diff --git a/.gitignore b/.gitignore index 901853b..6f8781a 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ -SOURCES/openjdk-21.0.6+7.tar.xz +SOURCES/openjdk-21.0.10+7.tar.xz SOURCES/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz diff --git a/.java-21-openjdk.metadata b/.java-21-openjdk.metadata index f2574ad..2c140bb 100644 --- a/.java-21-openjdk.metadata +++ b/.java-21-openjdk.metadata @@ -1,2 +1,2 @@ -fad71f19631dab375285056d10d08374e869bb35 SOURCES/openjdk-21.0.6+7.tar.xz +1e24e8b2c4802b336ecf71428de9e38abecc0d05 SOURCES/openjdk-21.0.10+7.tar.xz c8281ee37b77d535c9c1af86609a531958ff7b34 SOURCES/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz diff --git a/SOURCES/NEWS b/SOURCES/NEWS index 8fdac2e..1bf13ce 100644 --- a/SOURCES/NEWS +++ b/SOURCES/NEWS @@ -3,6 +3,1785 @@ Key: JDK-X - https://bugs.openjdk.java.net/browse/JDK-X CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY +New in release OpenJDK 21.0.10 (2026-01-20): +=========================================== +Live versions of these release notes can be found at: + * https://bit.ly/openjdk2110 + +* CVEs + - CVE-2026-21925 + - CVE-2026-21932 + - CVE-2026-21933 + - CVE-2026-21945 +* Changes + - JDK-7191877: TEST_BUG: java/rmi/transport/checkLeaseInfoLeak/CheckLeaseLeak.java failing intermittently + - JDK-8072701: resume001 failed due to ERROR: timeout for waiting for a BreakpintEvent + - JDK-8139228: JFileChooser renders file names as HTML document + - JDK-8139392: JInternalFrame has incorrect padding + - JDK-8140527: JInternalFrame has incorrect title button width + - JDK-8162380: [TEST_BUG] MouseEvent/.../AltGraphModifierTest.java has only "Fail" button + - JDK-8199149: Improve the exception message thrown by VarHandle of unsupported operation + - JDK-8201183: sjavac build failures: "Connection attempt failed: Connection refused" + - JDK-8201778: Speed up test javax/net/ssl/DTLS/PacketLossRetransmission.java + - JDK-8204868: java/util/zip/ZipFile/TestCleaner.java still fails with "cleaner failed to clean zipfile." + - JDK-8210807: Printing a JTable with a JScrollPane prints table without rows populated + - JDK-8216437: PPC64: Add intrinsic for GHASH algorithm + - JDK-8219408: Tests should handle ${} in the view of jtreg "smart action" + - JDK-8230016: re-visit test sun/security/pkcs11/Serialize/SerializeProvider.java + - JDK-8245545: Disable TLS_RSA cipher suites + - JDK-8265429: Improve GCM encryption + - JDK-8277424: javax/net/ssl/TLSCommon/TLSTest.java fails with connection refused + - JDK-8280482: Window transparency bug on Linux + - JDK-8290043: serviceability/attach/ConcAttachTest.java failed "guarantee(!CheckJNICalls) failed: Attached JNI thread exited without being detached" + - JDK-8297531: sun/security/krb5/MicroTime.java fails with "Exception: What? only 100 musec precision?" + - JDK-8300708: Some nsk jvmti tests fail with virtual thread wrapper due to jvmti missing some virtual thread support + - JDK-8304065: HttpServer.stop should terminate immediately if no exchanges are in progress + - JDK-8304811: vmTestbase/vm/mlvm/indy/func/jvmti/stepBreakPopReturn/INDIFY_Test.java fails with JVMTI_ERROR_TYPE_MISMATCH + - JDK-8305186: Reference.waitForReferenceProcessing should be more accessible to tests + - JDK-8305567: serviceability/tmtools/jstat/GcTest01.java failed utils.JstatGcResults.assertConsistency + - JDK-8306579: Consider building with /Zc:throwingNew + - JDK-8307160: Fix AWT/2D/A11Y to support the permissive- flag on the Microsoft Visual C compiler + - JDK-8308780: Fix the Java Integer types on Windows + - JDK-8309511: Regression test ExtraImportSemicolon.java refers to the wrong bug + - JDK-8310049: Refactor Charset tests to use JUnit + - JDK-8310915: Typo in aarch64.ad: "envcodings" + - JDK-8311076: RedefineClasses doesn't check for ConstantPool overflow + - JDK-8311906: Improve robustness of String constructors with mutable array inputs + - JDK-8313231: Redundant if statement in ZoneInfoFile + - JDK-8313770: jdk/internal/platform/docker/TestSystemMetrics.java fails on Ubuntu + - JDK-8315130: java.lang.IllegalAccessError when processing classlist to create CDS archive + - JDK-8315990: Amend problemlisted tests to proper position + - JDK-8316422: TestIntegerUnsignedDivMod.java triggers "invalid layout" assert in FrameValues::validate + - JDK-8317132: Prepare HotSpot for permissive- + - JDK-8317332: Prepare security for permissive- + - JDK-8317970: Bump target macosx-x64 version to 11.00.00 + - JDK-8318467: [jmh] tests concurrent.Queues and concurrent.ProducerConsumer hang with 101+ threads + - JDK-8318730: MonitorVmStartTerminate.java still times out after JDK-8209595 + - JDK-8318850: Duplicate code in the LCMSImageLayout + - JDK-8319570: Change to GCC 13.2.0 for building on Linux at Oracle + - JDK-8320049: PKCS10 would not discard the cause when throw SignatureException on invalid key + - JDK-8320577: Improve MessageHeader's toString() function to make HttpURLConnection's debug log readable + - JDK-8320836: jtreg gtest runs should limit heap size + - JDK-8321180: Condition for non-latin1 string size too large exception is off by one + - JDK-8321183: Incorrect warning from cds about the modules file + - JDK-8321514: UTF16 string gets constructed incorrectly from codepoints if CompactStrings is not enabled + - JDK-8322018: Test java/lang/String/CompactString/MaxSizeUTF16String.java fails with -Xcomp + - JDK-8322135: Printing JTable in Windows L&F throws InternalError: HTHEME is null + - JDK-8322140: javax/swing/JTable/JTableScrollPrintTest.java does not print the rows and columns of the table in Nimbus and Aqua LookAndFeel + - JDK-8323803: ConstantOopReadValue::print_on should print 'null' instead of 'nullptr' + - JDK-8324065: Daylight saving information for `Africa/Casablanca` are incorrect + - JDK-8324491: Keyboard layout didn't keep its state if it was changed when dialog was active + - JDK-8325277: [21u] Backout test change of JDK-8291809 + - JDK-8325530: Vague error message when com.sun.tools.attach.VirtualMachine fails to load agent library + - JDK-8325590: Regression in round-tripping UTF-16 strings after JDK-8311906 + - JDK-8325647: [IR framework] Only prints stdout if exitCode is 134 + - JDK-8325731: Installation instructions for Debian/Ubuntu don't mention autoconf + - JDK-8325766: Extend CertificateBuilder to create trust and end entity certificates programmatically + - JDK-8327434: Test java/util/PluggableLocale/TimeZoneNameProviderTest.java timed out + - JDK-8327704: Update nsk/jdi tests to use driver instead of othervm + - JDK-8327757: Convert javax/swing/JSlider/6524424/bug6524424.java applet to main + - JDK-8327856: Convert applet test SpanishDiacriticsTest.java to a main program + - JDK-8327980: Convert javax/swing/JToggleButton/4128979/bug4128979.java applet test to main + - JDK-8328124: Convert java/awt/Frame/ShownOnPack/ShownOnPack.html applet test to main + - JDK-8328247: Remove redundant dir for tests converted from applet to main + - JDK-8328299: Convert DnDFileGroupDescriptor.html applet test to main + - JDK-8328377: Convert java/awt/Cursor/MultiResolutionCursorTest test to main + - JDK-8328562: Convert java/awt/InputMethods/DiacriticsTest/DiacriticsTest.java applet test to main + - JDK-8331231: containers/docker/TestContainerInfo.java fails + - JDK-8333200: Test containers/docker/TestPids.java fails Limit value -1 is not accepted as unlimited + - JDK-8333526: Restructure java/nio/channels/DatagramChannel/StressNativeSignal.java to a fail fast exception handling policy + - JDK-8333569: jpackage tests must run app launchers with retries on Linux only + - JDK-8333783: java/nio/channels/FileChannel/directio/DirectIOTest.java is unstable with AV software + - JDK-8334217: [AIX] Misleading error messages after JDK-8320005 + - JDK-8334509: Cancelling PageDialog does not return the same PageFormat object + - JDK-8334756: javac crashed on call to non-existent generic method with explicit annotated type arg + - JDK-8334771: [TESTBUG] Run TestDockerMemoryMetrics.java with -Xcomp fails exitValue = 137 + - JDK-8335986: Test javax/swing/JCheckBox/4449413/bug4449413.java fails on Windows 11 x64 because RBMenuItem's and CBMenuItem's checkmark on the left side are not visible + - JDK-8337723: Remove redundant tests from com/sun/security/sasl/gsskerb + - JDK-8338428: Add logging of final VM flags while setting properties + - JDK-8338740: java/net/httpclient/HttpsTunnelAuthTest.java fails with java.io.IOException: HTTP/1.1 header parser received no bytes + - JDK-8339280: jarsigner -verify performs cross-checking between CEN and LOC + - JDK-8339366: [jittester] Make it possible to generate tests without execution + - JDK-8340015: Open source several AWT focus tests - series 7 + - JDK-8340321: Disable SHA-1 in TLS/DTLS 1.2 handshake signatures + - JDK-8340354: Open source AWT desktop properties and print related tests + - JDK-8341097: GHA: Demote Mac x86 jobs to build only + - JDK-8341131: Some jdk/jfr/event/compiler tests shouldn't be executed with Xcomp + - JDK-8341138: Rename jtreg property docker.support as container.support + - JDK-8341443: [macos] AppContentTest and SigningOptionsTest failed due to "codesign" does not fails with "--app-content" on macOS 15 + - JDK-8341496: Improve JMX connections + - JDK-8342576: [macos] AppContentTest still fails after JDK-8341443 for same reason on older macOS versions + - JDK-8342582: user.region for formatting number no longer works for 21.0.5 + - JDK-8342934: TYPE_USE annotations printed with error causing "," in toString output + - JDK-8343191: Cgroup v1 subsystem fails to set subsystem path + - JDK-8343340: Swapping checking do not work for MetricsMemoryTester failcount + - JDK-8343875: Minor improvements of jpackage test library + - JDK-8343876: Enhancements to jpackage test lib + - JDK-8344143: Test jdk/java/lang/Thread/virtual/stress/GetStackTraceALotWhenPinned.java timed out on macosx-x64 + - JDK-8344577: Virtual thread tests are timing out on some macOS systems + - JDK-8345213: JVM Prefers /etc/timezone Over /etc/localtime on Debian 12 + - JDK-8346142: [perf] scalability issue for the specjvm2008::xml.validation workload + - JDK-8346234: javax/swing/text/DefaultEditorKit/4278839/bug4278839.java still fails in CI + - JDK-8346753: Test javax/swing/JMenuItem/RightLeftOrientation/RightLeftOrientation.java fails on Windows Server 2025 x64 because the icons of RBMenuItem and CBMenuItem are not visible in Nimbus LookAndFeel + - JDK-8346839: [TESTBUG] "java/awt/textfield/setechochartest4/setechochartest4.java" failed because the test frame disappears on clicking "Click Several Times" button + - JDK-8346875: Test jdk/jdk/jfr/event/os/TestCPULoad.java fails on macOS + - JDK-8347143: [aix] Fix strdup use in os::dll_load + - JDK-8347277: java/awt/Focus/ComponentLostFocusTest.java fails intermittently + - JDK-8347300: Don't exclude the "PATH" var from the environment when running app launchers in jpackage tests + - JDK-8347377: Add validation checks for ICC_Profile header fields + - JDK-8347434: Richer VM operations events logging + - JDK-8347811: Container detection code for cgroups v2 should use cgroup.controllers + - JDK-8347841: Test fixes that use deprecated time zone IDs + - JDK-8348240: Remove SystemDictionaryShared::lookup_super_for_unregistered_class() + - JDK-8348402: PerfDataManager stalls shutdown for 1ms + - JDK-8349188: LineBorder does not scale correctly + - JDK-8349534: Refactor jdk/sun/security/krb5/runNameEquals.sh to java test + - JDK-8349705: java.net.URI.scanIPv4Address throws unnecessary URISyntaxException + - JDK-8349988: Change cgroup version detection logic to not depend on /proc/cgroups + - JDK-8350102: Decouple jpackage test-lib Executor.Result and Executor classes + - JDK-8350623: Fix -Wzero-as-null-pointer-constant warnings in nsk native test utilities + - JDK-8350813: Rendering of bulky sound bank from MIDI sequence can cause OutOfMemoryError + - JDK-8351110: ImageIO.write for JPEG can write corrupt JPEG for certain thumbnail dimensions + - JDK-8351359: OperatingSystemMXBean: values from getCpuLoad and getProcessCpuLoad are stale after 24.8 days (Windows) + - JDK-8351382: New test containers/docker/TestMemoryWithSubgroups.java is failing + - JDK-8351567: Jar Manifest test ValueUtf8Coding produces misleading diagnostic output + - JDK-8352016: Improve java/lang/RuntimeTests/RuntimeExitLogTest.java + - JDK-8352533: Report useful IOExceptions when jspawnhelper fails + - JDK-8352678: Opensource few JMenuItem tests + - JDK-8352682: Opensource JComponent tests + - JDK-8352686: Opensource JInternalFrame tests - series3 + - JDK-8352687: Opensource few JInternalFrame and JTextField tests + - JDK-8352793: Open source several AWT TextComponent tests - Batch 1 + - JDK-8352865: Open source several AWT TextComponent tests - Batch 2 + - JDK-8352905: Open some JComboBox bugs 1 + - JDK-8352926: New test TestDockerMemoryMetricsSubgroup.java fails + - JDK-8352966: Opensource Several Font related tests - Batch 2 + - JDK-8352997: Open source several Swing JTabbedPane tests + - JDK-8353007: Open some JComboBox bugs 2 + - JDK-8353011: Open source Swing JButton tests - Set 1 + - JDK-8353013: java.net.URI.create(String) may have low performance to scan the host/domain name from URI string when the hostname starts with number + - JDK-8353175: Eliminate double iteration of stream in FieldDescriptor reinitialization + - JDK-8353201: Open source Swing Tooltip tests - Set 2 + - JDK-8353299: VerifyJarEntryName.java test fails + - JDK-8353309: Open source several Swing text tests + - JDK-8353319: Open source Swing tests - Set 3 + - JDK-8353445: Open source several AWT Menu tests - Batch 1 + - JDK-8353470: Clean up and open source couple AWT Graphics related tests (Part 2) + - JDK-8353483: Open source some JProgressBar tests + - JDK-8353486: Open source Swing Tests - Set 4 + - JDK-8353585: Provide ChoiceFormat#parse(String, ParsePosition) tests + - JDK-8353586: Open source several toolkit tests + - JDK-8353589: Open source a few Swing menu-related tests + - JDK-8353592: Open source several scrollbar tests + - JDK-8353661: Open source several swing tests batch5 + - JDK-8353832: Opensource FontClass, Selection and Icon tests + - JDK-8353953: com/sun/jdi tests should be fixed to not always require includevirtualthreads=y + - JDK-8353957: Open source several AWT ScrollPane tests - Batch 1 + - JDK-8353958: Open source several AWT ScrollPane tests - Batch 2 + - JDK-8354095: Open some JTable bugs 5 + - JDK-8354106: Clean up and open source KeyEvent related tests (Part 2) + - JDK-8354214: Open source Swing tests Batch 2 + - JDK-8354233: Open some JTable bugs 6 + - JDK-8354235: Test javax/net/ssl/SSLSocket/Tls13PacketSize.java failed with java.net.SocketException: An established connection was aborted by the software in your host machine + - JDK-8354248: Open source several AWT GridBagLayout and List tests + - JDK-8354340: Open source Swing Tests - Set 6 + - JDK-8354341: Open some JTable bugs 7 + - JDK-8354365: Opensource few Modal and Full Screen related tests + - JDK-8354418: Open source Swing tests Batch 4 + - JDK-8354451: Open source some more Swing popup menu tests + - JDK-8354465: Open some JTable bugs 8 + - JDK-8354466: Open some misc Swing bugs 9 + - JDK-8354472: Clean up and open source KeyEvent related tests (Part 3) + - JDK-8354475: TestDockerMemoryMetricsSubgroup.java fails with exitValue = 1 + - JDK-8354493: Opensource Several MultiScreen and Insets related tests + - JDK-8354495: Open source several AWT DataTransfer tests + - JDK-8354532: Open source JFileChooser Tests - Set 7 + - JDK-8354552: Open source a few Swing tests + - JDK-8354553: Open source several clipboard tests batch0 + - JDK-8354561: Open source several swing tests batch0 + - JDK-8354646: java.awt.TextField allows to identify the spaces in a password when double clicked at the starting and end of the text + - JDK-8354653: Clean up and open source KeyEvent related tests (Part 4) + - JDK-8354701: Open source few JToolTip tests + - JDK-8354873: javax/swing/plaf/metal/MetalIconFactory/bug4952462.java failing on CI + - JDK-8354928: Clean up and open source some miscellaneous AWT tests + - JDK-8355071: Fix nsk/jdi test to not require lookup of main thread in order to set the breakpoint used for communication + - JDK-8355077: Compiler error at splashscreen_gif.c due to unterminated string initialization + - JDK-8355241: Move NativeDialogToFrontBackTest.java PL test to manual category + - JDK-8355333: Some Problem list entries point to non-existent / wrong files + - JDK-8355387: [jittester] Disable downcasts by default + - JDK-8355444: [java.io] Use @requires tag instead of exiting based on "os.name" property value + - JDK-8355478: DoubleActionESC.java fails intermittently + - JDK-8355558: SJIS.java test is always ignored + - JDK-8355561: [macos] Build failure with Xcode 16.3 + - JDK-8355569: Some nsk/jdi tests can glean the "main" thread by using the ClassPrepareEvent for the debuggee main class + - JDK-8355773: Some nsk/jdi tests can fetch ThreadReference from static field in the debuggee + - JDK-8356023: Some nsk/jdi tests can fetch ThreadReference from static field in the debuggee: part 2 + - JDK-8356040: java/util/PluggableLocale/LocaleNameProviderTest.java timed out + - JDK-8356145: ListEnterExitTest.java fails on macos + - JDK-8356187: TestJcmd.java may incorrectly parse podman version + - JDK-8356588: Some nsk/jdi tests can fetch ThreadReference from static field in the debuggee: part 3 + - JDK-8356752: Log mouse enter and exit events for debugging + - JDK-8356811: Some nsk/jdi tests can fetch ThreadReference from static field in the debuggee: part 4 + - JDK-8356897: Update NSS library to 3.111 + - JDK-8357172: Extend try block in nsk/jdi tests to capture exceptions thrown by Debuggee.classByName() + - JDK-8357305: Compilation failure in javax/swing/JMenuItem/bug6197830.java + - JDK-8357561: BootstrapLoggerTest does not work on Ubuntu 24 with LANG de_DE.UTF-8 + - JDK-8357799: Improve instructions for JFileChooser/HTMLFileName.java + - JDK-8357822: C2: Multiple string optimization tests are no longer testing string concatenation optimizations + - JDK-8357882: Use UTF-8 encoded data in LocaleDataTest + - JDK-8358048: java/net/httpclient/HttpsTunnelAuthTest.java incorrectly calls Thread::stop + - JDK-8358532: JFileChooser in GTK L&F still displays HTML filename + - JDK-8358577: Test serviceability/jvmti/thread/GetCurrentContendedMonitor/contmon01/contmon01.java failed: unexpexcted monitor object + - JDK-8358679: [asan] vmTestbase/nsk/jvmti tests show memory issues + - JDK-8358748: