Update to jdk-21.0.9+10 (GA)

- Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** Resolves: RHEL-118774 Resolves: RHEL-119466
2025-09-24 02:28:51 +01:00 · 2025-09-24 02:28:51 +01:00 · cd83d7c565
commit cd83d7c565
parent 1c79394c4c
4 changed files with 441 additions and 8 deletions
--- a/.gitignore
+++ b/.gitignore
@ -38,3 +38,5 @@
 /openjdk-21.0.8+2-ea.tar.xz
 /openjdk-21.0.8+8-ea.tar.xz
 /openjdk-21.0.8+9.tar.xz
+/openjdk-21.0.9+1-ea.tar.xz
+/openjdk-21.0.9+10.tar.xz
--- a/424
+++ b/424
@ -3,6 +3,426 @@ Key:
 JDK-X  - https://bugs.openjdk.java.net/browse/JDK-X
 CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY

+New in release OpenJDK 21.0.9 (2025-10-21):
+===========================================
+Live versions of these release notes can be found at:
+  * https://bit.ly/openjdk2109
+
+* CVEs
+  - CVE-2025-53057
+  - CVE-2025-53066
+  - CVE-2025-61748
+* Changes
+  - JDK-7036144: GZIPInputStream readTrailer uses faulty available() test for end-of-stream
+  - JDK-8079786: [macosx] Test java/awt/Frame/DisposeParentGC/DisposeParentGC.java fails for Mac only
+  - JDK-8167252: Some of Charset.availableCharsets() does not contain itself
+  - JDK-8185429: [macos] After a modal dialog is closed, no window becomes active
+  - JDK-8203867: Delete test java/awt/TrayIcon/DblClickActionEventTest/DblClickActionEventTest.html
+  - JDK-8217914: java/net/httpclient/ConnectTimeoutHandshakeSync.java failed on connection refused while doing POST
+  - JDK-8226919: attach in linux hangs due to permission denied accessing /proc/pid/root
+  - JDK-8249825: Tests sun/security/ssl/SSLSocketImpl/SetClientMode.java and NonAutoClose.java marked with @ignore
+  - JDK-8259540: MissingResourceException for key cvc-complex-type.2.4.d.1
+  - JDK-8261242: [Linux] OSContainer::is_containerized() returns true when run outside a container
+  - JDK-8279005: sun/tools/jstat tests do not check for test case exit codes after JDK-8245129
+  - JDK-8280818: Expand bug8033699.java to iterate over all LaFs
+  - JDK-8293713: java/net/httpclient/BufferingSubscriberTest.java fails in timeout, blocked in submission publisher
+  - JDK-8302293: jar --create fails with IllegalArgumentException if archive name is shorter than 3 characters
+  - JDK-8302744: Refactor Hotspot container detection code
+  - JDK-8304674: File java.c compile error with -fsanitize=address -O0
+  - JDK-8308633: Increase precision of timestamps in g1 log
+  - JDK-8309238: jdk/jfr/tool/TestView.java failed with "exitValue = 134"
+  - JDK-8309627: Incorrect sorting of DirtyCardQueue buffers
+  - JDK-8309899: Rename PtrQueueSet::buffer_size()
+  - JDK-8310264: In PhaseChaitin::Split defs and phis are leaked
+  - JDK-8310974: NMT: Arena diffs miss the scale
+  - JDK-8311644: Server should not send bad_certificate alert when the client does not send any certificates
+  - JDK-8313083: Print 'rss' and 'cache' as part of the container information
+  - JDK-8313355: javax/management/remote/mandatory/notif/ListenerScaleTest.java failed with "Exception: Failed: ratio=792.2791601423487"
+  - JDK-8313367: SunMSCAPI cannot read Local Computer certs w/o Windows elevation
+  - JDK-8314166: Update googletest to v1.14.0
+  - JDK-8314611: Provide more explicative error message parsing Currencies
+  - JDK-8314978: Multiple server call from connection failing with expect100 in getOutputStream
+  - JDK-8319067: ProblemList serviceability/AsyncGetCallTrace/MyPackage/ASGCTBaseTest.java on linux-aarch64 in Xcomp mode
+  - JDK-8319174: Enhance robustness of some j.m.BigInteger constructors
+  - JDK-8319598: SMFParser misinterprets interrupted running status
+  - JDK-8319932: [JVMCI] class unloading related tests can fail on libgraal
+  - JDK-8320189: vmTestbase/nsk/jvmti/scenarios/bcinstr/BI02/bi02t001 memory corruption when using -Xcheck:jni
+  - JDK-8320769: Remove ill-adviced "make install" target
+  - JDK-8320858: Move jpackage tests to tier3
+  - JDK-8320859: gtest high malloc footprint caused by BufferNodeAllocator stress test
+  - JDK-8322420: [Linux] cgroup v2: Limits in parent nested control groups are not detected
+  - JDK-8322992: Javac fails with StackOverflowError when compiling deeply nested synchronized blocks
