<div class="container">
<h1>Recommended update for apache-commons-pool2, apache-commons-net, apache-commons-daemon, apache-commons-configuration2</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-RU-2026:22560-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-07-06T20:10:17Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>moderate</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Enterprise Server 16.0</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP applications 16.0</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that can now be installed.</p>
<h2>Description:</h2>
<p>This update for apache-commons-pool2, apache-commons-net, apache-commons-daemon, apache-commons-configuration2 fixes the following issues:</p>
<p>Changes in apache-commons-pool2:</p>
<ul>
<li>
<p>Update to 2.13.1</p>
</li>
<li>
<p>Fixed Bugs:</p>
<ul>
<li>POOL-427: The fix for POOL-425 introduced a regression where
addObject fails when maxIdle is negative (indicating no limit)</li>
</ul>
</li>
<li>
<p>Update to 2.13.0</p>
</li>
<li>
<p>New features:</p>
<ul>
<li>Add org.apache.commons.pool2.PooledObject
.nonNull(PooledObject)</li>
<li>Add org.apache.commons.pool2.PooledObject
.getObject(PooledObject)</li>
<li>Made statistics collection optional in BaseGenericObjectPool
#429</li>
</ul>
</li>
<li>
<p>Fixed Bugs:</p>
<ul>
<li>POOL-424: GenericObjectPool.invalidateObject() can leave other
threads waiting to borrow hanging. The fix for this issue
changes behavior of invalidateObject. This method now always
tries to add a new instance to the pool to replace the
invalidated and destroyed instance. As a result of this
change, abandoned object removal now attemps to replace
abandoned objects</li>
<li>POOL-425: GenericObjectPool addObject does not respect maxIdle</li>
<li>POOL-350: Make placement of calls to GKOP reuseCapacity
configurable</li>
<li>POOL-290: TestSoftRefOutOfMemory (unit test) can loop
infinitely on failure</li>
<li>POOL-419: GenericObjectPool counters and object collections
can be corrupted when returnObject and invalidate are invoked
concurrently by client threads on the same pooled object</li>
<li>POOL-421: GenericObjectPool addObject should return
immediately when there is no capacity to add</li>
<li>POOL-420: The maximum wait time for GenericKeyedObjectPool
.borrowObject(*) may exceed configured maximum wait time.
This is the same issue as POOL-418, but for GKOP. Also included
in this fix is a change to addObject that prevents it from
waiting for capacity to create. That method now returns
immediately when there is no capcity to add to the pool under
the given key</li>
<li>Remove -nouses directive from maven-bundle-plugin. OSGi
package imports now state 'uses' definitions for package
imports, this doesn't affect JPMS
(from org.apache.commons:commons-parent:80)</li>
<li>POOL-418: The maximum wait time for GenericObjectPool
.borrowObject(*) may exceed expectations due to a spurious
thread wakeup. he remaining duration was incorrectly
calculated and the method did not end up waiting long enough.
Recompute the remaining duration an additional time when we
block when exhausted</li>
<li>Fix site link from the About page to the Download page, see
also #387</li>
<li>Operation on the "idleHighWaterMark" shared variable in
"ErodingFactor" class is not atomic
[org.apache.commons.pool2.PoolUtils$ErodingFactor] At
PoolUtils.java:[line 98]
AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE</li>
<li>org.apache.commons.pool2.impl.GenericObjectPool
.create(Duration) should normalize a negative duration to zero</li>
<li>Fix potential ConcurrentModificationException in EvictionTimer
thread clean-up</li>
<li>Fix potential ConcurrentModificationException in EvictionTimer
tasks</li>
</ul>
</li>
<li>
<p>Update to 2.12.1</p>
</li>
<li>
<p>Fixed Bugs:</p>
<ul>
<li>Use java.time.Instant precision in org.apache.commons.pool2
.impl.ThrowableCallStack.Snapshot throwable message</li>
<li>GenericObjectPool.borrowObject(Duration) doesn't obey its
borrowMaxWait Duration argument when the argument is different
from GenericObjectPool.getMaxWaitDuration()</li>
<li>POOL-418: The maximum wait time for GenericObjectPool
.borrowObject(*) may exceed expectations due to a spurious
thread wakeup</li>
<li>Javadoc is missing its Overview page</li>
<li>Migrate site generation templates to
https://maven.apache.org/xsd/xdoc-2.0.xsd</li>
</ul>
</li>
<li>
<p>Update to 2.12.0</p>
</li>
<li>New features:<ul>
<li>Add PooledObject.getFullDuration()</li>
<li>Add GenericKeyedObjectPool.getKeys()</li>
<li>Add KeyedObjectPool.getKeys()</li>
<li>Add github/codeql-action.</li>
<li>Add BaseGenericObjectPool.Evictor.toString().</li>
