8707: Add methods to remove compile and test source roots
+ MNG-8712: improve dependency version explanation: it's a
requirement, not always effective version
+ MNG-8717: Remove maven-plugin-plugin:addPluginArtifactMetadata
from default binding
+ MNG-8722: Use a single standalone version of asm
+ MNG-8731: Use https for xsi:schemaLocation in generated
descriptors
+ MNG-8734: Simplify scripting like 'get project version' cases
* Task
+ MNG-8728: Bump Eclipse Sisu from 0.9.0.M3 to 0.9.0.M4 and use
Java 24 on CI
- Link also the objectweb-asm/asm to the lib directory
+ MNG-8177: Warning
xmvn-connector was updated to fix:
- Add dependency on objectweb-asm to build with sisu 0.9.0.M4
- Upgrade to version 4.3.0
* Changes:
+ Fix typo in JavadocMojo
+ Reproducible javadoc
+ Reproducible manifest injection
+ Deprecate UUIDs
+ Implement MetadataResult.getPackageMetadataMap()
xmvn-mojo was updated to fix:
Upgrade to version 4.3.0
* Changes:
+ Fix typo in JavadocMojo
+ Reproducible javadoc
+ Reproducible manifest injection
+ Deprecate UUIDs
+ Implement MetadataResult.getPackageMetadataMap()
xmvn-parent was updated to fix:
- Upgrade to version 4.3.0
* Changes:
+ Fix typo in JavadocMojo
+ Reproducible javadoc
+ Reproducible manifest injection
+ Deprecate UUIDs
+ Implement MetadataResult.getPackageMetadataMap()
xmvn-tools was updated to:
- The new commons-compress needs commons-lang3
- Upgrade to version 4.3.0
* Changes:
+ Fix typo in JavadocMojo
+ Reproducible javadoc
+ Reproducible manifest injection
+ Deprecate UUIDs
+ Implement MetadataResult.getPackageMetadataMap()
xmvn was updated to fix:
- Adapt to no libjansi.so linked into the arch independent path
- Fix build after removal of the default %%{java_home} define
- Upgrade to version 4.3.0
* Changes:
+ Fix typo in JavadocMojo
+ Reproducible javadoc
+ Reproducible manifest injection
+ Deprecate UUIDs
+ Implement MetadataResult.getPackageMetadataMap()
The following package changes have been done:
- java-25-openjdk-headless-25.0.4.0-150700.15.13.1 updated
- java-25-openjdk-25.0.4.0-150700.15.13.1 updated
- geronimo-annotation-1_0-api-1.2-150200.15.8.1 added
- jansi-2.4.0-150200.3.9.1 updated
- java-25-openjdk-devel-25.0.4.0-150700.15.13.1 updated
- maven-resolver-api-1.9.27-150200.3.29.1 updated
- plexus-interpolation-1.27.0-150200.3.9.1 updated
- plexus-xml-3.0.1-150200.5.10.1 updated
- google-gson-2.8.9-150200.3.10.3 added
- guava-33.2.1-150200.3.15.1 updated
- maven-resolver-util-1.9.27-150200.3.29.1 updated
- maven-resolver-spi-1.9.27-150200.3.29.1 updated
- maven-resolver-named-locks-1.9.27-150200.3.29.1 updated
- google-guice-6.0.0-150200.3.13.2 updated
- maven-resolver-transport-file-1.9.27-150200.3.29.1 updated
- maven-resolver-connector-basic-1.9.27-150200.3.29.1 updated
- maven-resolver-transport-wagon-1.9.27-150200.3.29.1 updated
- maven-resolver-impl-1.9.27-150200.3.29.1 updated
- maven-resolver-transport-http-1.9.27-150200.3.29.1 updated
- maven-lib-3.9.16-150200.4.33.1 updated
- maven-3.9.16-150200.4.33.1 updated
- container:bci-openjdk-25-15.7.25-9.24 updated
More information about the sle-container-updates
mailing list