+  - JDK-8325397: sun/java2d/Disposer/TestDisposerRace.java fails in linux-aarch64
+  - JDK-8326606: Test javax/swing/text/BoxView/6494356/bug6494356.java performs a synchronization on a value based class
+  - JDK-8326705: Test CertMsgCheck.java fails to find alert certificate_required
+  - JDK-8327125: SpinYield.report should report microseconds
+  - JDK-8327748: Convert javax/swing/JFileChooser/6798062/bug6798062.java applet test to main
+  - JDK-8327750: Convert javax/swing/JFileChooser/FileFilterDescription/FileFilterDescription.java applet test to main
+  - JDK-8327751: Convert javax/swing/JInternalFrame/6726866/bug6726866.java applet test to main
+  - JDK-8327752: Convert javax/swing/JOptionPane/4174551/bug4174551.java applet to main
+  - JDK-8327753: Convert javax/swing/JOptionPane/8024926/bug8024926.java applet to main
+  - JDK-8327754: Convert javax/swing/JPopupMenu/7160604/bug7160604.java applet to main
+  - JDK-8327755: Convert javax/swing/JScrollBar/8039464/Test8039464.java applet to main
+  - JDK-8327756: Convert javax/swing/JSlider/4987336/bug4987336.java applet to main
+  - JDK-8327826: Convert javax/swing/border/Test4243289.java applet test to main
+  - JDK-8327835: Convert java/awt/FileDialog/RegexpFilterTest/RegexpFilterTest applet test to main
+  - JDK-8327838: Convert java/awt/FileDialog/MultipleMode/MultipleMode.html applet test to main
+  - JDK-8327872: Convert javax/swing/JToolTip/4644444/bug4644444.java applet test to main
+  - JDK-8327873: Convert javax/swing/border/Test4247606.java applet test to main
+  - JDK-8327874: Convert javax/swing/JTree/4314199/bug4314199.java applet test to main
+  - JDK-8327876: Convert javax/swing/border/Test4252164.java applet test to main
+  - JDK-8327879: Convert javax/swing/border/Test4760089.java applet test to main
+  - JDK-8327969: Convert javax/swing/border/Test6910490.java applet test to main
+  - JDK-8327972: Convert java/awt/FileDialog/SaveFileNameOverrideTest/SaveFileNameOverrideTest.html applet test to main
+  - JDK-8328000: Convert /java/awt/im/8154816/bug8154816.java applet test to main
+  - JDK-8328012: Convert InputMethod (/java/awt/im) applet tests to main
+  - JDK-8328030: Convert javax/swing/text/GlyphView/4984669/bug4984669.java applet test to main
+  - JDK-8328035: Convert javax/swing/text/html/TableView/7030332/bug7030332.java applet test to main
+  - JDK-8328087: Automate javax/swing/JTable/TAB/TAB.java applet test
+  - JDK-8328089: Automate javax/swing/JTable/4222153/bug4222153.java applet test
+  - JDK-8328154: Convert sun/java2d/loops/CopyAreaSpeed.java applet test to main
+  - JDK-8328190: Convert AWTPanelSmoothWheel.html applet test to main
+  - JDK-8328225: Convert ImageDecoratedDnD.html applet test to main
+  - JDK-8328244: Convert javax/swing/JSlider/6742358/bug6742358.java applet test to main
+  - JDK-8328248: Convert javax/swing/JSlider/6587742/bug6587742.java applet test to main
+  - JDK-8328262: Convert javax/swing/JSplitPane/8132123/bug8132123.java applet test to main
+  - JDK-8328279: Convert java/awt/Cursor/CursorOverlappedPanelsTest test to main
+  - JDK-8328328: Convert javax/swing/JTabbedPane/4666224/bug4666224.java applet test to main
+  - JDK-8328367: Convert java/awt/Component/UpdatingBootTime test to main
+  - JDK-8328378: Convert java/awt/FileDialog/FileDialogForDirectories test to main
+  - JDK-8328382: Convert java/awt/FileDialog/FileDialogForPackages test to main
+  - JDK-8328384: Convert java/awt/FileDialog/FileDialogOpenDirTest test to main
+  - JDK-8328385: Convert java/awt/FileDialog/FileDialogReturnTest test to main
+  - JDK-8328386: Convert java/awt/FileDialog/FileNameOverrideTest test to main
+  - JDK-8328398: Convert java/awt/im/4490692/bug4490692.html applet test to main
+  - JDK-8328401: Convert java/awt/Frame/InitialMaximizedTest/InitialMaximizedTest.html applet test to automated
+  - JDK-8328570: Convert closed JViewport manual applet tests to main
+  - JDK-8328631: Convert java/awt/InputMethods/InputMethodsTest/InputMethodsTest.java applet test to manual
+  - JDK-8330022: Failure test/hotspot/jtreg/vmTestbase/nsk/sysdict/share/BTreeTest.java: Could not initialize class java.util.concurrent.ThreadLocalRandom