<li>Make BaseGenericObjectPool implement AutoCloseable.</li>
<li>Add BaseGenericObjectPool methods that return Duration and
deprecate equivalents that return milliseconds as long</li>
<li>Add BaseObjectPoolConfig.DEFAULT_DURATION_BETWEEN_EVICTION_RUNS
and deprecate BaseObjectPoolConfig
.DEFAULT_TIME_BETWEEN_EVICTION_RUNS</li>
</ul>
</li>
<li>
<p>Fixed Bugs:</p>
<ul>
<li>POOL-401: Ensure that capacity freed by invalidateObject is
available to all keyed pools</li>
<li>POOL-391: Ensure capacity freed by clear is made available to
GKOP borrowers</li>
<li>POOL-402: Check blockWhenExhausted in hasBorrowWaiters #116</li>
<li>Simplify test assertion with similar call but simpler. #131</li>
<li>POOL-405: NullPointerException GenericKeyedObjectPool
.invalidateObject(GenericKeyedObjectPool.java:1343)</li>
<li>POOL-408: Fix a typo related to KeyedPooledObjectFactory on
the site and Javadoc</li>
<li>Fail-fast on null input for DefaultPooledObjectInfo
.DefaultPooledObjectInfo(PooledObject) with a
NullPointerException</li>
<li>POOL-393: Improve BaseGenericObjectPool's JMX Register
performance when creating many pools</li>
<li>Null-guard in GenericObjectPool.use(T) like other call sites
of GenericObjectPool.getPooledObject(T)</li>
<li>POOL-411: Guard against NPE when deregistering a key at the
end of borrow</li>
<li>Make private GenericKeyedObjectPool.ObjectDeque class static</li>
<li>Make private BaseGenericObjectPool.StatsStore class static</li>
<li>[StepSecurity] ci: Harden GitHub Actions #225</li>
<li>Fix possible NPE in DefaultPooledObjectInfo
.getPooledObjectToString()</li>
<li>Fix possible NPE in DefaultPooledObjectInfo
.getPooledObjectType()</li>
</ul>
</li>
<li>
<p>Update to 2.11.1</p>
</li>
<li>
<p>Fixed Bugs:</p>
<ul>
<li>Getting a PooledObject's active duration returns a negative
duration when the object is borrowed but not returned.
Affects:
° PooledObject.getActiveDuration()
° PooledObject.getActiveTime()
° PooledObject.getActiveTimeMillis()</li>
<li>The default implementation of TrackedUse.getLastUsedInstant()
uses seconds instead of milliseconds</li>
<li>This interface is not implemented within Apache Commons Pool
but affects Apache Commons DBCP</li>
<li>DefaultPooledObject.getIdleTime() drops nanoseconds on Java 9
and greater</li>
<li>Fix field label in BaseGenericObjectPool toString() builder:
From timeBetweenEvictionRunsMillis to
durationBetweenEvictionRuns</li>
<li>Fix field label in BaseObjectPoolConfig toString() builder:
From maxWaitMillis to maxWaitDuration</li>
<li>Fix field label in NoSuchElementException message for
GenericObjectPool.borrowObject(Duration): From
borrowMaxWaitMillis to borrowMaxWaitDuration</li>
<li>Reimplement DefaultPooledObject.getIdleDuration() using
Duration computation</li>
<li>Reimplement BaseGenericObjectPool.maxBorrowWait as a Duration
instead of a long</li>
<li>Minors Changes #89</li>
</ul>
</li>
<li>
<p>Update to 2.11.0</p>
</li>
<li>New features:<ul>
<li>Track timestamps with Instants instead of longs. There is
currently no increased precision on Java 8, but starting with
Java 9, the JRE SystemClock precision is increased usually
down to microseconds, or tenth of microseconds, depending on
the OS, Hardware, and JVM implementation.
Add and use:
° DefaultPooledObject.getCreateInstant()
° DefaultPooledObject.getLastUsedInstant()
° PooledObject.getCreateInstant()
° PooledObject.getLastBorrowInstant()
° PooledObject.getLastReturnInstant()
° PooledObject.getLastUsedInstant()
° TrackedUse#getLastUsedInstant()</li>
<li>Add BaseObjectPoolConfig.setEvictorShutdownTimeoutDuration(Duration),
deprecate setEvictorShutdownTimeoutMillis(Duration)</li>
<li>Add BaseGenericObjectPool.{get|set}MaxWaitDuration(Duration)
and deprecate {get|set}MaxWaitMillis(long)</li>
<li>Add BaseObjectPoolConfig.{get|set}MaxWaitDuration(Duration)
and deprecate {get|set}MaxWaitMillis(long)</li>
<li>Add and use Duration APIs instead of ints or longs.
° Add and use Duration APIs in BaseGenericObjectPool:
getDurationBetweenEvictionRuns(),
getEvictorShutdownTimeoutDuration(),
getMinEvictableIdleDuration(),
getSoftMinEvictableIdleDuration(), setMaxWait(Duration),
setMinEvictableIdle(Duration),
setSoftMinEvictableIdle(Duration)
° Add and use Duration APIs in BaseObjectPoolConfig:
getDurationBetweenEvictionRuns(),
getEvictorShutdownTimeoutDuration(),
getMinEvictableIdleDuration(),
getSoftMinEvictableIdleDuration()
° Add and use Duration APIs in EvictionConfig:
getIdleEvictDuration(), getIdleSoftEvictDuration()
° Add and use Duration APIs in PooledObject: getIdleDuration(),
getActiveDuration()
° No need to initialize instance variables to their default
values
° Update Javadocs.