Large page size initialization fails with assert "page_size must be a power of 2" + - JDK-8358764: (sc) SocketChannel.close when thread blocked in read causes connection to be reset (win) + - JDK-8358813: JPasswordField identifies spaces in password via delete shortcuts + - JDK-8359061: Update and ProblemList manual test java/awt/Cursor/CursorDragTest/ListDragCursor.java + - JDK-8359167: Remove unused test/hotspot/jtreg/vmTestbase/nsk/share/jpda/BindServer.java + - JDK-8359182: Use @requires instead of SkippedException for MaxPath.java + - JDK-8359207: Remove runtime/signal/TestSigusr2.java since it is always skipped + - JDK-8359418: Test "javax/swing/text/GlyphView/bug4188841.java" failed because the phrase of text pane does not match the instructions + - JDK-8359428: Test 'javax/swing/JTabbedPane/bug4499556.java' failed because after selecting one of L&F items, the test case automatically failed when clicking on L&F Menu button again + - JDK-8359449: [TEST] open/test/jdk/java/io/File/SymLinks.java Refactor extract method for Windows specific test + - JDK-8359477: com/sun/net/httpserver/Test12.java appears to have a temp file race + - JDK-8359501: Enhance Handling of URIs + - JDK-8359687: Use PassFailJFrame for java/awt/print/Dialog/DialogType.java + - JDK-8360022: ClassRefDupInConstantPoolTest.java fails when running in repeat + - JDK-8360178: TestArguments.atojulong gtest has incorrect format string + - JDK-8360288: Shenandoah crash at size_given_klass in op_degenerated + - JDK-8360408: [TEST] Use @requires tag instead of exiting based on "os.name" property value for sun/net/www/protocol/file/FileURLTest.java + - JDK-8360411: [TEST] open/test/jdk/java/io/File/MaxPathLength.java Refactor extract method to encapsulate Windows specific test logic + - JDK-8360478: libjsig related tier3 jtreg tests fail when asan is configured + - JDK-8360533: ContainerRuntimeVersionTestUtils fromVersionString fails with some docker versions + - JDK-8360981: Remove use of Thread.stop in test/jdk/java/net/Socket/DeadlockTest.java + - JDK-8361253: CommandLineOptionTest library should report observed values on failure + - JDK-8361298: SwingUtilities/bug4967768.java fails where character P is not underline + - JDK-8361314: Test serviceability/jvmti/VMEvent/MyPackage/VMEventRecursionTest.java FATAL ERROR in native method: Failed during the GetClassSignature call + - JDK-8361423: Add IPSupport::printPlatformSupport to java/net/NetworkInterface/IPv4Only.java + - JDK-8361447: [REDO] Checked version of JNI ReleaseArrayElements needs to filter out known wrapped arrays + - JDK-8361599: [PPC64] enable missing tests via jtreg requires + - JDK-8361751: Test sun/tools/jcmd/TestJcmdSanity.java timed out on Windows + - JDK-8361754: New test runtime/jni/checked/TestCharArrayReleasing.java can cause disk full errors + - JDK-8361868: [GCC static analyzer] complains about missing calloc - NULL checks in p11_util.c + - JDK-8361871: [GCC static analyzer] complains about use of uninitialized value ckpObject in p11_util.c + - JDK-8362123: ClassLoader Leak via Executors.newSingleThreadExecutor(...) + - JDK-8362204: test/jdk/sun/awt/font/TestDevTransform.java fails on Ubuntu 24.04 + - JDK-8362207: Add more test cases for possible double-rounding in fma + - JDK-8362308: Enhance Bitmap operations + - JDK-8362516: Support of GCC static analyzer (-fanalyzer) + - JDK-8362532: Test gc/g1/plab/* duplicate command-line options + - JDK-8362533: Tests sun/management/jmxremote/bootstrap/* duplicate VM flags + - JDK-8362602: Add test.timeout.factor to CompileFactory to avoid test timeouts + - JDK-8362632: Improve HttpServer Request handling + - JDK-8363676: [GCC static analyzer] missing return value check of malloc in OGLContext_SetTransform + - JDK-8363720: Follow up to JDK-8360411 with post review comments + - JDK-8363966: GHA: Switch cross-compiling sysroots to Debian trixie + - JDK-8364198: NMT should have a better corruption message + - JDK-8364199: Enhance list of environment variables printed in hserr/hsinfo file + - JDK-8364214: Enhance polygon data support + - JDK-8364235: Fix for JDK-8361447 breaks the alignment requirements for GuardedMemory + - JDK-8364257: JFR: User-defined events and settings with a one-letter name cannot be configured + - JDK-8364258: ThreadGroup constant pool serialization is not normalized + - JDK-8364263: HttpClient: Improve encapsulation of ProxyServer + - JDK-8364484: misc tests fail with Received fatal alert: handshake_failure + - JDK-8364514: [asan] runtime/jni/checked/TestCharArrayReleasing.java heap-buffer-overflow + - JDK-8364556: JFR: Disable SymbolTableStatistics and StringTableStatistics in default.jfc + - JDK-8364597: Replace THL A29 Limited with Tencent + - JDK-8364660: ClassVerifier::ends_in_athrow() should be removed + - JDK-8364786: Test java/net/vthread/HttpALot.java intermittently fails - 24999 handled, expected 25000 + - JDK-8364993: JFR: Disable jdk.ModuleExport in default.jfc + - JDK-8364996: java/awt/font/FontNames/LocaleFamilyNames.java times out on Windows + - JDK-8365058: Enhance CopyOnWriteArraySet + - JDK-8365086: CookieStore.getURIs() and get(URI) should return an immutable List + - JDK-8365098: make/RunTests.gmk generates a wrong path to test artifacts on Alpine + - JDK-8365168: Use 64-bit aligned addresses for CK_ULONG access in PKCS11 native key code + - JDK-8365240: [asan] exclude some tests when using asan enabled binaries + - JDK-8365271: Improve Swing supports + - JDK-8365280: Enhance JOptionPane + - JDK-8365425: [macos26] javax/swing/JInternalFrame/8160248/JInternalFrameDraggingTest.java fails on macOS 26 + - JDK-8365442: [asan] runtime/ErrorHandling/CreateCoredumpOnCrash.java fails + - JDK-8365487: [asan] some oops (mode) related tests fail + - JDK-8365615: Improve JMenuBar/RightLeftOrientation.java + - JDK-8365660: test/jdk/sun/security/pkcs11/KeyAgreement/ tests skipped without SkipExceprion + - JDK-8365790: Shutdown hook for application image does not work on Windows + - JDK-8365834: Mark java/net/httpclient/ManyRequests.java as intermittent + - JDK-8365913: Support latest MSC_VER in abstract_vm_version.cpp + - JDK-8365919: Replace currentTimeMillis with nanoTime in Stresser.java + - JDK-8365983: Tests should throw SkippedException when SCTP not supported + - JDK-8366092: [GCC static analyzer] UnixOperatingSystem.c warning: use of uninitialized value 'systemTicks' + - JDK-8366159: SkippedException is treated as a pass for pkcs11/KeyStore, pkcs11/SecretKeyFactory and pkcs11/SecureRandom + - JDK-8366208: Unexpected exception in sun.java2d.cmm.lcms.LCMSImageLayout + - JDK-8366229: runtime/Thread/TooSmallStackSize.java runs with all collectors + - JDK-8366231: Bump update version for OpenJDK: jdk-21.0.10 + - JDK-8366342: Key generator and key pair generator tests skipping, but showing as passed + - JDK-8366359: Test should throw SkippedException when there is no lpstat + - JDK-8366558: Gtests leave /tmp/cgroups-test* files + - JDK-8366750: Remove test 'java/awt/Choice/ChoiceMouseWheelTest/ChoiceMouseWheelTest.java' from problemlist + - JDK-8366764: Deproblemlist java/awt/ScrollPane/ScrollPositionTest.java + - JDK-8366844: Update and automate MouseDraggedOriginatedByScrollBarTest.java + - JDK-8366893: java/lang/Thread/virtual/stress/GetStackTraceALotWhenPinned.java timed out on macos-aarch64 + - JDK-8367017: Remove legacy checks from WrappedToolkitTest and convert from bash + - JDK-8367021: Regression in LocaleDataTest refactoring + - JDK-8367131: Test com/sun/jdi/ThreadMemoryLeakTest.java fails on 32 bits + - JDK-8367133: DTLS: fragmentation of Finished message results in handshake failure + - JDK-8367237: Thread-Safety Usage Warning for java.text.Collator Classes + - JDK-8367348: Enhance PassFailJFrame to support links in HTML + - JDK-8367372: Test `test/hotspot/jtreg/gc/TestObjectAlignmentCardSize.java` fails on 32 bit systems + - JDK-8367384: The ICC_Profile class may throw exceptions during serialization + - JDK-8367782: VerifyJarEntryName.java: Fix modifyJarEntryName to operate on bytes and re-introduce verifySignatureEntryName + - JDK-8367869: Test java/io/FileDescriptor/Sync.java timed out + - JDK-8367904: Test java/net/InetAddress/ptr/Lookup.java should throw SkippedException + - JDK-8368032: Enhance Certificate Checking + - JDK-8368192: Test java/lang/ProcessBuilder/Basic.java#id0 fails with Exception: Stack trace + - JDK-8368668: Several vmTestbase/vm/gc/compact tests timed out on large memory machine + - JDK-8368960: Adjust java UL logging in the build + - JDK-8368982: Test sun/security/tools/jarsigner/EC.java completed and timed out + - JDK-8369032: Add test to ensure serialized ICC_Profile stores only necessary optional data + - JDK-8369078: Fix faulty test conversion in IllegalCharsetName.java + - JDK-8369184: SimpleTimeZone equals() Returns True for Unequal Instances with Different hashCode Values + - JDK-8369226: GHA: Switch to MacOS 15 + - JDK-8369319: java/net/httpclient/CancelRequestTest.java fails intermittently + - JDK-8369450: [Ubuntu 25.10] openjdk fails to build due to rust-coreutils date + - JDK-8369506: Bytecode rewriting causes Java heap corruption on AArch64 + - JDK-8369563: Gtest dll_address_to_function_and_library_name has issues with stripped pdb files + - JDK-8369616: JavaFrameAnchor on RISC-V has unnecessary barriers and wrong store order in MacroAssembler + - JDK-8369946: Bytecode rewriting causes Java heap corruption on PPC + - JDK-8369947: Bytecode rewriting causes Java heap corruption on RISC-V + - JDK-8370214: [21u] Remove -Xdebug and -Xnoagent from tests: backport parts of 8227229 and 8312072 + - JDK-8370465: Right to Left Orientation Issues with MenuItem Component + - JDK-8372534: Update Libpng to 1.6.51 + - JDK-8375447: Remove designator DEFAULT_PROMOTED_VERSION_PRE=ea for release 21.0.10 + +Notes on individual issues: +=========================== + +core-libs/java.util:i18n: + +JDK-8345213: JVM Prefers /etc/timezone Over /etc/localtime on Debian 12 +======================================================================= +On older Debian-based GNU/Linux systems, the /etc/timezone file +contained the name of the timezone in use on the system and so was +preferred by OpenJDK for determining the default timezone returned by +`TimeZone.getDefault()`. Since Debian 3.1 in 2005, the /etc/localtime +file has also been provided as either a link to or a copy of the zone +data file provided by the tzdata database and this is now the +preferred source of the system timezone following Debian's adoption of +systemd. OpenJDK's continued preference for /etc/timezone meant that +it may be reading a timezone setting which was no longer updated on +modern Debian systems. With this OpenJDK update, OpenJDK only reads +/etc/localtime as on other GNU/Linux systems. + +See https://wiki.debian.org/TimeZoneChanges#Check_Configured_Timezone +for more details. + +core-libs/java.lang: + +JDK-8311906: Improve robustness of String constructors with mutable array inputs +================================================================================ +The introduction of Compact Strings (JEP 254, OpenJDK 9) changed the +implementation of the String class to use a byte array to store +character data in either ISO-8859-1/Latin-1 (one byte per character) +or UTF-16 (two bytes per character). This optimisation reduced the +memory usage over a character array when String objects with only +Latin-1 characters were used. However, this also introduced a +potential race condition if the input character array was modified +externally while being converted to bytes. With this release of +OpenJDK, the conversion now includes an additional verification step +which checks that the first character that is not Latin-1 is still not +Latin-1 in the original array after all characters have been copied. +If it has changed to Latin-1, a second attempt is made to compress the +character data to Latin-1. A note is also added to the documentation +of the relevant methods in AbstractStringBuilder, Appendable and +String to indicate that the contents of the final String are +unspecified if the character array is modified during construction. + +See https://openjdk.org/jeps/254 for more details on Compact Strings. + +core-svc/javax.management: + +JDK-8341496: Improve JMX connections +==================================== +With this release of OpenJDK, SSL connections created by +javax.rmi.ssl.SslRMIClientSocketFactory now enable HTTPS-based +endpoint identification by default. This can be disabled by setting +the new system property +jdk.rmi.ssl.client.enableEndpointIdentification to false. + +security-libs/java.security: + +JDK-8368032: Enhance Certificate Checking +========================================= +OpenJDK supports the authorityInfoAccess extension in X.509 +certificates when the `com.sun.security.enableAIAcaIssuers` system +property is set to `true`. With this release of OpenJDK, a security +and system property `com.sun.security.allowedAIALocations` is +introduced which acts as a filter on the URIs specified in the +extension. By default, the property is empty, which will cause all +URIs to be denied when the extension is enabled. A value of `any` may +be used to allow all URIs or a whitespace-separated list of filters +may be used for more fine-grained control. The syntax of the filters +is specified in the `java.security` file. A non-empty value for the +system property takes precedence over the security property. + +security-libs/javax.net.ssl: + +JDK-8245545: Disable TLS_RSA cipher suites +========================================== +The TLS_RSA cipher suites do not preserve forward secrecy and are +rarely used in practice. With this release, they are disabled by +adding "TLS_RSA_*" to the `jdk.tls.disabledAlgorithms` security +property in the `java.security` configuration file. Attempts to use +these suites with this release will result in a +`SSLHandshakeException` being thrown. Note that RSA cipher suites +which use DES, 3DES, RC4 or NULL were already disabled prior to this +change. + +Users can, *at their own risk*, remove this restriction by modifying +the `java.security` configuration file (or override it by using the +`java.security.properties` system property) so "TLS_RSA_*" is no +longer listed in the `jdk.tls.disabledAlgorithms` security property. + +This change results in the following cipher suites being disabled: + +* TLS_RSA_WITH_AES_256_GCM_SHA384 +* TLS_RSA_WITH_AES_256_CBC_SHA256 +* TLS_RSA_WITH_AES_256_CBC_SHA +* TLS_RSA_WITH_AES_128_GCM_SHA256 +* TLS_RSA_WITH_AES_128_CBC_SHA256 +* TLS_RSA_WITH_AES_128_CBC_SHA + +JDK-8340321: Disable SHA-1 in TLS/DTLS 1.2 handshake signatures +=============================================================== + +RFC 9155 deprecates the use of SHA-1 in TLS 1.2 and DTLS 1.2. The +algorithm has been regarded as insecure since 2005 and the first +public attack was published on the 23rd of February, 2017. With this +release of OpenJDK, SHA-1 is disabled in TLS 1.2 and DTLS 1.2 +handshake signature by adding "rsa_pkcs1_sha1 usage +HandshakeSignature, ecdsa_sha1 usage HandshakeSignature, dsa_sha1 +usage HandshakeSignature" to the `jdk.tls.disabledAlgorithms` security +property in the `java.security` configuration file. Attempts to use +these suites with this release will result in a +`SSLHandshakeException` being thrown. + +Users can, *at their own risk*, remove this restriction by modifying +the `java.security` configuration file (or override it by using the +`java.security.properties` system property) so the handshake +signatures are no longer listed in the `jdk.tls.disabledAlgorithms` +security property. + +This change results in the following signature schemes being disabled +for handshaking: + +* dsa_sha1 +* ecdsa_sha1 +* rsa_pkcs1_sha1 + +New in release OpenJDK 21.0.9 (2025-10-21): +=========================================== +Live versions of these release notes can be found at: + * https://bit.ly/openjdk2109 + +* CVEs + - CVE-2025-53057 + - CVE-2025-53066 + - CVE-2025-61748 +* Changes + - JDK-7036144: GZIPInputStream readTrailer uses faulty available() test for end-of-stream + - JDK-8079786: [macosx] Test java/awt/Frame/DisposeParentGC/DisposeParentGC.java fails for Mac only + - JDK-8167252: Some of Charset.availableCharsets() does not contain itself + - JDK-8185429: [macos] After a modal dialog is closed, no window becomes active + - JDK-8203867: Delete test java/awt/TrayIcon/DblClickActionEventTest/DblClickActionEventTest.html + - JDK-8217914: java/net/httpclient/ConnectTimeoutHandshakeSync.java failed on connection refused while doing POST + - JDK-8226919: attach in linux hangs due to permission denied accessing /proc/pid/root + - JDK-8249825: Tests sun/security/ssl/SSLSocketImpl/SetClientMode.java and NonAutoClose.java marked with @ignore + - JDK-8259540: MissingResourceException for key cvc-complex-type.2.4.d.1 + - JDK-8261242: [Linux] OSContainer::is_containerized() returns true when run outside a container + - JDK-8279005: sun/tools/jstat tests do not check for test case exit codes after JDK-8245129 + - JDK-8280818: Expand bug8033699.java to iterate over all LaFs + - JDK-8293713: java/net/httpclient/BufferingSubscriberTest.java fails in timeout, blocked in submission publisher + - JDK-8302293: jar --create fails with IllegalArgumentException if archive name is shorter than 3 characters + - JDK-8302744: Refactor Hotspot container detection code + - JDK-8304674: File java.c compile error with -fsanitize=address -O0 + - JDK-8308633: Increase precision of timestamps in g1 log + - JDK-8309238: jdk/jfr/tool/TestView.java failed with "exitValue = 134" + - JDK-8309627: Incorrect sorting of DirtyCardQueue buffers + - JDK-8309899: Rename PtrQueueSet::buffer_size() + - JDK-8310264: In PhaseChaitin::Split defs and phis are leaked + - JDK-8310974: NMT: Arena diffs miss the scale + - JDK-8311644: Server should not send bad_certificate alert when the client does not send any certificates + - JDK-8313083: Print 'rss' and 'cache' as part of the container information + - JDK-8313355: javax/management/remote/mandatory/notif/ListenerScaleTest.java failed with "Exception: Failed: ratio=792.2791601423487" + - JDK-8313367: SunMSCAPI cannot read Local Computer certs w/o Windows elevation + - JDK-8314166: Update googletest to v1.14.0 + - JDK-8314611: Provide more explicative error message parsing Currencies + - JDK-8314978: Multiple server call from connection failing with expect100 in getOutputStream + - JDK-8319067: ProblemList serviceability/AsyncGetCallTrace/MyPackage/ASGCTBaseTest.java on linux-aarch64 in Xcomp mode + - JDK-8319174: Enhance