+  - JDK-8330535: Update nsk/jdb tests to use driver instead of othervm
+  - JDK-8331389: runtime/ErrorHandling/TestDwarf.java fails with "Crash JVM should not exit gracefully"
+  - JDK-8331560: Refactor Hotspot container detection code so that subsystem delegates to controllers
+  - JDK-8332020: jwebserver tool prints invalid URL in case of IPv6 address binding
+  - JDK-8332271: Reading data from the clipboard from multiple threads crashes the JVM
+  - JDK-8332368: ubsan aarch64: immediate_aarch64.cpp:298:31: runtime error: shift exponent 32 is too large for 32-bit type 'int'
+  - JDK-8332551: Test vmTestbase/nsk/monitoring/MemoryNotificationInfo/from/from001/TestDescription.java timed out
+  - JDK-8332857: Test vmTestbase/nsk/jvmti/GetThreadCpuTime/thrcputime002/TestDescription.java failed
+  - JDK-8333326: Linux Alpine build fails after 8302744
+  - JDK-8333446: Add tests for hierarchical container support
+  - JDK-8334010: VM crashes with ObjectAlignmentInBytes > GCCardSizeInBytes
+  - JDK-8334016: Make PrintNullString.java automatic
+  - JDK-8334320: Replace vmTestbase/metaspace/share/TriggerUnloadingWithWhiteBox.java with ClassUnloadCommon from testlibrary
+  - JDK-8334394: Race condition in Class::protectionDomain
+  - JDK-8334457: Test javax/swing/JTabbedPane/bug4666224.java fail on macOS with because pressing the ‘C’ key does not switch the layout to WRAP_TAB_LAYOUT
+  - JDK-8335131: Test "javax/swing/JColorChooser/Test6977726.java" failed on ubuntu x64 because "Preview" title is missing for GTK L&F
+  - JDK-8335252: Reduce size of j.u.Formatter.Conversion#isValid
+  - JDK-8335577: runtime/cds/appcds/TestParallelGCWithCDS.java still fails with JNI error
+  - JDK-8335882: platform/cgroup/TestSystemSettings.java fails on Alpine Linux
+  - JDK-8336635: Add IR test for Reference.refersTo intrinsic
+  - JDK-8336702: C2 compilation fails with "all memory state should have been processed" assert
+  - JDK-8337506: Disable "best-fit" mapping on Windows command line
+  - JDK-8338236: Compile error in cgroup code on Linux when using clang
+  - JDK-8338482: com/sun/jdi/ThreadMemoryLeakTest.java requires that compressed oops are enabled
+  - JDK-8338939: Simplify processing of hidden class names
+  - JDK-8339460: CDS error when module is located in a directory with space in the name
+  - JDK-8339561: The test/jdk/java/awt/Paint/ListRepaint.java may fail after JDK-8327401
+  - JDK-8339962: Open source AWT TextField tests - Set1
+  - JDK-8340092: [Linux] containers/systemd/SystemdMemoryAwarenessTest.java failing on some systems
+  - JDK-8340185: Use make -k on GHA to catch more build errors
+  - JDK-8340276: Test java/lang/management/ThreadMXBean/Locks.java failed with NullPointerException
+  - JDK-8340389: vmTestbase/gc/gctests/PhantomReference/phantom001/TestDescription.java Test exit code: 97 with -Xcomp UseAVX=3
+  - JDK-8340547: Starting many threads can delay safepoints
+  - JDK-8340554: Improve MessageFormat readObject checks
+  - JDK-8341178: TypeRawPtr::add_offset may be "miscompiled" due to UB
+  - JDK-8341311: [Accessibility,macOS,VoiceOver] VoiceOver announces incorrect number of items in submenu of JPopupMenu
+  - JDK-8341370: Test java/awt/Frame/ShapeNotSetSometimes/ShapeNotSetSometimes.java fails intermittently on macOS-aarch64
+  - JDK-8341644: Compile error in cgroup coding when using toolchain clang
+  - JDK-8341684: Typo in External Specifications link of java.util.Currency
+  - JDK-8341861: GHA: Use only retention mechanism to remove bundles
+  - JDK-8341964: Add mechanism to disable different parts of TLS cipher suite
+  - JDK-8342074: Fix runtime/Thread/TestAlwaysPreTouchStacks.java to be flagless or accept VM flags
+  - JDK-8342238: Test javax/crypto/CryptoPermissions/InconsistentEntries.java writes files in tested JDK dir
+  - JDK-8342330: C2: "node pinned on loop exit test?" assert failure
+  - JDK-8342782: AWTEventMulticaster throws StackOverflowError using AquaButtonUI
+  - JDK-8343074: test/jdk/com/sun/net/httpserver/docs/test1/largefile.txt could be generated