° Update toString() implementations with duration labels</li>
<li>POOL-396: Handle validation exceptions during eviction. #85</li>
<li>POOL-395: Improve exception thrown in GenericObjectPool
.borrowObject when pool is exhausted. Added
BaseGenericObjectPool.setMessagesStatistics(boolean)</li>
<li>Add and use AbandonedConfig.copy(AbandonedConfig) to fix CPD
code duplication issues in GenericKeyedObjectPool and
GenericObjectPool</li>
<li>Pull up AbandonedConfig and related methods from
GenericKeyedObjectPool and GenericObjectPool to
BaseGenericObjectPool (fix for CPD issues).
° BaseGenericObjectPool.getLogAbandoned()
° BaseGenericObjectPool.getRemoveAbandonedOnBorrow()
° BaseGenericObjectPool.getRemoveAbandonedOnMaintenance()
° BaseGenericObjectPool.getRemoveAbandonedTimeout()
° BaseGenericObjectPool.getRemoveAbandonedTimeoutDuration()
° BaseGenericObjectPool.isAbandonedConfig()
° BaseGenericObjectPool.setAbandonedConfig(AbandonedConfig)</li>
</ul>
</li>
<li>
<p>Fixed Bugs:</p>
<ul>
<li>Fix "[WARNING] Old version of checkstyle detected. Consider
updating to >= v8.30." Update Checktyle to 8.44</li>
<li>Make Duration setters use their respective default values when
null</li>
<li>Call swallowException(Exception) instead of printing
exceptions to the console in GenericKeyedObjectPool
.removeAbandoned(AbandonedConfig) and GenericObjectPool
.removeAbandoned(AbandonedConfig)</li>
<li>Fix Javadoc link reference #91</li>
<li>No need to initialize to default values. #90</li>
</ul>
</li>
<li>
<p>Update to 2.10.0</p>
</li>
<li>New features:<ul>
<li>Add and use java.time.Duration APIs timeouts instead of using
ints for seconds.</li>
<li>Implement AbandonedConfig for GenericKeyedObjectPool #67</li>
</ul>
</li>
<li>
<p>Fixed Bugs:</p>
<ul>
<li>Simplify Assertions in tests #77</li>
<li>Replace C-style array declaration with Java style #80</li>
<li>Use Objects.equals(); Use Anonymous type; Use method reference
instead Lambda; Replace Loop with Collection.removeIf(). #81</li>
<li>Use diamond operator. #82</li>
<li>Code clean ups. #83</li>
</ul>
</li>
<li>
<p>Update to 2.9.0</p>
</li>
<li>
<p>Changes:</p>
<ul>
<li>POOL-387: Object factory destroy method should carry
information on activation context</li>
<li>Update spotbugs from 4.0.6 to 4.1.3, #37, #41, #46</li>
<li>Update actions/checkout from v2.3.1 to v2.3.3 #56, #45</li>
<li>Update actions/setup-java from v1.4.0 to v1.4.2 #42</li>
<li>Update optional asm-util from 8.0.1 to 9.0 #44</li>
</ul>
</li>
<li>
<p>Update to 2.8.1</p>
</li>
<li>New features:<ul>
<li>POOL-385: Added Automatic-Module-Name to support JPMS #31</li>
</ul>
</li>
<li>Fixed Bugs:<ul>
<li>POOL-386: Refactored EvictionTimer usage tracking to fix
POOL-386 and handle abandoned pools. #32</li>
<li>[Javadoc] Add missing @throws comment in PoolUtils. #27</li>
</ul>
</li>
<li>
<p>Changes:</p>
<ul>
<li>POOL-384: Update optional library org.ow2.asm:asm-util from
7.2 to 8.0.1</li>
<li>Update site reports from org.apache.bcel:bcel 6.4.1 to 6.5.0</li>
<li>Update site reports from maven-pmd-plugin 3.12.0 to 3.13.0</li>
<li>Update build from biz.aQute.bnd:biz.aQute.bndlib
5.1.0 -> 5.1.2</li>
<li>Update actions/checkout from v1 to v2.3.1 #33</li>
<li>Update commons-parent from 50 to 51 #36</li>
<li>Update Checkstyle plugin from 3.0.0 to 3.1.1</li>
<li>Update JApiCmp from 0.14.1 to 0.14.3</li>
<li>Update animal-sniffer-maven-plugin from 1.16 to 1.19</li>
</ul>
</li>
<li>
<p>Update to 2.8.0</p>
</li>
<li>New features:<ul>
<li>POOL-378: Deprecate PoolUtils.prefill(ObjectPool, int) in
favor of ObjectPool.addObjects(int)</li>
<li>POOL-379: Deprecate PoolUtils.prefill(KeyedObjectPool, K, int)
in favor of KeyedObjectPool.addObjects(K, int)</li>
<li>POOL-380: Deprecate PoolUtils.prefill(KeyedObjectPool,
Collection, int) in favor of KeyedObjectPool
.addObjects(Collection, int)</li>
</ul>
</li>
<li>Fixed Bugs:<ul>
<li>POOL-374: org.apache.commons.pool2.impl.GenericKeyedObjectPool
.returnObject(K, T) should throw IllegalStateException instead
of NullPointerException when a key is not found in the pool
map</li>