robustness of some j.m.BigInteger constructors + - JDK-8319598: SMFParser misinterprets interrupted running status + - JDK-8319932: [JVMCI] class unloading related tests can fail on libgraal + - JDK-8320189: vmTestbase/nsk/jvmti/scenarios/bcinstr/BI02/bi02t001 memory corruption when using -Xcheck:jni + - JDK-8320769: Remove ill-adviced "make install" target + - JDK-8320858: Move jpackage tests to tier3 + - JDK-8320859: gtest high malloc footprint caused by BufferNodeAllocator stress test + - JDK-8322420: [Linux] cgroup v2: Limits in parent nested control groups are not detected + - JDK-8322992: Javac fails with StackOverflowError when compiling deeply nested synchronized blocks + - JDK-8325397: sun/java2d/Disposer/TestDisposerRace.java fails in linux-aarch64 + - JDK-8326606: Test javax/swing/text/BoxView/6494356/bug6494356.java performs a synchronization on a value based class + - JDK-8326705: Test CertMsgCheck.java fails to find alert certificate_required + - JDK-8327125: SpinYield.report should report microseconds + - JDK-8327748: Convert javax/swing/JFileChooser/6798062/bug6798062.java applet test to main + - JDK-8327750: Convert javax/swing/JFileChooser/FileFilterDescription/FileFilterDescription.java applet test to main + - JDK-8327751: Convert javax/swing/JInternalFrame/6726866/bug6726866.java applet test to main + - JDK-8327752: Convert javax/swing/JOptionPane/4174551/bug4174551.java applet to main + - JDK-8327753: Convert javax/swing/JOptionPane/8024926/bug8024926.java applet to main + - JDK-8327754: Convert javax/swing/JPopupMenu/7160604/bug7160604.java applet to main + - JDK-8327755: Convert javax/swing/JScrollBar/8039464/Test8039464.java applet to main + - JDK-8327756: Convert javax/swing/JSlider/4987336/bug4987336.java applet to main + - JDK-8327826: Convert javax/swing/border/Test4243289.java applet test to main + - JDK-8327835: Convert java/awt/FileDialog/RegexpFilterTest/RegexpFilterTest applet test to main + - JDK-8327838: Convert java/awt/FileDialog/MultipleMode/MultipleMode.html applet test to main + - JDK-8327872: Convert javax/swing/JToolTip/4644444/bug4644444.java applet test to main + - JDK-8327873: Convert javax/swing/border/Test4247606.java applet test to main + - JDK-8327874: Convert javax/swing/JTree/4314199/bug4314199.java applet test to main + - JDK-8327876: Convert javax/swing/border/Test4252164.java applet test to main + - JDK-8327879: Convert javax/swing/border/Test4760089.java applet test to main + - JDK-8327969: Convert javax/swing/border/Test6910490.java applet test to main + - JDK-8327972: Convert java/awt/FileDialog/SaveFileNameOverrideTest/SaveFileNameOverrideTest.html applet test to main + - JDK-8328000: Convert /java/awt/im/8154816/bug8154816.java applet test to main + - JDK-8328012: Convert InputMethod (/java/awt/im) applet tests to main + - JDK-8328030: Convert javax/swing/text/GlyphView/4984669/bug4984669.java applet test to main + - JDK-8328035: Convert javax/swing/text/html/TableView/7030332/bug7030332.java applet test to main + - JDK-8328087: Automate javax/swing/JTable/TAB/TAB.java applet test + - JDK-8328089: Automate javax/swing/JTable/4222153/bug4222153.java applet test + - JDK-8328154: Convert sun/java2d/loops/CopyAreaSpeed.java applet test to main + - JDK-8328190: Convert AWTPanelSmoothWheel.html applet test to main + - JDK-8328225: Convert ImageDecoratedDnD.html applet test to main + - JDK-8328244: Convert javax/swing/JSlider/6742358/bug6742358.java applet test to main + - JDK-8328248: Convert javax/swing/JSlider/6587742/bug6587742.java applet test to main + - JDK-8328262: Convert javax/swing/JSplitPane/8132123/bug8132123.java applet test to main + - JDK-8328279: Convert java/awt/Cursor/CursorOverlappedPanelsTest test to main + - JDK-8328328: Convert javax/swing/JTabbedPane/4666224/bug4666224.java applet test to main + - JDK-8328367: Convert java/awt/Component/UpdatingBootTime test to main + - JDK-8328378: Convert java/awt/FileDialog/FileDialogForDirectories test to main + - JDK-8328382: Convert java/awt/FileDialog/FileDialogForPackages test to main + - JDK-8328384: Convert java/awt/FileDialog/FileDialogOpenDirTest test to main + - JDK-8328385: Convert java/awt/FileDialog/FileDialogReturnTest test to main + - JDK-8328386: Convert java/awt/FileDialog/FileNameOverrideTest test to main + - JDK-8328398: Convert java/awt/im/4490692/bug4490692.html applet test to main + - JDK-8328401: Convert java/awt/Frame/InitialMaximizedTest/InitialMaximizedTest.html applet test to automated + - JDK-8328570: Convert closed JViewport manual applet tests to main + - JDK-8328631: Convert java/awt/InputMethods/InputMethodsTest/InputMethodsTest.java applet test to manual + - JDK-8330022: Failure test/hotspot/jtreg/vmTestbase/nsk/sysdict/share/BTreeTest.java: Could not initialize class java.util.concurrent.ThreadLocalRandom + - JDK-8330535: Update nsk/jdb tests to use driver instead of othervm + - JDK-8331389: runtime/ErrorHandling/TestDwarf.java fails with "Crash JVM should not exit gracefully" + - JDK-8331560: Refactor Hotspot container detection code so that subsystem delegates to controllers + - JDK-8332020: jwebserver tool prints invalid URL in case of IPv6 address binding + - JDK-8332271: Reading data from the clipboard from multiple threads crashes the JVM + - JDK-8332368: ubsan aarch64: immediate_aarch64.cpp:298:31: runtime error: shift exponent 32 is too large for 32-bit type 'int' + - JDK-8332551: Test vmTestbase/nsk/monitoring/MemoryNotificationInfo/from/from001/TestDescription.java timed out + - JDK-8332857: Test vmTestbase/nsk/jvmti/GetThreadCpuTime/thrcputime002/TestDescription.java failed + - JDK-8333326: Linux Alpine build fails after 8302744 + - JDK-8333446: Add tests for hierarchical container support + - JDK-8334010: VM crashes with ObjectAlignmentInBytes > GCCardSizeInBytes + - JDK-8334016: Make PrintNullString.java automatic + - JDK-8334320: Replace vmTestbase/metaspace/share/TriggerUnloadingWithWhiteBox.java with ClassUnloadCommon from testlibrary + - JDK-8334394: Race condition in Class::protectionDomain + - JDK-8334457: Test javax/swing/JTabbedPane/bug4666224.java fail on macOS with because pressing the ‘C’ key does not switch the layout to WRAP_TAB_LAYOUT + - JDK-8335131: Test "javax/swing/JColorChooser/Test6977726.java" failed on ubuntu x64 because "Preview" title is missing for GTK L&F + - JDK-8335252: Reduce size of j.u.Formatter.Conversion#isValid + - JDK-8335577: runtime/cds/appcds/TestParallelGCWithCDS.java still fails with JNI error + - JDK-8335882: platform/cgroup/TestSystemSettings.java fails on Alpine Linux + - JDK-8336635: Add IR test for Reference.refersTo intrinsic + - JDK-8336702: C2 compilation fails with "all memory state should have been processed" assert + - JDK-8337506: Disable "best-fit" mapping on Windows command line + - JDK-8338236: Compile error in cgroup code on Linux when using clang + - JDK-8338482: com/sun/jdi/ThreadMemoryLeakTest.java requires that compressed oops are enabled + - JDK-8338939: Simplify processing of hidden class names + - JDK-8339460: CDS error when module is located in a directory with space in the name + - JDK-8339561: The test/jdk/java/awt/Paint/ListRepaint.java may fail after JDK-8327401 + - JDK-8339962: Open source AWT TextField tests - Set1 + - JDK-8340092: [Linux] containers/systemd/SystemdMemoryAwarenessTest.java failing on some systems + - JDK-8340185: Use make -k on GHA to catch more build errors + - JDK-8340276: Test java/lang/management/ThreadMXBean/Locks.java failed with NullPointerException + - JDK-8340389: vmTestbase/gc/gctests/PhantomReference/phantom001/TestDescription.java Test exit code: 97 with -Xcomp UseAVX=3 + - JDK-8340547: Starting many threads can delay safepoints + - JDK-8340554: Improve MessageFormat readObject checks + - JDK-8341178: TypeRawPtr::add_offset may be "miscompiled" due to UB + - JDK-8341311: [Accessibility,macOS,VoiceOver] VoiceOver announces incorrect number of items in submenu of JPopupMenu + - JDK-8341370: Test java/awt/Frame/ShapeNotSetSometimes/ShapeNotSetSometimes.java fails intermittently on macOS-aarch64 + - JDK-8341644: Compile error in cgroup coding when using toolchain clang + - JDK-8341684: Typo in External Specifications link of java.util.Currency + - JDK-8341861: GHA: Use only retention mechanism to remove bundles + - JDK-8341964: Add mechanism to disable different parts of TLS cipher suite + - JDK-8342074: Fix runtime/Thread/TestAlwaysPreTouchStacks.java to be flagless or accept VM flags + - JDK-8342238: Test javax/crypto/CryptoPermissions/InconsistentEntries.java writes files in tested JDK dir + - JDK-8342330: C2: "node pinned on loop exit test?" assert failure + - JDK-8342782: AWTEventMulticaster throws StackOverflowError using AquaButtonUI + - JDK-8343074: test/jdk/com/sun/net/httpserver/docs/test1/largefile.txt could be generated + - JDK-8343452: Incorrect WINDOWS build variable is used in macroAssembler_x86.cpp + - JDK-8343607: C2: Shenandoah crashes during barrier expansion in Continuation::enter + - JDK-8343618: Stack smashing in awt_InputMethod.c on Linux s390x + - JDK-8343804: Show the default time zone with -XshowSettings option + - JDK-8343977: Convert java/awt/TextArea/TextAreaCursorTest/HoveringAndDraggingTest to main + - JDK-8344137: Update XML Security for Java to 3.0.5 + - JDK-8344338: javax/swing/JTextArea/bug4265784.java fails on Ubuntu 24.04.1 + - JDK-8344671: Few JFR streaming tests fail with application not alive error on MacOS 15 + - JDK-8345173: BlockLocationPrinter::print_location misses a ResourceMark + - JDK-8345337: JFR: jfr view should display all direct subfields for an event type + - JDK-8345471: Clean up compiler/intrinsics/sha/cli tests + - JDK-8345566: Deproblemlist test/jdk/javax/swing/JComboBox/6559152/bug6559152.java + - JDK-8345767: javax/swing/JSplitPane/4164779/JSplitPaneKeyboardNavigationTest.java fails in ubuntu22.04 + - JDK-8346255: java/lang/management/ThreadMXBean/VirtualThreadDeadlocks.java finds no deadlock + - JDK-8346285: Update jarsigner compatibility test for change in default digest algorithm + - JDK-8346751: Internal java compiler error with type annotations in constants expression in constant fields + - JDK-8346871: Improve robustness of java/util/zip/EntryCount64k.java test + - JDK-8346929: runtime/ClassUnload/DictionaryDependsTest.java fails with "Test failed: should be unloaded" + - JDK-8346998: Test nsk/jvmti/ResourceExhausted/resexhausted003 fails with java.lang.OutOfMemoryError when CDS is off + - JDK-8347004: vmTestbase/metaspace/shrink_grow/ShrinkGrowTest/ShrinkGrowTest.java fails with CDS disabled + - JDK-8347302: Mark test tools/jimage/JImageToolTest.java as flagless + - JDK-8347381: Upgrade jQuery UI to version 1.14.1 + - JDK-8347564: ZGC: Crash in DependencyContext::clean_unloading_dependents + - JDK-8347826: Introspector shows wrong method list after 8071693 + - JDK-8347840: Fix testlibrary compilation warnings + - JDK-8348135: Fix couple of problem listing entries in test/hotspot/jtreg/ProblemList-Virtual.txt + - JDK-8348328: Update IANA Language Subtag Registry to Version 2025-05-15 + - JDK-8348365: Bad format string in CLDRDisplayNamesTest + - JDK-8348760: RadioButton is not shown if JRadioButtonMenuItem is rendered with ImageIcon in WindowsLookAndFeel + - JDK-8349151: Refactor test/java/security/cert/CertificateFactory/slowstream.sh to java test + - JDK-8349214: Improve size optimization flags for MSVC builds + - JDK-8349378: Build splashscreen lib with SIZE optimization + - JDK-8349583: Add mechanism to disable signature schemes based on their TLS scope + - JDK-8349849: PKCS11 SunTlsKeyMaterial crashes when used with TLS1.2 TlsKeyMaterialParameterSpec + - JDK-8350106: [PPC] Avoid ticks_unknown_not_Java AsyncGetCallTrace() if JavaFrameAnchor::_last_Java_pc not set + - JDK-8350111: [PPC] AsyncGetCallTrace crashes when called while handling SIGTRAP + - JDK-8350456: Test javax/crypto/CryptoPermissions/InconsistentEntries.java crashed: EXCEPTION_ACCESS_VIOLATION + - JDK-8350582: Correct the parsing of the ssl value in javax.net.debug + - JDK-8350665: SIZE_FORMAT_HEX macro undefined in gtest + - JDK-8350767: Fix -Wzero-as-null-pointer-constant warnings in nsk jni stress tests + - JDK-8350807: Certificates using MD5 algorithm that are disabled by default are incorrectly allowed in TLSv1.3 when re-enabled + - JDK-8350830: Values converted incorrectly when reading TLS session tickets + - JDK-8350858: [IR Framework] Some tests failed on Cascade Lake + - JDK-8350964: Add an ArtifactResolver.fetch(clazz) method + - JDK-8351277: Remove pipewire from AIX build + - JDK-8351487: [ubsan] jvmti.h runtime error: load of value which is not a valid value + - JDK-8351491: Add info from release file to hserr file + - JDK-8351593: [JMH] test PhoneCode.Bulk reports NPE exception + - JDK-8351601: [JMH] test UnixSocketChannelReadWrite failed for 2 threads config + - JDK-8351884: Refactor bug8033699.java test code + - JDK-8351907: [XWayland] [OL10] Robot.mousePress() is delivered to wrong place + - JDK-8351997: AArch64: Interpreter volatile reference stores with G1 are not sequentially consistent + - JDK-8352509: Update jdk.test.lib.SecurityTools jar method to accept List parameter + - JDK-8352624: Add missing {@code} to PassFailJFrame.Builder.splitUI + - JDK-8352637: Enhance bytecode verification + - JDK-8352677: Opensource JMenu tests - series2 + - JDK-8352719: Add an equals sign to the modules statement + - JDK-8352765: G1CollectedHeap::expand_and_allocate() may fail to allocate even after heap expansion succeeds + - JDK-8352800: [PPC] OpenJDK fails to build on PPC after JDK-8350106 + - JDK-8352860: Open source events tests batch0 + - JDK-8352879: TestPeriod.java and TestGetContentType.java run wrong test class + - JDK-8352895: UserCookie.java runs wrong test class + - JDK-8352896: LambdaExpr02.java runs wrong test class + - JDK-8352946: SEGV_BND signal code of SIGSEGV missing from our signal-code table + - JDK-8353000: Open source several swing tests batch2 + - JDK-8353126: Open source events tests batch1 + - JDK-8353213: Open source several swing tests batch3 + - JDK-8353235: Test jdk/jfr/api/metadata/annotations/TestPeriod.java fails with IllegalArgumentException + - JDK-8353293: Open source several swing tests batch4 + - JDK-8353304: Open source two JTabbedPane tests + - JDK-8353489: Increase timeout and improve Windows compatibility in test/jdk/java/lang/ProcessBuilder/Basic.java + - JDK-8353549: Open source events tests batch2 + - JDK-8353568: SEGV_BNDERR signal code adjust definition + - JDK-8353655: Clean up and open source KeyEvent related tests (Part 1) + - JDK-8353662: Add test for non-local file URL fallback to FTP + - JDK-8353698: Output of Simple Web Server is garbled if the console's encoding is not UTF-8 + - JDK-8353713: Improve Currency.getInstance exception handling + - JDK-8353748: Open source several swing tests batch6 + - JDK-8353847: Remove extra args to System.out.printf in open/test/jdk/java/net/httpclient tests + - JDK-8353950: Clipboard interaction on Windows is unstable + - JDK-8354285: Open source Swing tests Batch 3 + - JDK-8354327: Rewrite runtime/LoadClass/LoadClassNegative.java + - JDK-8354415: [Ubuntu25.04] api/java_awt/GraphicsDevice/indexTGF.html#SetDisplayMode - setDisplayMode_REFRESH_RATE_UNKNOWN fails: Height is different on vnc + - JDK-8354941: Build failure with glibc 2.42 due to uabs() name collision + - JDK-8355051: Problemlist java/awt/Graphics2D/CopyAreaOOB.java on macosx-aarch64 + - JDK-8355249: Remove the use of WMIC from the entire source code + - JDK-8355262: Test sun/security/ssl/SSLSessionImpl/NoInvalidateSocketException.java failed: accept timed out + - JDK-8355366: Fix the wrong usage of PassFailJFrame.forcePass() in some manual tests + - JDK-8355370: Include server name in HTTP test server thread names to improve diagnostics + - JDK-8355429: Open source ProgressMonitor test + - JDK-8355441: Remove antipattern from PassFailJFrame.forcePass javadoc + - JDK-8355453: nsk.share.jdi.Debugee.waitingEvent() does not timeout properly + - JDK-8355475: UNCTest should use an existing UNC path + - JDK-8355512: Test compiler/vectorization/TestVectorZeroCount.java times out with -XX:TieredStopAtLevel=3 + - JDK-8355515: Clarify the purpose of forcePass() and forceFail() methods + - JDK-8355528: Update HarfBuzz to 11.2.0 + - JDK-8355578: [java.net] Use @requires tag instead of exiting based on "os.name" property value + - JDK-8355779: When no "signature_algorithms_cert" extension is present we do not apply certificate scope constraints to algorithms in "signature_algorithms" extension + - JDK-8355979: ATTRIBUTE_NO_UBSAN needs to be extended to handle float divisions by zero on AIX + - JDK-8356269: Fix broken web-links after JDK-8295470 + - JDK-8356294: Enhance Path Factories + - JDK-8356324: JVM crash (SIGSEGV at ClassListParser::resolve_indy_impl) during -Xshare:dump starting from 21.0.5 + - JDK-8356778: Compiler add event logging in case of failures + - JDK-8357155: [asan] ZGC does not work (x86_64 and ppc64) + - JDK-8357173: Split jtreg test group jdk tier3 + - JDK-8357194: [21u] lible cannot find the path of libjava + - JDK-8357253: Test test/jdk/sun/security/ssl/SSLSessionImpl/ResumeClientTLS12withSNI.java writes in src dir + - JDK-8357285: JSR166 Test case testShutdownNow_delayedTasks failed + - JDK-8357672: Extreme font sizes can cause font substitution + - JDK-8357675: Amend headless message + - JDK-8357793: [PPC64] VM crashes with -XX:-UseSIGTRAP -XX:-ImplicitNullChecks + - JDK-8357826: Avoid running some jtreg tests when asan is configured + - JDK-8357910: LoaderConstraintsTest.java fails when run with TEST_THREAD_FACTORY=Virtual + - JDK-8357914: TestEmptyBootstrapMethodsAttr.java fails when run with TEST_THREAD_FACTORY=Virtual + - JDK-8357968: RISC-V: Interpreter volatile reference stores with G1 are not sequentially consistent + - JDK-8358004: Delete applications/scimark/Scimark.java test + - JDK-8358136: Make langtools/jdk/javadoc/doclet/testLinkOption/TestRedirectLinks.java intermittent + - JDK-8358310: ZGC: riscv, ppc ZPlatformAddressOffsetBits may return a too large value + - JDK-8358334: C2/Shenandoah: incorrect execution with Unsafe + - JDK-8358452: JNI exception pending in Java_sun_awt_screencast_ScreencastHelper_remoteDesktopKeyImpl of screencast_pipewire.c:1214 (ID: 51119) + - JDK-8358534: Bailout in Conv2B::Ideal when type of cmp input is not supported + - JDK-8358538: Update GHA Windows runner to 2025 + - JDK-8358617: java/net/HttpURLConnection/HttpURLConnectionExpectContinueTest.java fails with 403 due to system proxies + - JDK-8358659: Bump update version for OpenJDK: jdk-21.0.9 + - JDK-8358697: TextLayout/MyanmarTextTest.java passes if no Myanmar font is found + - JDK-8358701: Remove misleading javax.management.remote API doc wording about JMX spec, and historic link to JMXMP + - JDK-8359272: Several vmTestbase/compact tests timed out on large memory machine + - JDK-8359402: Test CloseDescriptors.java should throw SkippedException when there is no lsof/sctp + - JDK-8359454: Enhance String handling + - JDK-8360042: GHA: Bump MSVC to 14.44 + - JDK-8360518: Docker tests do not work when asan is configured + - JDK-8360647: [XWayland] [OL10] NumPad keys are not triggered + - JDK-8360937: Enhance certificate handling + - JDK-8361198: [AIX] fix misleading error output in thread_cpu_time_unchecked + - JDK-8361212: Remove AffirmTrust root CAs + - JDK-8361328: cds/appcds/dynamicArchive/TestAutoCreateSharedArchive.java archive timestamps comparison failed + - JDK-8361478: GHA: Use MSYS2 from GHA runners + - JDK-8361959: [GCC static analyzer] java_props_md.c leak of 'temp' variable is reported + - JDK-8362390: AIX make fails in awt_GraphicsEnv.c + - JDK-8362548: [21u] Add bugId to test missed in backport of JDK-8343804 + - JDK-8362582: GHA: Increase bundle retention time to deal with infra overload better + - JDK-8362838: RISC-V: Incorrect matching rule leading to improper oop instruction encoding + - JDK-8362839: [21u] Problem list more tests that fail in 21 and would be fixed by 8309622 + - JDK-8362855: Test java/net/ipv6tests/TcpTest.java should report SkippedException when there no ia4addr or ia6addr + - JDK-8363965: GHA: Switch cross-compiling sysroots to Debian bookworm + - JDK-8365375: Method SU3.setAcceleratorSelectionForeground assigns to acceleratorForeground + - JDK-8365389: Remove static color fields from SwingUtilities3 and WindowsMenuItemUI + - JDK-8365811: test/jdk/java/net/CookieHandler/B6644726.java failure - "Should have 5 cookies. Got only 4, expires probably didn't parse correctly" + - JDK-8367388: Tests start to fail on JDK-21 after JDK-8351907 + - JDK-8368308: ISO 4217 Amendment 180 Update + - JDK-8369643: [21u] Remove designator DEFAULT_PROMOTED_VERSION_PRE=ea for release 21.0.9 + +Notes on individual issues: +=========================== + +security-libs/javax.xml.crypto: + +JDK-8344137: Update XML Security for Java to 3.0.5 +================================================== +The XML Signature implementation has been updated to Apache Santuario +3.0.5 from 3.0.3. This adds support for four new SHA-3 based ECDSA +`SignatureMethod` algorithms. + +The `SignatureMethod` constants for these new algorithms are only +available in Java 25. Users will instead need to use the string +literals listed below to obtain instances of these new algorithms: + +* ECDSA_SHA3_224: http://www.w3.org/2021/04/xmldsig-more#ecdsa-sha3-224 +* ECDSA_SHA3_256: http://www.w3.org/2021/04/xmldsig-more#ecdsa-sha3-256 +* ECDSA_SHA3_384: http://www.w3.org/2021/04/xmldsig-more#ecdsa-sha3-384 +* ECDSA_SHA3_512: http://www.w3.org/2021/04/xmldsig-more#ecdsa-sha3-512 + +core-libs/java.util.jar: + +JDK-7036144: GZIPInputStream readTrailer uses faulty available() test for end-of-stream +======================================================================================= +The `GZIPInputStream` class supports concatenated GZIP streams and +will attempt to start reading a new stream after the previous one +ends. This attempt was conditional on `InputStream.available()` +returning a value greater than zero, but this method only returns an +estimate of the number of bytes that can be read without blocking. +With this release, the test is removed and reading a new stream is +always attempted. + +security-libs/javax.net.ssl: + +JDK-8341964: Add mechanism to disable different parts of TLS cipher suite +========================================================================= +The mechanisms in previous releases of OpenJDK for disabling TLS +algorithms were either too broad or too specific. Specifying an +algorithm (e.g. "RSA") would disable all suites using that algorithm. +The only alternative was to specify every suite. With this release, +the `jdk.tls.disabledAlgorithms` security property supports wildcards +for patterns that begin with "TLS_", so "TLS_RSA_*" can be used to +disable all suites that start with "TLS_RSA_". + +JDK-8349583: Add mechanism to disable signature schemes based on their TLS scope +================================================================================ +In this release, the `jdk.tls.disabledAlgorithms` property now +supports specifying the usage of a particular algorithm. An algorithm +can be limited to use only in a TLS handshake exchange or only in a +TLS certificate. + +The usage is specified by adding a suffix to the algorithm, consisting +of the word "usage" and either `HandshakeSignature` for TLS handshake +exchanges or `CertificateSignature` for TLS certificates. For +example, `rsa_pkcs1_sha1 usage HandshakeSignature` restricts the +`rsa_pkcs1_sha1` algorithm to use in TLS handshake exchanges only and +it can not be used to sign TLS certificates. + +tools/launcher: + +JDK-8337506: Disable "best-fit" mapping on Windows command line +=============================================================== +On Windows, the Java launcher in previous releases of OpenJDK used the +ANSI version of the GetCommandLine() Win32 API call to obtain +command-line arguments. If the arguments contained Unicode characters +that did not exist in the ANSI code page, they would be converted to +other characters using the Windows "best fit" mapping [0]. This +mapping could introduce unexpected characters and differed between +code pages. With this release, the JDK reads the command line +arguments as Unicode and then converts them to the ANSI codepage +itself, using the default replacement character for any that can not +be mapped. For cases where such Unicode characters need to be +retained as is, select UTF-8 in the Windows regional settings. + +[0] https://www.unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WindowsBestFit/readme.txt + +hotspot/runtime: + +JDK-8313083: Print 'rss' and 'cache' as part of the container information +========================================================================= +In this release, the information provided for containers is improved +by inclusion of the memory usage information for the Resident Set Size +(RSS) and the cache, in bytes. This is visible in the output of `jcmd + VM.info`, where `` is the running JVM, and in the `hs_err` +file generated on abrupt JVM termination. + +security-libs/java.security: + +JDK-8313367: SunMSCAPI cannot read Local Computer certs w/o Windows elevation +============================================================================= +The SunMSCAPI provider in previous releases of OpenJDK required +administrator privileges to access the local computer key store. The +store is now accessed with the `CERT_STORE_MAXIMUM_ALLOWED_FLAG` set +so that non-elevated processes will be able to access the key store in +read only mode. + +JDK-8361212: Remove AffirmTrust root CAs +======================================== +The following root certificates from AffirmTrust, which were +deactivated in the 21.0.5 release of October 2024, have been removed +from the `cacerts` keystore: + +Alias name: affirmtrustcommercialca [jdk] +CN=AffirmTrust Commercial +O=AffirmTrust +C=US +SHA256: 03:76:AB:1D:54:C5:F9:80:3C:E4:B2:E2:01:A0:EE:7E:EF:7B:57:B6:36:E8:A9:3C:9B:8D:48:60:C9:6F:5F:A7 + +Alias name: affirmtrustnetworkingca [jdk] +CN=AffirmTrust Networking +O=AffirmTrust +C=US +SHA256: 0A:81:EC:5A:92:97:77:F1:45:90:4A:F3:8D:5D:50:9F:66:B5:E2:C5:8F:CD:B5:31:05:8B:0E:17:F3:F0B4:1B + +Alias name: affirmtrustpremiumca [jdk] +CN=AffirmTrust Premium +O=AffirmTrust +C=US +SHA256: 70:A7:3F:7F:37:6B:60:07:42:48:90:45:34:B1:14:82:D5:BF:0E:69:8E:CC:49:8D:F5:25:77:EB:F2:E9:3B:9A + +Alias name: affirmtrustpremiumeccca [jdk] +CN=AffirmTrust Premium ECC +O=AffirmTrust +C=US +SHA256: BD:71:FD:F6:DA:97:E4:CF:62:D1:64:7A:DD:25:81:B0:7D:79:AD:F8:39:7E:B4:EC:BA:9C:5E:84:88:82:14:23 + +New in release OpenJDK 21.0.8 (2025-07-15): +=========================================== +Live versions of these release notes can be found at: + * https://bit.ly/openjdk2108 + +* CVEs + - CVE-2025-30749 + - CVE-2025-30754 + - CVE-2025-50059 + - CVE-2025-50106 +* Changes + - JDK-6956385: URLConnection.getLastModified() leaks file handles for jar:file and file: URLs + - JDK-8051591: Test javax/swing/JTabbedPane/8007563/Test8007563.java fails + - JDK-8136895: Writer not closed with disk full error, file resource leaked + - JDK-8180450: secondary_super_cache does not scale well + - JDK-8183348: Better cleanup for jdk/test/sun/security/pkcs12/P12SecretKey.java + - JDK-8200566: DistributionPointFetcher fails to fetch CRLs if the DistributionPoints field contains more than one DistributionPoint and the first one fails + - JDK-8202100: Merge vm/share/InMemoryJavaCompiler w/ jdk/test/lib/compiler/InMemoryJavaCompiler + - JDK-8210471: GZIPInputStream constructor could leak an un-end()ed Inflater + - JDK-8211400: nsk.share.gc.Memory::getArrayLength returns wrong value + - JDK-8220213: com/sun/jndi/dns/ConfigTests/Timeout.java failed intermittent + - JDK-8249831: Test sun/security/mscapi/nonUniqueAliases/NonUniqueAliases.java is marked with @ignore + - JDK-8253440: serviceability/sa/TestJhsdbJstackLineNumbers.java failed with "Didn't find enough line numbers" + - JDK-8256211: assert fired in java/net/httpclient/DependentPromiseActionsTest (infrequent) + - JDK-8258483: [TESTBUG] gtest CollectorPolicy.young_scaled_initial_ergo_vm fails if heap is too small + - JDK-8267174: Many test files have the wrong Copyright header + - JDK-8270269: Desktop.browse method fails if earlier CoInitialize call as COINIT_MULTITHREADED + - JDK-8276995: Bug in jdk.jfr.event.gc.collection.TestSystemGC + - JDK-8279016: JFR Leak Profiler is broken with Shenandoah + - JDK-8280991: [XWayland] No displayChanged event after setDisplayMode call + - JDK-8281511: java/net/ipv6tests/UdpTest.java fails with checkTime failed + - JDK-8282726: java/net/vthread/BlockingSocketOps.java timeout/hang intermittently on Windows + - JDK-8286204: [Accessibility,macOS,VoiceOver] VoiceOver reads the spinner value 10 as 1 when user iterates to 10 for the first time on macOS + - JDK-8286789: Test forceEarlyReturn002.java timed out + - JDK-8286875: ProgrammableUpcallHandler::on_entry/on_exit access thread fields from native + - JDK-8294155: Exception thrown before awaitAndCheck hangs PassFailJFrame + - JDK-8295804: javax/swing/JFileChooser/JFileChooserSetLocationTest.java failed with "setLocation() is not working properly" + - JDK-8297692: Avoid sending per-region GCPhaseParallel JFR events in G1ScanCollectionSetRegionClosure + - JDK-8303770: Remove Baltimore root certificate expiring in May 2025 + - JDK-8305010: Test vmTestbase/nsk/jvmti/scenarios/sampling/SP05/sp05t003/TestDescription.java timed out: thread not suspended + - JDK-8307318: Test serviceability/sa/ClhsdbCDSJstackPrintAll.java failed: ArrayIndexOutOfBoundsException + - JDK-8307824: Clean up Finalizable.java and finalize terminology in vmTestbase/nsk/share + - JDK-8308033: The jcmd thread dump related tests should test virtual threads + - JDK-8308966: Add intrinsic for float/double modulo for x86 AVX2 and AVX512 + - JDK-8309667: TLS handshake fails because of ConcurrentModificationException in PKCS12KeyStore.engineGetEntry + - JDK-8309841: Jarsigner should print a warning if an entry is removed + - JDK-8309978: [x64] Fix useless padding + - JDK-8310066: Improve test coverage for JVMTI GetThreadState on carrier and mounted vthread + - JDK-8310525: DynamicLauncher for JDP test needs to try harder to find a free port + - JDK-8310643: Misformatted copyright messages in FFM + - JDK-8312246: NPE when HSDB visits bad oop + - JDK-8312475: org.jline.util.PumpReader signed byte problem + - JDK-8313290: Misleading exception message from STS.Subtask::get when task forked after shutdown + - JDK-8313430: [JVMCI] fatal error: Never compilable: in JVMCI shutdown + - JDK-8313654: Test WaitNotifySuspendedVThreadTest.java timed out + - JDK-8314056: Remove runtime platform check from frem/drem + - JDK-8314136: Test java/net/httpclient/CancelRequestTest.java failed: WARNING: tracker for HttpClientImpl(42) has outstanding operations + - JDK-8314236: Overflow in Collections.rotate + - JDK-8314319: LogCompilation doesn't reset lateInlining when it encounters a failure. + - JDK-8314840: 3 gc/epsilon tests ignore external vm options + - JDK-8314842: zgc/genzgc tests ignore vm flags + - JDK-8315128: jdk/jfr/event/runtime/TestResidentSetSizeEvent.java fails with "The size should be less than or equal to peak" + - JDK-8315484: java/awt/dnd/RejectDragDropActionTest.java timed out + - JDK-8315669: Open source several Swing PopupMenu related tests + - JDK-8315742: Open source several Swing Scroll related tests + - JDK-8315827: Kitchensink.java and RenaissanceStressTest.java time out with jvmti module errors + - JDK-8315871: Opensource five more Swing regression tests + - JDK-8315876: Open source several Swing CSS related tests + - JDK-8315951: Open source several Swing HTMLEditorKit related tests + - JDK-8315981: Opensource five more random Swing tests + - JDK-8316061: Open source several Swing RootPane and Slider related tests + - JDK-8316324: Opensource five miscellaneous Swing tests + - JDK-8316388: Opensource five Swing component related regression tests + - JDK-8316452: java/lang/instrument/modules/AppendToClassPathModuleTest.java ignores VM flags + - JDK-8316497: ColorConvertOp - typo for non-ICC conversions needs one-line fix + - JDK-8316580: HttpClient with StructuredTaskScope does not close when a task fails + - JDK-8316629: j.text.DateFormatSymbols setZoneStrings() exception is unhelpful + - JDK-8317264: Pattern.Bound has `static` fields that should be `static final`. + - JDK-8318509: x86 count_positives intrinsic broken for -XX:AVX3Threshold=0 + - JDK-8318636: Add jcmd to print annotated process memory map + - JDK-8318700: MacOS Zero cannot run gtests due to wrong JVM path + - JDK-8318811: Compiler directives parser swallows a character after line comments + - JDK-8318915: Enhance checks in BigDecimal.toPlainString() + - JDK-8319439: Move BufferNode from PtrQueue files to new files + - JDK-8319572: Test jdk/incubator/vector/LoadJsvmlTest.java ignores VM flags + - JDK-8319690: [AArch64] C2 compilation hits offset_ok_for_immed: assert "c2 compiler bug" + - JDK-8320687: sun.jvmstat.monitor.MonitoredHost.getMonitoredHost() throws unexpected exceptions when invoked concurrently + - JDK-8320948: NPE due to unreported compiler error + - JDK-8321204: C2: assert(false) failed: node should be in igvn hash table + - JDK-8321479: java -D-D crashes + - JDK-8321931: memory_swap_current_in_bytes reports 0 as "unlimited" + - JDK-8322141: SequenceInputStream.transferTo should not return as soon as Long.MAX_VALUE bytes have been transferred + - JDK-8322475: Extend printing for System.map + - JDK-8323795: jcmd Compiler.codecache should print total size of code cache + - JDK-8324345: Stack overflow during C2 compilation when splitting memory phi + - JDK-8324678: Replace NULL with nullptr in HotSpot gtests + - JDK-8324681: Replace NULL with nullptr in HotSpot jtreg test native code files + - JDK-8324799: Use correct extension for C++ test headers + - JDK-8324880: Rename get_stack_trace.h + - JDK-8325055: Rename Injector.h + - JDK-8325180: Rename jvmti_FollowRefObjects.h + - JDK-8325347: Rename native_thread.h + - JDK-8325367: Rename nsk_list.h + - JDK-8325435: [macos] Menu or JPopupMenu not closed when main window is resized + - JDK-8325456: Rename nsk_mutex.h + - JDK-8325458: Rename mlvmJvmtiUtils.h + - JDK-8325680: Uninitialised memory in deleteGSSCB of GSSLibStub.c:179 + - JDK-8325682: Rename nsk_strace.h + - JDK-8325910: Rename jnihelper.h + - JDK-8326090: Rename jvmti_aod.h + - JDK-8326389: [test] improve assertEquals failure output + - JDK-8326524: Rename agent_common.h + - JDK-8326586: Improve Speed of System.map + - JDK-8327071: [Testbug] g-tests for cgroup leave files in /tmp on linux + - JDK-8327169: serviceability/dcmd/vm/SystemMapTest.java and SystemDumpMapTest.java may fail after JDK-8326586 + - JDK-8327370: (ch) sun.nio.ch.Poller.register throws AssertionError + - JDK-8327461: KeyStore getEntry is not thread-safe + - JDK-8328107: Shenandoah/C2: TestVerifyLoopOptimizations test failure + - JDK-8328301: Convert Applet test ManualHTMLDataFlavorTest.java to main program + - JDK-8328482: Convert and Open source few manual applet test to main based + - JDK-8328484: Convert and Opensource few JFileChooser applet test to main + - JDK-8328648: Remove applet usage from JFileChooser tests bug4150029 + - JDK-8328670: Automate and open source few closed manual applet test + - JDK-8328673: Convert closed text/html/CSS manual applet test to main + - JDK-8328864: NullPointerException in sun.security.jca.ProviderList.getService() + - JDK-8329261: G1: interpreter post-barrier x86 code asserts index size of wrong buffer + - JDK-8329729: java/util/Properties/StoreReproducibilityTest.java times out + - JDK-8330106: C2: VectorInsertNode::make() shouldn't call ConINode::make() directly + - JDK-8330158: C2: Loop strip mining uses ABS with min int + - JDK-8330534: Update nsk/jdwp tests to use driver instead of othervm + - JDK-8330598: java/net/httpclient/Http1ChunkedTest.java fails with java.util.MissingFormatArgumentException: Format specifier '%s' + - JDK-8330936: [ubsan] exclude function BilinearInterp and ShapeSINextSpan in libawt java2d from ubsan checks + - JDK-8331088: Incorrect TraceLoopPredicate output + - JDK-8331735: UpcallLinker::on_exit races with GC when copying frame anchor + - JDK-8332252: Clean up vmTestbase/vm/share + - JDK-8332506: SIGFPE In ObjectSynchronizer::is_async_deflation_needed() + - JDK-8332631: Update nsk.share.jpda.BindServer to don't use finalization + - JDK-8332641: Update nsk.share.jpda.Jdb to don't use finalization + - JDK-8332880: JFR GCHelper class recognizes "Archive" regions as valid + - JDK-8332921: Ctrl+C does not call shutdown hooks after JLine upgrade + - JDK-8333013: Update vmTestbase/nsk/share/LocalProcess.java to don't use finalization + - JDK-8333117: Remove support of remote and manual debuggee launchers + - JDK-8333680: com/sun/tools/attach/BasicTests.java fails with "SocketException: Permission denied: connect" + - JDK-8333805: Replaying compilation with null static final fields results in a crash + - JDK-8333890: Fatal error in auto-vectorizer with float16 kernel. + - JDK-8334644: Automate javax/print/attribute/PageRangesException.java + - JDK-8334780: Crash: assert(h_array_list.not_null()) failed: invariant + - JDK-8334895: OpenJDK fails to configure on linux aarch64 when CDS is disabled after JDK-8331942 + - JDK-8335181: Incorrect handling of HTTP/2 GOAWAY frames in HttpClient + - JDK-8335643: serviceability/dcmd/vm tests fail for ZGC after JDK-8322475 + - JDK-8335662: [AArch64] C1: guarantee(val < (1ULL << nbits)) failed: Field too big for insn + - JDK-8335684: Test ThreadCpuTime.java should pause like ThreadCpuTimeArray.java + - JDK-8335710: serviceability/dcmd/vm/SystemDumpMapTest.java and SystemMapTest.java fail on Linux Alpine after 8322475 + - JDK-8335836: serviceability/jvmti/StartPhase/AllowedFunctions/AllowedFunctions.java fails with unexpected exit code: 112 + - JDK-8335860: compiler/vectorization/TestFloat16VectorConvChain.java fails with non-standard AVX/SSE settings + - JDK-8336042: Caller/callee param size mismatch in deoptimization causes crash + - JDK-8336499: Failure when creating non-CRT RSA private keys in SunPKCS11 + - JDK-8336587: failure_handler lldb command times out on macosx-aarch64 core file + - JDK-8336827: compiler/vectorization/TestFloat16VectorConvChain.java timeouts on ppc64 platforms after JDK-8335860 + - JDK-8337221: CompileFramework: test library to conveniently compile java and jasm sources for fuzzing + - JDK-8337299: vmTestbase/nsk/jdb/stop_at/stop_at002/stop_at002.java failure goes undetected + - JDK-8337681: PNGImageWriter uses much more memory than necessary + - JDK-8337795: Type annotation attached to incorrect type during class reading + - JDK-8337958: Out-of-bounds array access in secondary_super_cache + - JDK-8337981: ShenandoahHeap::is_in should check for alive regions + - JDK-8337998: CompletionFailure in getEnclosingType attaching type annotations + - JDK-8338010: WB_IsFrameDeoptimized miss ResourceMark + - JDK-8338064: Give better error for ConcurrentHashTable corruption + - JDK-8338136: Hotspot should support multiple large page sizes on Windows + - JDK-8338154: Fix -Wzero-as-null-pointer-constant warnings in gtest framework + - JDK-8338202: Shenandoah: Improve handshake closure labels + - JDK-8338314: JFR: Split JFRCheckpoint VM operation + - JDK-8339148: Make os::Linux::active_processor_count() public + - JDK-8339288: Improve diagnostic logging runtime/cds/DeterministicDump.java + - JDK-8339300: CollectorPolicy.young_scaled_initial_ergo_vm gtest fails on ppc64 based platforms + - JDK-8339538: Wrong timeout computations in DnsClient + - JDK-8339639: Opensource few AWT PopupMenu tests + - JDK-8339678: Update runtime/condy tests to be executed with VM flags + - JDK-8339727: Open source several AWT focus tests - series 1 + - JDK-8339769: Incorrect error message during startup if working directory does not exist + - JDK-8339794: Open source closed choice tests #1 + - JDK-8339810: Clean up the code in sun.tools.jar.Main to properly close resources and use ZipFile during extract + - JDK-8339836: Open source several AWT Mouse tests - Batch 1 + - JDK-8339842: Open source several AWT focus tests - series 2 + - JDK-8339895: Open source several AWT focus tests - series 3 + - JDK-8339906: Open source several AWT focus tests - series 4 + - JDK-8339935: Open source several AWT focus tests - series 5 + - JDK-8339982: Open source several AWT Mouse tests - Batch 2 + - JDK-8339984: Open source AWT MenuItem related tests + - JDK-8339995: Open source several AWT focus tests - series 6 + - JDK-8340024: In ClassReader, extract a constant for the superclass supertype_index + - JDK-8340077: Open source few Checkbox tests - Set2 + - JDK-8340084: Open source AWT Frame related tests + - JDK-8340143: Open source several Java2D rendering loop tests. + - JDK-8340146: ZGC: TestAllocateHeapAt.java should not run with UseLargePages + - JDK-8340164: Open source few Component tests - Set1 + - JDK-8340173: Open source some Component/Panel/EventQueue tests - Set2 + - JDK-8340176: Replace usage of -noclassgc with -Xnoclassgc in test/jdk/java/lang/management/MemoryMXBean/LowMemoryTest2.java + - JDK-8340193: Open source several AWT Dialog tests - Batch 1 + - JDK-8340228: Open source couple more miscellaneous AWT tests + - JDK-8340271: Open source several AWT Robot tests + - JDK-8340279: Open source several AWT Dialog tests - Batch 2 + - JDK-8340332: Open source mixed AWT tests - Set3 + - JDK-8340366: Open source several AWT Dialog tests - Batch 3 + - JDK-8340367: Opensource few AWT image tests + - JDK-8340393: Open source closed choice tests #2 + - JDK-8340407: Open source a few more Component related tests + - JDK-8340417: Open source some MenuBar tests - Set1 + - JDK-8340432: Open source some MenuBar tests - Set2 + - JDK-8340433: Open source closed choice tests #3 + - JDK-8340437: Open source few more AWT Frame related tests + - JDK-8340458: Open source additional Component tests (part 2) + - JDK-8340555: Open source DnD tests - Set4 + - JDK-8340560: Open Source several AWT/2D font and rendering tests + - JDK-8340605: Open source several AWT PopupMenu tests + - JDK-8340621: Open source several AWT List tests + - JDK-8340625: Open source additional Component tests (part 3) + - JDK-8340639: Open source few more AWT List tests + - JDK-8340713: Open source DnD tests - Set5 + - JDK-8340784: Remove PassFailJFrame constructor with screenshots + - JDK-8340790: Open source several AWT Dialog tests - Batch 4 + - JDK-8340809: Open source few more AWT PopupMenu tests + - JDK-8340874: Open source some of the AWT Geometry/Button tests + - JDK-8340907: Open source closed frame tests # 2 + - JDK-8340966: Open source few Checkbox and Cursor tests - Set1 + - JDK-8340967: Open source few Cursor tests - Set2 + - JDK-8340978: Open source few DnD tests - Set6 + - JDK-8340985: Open source some Desktop related tests + - JDK-8341000: Open source some of the AWT Window tests + - JDK-8341004: Open source AWT FileDialog related tests + - JDK-8341072: Open source several AWT Canvas and Rectangle related tests + - JDK-8341128: open source some 2d graphics tests + - JDK-8341148: Open source several Choice related tests + - JDK-8341162: Open source some of the AWT window test + - JDK-8341170: Open source several Choice related tests (part 2) + - JDK-8341177: Opensource few List and a Window test + - JDK-8341191: Open source few more AWT FileDialog tests + - JDK-8341239: Open source closed frame tests # 3 + - JDK-8341257: Open source few DND tests - Set1 + - JDK-8341258: Open source few various AWT tests - Set1 + - JDK-8341278: Open source few TrayIcon tests - Set7 + - JDK-8341298: Open source more AWT window tests + - JDK-8341373: Open source closed frame tests # 4 + - JDK-8341378: Open source few TrayIcon tests - Set8 + - JDK-8341447: Open source closed frame tests # 5 + - JDK-8341535: sun/awt/font/TestDevTransform.java fails with RuntimeException: Different rendering + - JDK-8341637: java/net/Socket/UdpSocket.java fails with "java.net.BindException: Address already in use" (macos-aarch64) + - JDK-8341779: [REDO BACKPORT] type annotations are not visible to javac plugins across compilation boundaries (JDK-8225377) + - JDK-8341972: java/awt/dnd/DnDRemoveFocusOwnerCrashTest.java timed out after JDK-8341257 + - JDK-8342075: HttpClient: improve HTTP/2 flow control checks + - JDK-8342376: More reliable OOM handling in ExceptionDuringDumpAtObjectsInitPhase test + - JDK-8342524: Use latch in AbstractButton/bug6298940.java instead of delay + - JDK-8342633: javax/management/security/HashedPasswordFileTest.java creates tmp file in src dir + - JDK-8342958: Use jvmArgs consistently in microbenchmarks + - JDK-8343019: Primitive caches must use boxed instances from the archive + - JDK-8343037: Missing @since tag on JColorChooser.showDialog overload + - JDK-8343103: Enable debug logging for vmTestbase/nsk/jvmti/scenarios/sampling/SP05/sp05t003/TestDescription.java + - JDK-8343124: Tests fails with java.lang.IllegalAccessException: class com.sun.javatest.regtest.agent.MainWrapper$MainTask cannot access + - JDK-8343144: UpcallLinker::on_entry racingly clears pending exception with GC safepoints + - JDK-8343170: java/awt/Cursor/JPanelCursorTest/JPanelCursorTest.java does not show the default cursor + - JDK-8343224: print/Dialog/PaperSizeError.java fails with MediaSizeName is not A4: A4 + - JDK-8343342: java/io/File/GetXSpace.java fails on Windows with CD-ROM drive + - JDK-8343345: Use -jvmArgsPrepend when running microbenchmarks in RunTests.gmk + - JDK-8343529: serviceability/sa/ClhsdbWhere.java fails AssertionFailure: Corrupted constant pool + - JDK-8343754: Problemlist jdk/jfr/event/oldobject/TestShenandoah.java after JDK-8279016 + - JDK-8343855: HTTP/2 ConnectionWindowUpdateSender may miss some unprocessed DataFrames from closed streams + - JDK-8343891: Test javax/swing/JTabbedPane/TestJTabbedPaneBackgroundColor.java failed + - JDK-8343936: Adjust timeout in test javax/management/monitor/DerivedGaugeMonitorTest.java + - JDK-8344316: security/auth/callback/TextCallbackHandler/Password.java make runnable with JTReg and add the UI + - JDK-8344346: java/net/httpclient/ShutdownNow.java fails with java.lang.AssertionError: client was still running, but exited after further delay: timeout should be adjusted + - JDK-8344361: Restore null return for invalid services from legacy providers + - JDK-8344414: ZGC: Another division by zero in rule_major_allocation_rate + - JDK-8344925: translet-name ignored when package-name is also set + - JDK-8345133: Test sun/security/tools/jarsigner/TsacertOptionTest.java failed: Warning found in stdout + - JDK-8345134: Test sun/security/tools/jarsigner/ConciseJarsigner.java failed: unable to find valid certification path to requested target + - JDK-8345146: [PPC64] Make intrinsic conversions between bit representations of half precision values and floats + - JDK-8345341: Fix incorrect log message in JDI stop002t test + - JDK-8345357: test/jdk/javax/swing/JRadioButton/8033699/bug8033699.java fails in ubuntu22.04 + - JDK-8345447: test/jdk/javax/swing/JToolBar/4529206/bug4529206.java fails in ubuntu22.04 + - JDK-8345547: test/jdk/javax/swing/text/DefaultEditorKit/4278839/bug4278839.java fails in ubuntu22.04 + - JDK-8345598: Upgrade NSS binaries for interop tests + - JDK-8345625: Better HTTP connections + - JDK-8345728: [Accessibility,macOS,Screen Magnifier]: JCheckbox unchecked state does not magnify but works for checked state + - JDK-8345838: Remove the appcds/javaldr/AnonVmClassesDuringDump.java test + - JDK-8346049: jdk/test/lib/security/timestamp/TsaServer.java warnings + - JDK-8346082: Output JVMTI agent information in hserr files + - JDK-8346264: "Total compile time" counter should include time spent in failing/bailout compiles + - JDK-8346581: JRadioButton/ButtonGroupFocusTest.java fails in CI on Linux + - JDK-8346888: [ubsan] block.cpp:1617:30: runtime error: 9.97582e+36 is outside the range of representable values of type 'int' + - JDK-8347000: Bug in com/sun/net/httpserver/bugs/B6361557.java test + - JDK-8347019: Test javax/swing/JRadioButton/8033699/bug8033699.java still fails: Focus is not on Radio Button Single as Expected + - JDK-8347083: Incomplete logging in nsk/jvmti/ResourceExhausted/resexhausted00* tests + - JDK-8347126: gc/stress/TestStressG1Uncommit.java gets OOM-killed + - JDK-8347173: java/net/DatagramSocket/InterruptibleDatagramSocket.java fails with virtual thread factory + - JDK-8347286: (fs) Remove some extensions from java/nio/file/Files/probeContentType/Basic.java + - JDK-8347296: WinInstallerUiTest fails in local test runs if the path to test work directory is longer that regular + - JDK-8347373: HTTP/2 flow control checks may count unprocessed data twice + - JDK-8347506: Compatible OCSP readtimeout property with OCSP timeout + - JDK-8347596: Update HSS/LMS public key encoding + - JDK-8347629: Test FailOverDirectExecutionControlTest.java fails with -Xcomp + - JDK-8347995: Race condition in jdk/java/net/httpclient/offline/FixedResponseHttpClient.java + - JDK-8348107: test/jdk/java/net/httpclient/HttpsTunnelAuthTest.java fails intermittently + - JDK-8348110: Update LCMS to 2.17 + - JDK-8348299: Update List/ItemEventTest/ItemEventTest.java + - JDK-8348323: Corrupted timezone string in JVM crash log + - JDK-8348596: Update FreeType to 2.13.3 + - JDK-8348597: Update HarfBuzz to 10.4.0 + - JDK-8348598: Update Libpng to 1.6.47 + - JDK-8348600: Update PipeWire to 1.3.81 + - JDK-8348865: JButton/bug4796987.java never runs because Windows XP is unavailable + - JDK-8348936: [Accessibility,macOS,VoiceOver] VoiceOver doesn't announce untick on toggling the checkbox with "space" key on macOS + - JDK-8348989: Better Glyph drawing + - JDK-8349111: Enhance Swing supports + - JDK-8349200: [JMH] time.format.ZonedDateTimeFormatterBenchmark fails + - JDK-8349348: Refactor ClassLoaderDeadlock.sh and Deadlock.sh to run fully in java + - JDK-8349358: [JMH] Cannot access class jdk.internal.vm.ContinuationScope + - JDK-8349492: Update sun/security/pkcs12/KeytoolOpensslInteropTest.java to use a recent Openssl version + - JDK-8349501: Relocate supporting classes in security/testlibrary to test/lib/jdk tree + - JDK-8349594: Enhance TLS protocol support + - JDK-8349623: [ASAN] Gtest os_linux.glibc_mallinfo_wrapper_vm fails + - JDK-8349637: Integer.numberOfLeadingZeros outputs incorrectly in certain cases + - JDK-8349751: AIX build failure after upgrade pipewire to 1.3.81 + - JDK-8350201: Out of bounds access on Linux aarch64 in os::print_register_info + - JDK-8350211: CTW: Attempt to preload all classes in constant pool + - JDK-8350224: Test javax/swing/JComboBox/TestComboBoxComponentRendering.java fails in ubuntu 23.x and later + - JDK-8350260: Improve HTML instruction formatting in PassFailJFrame + - JDK-8350313: Include timings for leaving safepoint in safepoint logging + - JDK-8350383: Test: add more test case for string compare (UL case) + - JDK-8350386: Test TestCodeCacheFull.java fails with option -XX:-UseCodeCacheFlushing + - JDK-8350412: [21u] AArch64: Ambiguous frame layout leads to incorrect traces in JFR + - JDK-8350483: AArch64: turn on signum intrinsics by default on Ampere CPUs + - JDK-8350498: Remove two Camerfirma root CA certificates + - JDK-8350546: Several java/net/InetAddress tests fails UnknownHostException + - JDK-8350616: Skip ValidateHazardPtrsClosure in non-debug builds + - JDK-8350650: Bump update version for OpenJDK: jdk-21.0.8 + - JDK-8350682: [JMH] vector.IndexInRangeBenchmark failed with IndexOutOfBoundsException for size=1024 + - JDK-8350786: Some java/lang jtreg tests miss requires vm.hasJFR + - JDK-8350924: javax/swing/JMenu/4213634/bug4213634.java fails + - JDK-8350991: Improve HTTP client header handling + - JDK-8351086: (fc) Make java/nio/channels/FileChannel/BlockDeviceSize.java test manual + - JDK-8351500: G1: NUMA migrations cause crashes in region allocation + - JDK-8351665: Remove unused UseNUMA in os_aix.cpp + - JDK-8351933: Inaccurate masking of TC subfield decrement in ForkJoinPool + - JDK-8352076: [21u] Problem list tests that fail in 21 and would be fixed by 8309622 + - JDK-8352109: java/awt/Desktop/MailTest.java fails in platforms where Action.MAIL is not supported + - JDK-8352302: Test sun/security/tools/jarsigner/TimestampCheck.java is failing + - JDK-8352512: TestVectorZeroCount: counter not reset between iterations + - JDK-8352676: Opensource JMenu tests - series1 + - JDK-8352680: Opensource few misc swing tests + - JDK-8352684: Opensource JInternalFrame tests - series1 + - JDK-8352706: httpclient HeadTest does not run on HTTP2 + - JDK-8352716: (tz) Update Timezone Data to 2025b + - JDK-8352908: Open source several swing tests batch1 + - JDK-8352942: jdk/jfr/startupargs/TestMemoryOptions.java fails with 32-bit build + - JDK-8353070: Clean up and open source couple AWT Graphics related tests (Part 1) + - JDK-8353138: Screen capture for test TaskbarPositionTest.java, failure case + - JDK-8353190: Use "/native" Run Option for TestAvailableProcessors Execution + - JDK-8353237: [AArch64] Incorrect result of VectorizedHashCode intrinsic on Cortex-A53 + - JDK-8353320: Open source more Swing text tests + - JDK-8353446: Open source several AWT Menu tests - Batch 2 + - JDK-8353475: Open source two Swing DefaultCaret tests + - JDK-8353685: Open some JComboBox bugs 4 + - JDK-8353709: Debug symbols bundle should contain full debug files when building --with-external-symbols-in-bundles=public + - JDK-8353787: Increased number of SHA-384-Digest java.util.jar.Attributes$Name instances leading to higher memory footprint + - JDK-8353942: Open source Swing Tests - Set 5 + - JDK-8354255: [jittester] Remove TempDir debug output + - JDK-8354530: AIX: sporadic unexpected errno when calling setsockopt in Net.joinOrDrop + - JDK-8354554: Open source several clipboard tests batch1 + - JDK-8354802: MAX_SECS definition is unused in os_linux + - JDK-8354893: [REDO BACKPORT] javac crashes while adding type annotations to the return type of a constructor (JDK-8320001) + - JDK-8355498: [AIX] Adapt code for C++ VLA rule + - JDK-8356053: Test java/awt/Toolkit/Headless/HeadlessToolkit.java fails by timeout + - JDK-8356096: ISO 4217 Amendment 179 Update + - JDK-8356571: Re-enable -Wtype-limits for GCC in LCMS + - JDK-8357105: C2: compilation fails with "assert(false) failed: empty program detected during loop optimization" + - JDK-8357193: [VS 2022 17.14] Warning C5287 in debugInit.c: enum type mismatch during build + - JDK-8359170: Add 2 TLS and 2 CS Sectigo roots + - JDK-8360147: Better Glyph drawing redux + - JDK-8360406: [21u] Disable logic for attaching type annotations to class files until 8359336 is fixed + - JDK-8361672: [21u] Remove designator DEFAULT_PROMOTED_VERSION_PRE=ea for release 21.0.8 + +Notes on individual issues: +=========================== + +tools/javac: + +JDK-8341779: [REDO BACKPORT] type annotations are not visible to javac plugins across compilation boundaries (JDK-8225377) +========================================================================================================================== +The compiler in previous releases of OpenJDK 21 would only provide +access to type annotations on types loaded from source code files. If +the type was instead loaded from bytecode, then any type annotations +would be absent. + +With this release, `TypeMirror` now provides access to annotations for +types loaded from bytecode. These type annotations can be obtained +using `AnnotationMirror#getAnnotationMirrors` and will be included in +the output of `AnnotationMirror#toString`. + +Programs that rely on type annotations being absent from elements +loaded from bytecode will need to be updated accordingly. Due to +ongoing issues with this new feature (see JDK-8360406), it is not +enabled by default and the option `-XDaddTypeAnnotationsToSymbol=true` +must be specified in order for bytecode type annotations to be +included. + +core-libs/java.net: + +JDK-8342075: HttpClient: improve HTTP/2 flow control checks +=========================================================== +This release of OpenJDK 21 enhances the HTTP/2 client implementation +in `java.net.http.HttpClient` to report flow control errors back to +the server. While this should be transparent in most cases, it may +lead to streams being reset or connections being closed if connecting +to a HTTP/2 server that does not correctly handle these errors. + +Flow control limits can be adjusted using the following existing +properties: + +* `jdk.httpclient.connectionWindowSize` + - Specifies the HTTP/2 client connection window size in bytes. + - Default value: `67108864` (2^26, 64 MiB) + - Range: `2^16-1` to `2^31-1`. + +* `jdk.httpclient.windowSize` + - Specifies the HTTP/2 client stream window size in bytes. + - Default value: `16777216` (2^24, 16 MiB) + - Range: `2^14` to `2^31-1` + +Specifying an invalid value leads to the default value being used. +The implementation guarantees that the actual value used for the +connection window size will be no smaller than the stream window size. + +hotspot/runtime: + +JDK-8318636: Add jcmd to print annotated process memory map +=========================================================== +Two new diagnostic commands have been added to `jcmd`, which print the +virtual memory map of the JVM either to standard output or a file. If +Native Memory Tracking (NMT) is enabled, NMT information about the +virtual memory segments will be included. + +The new commands are: + +* `jcmd System.map` -- prints the virtual memory map of the JVM +identified by `` to the standard output. + +* `jcmd System.dump_map` -- prints the virtual memory map of the +JVM identified by `` to a file `vm_memory_map_.txt` in the +current directory. + +security-libs/java.security: + +JDK-8303770: Remove Baltimore root certificate expiring in May 2025 +=================================================================== +The following root certificate from Baltimore has been removed from +the `cacerts` keystore: + +Alias Name: baltimorecybertrustca [jdk] +Distinguished Name: CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE + +JDK-8347506: Compatible OCSP readtimeout property with OCSP timeout +=================================================================== +The initial release of OpenJDK 21 introduced the +`com.sun.security.ocsp.readtimeout` property, which was paired with +the existing `com.sun.security.ocsp.timeout` to give greater control +over the timeouts for OCSP connections and certificate retrieval. The +existence of two separate properties allows the timeout for reading +data to be set separately from the timeout for the transport layer. + +When `com.sun.security.ocsp.readtimeout` was backported to OpenJDK +17.0.15, the default value of `com.sun.security.ocsp.readtimeout` was +changed from 15 seconds to the value of +`com.sun.security.ocsp.timeout`, which itself has a default of 15 +seconds. This change is brought forward to OpenJDK 21 with this +release. + +If neither property is set, both will default to 15 seconds as in +previous OpenJDK 21 releases. If only `com.sun.security.ocsp.timeout` +is set, `com.sun.security.ocsp.readtimeout` will use the same value +which retains the behaviour from before the +`com.sun.security.ocsp.readtimeout` property was introduced. + +JDK-8347596: Update HSS/LMS public key encoding +=============================================== +The X.509 encoding format for HSS/LMS public keys has been updated to +align with the latest standard outlined in RFC 9708 [0]. Notably, the +OCTET_STRING wrapping around the public key value has been removed. +For compatibility, the JDK will still detect the presence of DER +encoding when reading keys encoded by earlier releases. + +[0] https://www.rfc-editor.org/rfc/rfc9708.html#name-hss-lms-public-key-identifi + +JDK-8350498: Remove two Camerfirma root CA certificates +======================================================= +The following expired root certificates from Camerfirma have been +removed from the `cacerts` keystore: + +Alias name: camerfirmachamberscommerceca [jdk] +CN=Chambers of Commerce Root +OU=http://www.chambersign.org +O=AC Camerfirma SA CIF A82743287 +C=EU +SHA256: 0C:25:8A:12:A5:67:4A:EF:25:F2:8B:A7:DC:FA:EC:EE:A3:48:E5:41:E6:F5:CC:4E:E6:3B:71:B3:61:60:6A:C3 + +Alias name: camerfirmachambersignca [jdk] +CN=Global Chambersign Root - 2008 +O=AC Camerfirma S.A. +SERIALNUMBER=A82743287 +L=Madrid (see current address at www.camerfirma.com/address) +C=EU +SHA256: 13:63:35:43:93:34:A7:69:80:16:A0:D3:24:DE:72:28:4E:07:9D:7B:52:20:BB:8F:BD:74:78:16:EE:BE:BA:CA + +JDK-8359170: Add 2 TLS and 2 CS Sectigo roots +============================================= +The following root certificates have been added to the cacerts +truststore: + +Name: Sectigo Limited +Alias Name: sectigocodesignroote46 +Distinguished Name: CN=Sectigo Public Code Signing Root E46, O=Sectigo Limited, C=GB + +Name: Sectigo Limited +Alias Name: sectigocodesignrootr46 +Distinguished Name: CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB + +Name: Sectigo Limited +Alias Name: sectigotlsroote46 +Distinguished Name: Sectigo Public Server Authentication Root E46, O=Sectigo Limited, C=GB + +Name: Sectigo Limited +Alias Name: sectigotlsrootr46 +Distinguished Name: Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB + +New in release OpenJDK 21.0.7 (2025-04-15): +=========================================== +Live versions of these release notes can be found at: + * https://bit.ly/openjdk2107 + +* CVEs + - CVE-2025-21587 + - CVE-2025-30691 + - CVE-2025-30698 +* Changes + - JDK-8198237: [macos] Test java/awt/Frame/ExceptionOnSetExtendedStateTest/ExceptionOnSetExtendedStateTest.java fails + - JDK-8211851: (ch) java/nio/channels/AsynchronousSocketChannel/StressLoopback.java times out (aix) + - JDK-8226933: [TEST_BUG]GTK L&F: There is no swatches or RGB tab in JColorChooser + - JDK-8226938: [TEST_BUG]GTK L&F: There is no Details button in FileChooser Dialog + - JDK-8227529: With malformed --app-image the error messages are awful + - JDK-8277240: java/awt/Graphics2D/ScaledTransform/ScaledTransform.java dialog does not get disposed + - JDK-8283664: Remove jtreg tag manual=yesno for java/awt/print/PrinterJob/PrintTextTest.java + - JDK-8286875: ProgrammableUpcallHandler::on_entry/on_exit access thread fields from native + - JDK-8293345: SunPKCS11 provider checks on PKCS11 Mechanism are problematic + - JDK-8294316: SA core file support is broken on macosx-x64 starting with macOS 12.x + - JDK-8295159: DSO created with -ffast-math breaks Java floating-point arithmetic + - JDK-8302111: Serialization considerations + - JDK-8304701: Request with timeout aborts later in-flight request on HTTP/1.1 cxn + - JDK-8309841: Jarsigner should print a warning if an entry is removed + - JDK-8311546: Certificate name constraints improperly validated with leading period + - JDK-8312570: [TESTBUG] Jtreg compiler/loopopts/superword/TestDependencyOffsets.java fails on 512-bit SVE + - JDK-8313633: [macOS] java/awt/dnd/NextDropActionTest/NextDropActionTest.java fails with java.lang.RuntimeException: wrong next drop action! + - JDK-8313905: Checked_cast assert in CDS compare_by_loader + - JDK-8314752: Use google test string comparison macros + - JDK-8314909: tools/jpackage/windows/Win8282351Test.java fails with java.lang.AssertionError: Expected [0]. Actual [1618]: + - JDK-8315486: vmTestbase/nsk/jdwp/ThreadReference/ForceEarlyReturn/forceEarlyReturn002/forceEarlyReturn002.java timed out + - JDK-8315825: Open some swing tests + - JDK-8315882: Open some swing tests 2 + - JDK-8315883: Open source several Swing JToolbar tests + - JDK-8315952: Open source several Swing JToolbar JTooltip JTree tests + - JDK-8316056: Open source several Swing JTree tests + - JDK-8316146: Open some swing tests 4 + - JDK-8316149: Open source several Swing JTree JViewport KeyboardManager tests + - JDK-8316218: Open some swing tests 5 + - JDK-8316371: Open some swing tests 6 + - JDK-8316627: JViewport Test headless failure + - JDK-8316885: jcmd: Compiler.CodeHeap_Analytics cmd does not inform about missing aggregate + - JDK-8317283: jpackage tests run osx-specific checks on windows and linux + - JDK-8317636: Improve heap walking API tests to verify correctness of field indexes + - JDK-8317808: HTTP/2 stream cancelImpl may leave subscriber registered + - JDK-8317919: pthread_attr_init handle return value and destroy pthread_attr_t object + - JDK-8319233: AArch64: Build failure with clang due to -Wformat-nonliteral warning + - JDK-8320372: test/jdk/sun/security/x509/DNSName/LeadingPeriod.java validity check failed + - JDK-8320676: Manual printer tests have no Pass/Fail buttons, instructions close set 1 + - JDK-8320691: Timeout handler on Windows takes 2 hours to complete + - JDK-8320706: RuntimePackageTest.testUsrInstallDir test fails on Linux + - JDK-8320916: jdk/jfr/event/gc/stacktrace/TestParallelMarkSweepAllocationPendingStackTrace.java failed with "OutOfMemoryError: GC overhead limit exceeded" + - JDK-8321818: vmTestbase/nsk/stress/strace/strace015.java failed with 'Cannot read the array length because "" is null' + - JDK-8322983: Virtual Threads: exclude 2 tests + - JDK-8324672: Update jdk/java/time/tck/java/time/TCKInstant.java now() to be more robust + - JDK-8324807: Manual printer tests have no Pass/Fail buttons, instructions close set 2 + - JDK-8324838: test_nmt_locationprinting.cpp broken in the gcc windows build + - JDK-8325042: Remove unused JVMDITools test files + - JDK-8325529: Remove unused imports from `ModuleGenerator` test file + - JDK-8325659: Normalize Random usage by incubator vector tests + - JDK-8325937: runtime/handshake/HandshakeDirectTest.java causes "monitor end should be strictly below the frame pointer" assertion failure on AArch64 + - JDK-8326421: Add jtreg test for large arrayCopy disjoint case. + - JDK-8326525: com/sun/tools/attach/BasicTests.java does not verify AgentLoadException case + - JDK-8327098: GTest needs larger combination limit + - JDK-8327390: JitTester: Implement temporary folder functionality + - JDK-8327460: Compile tests with the same visibility rules as product code + - JDK-8327476: Upgrade JLine to 3.26.1 + - JDK-8327505: Test com/sun/jmx/remote/NotificationMarshalVersions/TestSerializationMismatch.java fails + - JDK-8327857: Remove applet usage from JColorChooser tests Test4222508 + - JDK-8327859: Remove applet usage from JColorChooser tests Test4319113 + - JDK-8327986: ASAN reports use-after-free in DirectivesParserTest.empty_object_vm + - JDK-8327994: Update code gen in CallGeneratorHelper + - JDK-8328005: Convert java/awt/im/JTextFieldTest.java applet test to main + - JDK-8328085: C2: Use after free in PhaseChaitin::Register_Allocate() + - JDK-8328121: Remove applet usage from JColorChooser tests Test4759306 + - JDK-8328130: Remove applet usage from JColorChooser tests Test4759934 + - JDK-8328185: Convert java/awt/image/MemoryLeakTest/MemoryLeakTest.java applet test to main + - JDK-8328227: Remove applet usage from JColorChooser tests Test4887836 + - JDK-8328368: Convert java/awt/image/multiresolution/MultiDisplayTest/MultiDisplayTest.java applet test to main + - JDK-8328370: Convert java/awt/print/Dialog/PrintApplet.java applet test to main + - JDK-8328380: Remove applet usage from JColorChooser tests Test6348456 + - JDK-8328387: Convert java/awt/Frame/FrameStateTest/FrameStateTest.html applet test to main + - JDK-8328403: Remove applet usage from JColorChooser tests Test6977726 + - JDK-8328553: Get rid of JApplet in test/jdk/sanity/client/lib/SwingSet2/src/DemoModule.java + - JDK-8328558: Convert javax/swing/JCheckBox/8032667/bug8032667.java applet test to main + - JDK-8328717: Convert javax/swing/JColorChooser/8065098/bug8065098.java applet test to main + - JDK-8328719: Convert java/awt/print/PageFormat/SetOrient.html applet test to main + - JDK-8328730: Convert java/awt/print/bug8023392/bug8023392.html applet test to main + - JDK-8328753: Open source few Undecorated Frame tests + - JDK-8328819: Remove applet usage from JFileChooser tests bug6698013 + - JDK-8328827: Convert java/awt/print/PrinterJob/PrinterDialogsModalityTest/PrinterDialogsModalityTest.html applet test to main + - JDK-8329210: Delete Redundant Printer Dialog Modality Test + - JDK-8329320: Simplify awt/print/PageFormat/NullPaper.java test + - JDK-8329322: Convert PageFormat/Orient.java to use PassFailJFrame + - JDK-8329692: Add more details to FrameStateTest.java test instructions + - JDK-8330647: Two CDS tests fail with -UseCompressedOops and UseSerialGC/UseParallelGC + - JDK-8330702: Update failure handler to don't generate Error message if cores actions are empty + - JDK-8331735: UpcallLinker::on_exit races with GC when copying frame anchor + - JDK-8331959: Update PKCS#11 Cryptographic Token Interface to v3.1 + - JDK-8331977: Crash: SIGSEGV in dlerror() + - JDK-8331993: Add counting leading/trailing zero tests for Integer + - JDK-8332158: [XWayland] test/jdk/java/awt/Mouse/EnterExitEvents/ResizingFrameTest.java + - JDK-8332494: java/util/zip/EntryCount64k.java failing with java.lang.RuntimeException: '\\A\\Z' missing from stderr + - JDK-8332917: failure_handler should execute gdb "info threads" command on linux + - JDK-8333116: test/jdk/tools/jpackage/share/ServiceTest.java test fails + - JDK-8333360: PrintNullString.java doesn't use float arguments + - JDK-8333391: Test com/sun/jdi/InterruptHangTest.java failed: Thread was never interrupted during sleep + - JDK-8333403: Write a test to check various components events are triggered properly + - JDK-8333647: C2 SuperWord: some additional PopulateIndex tests + - JDK-8334305: Remove all code for nsk.share.Log verbose mode + - JDK-8334371: [AIX] Beginning with AIX 7.3 TL1 mmap() supports 64K memory pages + - JDK-8334490: Normalize string with locale invariant `toLowerCase()` + - JDK-8334777: Test javax/management/remote/mandatory/notif/NotifReconnectDeadlockTest.java failed with NullPointerException + - JDK-8335288: SunPKCS11 initialization will call C_GetMechanismInfo on unsupported mechanisms + - JDK-8335468: [XWayland] JavaFX hangs when calling java.awt.Robot.getPixelColor + - JDK-8335789: [TESTBUG] XparColor.java test fails with Error. Parse Exception: Invalid or unrecognized bugid: @ + - JDK-8336012: Fix usages of jtreg-reserved properties + - JDK-8336498: [macos] [build]: install-file macro may run into permission denied error + - JDK-8336692: Redo fix for JDK-8284620 + - JDK-8336942: Improve test coverage for class loading elements with annotations of different retentions + - JDK-8337222: gc/TestDisableExplicitGC.java fails due to unexpected CodeCache GC + - JDK-8337494: Clarify JarInputStream behavior + - JDK-8337660: C2: basic blocks with only BoxLock nodes are wrongly treated as empty + - JDK-8337692: Better TLS connection support + - JDK-8337886: java/awt/Frame/MaximizeUndecoratedTest.java fails in OEL due to a slight color difference + - JDK-8337951: Test sun/security/validator/samedn.sh CertificateNotYetValidException: NotBefore validation + - JDK-8337994: [REDO] Native memory leak when not recording any events + - JDK-8338100: C2: assert(!n_loop->is_member(get_loop(lca))) failed: control must not be back in the loop + - JDK-8338303: Linux ppc64le with toolchain clang - detection failure in early JVM startup + - JDK-8338426: Test java/nio/channels/Selector/WakeupNow.java failed + - JDK-8338430: Improve compiler transformations + - JDK-8338571: [TestBug] DefaultCloseOperation.java test not working as expected wrt instruction after JDK-8325851 fix + - JDK-8338595: Add more linesize for MIME decoder in macro bench test Base64Decode + - JDK-8338668: Test javax/swing/JFileChooser/8080628/bug8080628.java doesn't test for GTK L&F + - JDK-8339154: Cleanups and JUnit conversion of test/jdk/java/util/zip/Available.java + - JDK-8339261: Logs truncated in test javax/net/ssl/DTLS/DTLSRehandshakeTest.java + - JDK-8339356: Test javax/net/ssl/SSLSocket/Tls13PacketSize.java failed with java.net.SocketException: An established connection was aborted by the software in your host machine + - JDK-8339475: Clean up return code handling for pthread calls in library coding + - JDK-8339524: Clean up a few ExtendedRobot tests + - JDK-8339542: compiler/codecache/CheckSegmentedCodeCache.java fails + - JDK-8339687: Rearrange reachabilityFence()s in jdk.test.lib.util.ForceGC + - JDK-8339728: [Accessibility,Windows,JAWS] Bug in the getKeyChar method of the AccessBridge class + - JDK-8339810: Clean up the code in sun.tools.jar.Main to properly close resources and use ZipFile during extract + - JDK-8339834: Replace usages of -mx and -ms in some tests + - JDK-8339883: Open source several AWT/2D related tests + - JDK-8339902: Open source couple TextField related tests + - JDK-8339943: Frame not disposed in java/awt/dnd/DropActionChangeTest.java + - JDK-8340078: Open source several 2D tests + - JDK-8340116: test/jdk/sun/security/tools/jarsigner/PreserveRawManifestEntryAndDigest.java can fail due to regex + - JDK-8340313: Crash due to invalid oop in nmethod after C1 patching + - JDK-8340411: open source several 2D imaging tests + - JDK-8340480: Bad copyright notices in changes from JDK-8339902 + - JDK-8340687: Open source closed frame tests #1 + - JDK-8340719: Open source AWT List tests + - JDK-8340824: C2: Memory for TypeInterfaces not reclaimed by hashcons() + - JDK-8340969: jdk/jfr/startupargs/TestStartDuration.java should be marked as flagless + - JDK-8341037: Use standard layouts in DefaultFrameIconTest.java and MenuCrash.java + - JDK-8341111: open source several AWT tests including menu shortcut tests + - JDK-8341135: Incorrect format string after JDK-8339475 + - JDK-8341194: [REDO] Implement C2 VectorizedHashCode on AArch64 + - JDK-8341316: [macos] javax/swing/ProgressMonitor/ProgressMonitorEscapeKeyPress.java fails sometimes in macos + - JDK-8341412: Various test failures after JDK-8334305 + - JDK-8341424: GHA: Collect hs_errs from build time failures + - JDK-8341453: java/awt/a11y/AccessibleJTableTest.java fails in some cases where the test tables are not visible + - JDK-8341715: PPC64: ObjectMonitor::_owner should be reset unconditionally