+  - JDK-8343452: Incorrect WINDOWS build variable is used in macroAssembler_x86.cpp
+  - JDK-8343607: C2: Shenandoah crashes during barrier expansion in Continuation::enter
+  - JDK-8343618: Stack smashing in awt_InputMethod.c on Linux s390x
+  - JDK-8343804: Show the default time zone with -XshowSettings option
+  - JDK-8343977: Convert java/awt/TextArea/TextAreaCursorTest/HoveringAndDraggingTest to main
+  - JDK-8344137: Update XML Security for Java to 3.0.5
+  - JDK-8344338: javax/swing/JTextArea/bug4265784.java fails on Ubuntu 24.04.1
+  - JDK-8344671: Few JFR streaming tests fail with application not alive error on MacOS 15
+  - JDK-8345173: BlockLocationPrinter::print_location misses a ResourceMark
+  - JDK-8345337: JFR: jfr view should display all direct subfields for an event type
+  - JDK-8345471: Clean up compiler/intrinsics/sha/cli tests
+  - JDK-8345566: Deproblemlist test/jdk/javax/swing/JComboBox/6559152/bug6559152.java
+  - JDK-8345767: javax/swing/JSplitPane/4164779/JSplitPaneKeyboardNavigationTest.java fails in ubuntu22.04
+  - JDK-8346255: java/lang/management/ThreadMXBean/VirtualThreadDeadlocks.java finds no deadlock
+  - JDK-8346285: Update jarsigner compatibility test for change in default digest algorithm
+  - JDK-8346751: Internal java compiler error with type annotations in constants expression in constant fields
+  - JDK-8346871: Improve robustness of java/util/zip/EntryCount64k.java test
+  - JDK-8346929: runtime/ClassUnload/DictionaryDependsTest.java fails with "Test failed: should be unloaded"
+  - JDK-8346998: Test nsk/jvmti/ResourceExhausted/resexhausted003 fails with java.lang.OutOfMemoryError when CDS is off
+  - JDK-8347004: vmTestbase/metaspace/shrink_grow/ShrinkGrowTest/ShrinkGrowTest.java fails with CDS disabled
+  - JDK-8347302: Mark test tools/jimage/JImageToolTest.java as flagless
+  - JDK-8347381: Upgrade jQuery UI to version 1.14.1
+  - JDK-8347564: ZGC: Crash in DependencyContext::clean_unloading_dependents
+  - JDK-8347826: Introspector shows wrong method list after 8071693
+  - JDK-8347840: Fix testlibrary compilation warnings
+  - JDK-8348135: Fix couple of problem listing entries in test/hotspot/jtreg/ProblemList-Virtual.txt
+  - JDK-8348328: Update IANA Language Subtag Registry to Version 2025-05-15
+  - JDK-8348365: Bad format string in CLDRDisplayNamesTest
+  - JDK-8348760: RadioButton is not shown if JRadioButtonMenuItem is rendered with ImageIcon in WindowsLookAndFeel
+  - JDK-8349151: Refactor test/java/security/cert/CertificateFactory/slowstream.sh to java test
+  - JDK-8349214: Improve size optimization flags for MSVC builds
+  - JDK-8349378: Build splashscreen lib with SIZE optimization
+  - JDK-8349583: Add mechanism to disable signature schemes based on their TLS scope
+  - JDK-8349849: PKCS11 SunTlsKeyMaterial crashes when used with TLS1.2 TlsKeyMaterialParameterSpec
+  - JDK-8350106: [PPC] Avoid ticks_unknown_not_Java AsyncGetCallTrace() if JavaFrameAnchor::_last_Java_pc not set
+  - JDK-8350111: [PPC] AsyncGetCallTrace crashes when called while handling SIGTRAP
+  - JDK-8350456: Test javax/crypto/CryptoPermissions/InconsistentEntries.java crashed: EXCEPTION_ACCESS_VIOLATION
+  - JDK-8350582: Correct the parsing of the ssl value in javax.net.debug
+  - JDK-8350665: SIZE_FORMAT_HEX macro undefined in gtest
+  - JDK-8350767: Fix -Wzero-as-null-pointer-constant warnings in nsk jni stress tests
+  - JDK-8350807: Certificates using MD5 algorithm that are disabled by default are incorrectly allowed in TLSv1.3 when re-enabled
+  - JDK-8350830: Values converted incorrectly when reading TLS session tickets
+  - JDK-8350858: [IR Framework] Some tests failed on Cascade Lake
+  - JDK-8350964: Add an ArtifactResolver.fetch(clazz) method
+  - JDK-8351277: Remove pipewire from AIX build
+  - JDK-8351487: [ubsan] jvmti.h runtime error: load of value which is not a valid value
+  - JDK-8351491: Add info from release file to hserr file
+  - JDK-8351593: [JMH] test PhoneCode.Bulk reports NPE exception
+  - JDK-8351601: [JMH] test UnixSocketChannelReadWrite failed for 2 threads config
+  - JDK-8351884: Refactor bug8033699.java test  code
+  - JDK-8351907: [XWayland] [OL10] Robot.mousePress() is delivered to wrong place