<li>POOL-376: Fixed regression from original fix for POOL-356
which could result in NPE when destroying objects</li>
<li>POOL-326: Eliminated NPE / ISE exceptions due to keyed pools
being prematurely removed</li>
<li>Close BufferedOutputStream in test before calling toString on
underlying BufferedOutputStream #26</li>
<li>[Javadoc] Add missing @throws comment in
SoftReferenceObjectPool. #28</li>
</ul>
</li>
<li>
<p>Changes:</p>
<ul>
<li>POOL-375: Update optional library cglib from 3.2.12 to 3.3.0</li>
<li>Update site build from Apache Commons BCEL 6.3.1 to 6.4.1</li>
<li>POOL-377: Update optional library org.ow2.asm:asm-util from
7.1 to 7.2</li>
</ul>
</li>
<li>
<p>Update to 2.7.0</p>
</li>
<li>New features:<ul>
<li>POOL-370: Add org.apache.commons.pool2.PooledObject
#getBorrowedCount()</li>
<li>POOL-371: Add org.apache.commons.pool2.PooledObject
#setRequireFullStackTrace(boolean)</li>
</ul>
</li>
<li>Fixed Bugs:<ul>
<li>POOL-361: Move validation for newly created objects into
create(). Fixes #23</li>
</ul>
</li>
<li>
<p>Changes:</p>
<ul>
<li>POOL-364: Update from Java 7 to Java 8</li>
<li>POOL-365: Update ASM from 7.0 to 7.1</li>
<li>POOL-366: Update optional library cglib from 3.2.10 to 3.2.12</li>
<li>POOL-367: Fix typo in package private method name
stopEvitor() -> stopEvictor() #22</li>
</ul>
</li>
<li>
<p>Update to 2.6.2</p>
</li>
<li>
<p>Fixed Bugs:</p>
<ul>
<li>POLL-362: Always null out org.apache.commons.pool2.impl
.BaseGenericObjectPool.evictionIterator to match
org.apache.commons.pool2.impl.BaseGenericObjectPool.evictor</li>
<li>POLL-363: Evictor Thread prevents Spring Context shutdown in
standalone app</li>
<li>POLL-348: The commons-pool-evictor-thread should run as a
Deamon</li>
</ul>
</li>
<li>
<p>Update to 2.6.1</p>
</li>
<li>Fixed Bugs:<ul>
<li>POOL-340: Correct validateObject with concurrent borrowObject</li>
<li>POOL-356: Fix deadlock on massive concurrent requests</li>
<li>POOL-347: Method borrowObject waits for maxWaitMillis over in
pool full</li>
<li>POOL-359: NullPointerException closing multiple
GenericObjectPools</li>
<li>POOL-326: Threading issue, NullPointerException and
IllegalStateException in GenericKeyedObjectPool</li>
<li>POOL-352: CallStackUtils mishandles security manager check
(partial fix.)</li>
</ul>
</li>
<li>
<p>Changes:</p>
<ul>
<li>POOL-345: Update optional library cglib from 3.2.6 to 3.2.9</li>
<li>POOL-346: Move common configuration setter to
BaseGenericObjectPool #9</li>
<li>POOL-349: Update optional library asm-util from 6.2 to 7.0</li>
<li>POOL-360: Update optional library cglib from 3.2.9 to 3.2.10</li>
</ul>
</li>
<li>
<p>Update to 2.6.0</p>
</li>
<li>Fixed Bugs:<ul>
<li>POOL-337: Ensure cancelled eviction tasks are removed from
scheduler</li>
<li>POOL-338: GenericObjectPool constructor may throw an exception
under OSGi</li>
<li>POOL-324: org.apache.commons.pool2.impl.GenericObjectPool
.getFactoryType() throws java.lang.ClassCastException</li>
<li>POOL-344: Delete repeated call startEvictor</li>
</ul>
</li>
<li>
<p>Changes:</p>
<ul>
<li>POOL-336: GenericObjectPool's borrowObject lock if create()
fails with Error</li>
<li>POOL-339: Update optional library cglib from 3.2.5 to 3.2.6</li>
<li>POOL-341: Update optional library asm-util from 6.0 to 6.1.1</li>
<li>POOL-342: Update optional library asm-util from 6.1.1 to 6.2</li>
</ul>
</li>
<li>
<p>Update to 2.5.0</p>
</li>
<li>New features:<ul>
<li>POOL-332: ObjectPool and KeyedObject pool should extend
Closeable.</li>
<li>POOL-335: Make abandoned logging stack trace requirements
configurable. This also reverts the default behavior
introduced by POOL-320.</li>
</ul>
</li>
<li>
<p>Changes:</p>
<ul>
<li>POOL-331: Update from Java 6 to 7.</li>
<li>POOL-333: Update optional dependency asm-util from 5.2 to 6.0</li>
<li>POOL-334: org.apache.commons.pool2.impl.ThrowableCallStack
.Snapshot is missing serialVersionUID</li>
</ul>
</li>
<li>
<p>Update to 2.4.3</p>
</li>
<li>New features:<ul>
<li>POOL-320: Use more efficient stack walking mechanisms for
usage tracking when possible.</li>
</ul>
</li>
<li>Fixed Bugs:<ul>
<li>POOL-328: Documentation with repeated words (sources, tests,