in nmethod unlocking + - JDK-8341820: Check return value of hcreate_r + - JDK-8341862: PPC64: C1 unwind_handler fails to unlock synchronized methods with LM_MONITOR + - JDK-8341881: [REDO] java/nio/file/attribute/BasicFileAttributeView/CreationTime.java#tmp fails on alinux3 + - JDK-8341978: Improve JButton/bug4490179.java + - JDK-8341982: Simplify JButton/bug4323121.java + - JDK-8342098: Write a test to compare the images + - JDK-8342145: File libCreationTimeHelper.c compile fails on Alpine + - JDK-8342270: Test sun/security/pkcs11/Provider/RequiredMechCheck.java needs write access to src tree + - JDK-8342498: Add test for Allocation elimination after use as alignment reference by SuperWord + - JDK-8342508: Use latch in BasicMenuUI/bug4983388.java instead of delay + - JDK-8342541: Exclude List/KeyEventsTest/KeyEventsTest.java from running on macOS + - JDK-8342562: Enhance Deflater operations + - JDK-8342602: Remove JButton/PressedButtonRightClickTest test + - JDK-8342609: jpackage test helper function incorrectly removes a directory instead of its contents only + - JDK-8342634: javax/imageio/plugins/wbmp/WBMPStreamTruncateTest.java creates temp file in src dir + - JDK-8342635: javax/swing/JFileChooser/FileSystemView/WindowsDefaultIconSizeTest.java creates tmp file in src dir + - JDK-8342704: GHA: Report truncation is broken after JDK-8341424 + - JDK-8342811: java/net/httpclient/PlainProxyConnectionTest.java failed: Unexpected connection count: 5 + - JDK-8342858: Make target mac-jdk-bundle fails on chmod command + - JDK-8342988: GHA: Build JTReg in single step + - JDK-8343007: Enhance Buffered Image handling + - JDK-8343100: Consolidate EmptyFolderTest and EmptyFolderPackageTest jpackage tests into single java file + - JDK-8343101: Rework BasicTest.testTemp test cases + - JDK-8343102: Remove `--compress` from jlink command lines from jpackage tests + - JDK-8343118: [TESTBUG] java/awt/PrintJob/PrintCheckboxTest/PrintCheckboxManualTest.java fails with rror. Can't find HTML file PrintCheckboxManualTest.html + - JDK-8343128: PassFailJFrame.java test result: Error. Bad action for script: build} + - JDK-8343129: Disable unstable check of ThreadsListHandle.sanity_vm ThreadList values + - JDK-8343144: UpcallLinker::on_entry racingly clears pending exception with GC safepoints + - JDK-8343149: Cleanup os::print_tos_pc on AIX + - JDK-8343178: Test BasicTest.java javac compile fails cannot find symbol + - JDK-8343205: CompileBroker::possibly_add_compiler_threads excessively polls available memory + - JDK-8343314: Move common properties from jpackage jtreg test declarations to TEST.properties file + - JDK-8343343: Misc crash dump improvements on more platforms after JDK-8294160 + - JDK-8343378: Exceptions in javax/management DeadLockTest.java do not cause test failure + - JDK-8343396: Use OperatingSystem, Architecture, and OSVersion in jpackage tests + - JDK-8343491: javax/management/remote/mandatory/connection/DeadLockTest.java failing with NoSuchObjectException: no such object in table + - JDK-8343599: Kmem limit and max values swapped when printing container information + - JDK-8343882: BasicAnnoTests doesn't handle multiple annotations at the same position + - JDK-8344275: tools/jpackage/windows/Win8301247Test.java fails on localized Windows platform + - JDK-8344326: Move jpackage tests from "jdk.jpackage.tests" package to the default package + - JDK-8344581: [TESTBUG] java/awt/Robot/ScreenCaptureRobotTest.java failing on macOS + - JDK-8344589: Update IANA Language Subtag Registry to Version 2024-11-19 + - JDK-8344646: The libjsig deprecation warning should go to stderr not stdout + - JDK-8345296: AArch64: VM crashes with SIGILL when prctl is disallowed + - JDK-8345368: java/io/File/createTempFile/SpecialTempFile.java fails on Windows Server 2025 + - JDK-8345370: Bump update version for OpenJDK: jdk-21.0.7 + - JDK-8345375: Improve debuggability of test/jdk/java/net/Socket/CloseAvailable.java + - JDK-8345414: Google CAInterop test failures + - JDK-8345468: test/jdk/javax/swing/JScrollBar/4865918/bug4865918.java fails in ubuntu22.04 + - JDK-8345569: [ubsan] adjustments to filemap.cpp and virtualspace.cpp for macOS aarch64 + - JDK-8345614: Improve AnnotationFormatError message for duplicate annotation interfaces + - JDK-8345676: [ubsan] ProcessImpl_md.c:561:40: runtime error: applying zero offset to null pointer on macOS aarch64 + - JDK-8345684: OperatingSystemMXBean.getSystemCpuLoad() throws NPE + - JDK-8345750: Shenandoah: Test TestJcmdHeapDump.java#aggressive intermittent assert(gc_cause() == GCCause::_no_gc) failed: Over-writing cause + - JDK-8346055: javax/swing/text/StyledEditorKit/4506788/bug4506788.java fails in ubuntu22.04 + - JDK-8346108: [21u][BACKOUT] 8337994: [REDO] Native memory leak when not recording any events + - JDK-8346324: javax/swing/JScrollBar/4865918/bug4865918.java fails in CI + - JDK-8346587: Distrust TLS server certificates anchored by Camerfirma Root CAs + - JDK-8346671: java/nio/file/Files/probeContentType/Basic.java fails on Windows 2025 + - JDK-8346713: [testsuite] NeverActAsServerClassMachine breaks TestPLABAdaptToMinTLABSize.java TestPinnedHumongousFragmentation.java TestPinnedObjectContents.java + - JDK-8346828: javax/swing/JScrollBar/4865918/bug4865918.java still fails in CI + - JDK-8346847: [s390x] minimal build failure + - JDK-8346880: [aix] java/lang/ProcessHandle/InfoTest.java still fails: "reported cputime less than expected" + - JDK-8346881: [ubsan] logSelection.cpp:154:24 / logSelectionList.cpp:72:94 : runtime error: applying non-zero offset 1 to null pointer + - JDK-8346887: DrawFocusRect() may cause an assertion failure + - JDK-8346972: Test java/nio/channels/FileChannel/LoopingTruncate.java fails sometimes with IOException: There is not enough space on the disk + - JDK-8347038: [JMH] jdk.incubator.vector.SpiltReplicate fails NoClassDefFoundError + - JDK-8347129: cpuset cgroups controller is required for no good reason + - JDK-8347171: (dc) java/nio/channels/DatagramChannel/InterruptibleOrNot.java fails with virtual thread factory + - JDK-8347256: Epsilon: Demote heap size and AlwaysPreTouch warnings to info level + - JDK-8347267: [macOS]: UnixOperatingSystem.c:67:40: runtime error: division by zero + - JDK-8347268: [ubsan] logOutput.cpp:357:21: runtime error: applying non-zero offset 1 to null pointer + - JDK-8347424: Fix and rewrite sun/security/x509/DNSName/LeadingPeriod.java test + - JDK-8347427: JTabbedPane/8134116/Bug8134116.java has no license header + - JDK-8347576: Error output in libjsound has non matching format strings + - JDK-8347740: java/io/File/createTempFile/SpecialTempFile.java failing + - JDK-8347847: Enhance jar file support + - JDK-8347911: Limit the length of inflated text chunks + - JDK-8347965: (tz) Update Timezone Data to 2025a + - JDK-8348562: ZGC: segmentation fault due to missing node type check in barrier elision analysis + - JDK-8348625: [21u, 17u] Revert JDK-8185862 to restore old java.awt.headless behavior on Windows + - JDK-8348675: TrayIcon tests fail in Ubuntu 24.10 Wayland + - JDK-8349039: Adjust exception No type named in database + - JDK-8349603: [21u, 17u, 11u] Update GHA JDKs after Jan/25 updates + - JDK-8349729: [21u] AIX jtreg tests fail to compile with qvisibility=hidden + - JDK-8352097: (tz) zone.tab update missed in 2025a backport + - JDK-8353904: [21u] Remove designator DEFAULT_PROMOTED_VERSION_PRE=ea for release 21.0.7 + +Notes on individual issues: +=========================== + +security-libs/java.security: + +JDK-8309841: Jarsigner should print a warning if an entry is removed +==================================================================== +In previous OpenJDK releases, the jarsigner tool did not detect the +case where a file was removed from a signed JAR file but its signature +was still present. With this release, `jarsigner -verify` checks that +every signature has a matching file entry and prints a warning if this +is not the case. The `-verbose` option can also be added to the +command to see the names of the mismatched entries. + +security-libs/javax.net.ssl: + +JDK-8346587: Distrust TLS server certificates anchored by Camerfirma Root CAs +============================================================================= +In accordance with similar plans recently announced by Google, +Mozilla, Apple and Microsoft, the JDK will not trust Transport Layer +Security (TLS) certificates issued after the 15th of April 2025 which +are anchored by Camerfirma root certificates. + +Certificates issued on or before April 15th, 2025 will continue to +be trusted until they expire. + +If a server's certificate chain is anchored by an affected +certificate, attempts to negotiate a TLS session will fail with an +Exception that indicates the trust anchor is not trusted. For example, + +"TLS server certificate issued after 2025-04-15 and anchored by a +distrusted legacy Camerfirma root CA: CN=Chambers of Commerce Root - +2008, O=AC Camerfirma S.A., SERIALNUMBER=A82743287, L=Madrid (see +current address at www.camerfirma.com/address), C=EU" + +To check whether a certificate in a JDK keystore is affected by this +change, you can the `keytool` utility: + +keytool -v -list -alias -keystore + +If any of the certificates in the chain are affected by this change, +then you will need to update the certificate or contact the +organisation responsible for managing the certificate. + +These restrictions apply to the following Camerfirma root certificates +included in the JDK: + +Alias name: camerfirmachamberscommerceca [jdk] +CN=Chambers of Commerce Root +OU=http://www.chambersign.org +O=AC Camerfirma SA CIF A82743287 +C=EU +SHA256: 0C:25:8A:12:A5:67:4A:EF:25:F2:8B:A7:DC:FA:EC:EE:A3:48:E5:41:E6:F5:CC:4E:E6:3B:71:B3:61:60:6A:C3 + +Alias name: camerfirmachambersca [jdk] +CN=Chambers of Commerce Root - 2008 +O=AC Camerfirma S.A. +SERIALNUMBER=A82743287 +L=Madrid (see current address at www.camerfirma.com/address) +C=EU +SHA256: 06:3E:4A:FA:C4:91:DF:D3:32:F3:08:9B:85:42:E9:46:17:D8:93:D7:FE:94:4E:10:A7:93:7E:E2:9D:96:93:C0 + +Alias name: camerfirmachambersignca [jdk] +CN=Global Chambersign Root - 2008 +O=AC Camerfirma S.A. +SERIALNUMBER=A82743287 +L=Madrid (see current address at www.camerfirma.com/address) +C=EU +SHA256: 13:63:35:43:93:34:A7:69:80:16:A0:D3:24:DE:72:28:4E:07:9D:7B:52:20:BB:8F:BD:74:78:16:EE:BE:BA:CA + +Users can, *at their own risk*, remove this restriction by modifying +the `java.security` configuration file (or override it by using the +`java.security.properties` system property) so "CAMERFIRMA_TLS" is no +longer listed in the `jdk.security.caDistrustPolicies` security +property. + +security-libs/javax.crypto:pkcs11: + +JDK-8293345: SunPKCS11 provider checks on PKCS11 Mechanism are problematic +========================================================================== +In OpenJDK 14, the notion of legacy mechanisms was introduced into the +SunPKCS11 provider. If a mechanism was found to be using a weak +algorithm, it was determined to be legacy and disabled. + +However, this approach has proved inflexible. There was no way for the +user to override the legacy determination and enable the mechanism +anyway. Also, a mechanism being used for signing would be declared +legacy and disabled if it had a weak encryption algorithm, even though +encryption was not being used. Similarly, a weak signing algorithm +would prevent the mechanism's use as a cipher for encryption or +decryption. + +This OpenJDK release resolves these issues. It introduces the PKCS11 +provider configuration attribute "allowLegacy" which can be set to +`true` if the user wishes to override the legacy determination. By +default, it is set to `false`. The legacy determination now also +considers the service type and will only check encryption algorithms +for Ciphers and only signature algorithms for Signatures. + New in release OpenJDK 21.0.6 (2025-01-21): =========================================== Live versions of these release notes can be found at: diff --git a/SOURCES/fips-21u-0a42e29b391.patch b/SOURCES/fips-21u-a0fd6e8ed6e.patch similarity index 99% rename from SOURCES/fips-21u-0a42e29b391.patch rename to SOURCES/fips-21u-a0fd6e8ed6e.patch index 54e8da0..2db9580 100644 --- a/SOURCES/fips-21u-0a42e29b391.patch +++ b/SOURCES/fips-21u-a0fd6e8ed6e.patch @@ -136,10 +136,10 @@ index 51d4f724c33..feb0bcf3e75 100644 BASIC_JDKLIB_LIBS="" BASIC_JDKLIB_LIBS_TARGET="" diff --git a/make/autoconf/spec.gmk.in b/make/autoconf/spec.gmk.in -index f6def153c82..4d7abc33427 100644 +index 7f085676ca9..2476b9ae964 100644 --- a/make/autoconf/spec.gmk.in +++ b/make/autoconf/spec.gmk.in -@@ -873,6 +873,11 @@ INSTALL_SYSCONFDIR=@sysconfdir@ +@@ -822,6 +822,11 @@ PANDOC_MARKDOWN_FLAG:=@PANDOC_MARKDOWN_FLAG@ # Libraries # @@ -1979,7 +1979,7 @@ index 539ef1e8ee8..435f57e3ff2 100644 "sun.security.rsa.PSSParameters", null); } diff --git a/src/java.base/share/conf/security/java.security b/src/java.base/share/conf/security/java.security -index 5149edba0e5..8227d650a03 100644 +index 6b0fd201b9b..2af4e3a3e21 100644 --- a/src/java.base/share/conf/security/java.security +++ b/src/java.base/share/conf/security/java.security @@ -85,6 +85,17 @@ security.provider.tbd=Apple @@ -2064,7 +2064,7 @@ index 5149edba0e5..8227d650a03 100644 # the javax.net.ssl package. diff --git a/src/java.base/share/conf/security/nss.fips.cfg.in b/src/java.base/share/conf/security/nss.fips.cfg.in new file mode 100644 -index 00000000000..55bbba98b7a +index 00000000000..6de716e6b42 --- /dev/null +++ b/src/java.base/share/conf/security/nss.fips.cfg.in @@ -0,0 +1,8 @@ @@ -2074,7 +2074,7 @@ index 00000000000..55bbba98b7a +nssDbMode = readWrite +nssModule = fips + -+attributes(*,CKO_SECRET_KEY,CKK_GENERIC_SECRET)={ CKA_SIGN=true } ++attributes(*,CKO_SECRET_KEY,*)={ CKA_SIGN=true CKA_ENCRYPT=true } + diff --git a/src/java.base/share/lib/security/default.policy b/src/java.base/share/lib/security/default.policy index 86d45147709..22fd8675503 100644 @@ -2959,7 +2959,7 @@ index 00000000000..f8d505ca815 +} \ No newline at end of file diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java -index c3b412885a6..0e7ce73b158 100644 +index f8dd5a71c2c..6423805d164 100644 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java @@ -37,6 +37,8 @@ import javax.crypto.*; @@ -2981,7 +2981,7 @@ index c3b412885a6..0e7ce73b158 100644 private static final String PUBLIC = "public"; private static final String PRIVATE = "private"; private static final String SECRET = "secret"; -@@ -401,9 +406,10 @@ abstract class P11Key implements Key, Length { +@@ -414,9 +419,10 @@ abstract class P11Key implements Key, Length { new CK_ATTRIBUTE(CKA_EXTRACTABLE), }); @@ -2995,7 +2995,7 @@ index c3b412885a6..0e7ce73b158 100644 return switch (algorithm) { case "RSA" -> P11RSAPrivateKeyInternal.of(session, keyID, algorithm, -@@ -455,7 +461,8 @@ abstract class P11Key implements Key, Length { +@@ -468,7 +474,8 @@ abstract class P11Key implements Key, Length { public String getFormat() { token.ensureValid(); @@ -3005,13 +3005,13 @@ index c3b412885a6..0e7ce73b158 100644 return null; } else { return "RAW"; -@@ -1625,4 +1632,3 @@ final class SessionKeyRef extends PhantomReference { +@@ -1664,4 +1671,3 @@ final class SessionKeyRef extends PhantomReference { this.clear(); } } - diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java -index 5cd6828d293..bae49c4e8a9 100644 +index 0a62021633f..0723b69c2bc 100644 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java @@ -26,6 +26,9 @@ @@ -3022,7 +3022,7 @@ index 5cd6828d293..bae49c4e8a9 100644 +import java.lang.invoke.MethodHandles; +import java.lang.invoke.MethodType; import java.util.*; - + import java.util.stream.Collectors; import java.security.*; @@ -42,10 +45,12 @@ import javax.security.auth.callback.PasswordCallback; @@ -3141,7 +3141,7 @@ index 5cd6828d293..bae49c4e8a9 100644 } p11 = tmpPKCS11; -@@ -1389,11 +1461,52 @@ public final class SunPKCS11 extends AuthProvider { +@@ -1388,11 +1460,52 @@ public final class SunPKCS11 extends AuthProvider { } @Override @@ -3194,7 +3194,7 @@ index 5cd6828d293..bae49c4e8a9 100644 try { return newInstance0(param); } catch (PKCS11Exception e) { -@@ -1750,6 +1863,9 @@ public final class SunPKCS11 extends AuthProvider { +@@ -1749,6 +1862,9 @@ public final class SunPKCS11 extends AuthProvider { try { session = token.getOpSession(); p11.C_Logout(session.id()); @@ -3252,7 +3252,7 @@ index a6f5f0a8764..9a07c96ca4e 100644 } diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java -index 4b06daaf264..55e14945469 100644 +index 0fd13fd6fa6..3c959c942a1 100644 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java @@ -49,6 +49,9 @@ package sun.security.pkcs11.wrapper; @@ -3312,7 +3312,7 @@ index 4b06daaf264..55e14945469 100644 } if (omitInitialize == false) { try { -@@ -1976,4 +2004,194 @@ static class SynchronizedPKCS11 extends PKCS11 { +@@ -2012,4 +2040,194 @@ static class SynchronizedPKCS11 extends PKCS11 { super.C_GenerateRandom(hSession, randomData); } } diff --git a/SOURCES/java-21-openjdk-portable.specfile b/SOURCES/java-21-openjdk-portable.specfile index 1d56ee3..23085bd 100644 --- a/SOURCES/java-21-openjdk-portable.specfile +++ b/SOURCES/java-21-openjdk-portable.specfile @@ -126,7 +126,7 @@ # Set of architectures for which we build fastdebug builds %global fastdebug_arches x86_64 ppc64le aarch64 # Set of architectures with a Just-In-Time (JIT) compiler -%global jit_arches %{arm} %{aarch64} %{ix86} %{power64} s390x sparcv9 sparc64 x86_64 +%global jit_arches %{arm} %{aarch64} %{ix86} %{power64} s390x sparcv9 sparc64 x86_64 riscv64 # Set of architectures which use the Zero assembler port (!jit_arches) %global zero_arches ppc s390 # Set of architectures which run a full bootstrap cycle @@ -136,15 +136,15 @@ # Set of architectures with a Ahead-Of-Time (AOT) compiler %global aot_arches x86_64 %{aarch64} # Set of architectures which support the serviceability agent -%global sa_arches %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{power64} %{arm} +%global sa_arches %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{power64} %{arm} riscv64 # Set of architectures which support class data sharing # As of JDK-8005165 in OpenJDK 10, class sharing is not arch-specific # However, it does segfault on the Zero assembler port, so currently JIT only %global share_arches %{jit_arches} # Set of architectures for which we build the Shenandoah garbage collector -%global shenandoah_arches x86_64 %{aarch64} +%global shenandoah_arches x86_64 %{aarch64} riscv64 # Set of architectures for which we build the Z garbage collector -%global zgc_arches x86_64 +%global zgc_arches