Update to jdk-21.0.8+9 (GA)

- Update release notes to 21.0.8+9
- Switch to GA mode

** This tarball is embargoed until 2025-07-15 @ 1pm PT. **

Resolves: RHEL-102289

.gitignore

@@ -37,3 +37,4 @@
 /openjdk-21.0.8+1-ea.tar.xz
 /openjdk-21.0.8+2-ea.tar.xz
 /openjdk-21.0.8+8-ea.tar.xz
+/openjdk-21.0.8+9.tar.xz

NEWS

@@ -8,6 +8,11 @@ New in release OpenJDK 21.0.8 (2025-07-15):
 Live versions of these release notes can be found at:
   * https://bit.ly/openjdk2108
 
+* CVEs
+  - CVE-2025-30749
+  - CVE-2025-30754
+  - CVE-2025-50059
+  - CVE-2025-50106
 * Changes
   - JDK-6956385: URLConnection.getLastModified() leaks file handles for jar:file and file: URLs
   - JDK-8051591: Test javax/swing/JTabbedPane/8007563/Test8007563.java fails
@@ -279,6 +284,7 @@ Live versions of these release notes can be found at:
   - JDK-8345447: test/jdk/javax/swing/JToolBar/4529206/bug4529206.java fails in ubuntu22.04
   - JDK-8345547: test/jdk/javax/swing/text/DefaultEditorKit/4278839/bug4278839.java fails in ubuntu22.04
   - JDK-8345598: Upgrade NSS binaries for interop tests
+  - JDK-8345625: Better HTTP connections
   - JDK-8345728: [Accessibility,macOS,Screen Magnifier]: JCheckbox unchecked state does not magnify but works for checked state
   - JDK-8345838: Remove the appcds/javaldr/AnonVmClassesDuringDump.java test
   - JDK-8346049: jdk/test/lib/security/timestamp/TsaServer.java warnings
@@ -308,11 +314,14 @@ Live versions of these release notes can be found at:
   - JDK-8348600: Update PipeWire to 1.3.81
   - JDK-8348865: JButton/bug4796987.java never runs because Windows XP is unavailable
   - JDK-8348936: [Accessibility,macOS,VoiceOver] VoiceOver doesn't announce untick on toggling the checkbox with "space" key on macOS
+  - JDK-8348989: Better Glyph drawing
+  - JDK-8349111: Enhance Swing supports
   - JDK-8349200: [JMH] time.format.ZonedDateTimeFormatterBenchmark fails
   - JDK-8349348: Refactor ClassLoaderDeadlock.sh and Deadlock.sh to run fully in java
   - JDK-8349358: [JMH] Cannot access class jdk.internal.vm.ContinuationScope
   - JDK-8349492: Update sun/security/pkcs12/KeytoolOpensslInteropTest.java to use a recent Openssl version
   - JDK-8349501: Relocate supporting classes in security/testlibrary to test/lib/jdk tree
+  - JDK-8349594: Enhance TLS protocol support
   - JDK-8349623: [ASAN] Gtest os_linux.glibc_mallinfo_wrapper_vm fails
   - JDK-8349637: Integer.numberOfLeadingZeros outputs incorrectly in certain cases
   - JDK-8349751: AIX build failure after upgrade pipewire to 1.3.81
@@ -332,6 +341,7 @@ Live versions of these release notes can be found at:
   - JDK-8350682: [JMH] vector.IndexInRangeBenchmark failed with IndexOutOfBoundsException for size=1024
   - JDK-8350786: Some java/lang jtreg tests miss requires vm.hasJFR
   - JDK-8350924: javax/swing/JMenu/4213634/bug4213634.java fails
+  - JDK-8350991: Improve HTTP client header handling
   - JDK-8351086: (fc) Make java/nio/channels/FileChannel/BlockDeviceSize.java test manual
   - JDK-8351500: G1: NUMA migrations cause crashes in region allocation
   - JDK-8351665: Remove unused UseNUMA in os_aix.cpp
@@ -370,7 +380,9 @@ Live versions of these release notes can be found at:
   - JDK-8357105: C2: compilation fails with "assert(false) failed: empty program detected during loop optimization"
   - JDK-8357193: [VS 2022 17.14] Warning C5287 in debugInit.c: enum type mismatch during build
   - JDK-8359170: Add 2 TLS and 2 CS Sectigo roots
+  - JDK-8360147: Better Glyph drawing redux
   - JDK-8360406: [21u] Disable logic for attaching type annotations to class files until 8359336 is fixed
+  - JDK-8361672: [21u] Remove designator DEFAULT_PROMOTED_VERSION_PRE=ea for release 21.0.8
 
 Notes on individual issues:
 ===========================

java-21-openjdk.spec

@@ -365,7 +365,7 @@
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{vcstag}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        8
+%global buildver        9
 %global rpmrelease      1
 # Settings used by the portable build
 %global portablerelease 1
@@ -394,7 +394,7 @@
 # Release will be (where N is usually a number starting at 1):
 # - 0.N%%{?extraver}%%{?dist} for EA releases,
 # - N%%{?extraver}{?dist} for GA releases
-%global is_ga           0
+%global is_ga           1
 %if %{is_ga}
 %global build_type GA
 %global ea_designator ""
@@ -2563,6 +2563,13 @@ cjc.mainProgram(args)
 %endif
 
 %changelog
+* Thu Jul 10 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.9-1.1
+- Update to jdk-21.0.8+9 (GA)
+- Update release notes to 21.0.8+9
+- Switch to GA mode
+- ** This tarball is embargoed until 2025-07-15 @ 1pm PT. **
+- Resolves: RHEL-102289
+
 * Thu Jul 10 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.8-0.1.ea
 - Update to jdk-21.0.8+8 (EA)
 - Update release notes to 21.0.8+8

sources

@@ -1,2 +1,2 @@
 SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30
-SHA512 (openjdk-21.0.8+8-ea.tar.xz) = d7523ddcf068aaa29de9ebac2f6d2354666dceac95a94dc33c9fdce8f7ffbb6165d7cc309eb7b87ed9cea3d986753e475b9db63fd91f406cd5ec74efb518441b
+SHA512 (openjdk-21.0.8+9.tar.xz) = 81be6d151fdca910fbee9ea1a93b20af037d2dbafeb12fa368a6091096a22dcf997cf419bebe0261f016ce0fe1e74acd4fca54ca0840a3d69ad76ae7a1336e4c