and examples)</li>
<li>POOL-317: Correction of default value of
softMinEvictableIdleTimeMillis in BaseObjectPoolConfig</li>
<li>POOL-309: Fix misspellings from "destory" to "destroy"</li>
<li>POOL-306: Ensure BaseGenericObjectPool
.IdentityWrapper#equals() follows the expected contract for
equals()</li>
<li>POOL-303: Ensure that threads do not block indefinitely if
more than maxTotal threads try to borrow an object at the same
time and the factory fails to create any objects.</li>
<li>POOL-310: Ensure that threads using GKOP do not block
indefinitely if more than maxTotal threads try to borrow
objects with different keys at the same time and the factory
destroys objects on return</li>
<li>Ensure that any class name used for evictionPolicyClassName
represents a class that implements EvictionPolicy.</li>
<li>POOL-315: Add a configurable delay (default 10 seconds) to
wait when shutting down an Evictor to allow the associated
thread time to complete and current evictions and to terminate</li>
<li>Ensure that a call to GKOP preparePool() takes account of
other threads that might create objects concurrently,
particularly the Evictor.</li>
</ul>
</li>
<li>
<p>Changes:</p>
<ul>
<li>POOL-280: Small refactoring of borrowObject() to reduce code
duplication</li>
<li>POOL-307: Replace inefficient use of keySet with entrySet in
GKOP</li>
<li>POOL-322: Update optional cglib library from 3.1 to 3.2.5.</li>
<li>POOL-323: Update optional OW2 ASM from 5.0.4 to 5.2.</li>
</ul>
</li>
<li>
<p>set source=1.4 for java</p>
</li>
</ul>
<p>Changes in apache-commons-net:</p>
<ul>
<li>Upgrade to 3.13.0</li>
<li>New features<ul>
<li>Add DatagramSocketClient.getDefaultTimeoutDuration() and
deprecate getDefaultTimeout()</li>
<li>NET-741: Add subnet IPv6 handling with SubnetUtils6 #391</li>
</ul>
</li>
<li>
<p>Fixed Bugs</p>
<ul>
<li>DaytimeTCPClientTest now should now pass inside most VPNs</li>
<li>Migrate tests to JUnit5 #358, #359</li>
<li>Fix malformed Javadoc comments</li>
<li>IMAPExportMbox now restores the current thread's interrupt
flag when catching InterruptedException</li>
<li>IOUtil.readWrite() now restores the current thread's interrupt
flag when catching InterruptedException</li>
<li>TelnetInputStream now restores the current thread's interrupt
flag when catching InterruptedException</li>
<li>NET-740: FTP fails to parse listings for Linux vsftpd in
Chinese or Japanese #393</li>
<li>TelnetInputStream.read() doesn't preserve the original
InterruptedException as the cause of its
InterruptedIOException</li>
<li>FTPClient._storeFile(String, String, InputStream) doesn't
always close it's internal socket when an exception is thrown
early in processing</li>
<li>ListenerList.removeListener(T) now ignores null input to avoid
a NullPointerException</li>
<li>ListenerList.addListener(T) now ignores null input</li>
<li>Fix typo in FTPConnectionClosedException message from FTP
.getReply(boolean)</li>
<li>Reimplement Util.copyReader() with IOUtils.copyLarge()</li>
<li>Reimplement Util.copyStream() with IOUtils.copyLarge()</li>
<li>Reimplement Util.copyStream() with IOUtils.copyLarge()</li>
<li>Deprecate Util.copyReader(Reader, Writer) in favor of IOUtils
.copyLarge(Reader, Writer)</li>
</ul>
</li>
<li>
<p>Upgrade to 3.12.0</p>
</li>
<li>
<p>New features</p>
<ul>
<li>Add org.apache.commons.net.nntp.Article#getChild()</li>
<li>Add org.apache.commons.net.nntp.Article#getNext()</li>
<li>Add private SubnetAddressStringIterable and private
SubnetAddressStringIterator to implement
SubnetInfo.iterableAddressStrings() and
SubnetInfo.streamAddressStrings() #298</li>
<li>Add SubnetInfo.iterableAddressStrings()</li>
<li>Add SubnetInfo.streamAddressStrings()</li>
<li>Add FTPCmd.OPTS</li>
<li>Add FTP.opts(String, String)</li>
<li>Add FTP.opts(String...)</li>
<li>Add FTP.setControlEncoding(Charset)</li>
<li>Add --OPTS to FTPClientExample</li>
<li>NET-727: Add accessing options map for TFTP request packet and
allow using 'blksize' option #331</li>
<li>Add org.apache.commons.net.util.ListenerList.isEmpty()</li>