+  - JDK-8351997: AArch64: Interpreter volatile reference stores with G1 are not sequentially consistent
+  - JDK-8352509: Update jdk.test.lib.SecurityTools jar method to accept List<String> parameter
+  - JDK-8352624: Add missing {@code} to PassFailJFrame.Builder.splitUI
+  - JDK-8352637: Enhance bytecode verification
+  - JDK-8352677: Opensource JMenu tests - series2
+  - JDK-8352719: Add an equals sign to the modules statement
+  - JDK-8352765: G1CollectedHeap::expand_and_allocate() may fail to allocate even after heap expansion succeeds
+  - JDK-8352800: [PPC] OpenJDK fails to build on PPC after JDK-8350106
+  - JDK-8352860: Open source events tests batch0
+  - JDK-8352879: TestPeriod.java and TestGetContentType.java run wrong test class
+  - JDK-8352895: UserCookie.java runs wrong test class
+  - JDK-8352896: LambdaExpr02.java runs wrong test class
+  - JDK-8352946: SEGV_BND signal code of SIGSEGV missing from our signal-code table
+  - JDK-8353000: Open source several swing tests batch2
+  - JDK-8353126: Open source events tests batch1
+  - JDK-8353213: Open source several swing tests batch3
+  - JDK-8353235: Test jdk/jfr/api/metadata/annotations/TestPeriod.java fails with IllegalArgumentException
+  - JDK-8353293: Open source several swing tests batch4
+  - JDK-8353304: Open source two JTabbedPane tests
+  - JDK-8353489: Increase timeout and improve Windows compatibility in test/jdk/java/lang/ProcessBuilder/Basic.java
+  - JDK-8353549: Open source events tests batch2
+  - JDK-8353568: SEGV_BNDERR signal code adjust definition
+  - JDK-8353655: Clean up and open source KeyEvent related tests (Part 1)
+  - JDK-8353662: Add test for non-local file URL fallback to FTP
+  - JDK-8353698: Output of Simple Web Server is garbled if the console's encoding is not UTF-8
+  - JDK-8353713: Improve Currency.getInstance exception handling
+  - JDK-8353748: Open source several swing tests batch6
+  - JDK-8353847: Remove extra args to System.out.printf in open/test/jdk/java/net/httpclient tests
+  - JDK-8353950: Clipboard interaction on Windows is unstable
+  - JDK-8354285: Open source Swing tests Batch 3
+  - JDK-8354327: Rewrite runtime/LoadClass/LoadClassNegative.java
+  - JDK-8354415: [Ubuntu25.04] api/java_awt/GraphicsDevice/indexTGF.html#SetDisplayMode - setDisplayMode_REFRESH_RATE_UNKNOWN fails: Height is different on vnc
+  - JDK-8354941: Build failure with glibc 2.42 due to uabs() name collision
+  - JDK-8355051: Problemlist java/awt/Graphics2D/CopyAreaOOB.java on macosx-aarch64
+  - JDK-8355249: Remove the use of WMIC from the entire source code
+  - JDK-8355262: Test sun/security/ssl/SSLSessionImpl/NoInvalidateSocketException.java failed: accept timed out
+  - JDK-8355366: Fix the wrong usage of PassFailJFrame.forcePass() in some manual tests
+  - JDK-8355370: Include server name in HTTP test server thread names to improve diagnostics
+  - JDK-8355429: Open source ProgressMonitor test
+  - JDK-8355441: Remove antipattern from PassFailJFrame.forcePass javadoc
+  - JDK-8355453: nsk.share.jdi.Debugee.waitingEvent() does not timeout properly
+  - JDK-8355475: UNCTest should use an existing UNC path
+  - JDK-8355512: Test compiler/vectorization/TestVectorZeroCount.java times out with -XX:TieredStopAtLevel=3
+  - JDK-8355515: Clarify the purpose of forcePass() and forceFail() methods
+  - JDK-8355528: Update HarfBuzz to 11.2.0
+  - JDK-8355578: [java.net] Use @requires tag instead of exiting based on "os.name" property value
+  - JDK-8355779: When no "signature_algorithms_cert" extension is present we do not apply certificate scope constraints to algorithms in "signature_algorithms" extension
+  - JDK-8355979: ATTRIBUTE_NO_UBSAN needs to be extended to handle float divisions by zero on AIX
+  - JDK-8356269: Fix broken web-links after JDK-8295470
+  - JDK-8356294: Enhance Path Factories
+  - JDK-8356324: JVM crash (SIGSEGV at ClassListParser::resolve_indy_impl) during -Xshare:dump starting from 21.0.5
+  - JDK-8356778: Compiler add event logging in case of failures
+  - JDK-8357155: [asan] ZGC does not work (x86_64 and ppc64)
+  - JDK-8357173: Split jtreg test group jdk tier3