x86_64 riscv64 # Set of architectures for which alt-java has SSB mitigation %global ssbd_arches x86_64 # Set of architectures for which java has short vector math library (libjsvml.so) @@ -161,7 +161,7 @@ # Set of architectures for which we have a devkit # Only used on RHEL %if 0%{?centos} == 0 -%global devkit_arches %{aarch64} %{ppc64le} s390x x86_64 +%global devkit_arches %{aarch64} %{ppc64le} riscv64 s390x x86_64 %endif # By default, we build a slowdebug build during main build on JIT architectures @@ -300,6 +300,10 @@ %global archinstall aarch64 %global stapinstall arm64 %endif +%ifarch riscv64 +%global archinstall riscv64 +%global stapinstall %{_target_cpu} +%endif # 32 bit sparc, optimized for v9 %ifarch sparcv9 %global archinstall sparc @@ -325,7 +329,7 @@ # New Version-String scheme-style defines %global featurever 21 %global interimver 0 -%global updatever 6 +%global updatever 10 %global patchver 0 # buildjdkver is usually same as %%{featurever}, # but in time of bootstrap of next jdk, it is featurever-1, @@ -375,7 +379,7 @@ # Define IcedTea version used for SystemTap tapsets and desktop file %global icedteaver 6.0.0pre00-c848b93a8598 # Define current Git revision for the FIPS support patches -%global fipsver 0a42e29b391 +%global fipsver a0fd6e8ed6e # Define JDK versions %global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver} %global javaver %{featurever} @@ -540,7 +544,7 @@ %if 0%{?centos} == 0 ExclusiveArch: %{devkit_arches} %else -ExclusiveArch: %{aarch64} %{ppc64le} s390x x86_64 +ExclusiveArch: %{aarch64} %{ppc64le} riscv64 s390x x86_64 %endif Name: java-%{javaver}-%{origin}-portable%{?pkgos:-%{pkgos}} @@ -657,6 +661,7 @@ Source18: TestTranslations.java # test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class # RH1940064: Enable XML Signature provider in FIPS mode # RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized [now part of JDK-8301553 upstream] +# OPENJDK-4013: Update nss.fips.cfg to grant CKA_SIGN and CKA_ENCRYPT to any CKO_SECRET_KEY Patch1001: fips-%{featurever}u-%{fipsver}.patch ############################################# @@ -699,7 +704,7 @@ BuildRequires: devtoolset-%{dtsversion}-gcc BuildRequires: devtoolset-%{dtsversion}-gcc-c++ %else %ifarch %{devkit_arches} -BuildRequires: %{devkit_name} >= 1.0-9 +BuildRequires: %{devkit_name} >= 1.1 %else # Earlier versions have a bug in tree vectorization on PPC BuildRequires: gcc >= 4.8.3-8 @@ -755,18 +760,18 @@ BuildRequires: libjpeg-devel BuildRequires: libpng-devel BuildRequires: zlib-devel %else -# Version in src/java.desktop/share/legal/freetype.md -Provides: bundled(freetype) = 2.13.2 +# Version in src/java.desktop/share/native/libfreetype/include/freetype/freetype.h +Provides: bundled(freetype) = 2.13.3 # Version in src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h Provides: bundled(giflib) = 5.2.2 # Version in src/java.desktop/share/native/libharfbuzz/hb-version.h -Provides: bundled(harfbuzz) = 8.2.2 +Provides: bundled(harfbuzz) = 11.2.0 # Version in src/java.desktop/share/native/liblcms/lcms2.h -Provides: bundled(lcms2) = 2.16.0 +Provides: bundled(lcms2) = 2.17.0 # Version in src/java.desktop/share/native/libjavajpeg/jpeglib.h Provides: bundled(libjpeg) = 6b # Version in src/java.desktop/share/native/libsplashscreen/libpng/png.h -Provides: bundled(libpng) = 1.6.43 +Provides: bundled(libpng) = 1.6.51 # Version in src/java.base/share/native/libzip/zlib/zlib.h Provides: bundled(zlib) = 1.3.1 # We link statically against libstdc++ to increase portability @@ -1039,6 +1044,14 @@ done tar -C devkit --strip-components=1 -xzf ${devkittarball} DEVKIT_ROOT=$(pwd)/devkit source ${DEVKIT_ROOT}/devkit.info + # Install annobin plugin as gcc does + ANNOBIN_DIR=${DEVKIT_ROOT}/lib/gcc/%{_target_cpu}-%{_target_os}-gnu/*/plugin + echo "annobin directory = $(echo ${ANNOBIN_DIR})" + pushd ${ANNOBIN_DIR} + cp annobin.so.0.0.0 gcc-annobin.so.0.0.0 + rm -f gcc-annobin.so.0 gcc-annobin.so + ln -s gcc-annobin.so.0.0.0 gcc-annobin.so.0 + ln -s gcc-annobin.so.0.0.0 gcc-annobin.so echo "Installed ${DEVKIT_NAME} devkit" %else %if 0%{?centos} > 0 @@ -1081,9 +1094,6 @@ EXTRA_CFLAGS="$(echo ${EXTRA_CFLAGS} | sed -e 's|-mstackrealign|-mincoming-stack EXTRA_CPP_FLAGS="$(echo ${EXTRA_CPP_FLAGS} | sed -e 's|-mstackrealign|-mincoming-stack-boundary=2 -mpreferred-stack-boundary=4|')" %endif %ifarch %{devkit_arches} -# Remove annobin plugin reference which isn't available in the devkit -EXTRA_CFLAGS="$(echo ${EXTRA_CFLAGS} | sed -e 's|-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1||')" -EXTRA_CPP_FLAGS="$(echo ${EXTRA_CPP_FLAGS} | sed -e 's|-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1||')" # Force DWARF 4 for compatibility EXTRA_CFLAGS="${EXTRA_CFLAGS} -gdwarf-4" EXTRA_CPP_FLAGS="${EXTRA_CPP_FLAGS} -gdwarf-4" @@ -1692,6 +1702,11 @@ $JAVA_HOME/bin/java -XX:+UnlockExperimentalVMOptions -XX:+UseShenandoahGC -versi $JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|sed "s|\.java||") CLDR %endif + # Check blocked.certs is valid (OPENJDK-4362) + jtreg_test=$(pwd)/%{top_level_dir_name}/test/jdk/sun/security/lib/CheckBlockedCerts.java + jtreg_dir=$(dirname ${jtreg_test}) + $JAVA_HOME/bin/java --add-exports java.base/sun.security.util=ALL-UNNAMED -Dtest.src=${jtreg_dir} ${jtreg_test} + # Check src.zip has all sources. See RHBZ#1130490 unzip -l $JAVA_HOME/lib/src.zip | grep 'sun.misc.Unsafe' @@ -1935,6 +1950,104 @@ done %endif %changelog +* Sun Jan 18 2026 Andrew Hughes - 1:21.0.10.0.7-1 +- Update to jdk-21.0.10+7 (GA) +- Update release notes to 21.0.10+7 +- Bump libpng version to 1.6.51 following JDK-8372534 +- Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT +- Add test to ensure blocked.certs is valid (OPENJDK-4362) +- Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh +- Resolves: OPENJDK-4273 +- Resolves: OPENJDK-4281 +- Resolves: OPENJDK-4357 +- Resolves: OPENJDK-4397 +- Resolves: OPENJDK-4380 +- Resolves: OPENJDK-4388 +- ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** + +* Fri Oct 17 2025 Andrew Hughes - 1:21.0.9.0.10-1 +- Update to jdk-21.0.9+10 (GA) +- Update release notes to 21.0.9+10 +- Bump harfbuzz version to 11.2.0 following JDK-8355528 +- Add NEWS corrections from Thomas +- Use double spacing consistently in notes for this release +- Correct 11u release reference to corresponding 21u release as pointed out by Kieran +- ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** +- Resolves: OPENJDK-4131 + +* Fri Oct 17 2025 Andrew Hughes - 1:21.0.8.0.9-2 +- Depend on a devkit with the annobin plugin and stop filtering it out of the build flags +- Install annobin plugin as gcc-annobin in the same way as the gcc spec file +- Resolves: OPENJDK-4142 + +* Thu Jul 10 2025 Andrew Hughes - 1:21.0.8.0.9-1 +- Update to jdk-21.0.8+9 (GA) +- Update release notes to 21.0.8+9 +- Switch to GA mode +- ** This tarball is embargoed until 2025-07-15 @ 1pm PT. ** + +* Thu Jul 10 2025 Andrew Hughes - 1:21.0.8.0.8-0.1.ea +- Update to jdk-21.0.8+8 (EA) +- Update release notes to 21.0.8+8 + +* Wed Jul 09 2025 Andrew Hughes - 1:21.0.8.0.2-0.1.ea +- Update to jdk-21.0.8+2 (EA) +- Update release notes to 21.0.8+2 +- Add timezone data update check to openjdk_news.sh +- Add duplicate check to openjdk_news.sh +- Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh +- Related: OPENJDK-3949 + +* Tue Jul 08 2025 Andrew Hughes - 1:21.0.8.0.1-0.1.ea +- Update get_bundle_versions.sh to match other scripts +- * get_bundle_versions.sh: Add license +- * get_bundle_versions.sh: Set compile-command in Emacs +- * get_bundle_versions.sh: Use different error codes for different failures +- * get_bundle_versions.sh: Remove unneeded '.' in JPEG version +- * get_bundle_versions.sh: shellcheck: Double-quote variable references (SC2086) +- * get_bundle_versions.sh: shellcheck: Drop use of cat and pass file to awk directly (SC2002) +- Add OpenJDK 8u support to get_bundle_versions.sh +- Print bundle updates and backouts at end of openjdk_news.sh output +- Refer user to get_bundle_versions.sh when bundle updates are found by openjdk_news.sh +- Resolves: OPENJDK-3949 + +* Tue Jul 08 2025 Antonio Vieiro - 1:21.0.8.0.1-0.1.ea +- Add script to obtain bundled library versions from OpenJDK sources +- Related: OPENJDK-3949 + +* Tue Jul 08 2025 Thomas Fitzsimmons - 1:21.0.8.0.1-0.1.ea +- Warn about bundled provide version bumps and backouts in openjdk_news.sh +- Related: OPENJDK-3949 + +* Tue Jul 08 2025 Andrew Hughes - 1:21.0.8.0.1-0.1.ea +- Update to jdk-21.0.8+1 (EA) +- Update release notes to 21.0.8+1 +- Bump freetype version to 2.13.3 following JDK-8348596 +- Bump harfbuzz version to 10.4.0 following JDK-8348597 +- Bump lcms2 version to 2.17.0 following JDK-8348110 +- Bump libpng version to 1.6.47 following JDK-8348598 +- Switch to EA mode +- Drop JDK-8351500 local patch which is now available in 21.0.8+1 upstream + +* Fri Jul 04 2025 Andrew Hughes - 1:21.0.7.0.6-3 +- Move riscv64 addition to ExclusiveArch to devkit_arches on RHEL +- Related: OPENJDK-3850 + +* Tue May 20 2025 Kashyap Chamarthy - 1:21.0.7.0.6-3 +- Enable riscv64 arch; thanks: Songsong Zhang +- Resolves: OPENJDK-3850 + +* Thu May 08 2025 Andrew Hughes - 1:21.0.7.0.6-2 +- Add local version of JDK-8351500 for early interim release before 21.0.8 +- Resolves: OPENJDK-3679 + +* Fri Apr 11 2025 Andrew Hughes - 1:21.0.7.0.6-1 +- Update to jdk-21.0.7+6 (GA) +- Update release notes to 21.0.7+6 +- Rebase FIPS support against 21.0.7+5 +- ** This tarball is embargoed until 2025-04-15 @ 1pm PT. ** +- Resolves: OPENJDK-3789 + * Sat Jan 11 2025 Andrew Hughes - 1:21.0.6.0.7-1 - Update to jdk-21.0.6+7 (GA) - Update release notes to 21.0.6+7 diff --git a/SPECS/java-21-openjdk.spec b/SPECS/java-21-openjdk.spec index 52756b0..ce41781 100644 --- a/SPECS/java-21-openjdk.spec +++ b/SPECS/java-21-openjdk.spec @@ -308,7 +308,7 @@ # New Version-String scheme-style defines %global featurever 21 %global interimver 0 -%global updatever 6 +%global updatever 10 %global patchver 0 # We don't add any LTS designator for STS packages (Fedora and EPEL). # We need to explicitly exclude EPEL as it would have the %%{rhel} macro defined. @@ -344,7 +344,7 @@ # Define IcedTea version used for SystemTap tapsets and desktop file %global icedteaver 6.0.0pre00-c848b93a8598 # Define current Git revision for the FIPS support patches -%global fipsver 0a42e29b391 +%global fipsver a0fd6e8ed6e # Define JDK versions %global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver} %global javaver %{featurever} @@ -1142,6 +1142,10 @@ OrderWithRequires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release %if 0%{?rhel} >= 8 || 0%{?fedora} > 0 Recommends: gtk3%{?_isa} %endif +# Recommend PipeWire for screenshots under Wayland. +%if 0%{?rhel} >= 9 || 0%{?fedora} > 0 +Recommends: pipewire%{?_isa} +%endif Provides: java-%{javaver}-%{origin}%{?1} = %{epoch}:%{version}-%{release} @@ -1163,8 +1167,8 @@ Requires: ca-certificates # Require javapackages-filesystem for ownership of /usr/lib/jvm/ and macros Requires: javapackages-filesystem # Require zone-info data provided by tzdata-java sub-package -# 2024b required as of JDK-8339637 -Requires: tzdata-java >= 2024b +# 2025a required as of JDK-8347965 +Requires: tzdata-java >= 2025a # for support of kernel stream control # libsctp.so.1 is being `dlopen`ed on demand Requires: lksctp-tools%{?_isa} @@ -1438,6 +1442,7 @@ Source30: 0008-Tools.gmk-Use-update-repository-on-RHEL-rather-than-.patch # test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class # RH1940064: Enable XML Signature provider in FIPS mode # RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized [now part of JDK-8301553 upstream] +# OPENJDK-4013: Update nss.fips.cfg to grant CKA_SIGN and CKA_ENCRYPT to any CKO_SECRET_KEY Patch1001: fips-%{featurever}u-%{fipsver}.patch ############################################# @@ -1454,6 +1459,8 @@ Patch1001: fips-%{featurever}u-%{fipsver}.patch # ############################################# +# Currently empty + ############################################# # # Portable build specific patches @@ -1511,8 +1518,8 @@ BuildRequires: %{pkgnameroot}-misc = %{epoch}:%{version}-%{prelease}.%{portables %ifarch %{zero_arches} BuildRequires: libffi-devel %endif -# 2024b required as of JDK-8339637 -BuildRequires: tzdata-java >= 2024b +# 2025a required as of JDK-8347965 +BuildRequires: tzdata-java >= 2025a # Earlier versions have a bug in tree vectorization on PPC BuildRequires: gcc >= 4.8.3-8 @@ -1530,18 +1537,18 @@ BuildRequires: libjpeg-devel BuildRequires: libpng-devel BuildRequires: zlib-devel %else -# Version in src/java.desktop/share/legal/freetype.md -Provides: bundled(freetype) = 2.13.2 +# Version in src/java.desktop/share/native/libfreetype/include/freetype/freetype.h +Provides: bundled(freetype) = 2.13.3 # Version in src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h Provides: bundled(giflib) = 5.2.2 # Version in src/java.desktop/share/native/libharfbuzz/hb-version.h -Provides: bundled(harfbuzz) = 8.2.2 +Provides: bundled(harfbuzz) = 11.2.0 # Version in src/java.desktop/share/native/liblcms/lcms2.h -Provides: bundled(lcms2) = 2.16.0 +Provides: bundled(lcms2) = 2.17.0 # Version in src/java.desktop/share/native/libjavajpeg/jpeglib.h Provides: bundled(libjpeg) = 6b # Version in src/java.desktop/share/native/libsplashscreen/libpng/png.h -Provides: bundled(libpng) = 1.6.43 +Provides: bundled(libpng) = 1.6.51 # Version in src/java.base/share/native/libzip/zlib/zlib.h Provides: bundled(zlib) = 1.3.1 %endif @@ -2565,9 +2572,127 @@ cjc.mainProgram(args) %endif %changelog -* Tue Mar 11 2025 Eduard Abdullin - 1:21.0.6.0.7-2.alma.1 +* Mon Mar 30 2026 Eduard Abdullin - 1:21.0.10.0.7-2.alma.1 - Set portablesuffix to el8 +* Wed Feb 18 2026 Andrew Hughes - 1:21.0.10.0.7-2 +- Bump rpmrelease for CentOS build +- Related: RHEL-142859 +- Related: RHEL-139560 +- Related: RHEL-131592 +- Related: RHEL-131602 +- Related: RHEL-122121 +- Related: RHEL-142820 + +* Sun Jan 18 2026 Andrew Hughes - 1:21.0.10.0.7-1 +- Update to jdk-21.0.10+7 (GA) +- Update release notes to 21.0.10+7 +- Bump libpng version to 1.6.51 following JDK-8372534 +- Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT +- Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh +- Sync the copy of the portable specfile with the latest update +- Resolves: RHEL-142859 +- Resolves: RHEL-139560 +- Resolves: RHEL-131592 +- Resolves: RHEL-131602 +- Resolves: RHEL-122121 +- Resolves: RHEL-142820 +- ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** + +* Sat Oct 18 2025 Andrew Hughes - 1:21.0.9.0.10-2 +- Bump rpmrelease for CentOS build +- Add scripts to handle tagging of portable-based RPMs +- Related: RHEL-118774 +- Related: RHEL-119466 + +* Fri Oct 17 2025 Andrew Hughes - 1:21.0.9.0.10-1 +- Update to jdk-21.0.9+10 (GA) +- Update release notes to 21.0.9+10 +- Bump harfbuzz version to 11.2.0 following JDK-8355528 +- Add NEWS corrections from Thomas +- Use double spacing consistently in notes for this release +- Correct 11u release reference to corresponding 21u release as pointed out by Kieran +- Sync the copy of the portable specfile with the latest update +- ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** +- Resolves: RHEL-118774 +- Resolves: RHEL-119466 + +* Thu Jul 10 2025 Andrew Hughes - 1:21.0.8.0.9-1 +- Update to jdk-21.0.8+9 (GA) +- Update release notes to 21.0.8+9 +- Switch to GA mode +- Sync the copy of the portable specfile with the latest update +- ** This tarball is embargoed until 2025-07-15 @ 1pm PT. ** +- Resolves: RHEL-102289 + +* Thu Jul 10 2025 Thomas Fitzsimmons - 1:21.0.7.0.6-3 +- Recommend PipeWire on RHEL 9 and later for java.awt.Robot screenshots under Wayland +- Resolves: RHEL-102677 + +* Thu Jul 10 2025 Andrew Hughes - 1:21.0.8.0.8-0.1.ea +- Update to jdk-21.0.8+8 (EA) +- Update release notes to 21.0.8+8 +- Sync the copy of the portable specfile with the latest update +- Resolves: RHEL-101798 + +* Wed Jul 09 2025 Andrew Hughes - 1:21.0.8.0.2-0.1.ea +- Update to jdk-21.0.8+2 (EA) +- Update release notes to 21.0.8+2 +- Sync the copy of the portable specfile with the latest update +- Add timezone data update check to openjdk_news.sh +- Add duplicate check to openjdk_news.sh +- Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh +- Related: RHEL-101798 +- Resolves: RHEL-103209 + +* Wed Jul 09 2025 Andrew Hughes - 1:21.0.8.0.1-0.1.ea +- Update get_bundle_versions.sh to match other scripts +- * get_bundle_versions.sh: Add license +- * get_bundle_versions.sh: Set compile-command in Emacs +- * get_bundle_versions.sh: Use different error codes for different failures +- * get_bundle_versions.sh: Remove unneeded '.' in JPEG version +- * get_bundle_versions.sh: shellcheck: Double-quote variable references (SC2086) +- * get_bundle_versions.sh: shellcheck: Drop use of cat and pass file to awk directly (SC2002) +- Add OpenJDK 8u support to get_bundle_versions.sh +- Print bundle updates and backouts at end of openjdk_news.sh output +- Refer user to get_bundle_versions.sh when bundle updates are found by openjdk_news.sh +- Related: RHEL-103209 + +* Wed Jul 09 2025 Antonio Vieiro - 1:21.0.8.0.1-0.1.ea +- Add script to obtain bundled library versions from OpenJDK sources +- Related: RHEL-103209 + +* Wed Jul 09 2025 Thomas Fitzsimmons - 1:21.0.8.0.1-0.1.ea +- Warn about bundled provide version bumps and backouts in openjdk_news.sh +- Related: RHEL-103209 + +* Wed Jul 09 2025 Andrew Hughes - 1:21.0.8.0.1-0.1.ea +- Update to jdk-21.0.8+1 (EA) +- Update release notes to 21.0.8+1 +- Bump freetype version to 2.13.3 following JDK-8348596 +- Bump harfbuzz version to 10.4.0 following JDK-8348597 +- Bump lcms2 version to 2.17.0 following JDK-8348110 +- Bump libpng version to 1.6.47 following JDK-8348598 +- Switch to EA mode +- Drop JDK-8351500 local patch which is now available in 21.0.8+1 upstream +- Sync the copy of the portable specfile with the latest update +- Related: RHEL-101798 + +* Thu May 08 2025 Andrew Hughes - 1:21.0.7.0.6-2 +- Add local version of JDK-8351500 for early interim release before 21.0.8 +- Sync the copy of the portable specfile with the latest update +- Resolves: RHEL-90309 + +* Fri Apr 11 2025 Andrew Hughes - 1:21.0.7.0.6-1 +- Update to jdk-21.0.7+6 (GA) +- Update release notes to 21.0.7+6 +- Rebase FIPS support against 21.0.7+5 +- Require tzdata 2025a due to upstream inclusion of JDK-8347965 +- Sync the copy of the portable specfile with the latest update +- ** This tarball is embargoed until 2025-04-15 @ 1pm PT. ** +- Resolves: RHEL-86984 +- Resolves: RHEL-86635 + * Thu Feb 06 2025 Andrew Hughes - 1:21.0.6.0.7-2 - Bump tzdata requirement to 2024b for JDK-8339637 - Resolves: RHEL-74001