<li>Add org.apache.commons.net.ftp.FTPClient
.getSystemTypeOverride()</li>
<li>Add generics to ListenerList</li>
<li>Add module-info.class in the JAR file instead of an
Automatic-Module-Name in MANIFEST.MF</li>
<li>Fixed Bugs</li>
<li>Increase message limit in IMAPReply.TAGGED_RESPONSE from 80 to
500 characters</li>
<li>Increase message limit in IMAPReply.UNTAGGED_RESPONSE from 160
to 500 characters</li>
<li>Remove InvalidKeySpecException from AuthenticatingIMAPClient
.auth(AUTH_METHOD, String, String) never throws, it's not
thrown</li>
<li>Remove InvalidKeySpecException from AuthenticatingIMAPClient
.authenticate(AUTH_METHOD, String, String) never throws, it's
not thrown</li>
<li>Remove InvalidKeySpecException from ExtendedPOP3Client
.auth(AUTH_METHOD, String, String) never throws, it's not
thrown</li>
<li>Remove InvalidKeySpecException from
org.apache.commons.net.smtp.AuthenticatingSMTPClient
.auth(AUTH_METHOD, String, String) never throws, it's not
thrown</li>
<li>Fix SpotBugs RCN_REDUNDANT_NULLCHECK_OF_NONNULL_VALUE in
SSLSocketUtils</li>
<li>Fix PMD UnnecessaryFullyQualifiedName</li>
<li>Fix PMD UnusedFormalParameter</li>
<li>Fix PMD AvoidBranchingStatementAsLastInLoop in org.apache
.commons.net.bsd.RCommandClient</li>
<li>Fix PMD UselessOverridingMethod in org.apache.commons.net
.telnet.TelnetClient</li>
<li>Fix PMD UnnecessaryModifier</li>
<li>Deprecate MLSxEntryParser default constructor in favor of
MLSxEntryParser.getInstance()</li>
<li>Deprecate direct access to org.apache.commons.net.nntp.Article
.kid and next fields</li>
<li>Fix SpotBugs CT_CONSTRUCTOR_THROW in Base64 by implementing
finalize() as a noop to avoid finalizer attacks</li>
<li>Add missing Javadoc to ListenerList</li>
<li>Add missing Javadoc to SubnetUtils</li>
<li>Deprecate PrintCommandListeners.PrintCommandListeners()</li>
<li>Deprecate NtpUtils.NtpUtils()</li>
<li>Deprecate FTPFileFilters.FTPFileFilters()</li>
<li>Avoid multiple possible NullPointerException in SocketClient
.verifyRemote(Socket)</li>
<li>PrintCommandListener.protocolReplyReceived(ProtocolCommandEvent)
doesn't always use an end-of-line</li>
<li>FTPClientExample uses the wrong FTP system type to parse file
lines</li>
<li>Base64 does not call super.finalize()</li>
<li>TFTPServer does not call super.finalize()</li>
<li>KeyManagerUtils.loadStore(String, File, String) shouldn't
ignore an IOException closing a keystore stream; use
try-with-resources</li>
<li>NNTPClient.readNewsgroupListing() can use an ArrayList instead
of a Vector</li>
<li>Deprecate org.apache.commons.net.util.Charsets</li>
<li>Performance: NTFTPEntryParser.parseFTPEntry(String) doesn't
need to parse timestamps if there is no name</li>
<li>Improve error handling in org.apache.commons.net.ftp.parser
.DefaultFTPFileEntryParserFactory
.createFileEntryParser(String, FTPClientConfig)</li>
<li>Fail-fast in org.apache.commons.net.PrintCommandListener
.PrintCommandListener(PrintWriter, boolean, char, boolean) if
the PrintWriter is null</li>
<li>Avoid NullPointerException in org.apache.commons.net
.PrintCommandListener.protocolCommandSent(ProtocolCommandEvent)</li>
<li>Avoid NullPointerException in org.apache.commons.net
.PrintCommandListener.protocolReplyReceived(ProtocolCommandEvent)</li>
</ul>
</li>
<li>
<p>Upgrade to 3.11.1</p>
</li>
<li>
<p>Fixed Bugs</p>
<ul>
<li>Allow longer data in pattern IMAPReply.UNTAGGED_RESPONSE</li>
<li>Fix Reproducible Builds issues #259</li>
</ul>
</li>
<li>
<p>Upgrade to 3.11.0</p>
</li>
<li>New features<ul>
<li>NET-726: Add protected getters to FTPSClient #204</li>
<li>Add SubnetUtils.toString()</li>
<li>Add Maven property project.build.outputTimestamp for build
reproducibility</li>
<li>Add FTP.DEFLATE_TRANSFER_MODE to support the "deflate"
compression format in FTPClient.setFileTransferMode(int)</li>
<li>Add org.apache.commons.net.SocketClient.checkOpenOutputStream()</li>
</ul>
</li>
<li>
<p>Fixed Bugs</p>
<ul>
<li>Precompile regular expression in UnixFTPEntryParser
.preParse(List<String>)</li>
<li>Guard against polynomial regular expression used on
uncontrolled data in VMSVersioningFTPEntryParser.REGEX</li>