+  - JDK-8357194: [21u] lible cannot find the path of libjava
+  - JDK-8357253: Test test/jdk/sun/security/ssl/SSLSessionImpl/ResumeClientTLS12withSNI.java writes in src dir
+  - JDK-8357285: JSR166 Test case testShutdownNow_delayedTasks failed
+  - JDK-8357672: Extreme font sizes can cause font substitution
+  - JDK-8357675: Amend headless message
+  - JDK-8357793: [PPC64] VM crashes with -XX:-UseSIGTRAP -XX:-ImplicitNullChecks
+  - JDK-8357826: Avoid running some jtreg tests when asan is configured
+  - JDK-8357910: LoaderConstraintsTest.java fails when run with TEST_THREAD_FACTORY=Virtual
+  - JDK-8357914: TestEmptyBootstrapMethodsAttr.java fails when run with TEST_THREAD_FACTORY=Virtual
+  - JDK-8357968: RISC-V: Interpreter volatile reference stores with G1 are not sequentially consistent
+  - JDK-8358004: Delete applications/scimark/Scimark.java test
+  - JDK-8358136: Make langtools/jdk/javadoc/doclet/testLinkOption/TestRedirectLinks.java intermittent
+  - JDK-8358310: ZGC: riscv, ppc ZPlatformAddressOffsetBits may return a too large value
+  - JDK-8358334: C2/Shenandoah: incorrect execution with Unsafe
+  - JDK-8358452: JNI exception pending in Java_sun_awt_screencast_ScreencastHelper_remoteDesktopKeyImpl of screencast_pipewire.c:1214 (ID: 51119)
+  - JDK-8358534: Bailout in Conv2B::Ideal when type of cmp input is not supported
+  - JDK-8358538: Update GHA Windows runner to 2025
+  - JDK-8358617: java/net/HttpURLConnection/HttpURLConnectionExpectContinueTest.java fails with 403 due to system proxies
+  - JDK-8358659: Bump update version for OpenJDK: jdk-21.0.9
+  - JDK-8358697: TextLayout/MyanmarTextTest.java passes if no Myanmar font is found
+  - JDK-8358701: Remove misleading javax.management.remote API doc wording about JMX spec, and historic link to JMXMP
+  - JDK-8359272: Several vmTestbase/compact tests timed out on large memory machine
+  - JDK-8359402: Test CloseDescriptors.java should throw SkippedException when there is no lsof/sctp
+  - JDK-8359454: Enhance String handling
+  - JDK-8360042: GHA: Bump MSVC to 14.44
+  - JDK-8360518: Docker tests do not work when asan is configured
+  - JDK-8360647: [XWayland] [OL10] NumPad keys are not triggered
+  - JDK-8360937: Enhance certificate handling
+  - JDK-8361198: [AIX] fix misleading error output in thread_cpu_time_unchecked
+  - JDK-8361212: Remove AffirmTrust root CAs
+  - JDK-8361328: cds/appcds/dynamicArchive/TestAutoCreateSharedArchive.java archive timestamps comparison failed
+  - JDK-8361478: GHA: Use MSYS2 from GHA runners
+  - JDK-8361959: [GCC static analyzer] java_props_md.c  leak of 'temp'  variable is reported
+  - JDK-8362390: AIX make fails in awt_GraphicsEnv.c
+  - JDK-8362548: [21u] Add bugId to test missed in backport of JDK-8343804
+  - JDK-8362582: GHA: Increase bundle retention time to deal with infra overload better
+  - JDK-8362838: RISC-V: Incorrect matching rule leading to improper oop instruction encoding
+  - JDK-8362839: [21u] Problem list more tests that fail in 21 and would be fixed by 8309622
+  - JDK-8362855: Test java/net/ipv6tests/TcpTest.java should report SkippedException when there no ia4addr  or ia6addr
+  - JDK-8363965: GHA: Switch cross-compiling sysroots to Debian bookworm
+  - JDK-8365375: Method SU3.setAcceleratorSelectionForeground assigns to acceleratorForeground
+  - JDK-8365389: Remove static color fields from SwingUtilities3 and WindowsMenuItemUI
+  - JDK-8365811: test/jdk/java/net/CookieHandler/B6644726.java failure - "Should have 5 cookies. Got only 4, expires probably didn't parse correctly"
+  - JDK-8367388: Tests start to fail on JDK-21 after JDK-8351907
+  - JDK-8368308: ISO 4217 Amendment 180 Update
+  - JDK-8369643: [21u] Remove designator DEFAULT_PROMOTED_VERSION_PRE=ea for release 21.0.9
+
+Notes on individual issues:
+===========================
+
+security-libs/javax.xml.crypto:
+
+JDK-8344137: Update XML Security for Java to 3.0.5
+==================================================
+The XML Signature implementation has been updated to Apache Santuario
+3.0.5 from 3.0.3.  This adds support for four new SHA-3 based ECDSA
+`SignatureMethod` algorithms.