<li>Guard against polynomial regular expression used on
uncontrolled data in IMAPReply.TAGGED_RESPONSE</li>
<li>Guard against polynomial regular expression used on
uncontrolled data in IMAPReply.UNTAGGED_RESPONSE</li>
<li>NET-730: Cannot connect to FTP server with HTTP proxy</li>
<li>Base 64 Encoding with URL and Filename Safe Alphabet should
not chunk per RFC 4648</li>
<li>Deprecate org.apache.commons.net.util.Charsets.Charsets() for
removal</li>
<li>Deprecate org.apache.commons.net.util.TrustManagerUtils
.TrustManagerUtils() for removal</li>
</ul>
</li>
<li>
<p>Upgrade to 3.10.0</p>
</li>
<li>New features<ul>
<li>Add and use DatagramSocketClient.setDefaultTimeout(Duration)
and deprecate DatagramSocketClient.setDefaultTimeout(int)</li>
<li>Add and use TFTP.DEFAULT_TIMEOUT_DURATION and deprecate
org.apache.commons.net.tftp.TFTP.DEFAULT_TIMEOUT</li>
<li>Add and use DatagramSocketClient#getSoTimeoutDuration()</li>
<li>Add and use DatagramSocketClient#setSoTimeout(Duration)</li>
<li>Add and use DatagramSocketClient.checkOpen()</li>
<li>Add TelnetClient.sendAYT(Duration)</li>
<li>TFTPServer implements AutoCloseable</li>
<li>DatagramSocketClient implements AutoCloseable</li>
<li>Add IMAP package tests, include junit-jupiter-params artifact
#166</li>
<li>Add Base64 missing tests and documentation fixes #161</li>
<li>Add FTPFile tests and fix Javadoc typos #162</li>
<li>Add IMAPReply tests and documentation fixes #165</li>
</ul>
</li>
<li>Fixed Bugs<ul>
<li>NET-650: Delegate host resolution to Socket.connect() #138</li>
<li>Fixes many grammar issues and typos in JavaDoc and code
comments #141</li>
<li>Remove redundant (null) initializations and other clean ups
#155</li>
<li>TFTPServer.setMaxTimeoutRetries() now throws
IllegalArgumentException instead of RuntimeException</li>
<li>TFTPServer.setSocketTimeout() now throws
IllegalArgumentException instead of RuntimeException</li>
<li>FTPCommand.checkArray() now throws IllegalStateException
instead of RuntimeException</li>
<li>org.apache.commons.net.nntp.Threader now throws
IllegalStateException instead of RuntimeException</li>
<li>POP3Command static initializer now throws
IllegalStateException instead of RuntimeException</li>
<li>SMTPCommand static initializer now throws
IllegalStateException instead of RuntimeException</li>
<li>SubnetUtils.SubnetInfo.getPreviousAddress() now throws
IllegalStateException instead of RuntimeException</li>
<li>IMAPExportMbox.MboxListener.chunkReceived(IMAP) now throws
UncheckedIOException instead of RuntimeException</li>
<li>IMAPUtils.imapLogin(URI, int, ProtocolCommandListener) now
throws IOException instead of RuntimeException while
maintaining method signature source compatibility</li>
<li>[StepSecurity] ci: Harden GitHub Actions #156</li>
<li>NET-722: Javadoc for FtpClient
.setControlKeepAliveReplyTimeout(Duration) says timeout is in
milliseconds</li>
<li>Change class org.apache.commons.net.ftp.parser
.MVSFTPEntryParser to support more datasets #182</li>
<li>Bulletproof TFTPServerPathTest #173</li>
<li>Deprecate org.apache.commons.net.util.Base64 in favor of
java.util.Base64</li>
<li>Replace use of org.apache.commons.net.util.Base64 with
java.util.Base64 in org.apache.commons.net.ftp</li>
<li>Replace use of org.apache.commons.net.util.Base64 with
java.util.Base64 in org.apache.commons.net.imap</li>
<li>Replace use of org.apache.commons.net.util.Base64 with
java.util.Base64 in org.apache.commons.net.pop3</li>
<li>Replace use of org.apache.commons.net.util.Base64 with
java.util.Base64 in org.apache.commons.net.smtp</li>
</ul>
</li>
</ul>
<p>Changes in apache-commons-daemon:</p>
<ul>
<li>Upgrade to 1.6.1</li>
<li>Bug Fixes:<ul>
<li>Remove -nouses directive from maven-bundle-plugin. OSGi
package imports now state 'uses' definitions for package
imports, this doesn't affect JPMS
(from org.apache.commons:commons-parent:80)</li>
<li>Document --enable-preview</li>
<li>Fix first appearance of --enable-native-access</li>
<li>Procrun. Fix redirection issues on some OS versions by using
recommended method to redirect stdout and stderr.