+
+The `SignatureMethod` constants for these new algorithms are only
+available in Java 25.  Users will instead need to use the string
+literals listed below to obtain instances of these new algorithms:
+
+* ECDSA_SHA3_224: http://www.w3.org/2021/04/xmldsig-more#ecdsa-sha3-224
+* ECDSA_SHA3_256: http://www.w3.org/2021/04/xmldsig-more#ecdsa-sha3-256
+* ECDSA_SHA3_384: http://www.w3.org/2021/04/xmldsig-more#ecdsa-sha3-384
+* ECDSA_SHA3_512: http://www.w3.org/2021/04/xmldsig-more#ecdsa-sha3-512
+
+core-libs/java.util.jar:
+
+JDK-7036144: GZIPInputStream readTrailer uses faulty available() test for end-of-stream
+=======================================================================================
+The `GZIPInputStream` class supports concatenated GZIP streams and
+will attempt to start reading a new stream after the previous one
+ends.  This attempt was conditional on `InputStream.available()`
+returning a value greater than zero, but this method only returns an
+estimate of the number of bytes that can be read without blocking.
+With this release, the test is removed and reading a new stream is
+always attempted.
+
+security-libs/javax.net.ssl:
+
+JDK-8341964: Add mechanism to disable different parts of TLS cipher suite
+=========================================================================
+The mechanisms in previous releases of OpenJDK for disabling TLS
+algorithms were either too broad or too specific.  Specifying an
+algorithm (e.g. "RSA") would disable all suites using that algorithm.
+The only alternative was to specify every suite.  With this release,
+the `jdk.tls.disabledAlgorithms` security property supports wildcards
+for patterns that begin with "TLS_", so "TLS_RSA_*" can be used to
+disable all suites that start with "TLS_RSA_".
+
+JDK-8349583: Add mechanism to disable signature schemes based on their TLS scope
+================================================================================
+In this release, the `jdk.tls.disabledAlgorithms` property now
+supports specifying the usage of a particular algorithm.  An algorithm
+can be limited to use only in a TLS handshake exchange or only in a
+TLS certificate.
+
+The usage is specified by adding a suffix to the algorithm, consisting
+of the word "usage" and either `HandshakeSignature` for TLS handshake
+exchanges or `CertificateSignature` for TLS certificates.  For
+example, `rsa_pkcs1_sha1 usage HandshakeSignature` restricts the
+`rsa_pkcs1_sha1` algorithm to use in TLS handshake exchanges only and
+it can not be used to sign TLS certificates.
+
+tools/launcher:
+
+JDK-8337506: Disable "best-fit" mapping on Windows command line
+===============================================================
+On Windows, the Java launcher in previous releases of OpenJDK used the
+ANSI version of the GetCommandLine() Win32 API call to obtain
+command-line arguments.  If the arguments contained Unicode characters
+that did not exist in the ANSI code page, they would be converted to
+other characters using the Windows "best fit" mapping [0].  This
+mapping could introduce unexpected characters and differed between
+code pages.  With this release, the JDK reads the command line
+arguments as Unicode and then converts them to the ANSI codepage
+itself, using the default replacement character for any that can not
+be mapped.  For cases where such Unicode characters need to be
+retained as is, select UTF-8 in the Windows regional settings.
+
+[0] https://www.unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WindowsBestFit/readme.txt
+
+hotspot/runtime:
+
+JDK-8313083: Print 'rss' and 'cache' as part of the container information
+=========================================================================
+In this release, the information provided for containers is improved
+by inclusion of the memory usage information for the Resident Set Size
+(RSS) and the cache, in bytes.  This is visible in the output of `jcmd
+<PID> VM.info`, where `<PID>` is the running JVM, and in the `hs_err`
+file generated on abrupt JVM termination.
+
+security-libs/java.security:
+
+JDK-8313367: SunMSCAPI cannot read Local Computer certs w/o Windows elevation
+=============================================================================
+The SunMSCAPI provider in previous releases of OpenJDK required
+administrator privileges to access the local computer key store.  The
+store is now accessed with the `CERT_STORE_MAXIMUM_ALLOWED_FLAG` set
+so that non-elevated processes will be able to access the key store in
+read only mode.