Fixes DAEMON-398.</li>
<li>Procrun. Fix updating of startup mode to 'Automatic (delayed)'
being incorrectly processed as an update to 'Manual'.
Fixes DAEMON-439.</li>
<li>Procrun. Fix timeout handling #238. Fixes DAEMON-468.</li>
<li>Procrun. Replace RTF version of license header with plain text
version of full license in about box for monitor application.
Fixes DAEMON-472.</li>
<li>Procrun. Service should be marked as stopped if the service
worker crashes. Fixes DAEMON-475.</li>
<li>jsvc. Fix compilation warnings.</li>
<li>jsvc. Fix a regression in 1.5.1 that exposed long standing
bugs around the locking and unlocking of pid files. Also fix
the locking/unlocking bugs.</li>
<li>Detaches from console when the service stops #307. Fixes
DAEMON-477.</li>
<li>jsvc. Correct a packaging error in the 1.6.0 native source
tarball for *nix systems. Thanks to Michael Osipov.</li>
</ul>
</li>
<li>New Features:<ul>
<li>Add support for --enable-native-access Java startup option in
jsvc. Fixes DAEMON-471.</li>
<li>Add tests for prunsrv on Windows #260.</li>
<li>Add Java API compatibility report to the site (JApiCmp).</li>
<li>Procun. Build binaries for Windows using the static hybrid CRT
strategy by default.</li>
<li>jsvc. Use FreeBSD's setproctitle(3) to pass -procname similar
to daemon(8).</li>
<li>procrun. Add ARM64 support for Windows binaries. Fixes
DAEMON-462.</li>
</ul>
</li>
<li>Update dependencies:<ul>
<li>Bump org.apache.commons:commons-parent from 78 to 91 #253,
#255, #287.</li>
<li>Update to use new ASF logo</li>
<li>Bump org.apache.commons:commons-parent from 93 to 99.</li>
<li>jsvc. Consistently use strerror(3) for log output.</li>
</ul>
</li>
</ul>
<p>Changes in apache-commons-configuration2:</p>
<ul>
<li>Upgrade to version 2.15.1</li>
<li>Fixed Bugs<ul>
<li>CONFIGURATION-856: The artifact commons-io:commons-io is a
normal dependency</li>
<li>Avoid NPE when combined location strategy sub strategies is
immutable list (#639)</li>
</ul>
</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Linux Enterprise Server 16.0
<br/>
<code>zypper in -t patch SUSE-SLES-16.0-1146=1</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Server for SAP applications 16.0
<br/>
<code>zypper in -t patch SUSE-SLES-16.0-1146=1</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Linux Enterprise Server 16.0 (aarch64 ppc64le s390x x86_64)
<ul>
<li>apache-commons-daemon-jsvc-1.6.1-160000.1.2</li>
<li>apache-commons-daemon-1.6.1-160000.1.2</li>
<li>apache-commons-daemon-jsvc-debuginfo-1.6.1-160000.1.2</li>
<li>apache-commons-daemon-debugsource-1.6.1-160000.1.2</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server 16.0 (noarch)
<ul>
<li>apache-commons-pool2-2.13.1-160000.1.2</li>
<li>apache-commons-daemon-javadoc-1.6.1-160000.1.2</li>
<li>apache-commons-net-javadoc-3.13.0-160000.1.2</li>
<li>apache-commons-configuration2-javadoc-2.15.1-160000.1.2</li>
<li>apache-commons-pool2-javadoc-2.13.1-160000.1.2</li>
<li>apache-commons-net-3.13.0-160000.1.2</li>
<li>apache-commons-configuration2-2.15.1-160000.1.2</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server for SAP applications 16.0 (noarch)
<ul>
<li>apache-commons-pool2-2.13.1-160000.1.2</li>
<li>apache-commons-daemon-javadoc-1.6.1-160000.1.2</li>
<li>apache-commons-net-javadoc-3.13.0-160000.1.2</li>
<li>apache-commons-configuration2-javadoc-2.15.1-160000.1.2</li>
<li>apache-commons-pool2-javadoc-2.13.1-160000.1.2</li>
<li>apache-commons-net-3.13.0-160000.1.2</li>
<li>apache-commons-configuration2-2.15.1-160000.1.2</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server for SAP applications 16.0 (ppc64le x86_64)
<ul>
<li>apache-commons-daemon-jsvc-1.6.1-160000.1.2</li>
<li>apache-commons-daemon-1.6.1-160000.1.2</li>
<li>apache-commons-daemon-jsvc-debuginfo-1.6.1-160000.1.2</li>
<li>apache-commons-daemon-debugsource-1.6.1-160000.1.2</li>
</ul>
</li>
</ul>
</div>