+
+JDK-8361212: Remove AffirmTrust root CAs
+========================================
+The following root certificates from AffirmTrust, which were
+deactivated in the 21.0.5 release of October 2024, have been removed
+from the `cacerts` keystore:
+
+Alias name: affirmtrustcommercialca [jdk]
+CN=AffirmTrust Commercial
+O=AffirmTrust
+C=US
+SHA256: 03:76:AB:1D:54:C5:F9:80:3C:E4:B2:E2:01:A0:EE:7E:EF:7B:57:B6:36:E8:A9:3C:9B:8D:48:60:C9:6F:5F:A7
+
+Alias name: affirmtrustnetworkingca [jdk]
+CN=AffirmTrust Networking
+O=AffirmTrust
+C=US
+SHA256: 0A:81:EC:5A:92:97:77:F1:45:90:4A:F3:8D:5D:50:9F:66:B5:E2:C5:8F:CD:B5:31:05:8B:0E:17:F3:F0B4:1B
+
+Alias name: affirmtrustpremiumca [jdk]
+CN=AffirmTrust Premium
+O=AffirmTrust
+C=US
+SHA256: 70:A7:3F:7F:37:6B:60:07:42:48:90:45:34:B1:14:82:D5:BF:0E:69:8E:CC:49:8D:F5:25:77:EB:F2:E9:3B:9A
+
+Alias name: affirmtrustpremiumeccca [jdk]
+CN=AffirmTrust Premium ECC
+O=AffirmTrust
+C=US
+SHA256: BD:71:FD:F6:DA:97:E4:CF:62:D1:64:7A:DD:25:81:B0:7D:79:AD:F8:39:7E:B4:EC:BA:9C:5E:84:88:82:14:23
+
 New in release OpenJDK 21.0.8 (2025-07-15):
 ===========================================
 Live versions of these release notes can be found at:
@ -423,12 +843,12 @@ properties:

 * `jdk.httpclient.connectionWindowSize`
  - Specifies the HTTP/2 client connection window size in bytes.
-  - Default value: `2^26`
+  - Default value: `67108864` (2^26, 64 MiB)
  - Range: `2^16-1` to `2^31-1`.

 * `jdk.httpclient.windowSize`
  - Specifies the HTTP/2 client stream window size in bytes.
-  - Default value: `16777216` (16MB)
+  - Default value: `16777216` (2^24, 16 MiB)
  - Range: `2^14` to `2^31-1`

 Specifying an invalid value leads to the default value being used.
--- a/java-21-openjdk.spec
+++ b/java-21-openjdk.spec
@ -308,7 +308,7 @@
 # New Version-String scheme-style defines
 %global featurever 21
 %global interimver 0
-%global updatever 8
+%global updatever 9
 %global patchver 0
 # We don't add any LTS designator for STS packages (Fedora and EPEL).
 # We need to explicitly exclude EPEL as it would have the %%{rhel} macro defined.
@ -365,7 +365,7 @@
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{vcstag}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        9
+%global buildver        10
 %global rpmrelease      1
 # Settings used by the portable build
 %global portablerelease 1
@ -1532,12 +1532,12 @@ BuildRequires: libjpeg-devel
 BuildRequires: libpng-devel
 BuildRequires: zlib-devel
 %else
-# Version in src/java.desktop/share/legal/freetype.md
+# Version in src/java.desktop/share/native/libfreetype/include/freetype/freetype.h
 Provides: bundled(freetype) = 2.13.3
 # Version in src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h
 Provides: bundled(giflib) = 5.2.2
 # Version in src/java.desktop/share/native/libharfbuzz/hb-version.h
-Provides: bundled(harfbuzz) = 10.4.0
+Provides: bundled(harfbuzz) = 11.2.0
 # Version in src/java.desktop/share/native/liblcms/lcms2.h
 Provides: bundled(lcms2) = 2.17.0
 # Version in src/java.desktop/share/native/libjavajpeg/jpeglib.h
@ -2567,7 +2567,18 @@ cjc.mainProgram(args)
 %endif

 %changelog
-* Thu Jul 10 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.9-1.1
+* Fri Oct 17 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.9.0.10-1
+- Update to jdk-21.0.9+10 (GA)
+- Update release notes to 21.0.9+10
+- Bump harfbuzz version to 11.2.0 following JDK-8355528
+- Add NEWS corrections from Thomas
+- Use double spacing consistently in notes for this release
+- Correct 11u release reference to corresponding 21u release as pointed out by Kieran
+- ** This tarball is embargoed until 2025-10-21 @ 1pm PT. **
+- Resolves: RHEL-118774
+- Resolves: RHEL-119466
+
+* Thu Jul 10 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.9-1
 - Update to jdk-21.0.8+9 (GA)
 - Update release notes to 21.0.8+9
 - Switch to GA mode
--- a/2
+++ b/2
@ -1,2 +1,2 @@
 SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30
-SHA512 (openjdk-21.0.8+9.tar.xz) = 81be6d151fdca910fbee9ea1a93b20af037d2dbafeb12fa368a6091096a22dcf997cf419bebe0261f016ce0fe1e74acd4fca54ca0840a3d69ad76ae7a1336e4c
+SHA512 (openjdk-21.0.9+10.tar.xz) = 95da8df167a2ce632614280ae50dee74aaba96001ec33e9a8b59abf8805f4c06b6ebc9eec1b0b03fe489ce8778adb83d94fe3648b343816b8d9ab2a621c580b8