This update for postgresql-jdbc fixes the following issues: CVE-2024-1597: Fixed SQL Injection via line comment generation (bsc#1220644).

This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 115.2.1 ESR (bsc#1215245). CVE-2023-4863: Fixed heap buffer overflow in libwebp (MFSA 2023-40) (bsc#1215231). The following non-security bug was fixed: Fix i586 build by reducing debug info to -g1 (bsc#1210168).

This update for webkit2gtk3 fixes the following issues: CVE-2023-42890: Fixed processing malicious web content may lead to arbitrary code execution (bsc#1218033). CVE-2023-42883: Fixed processing a malicious image may lead to a denial-of-service (bsc#1218032). CVE-2023-41074: Fixed use-after-free in the MediaRecorder API of the WebKit GStreamer-based ports (bsc#1215870). CVE-2023-40451, CVE-2023-41074: Update to version 2.42.4 (bsc#1215868).

This update for postfix fixes the following issues: CVE-2023-51764: Fixed SMTP smuggling attack (bsc#1218304).

This update for eclipse-jgit, jsch fixes the following issues: Security fix: - CVE-2023-4759: Fixed an arbitrary file overwrite which might have occurred with a specially crafted git repository and a case-insensitive filesystem. (bsc#1215298) Other fixes: jsch was updated to version 0.2.9: - Added support for various algorithms - Migrated from com.jcraft:jsch to com.github.mwiede:jsch fork (bsc#1211955): Alias to the old artifact since the new one is drop-in replacement Keep the old OSGi bundle symbolic name to avoid extensive patching of eclipse stack - Updated to version 0.2.9: For the full list of changes please consult the upstream changelogs below for each version updated: + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.9 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.8 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.7 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.6 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.5 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.4 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.3 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.2 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.1 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.0 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.71 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.70 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.69 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.68 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.67 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.66 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.65 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.64 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.63 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.62 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.61 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.60 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.59 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.58 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.57 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.56 eclipse-jgit: Craft the jgit script from the real Main class of the jar file instead of using a jar launcher (bsc#1209646)

This update for postgresql, postgresql15, postgresql16 fixes the following issues: This update ships postgresql 16. Security issues fixed: CVE-2023-5868: Fix handling of unknown-type arguments in DISTINCT "any" aggregate functions. This error led to a text-type value being interpreted as an unknown-type value (that is, a zero-terminated string) at runtime. This could result in disclosure of server memory following the text value. (bsc#1216962) CVE-2023-5869: Detect integer overflow while computing new array dimensions. When assigning new elements to array subscripts that are outside the current array bounds, an undetected integer overflow could occur in edge cases. Memory stomps that are potentially exploitable for arbitrary code execution are possible, and so is disclosure of server memory. (bsc#1216961) CVE-2023-5870: Prevent the pgsignalbackend role from signalling background workers and autovacuum processes. The documentation says that pgsignalbackend cannot issue signals to superuser-owned processes. It was able to signal these background processes, though, because they advertise a role OID of zero. Treat that as indicating superuser ownership. The security implications of cancelling one of these process types are fairly small so far as the core code goes (we'll just start another one), but extensions might add background workers that are more vulnerable. Also ensure that the issuperuser parameter is set correctly in such processes. No specific security consequences are known for that oversight, but it might be significant for some extensions. (bsc#1216960) Changes in postgresql16: Upgrade to 16.1:

https://www.postgresql.org/about/news/2715

https://www.postgresql.org/docs/16/release-16.html

https://www.postgresql.org/docs/16/release-16-1.html

Overhaul postgresql-README.SUSE and move it from the binary package to the noarch wrapper package.

Change the unix domain socket location from /var/run to /run. Changes in postgresql15: Update to 15.5 https://www.postgresql.org/docs/15/release-15-5.html

The libs and mini package are now provided by postgresql16.

Overhaul postgresql-README.SUSE and move it from the binary package to the noarch wrapper package.

Change the unix domain socket location from /var/run to /run. Changes in postgresql: Interlock version and release of all noarch packages except for the postgresql-docs. bsc#1122892: Add a sysconfig variable for initdb. Overhaul postgresql-README.SUSE and move it from the binary package to the noarch wrapper package. bsc#1179231: Add an explanation for the /tmp -> /run/postgresql move and permission change. Add postgresql-README as a separate source file. bsc#1209208: Drop hard dependency on systemd bsc#1206796: Refine the distinction of where to use sysusers and use bcond to have the expression only in one place.

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: CVE-2020-26555: Fixed Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B that may permit an unauthenticated nearby device to spoof the BDADDR of the peer device to complete pairing without knowledge of the PIN (bsc#1179610 bsc#1215237). CVE-2023-51779: Fixed a use-after-free because of a btsockioctl race condition in btsockrecvmsg (bsc#1218559). CVE-2023-6121: Fixed an out-of-bounds read vulnerability in the NVMe-oF/TCP subsystem that could lead to information leak (bsc#1217250). CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947). CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946). CVE-2023-6931: Fixed a heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component that could lead to local privilege escalation. (bsc#1218258). CVE-2023-6932: Fixed a use-after-free vulnerability in the Linux kernel's ipv4: igmp component that could lead to local privilege escalation (bsc#1218253). The following non-security bugs were fixed: clocksource: Avoid accidental unstable marking of clocksources (bsc#1218105). clocksource: Suspend the watchdog temporarily when high read latency detected (bsc#1218105). doc/README.SUSE: Add how to update the config for module signing (jsc#PED-5021) doc/README.SUSE: Remove how to build modules using kernel-source (jsc#PED-5021) doc/README.SUSE: Simplify the list of references (jsc#PED-5021). efi/mokvar: Reserve the table only if it is in boot services data (bsc#1215375). iouring: fix 32-bit compatability with sendmsg/recvmsg (bsc#1217709).

This update for util-linux fixes the following issues: Instead of explicitly truncating clocks.txt file, pad with whitespaces in the end of file. This is done to improve performance of libuuid on xfs. (bsc#1207987)

This update for perl-Spreadsheet-ParseExcel fixes the following issues: CVE-2023-7101: Fixed a command injection issue when parsing an untrusted spreadsheet (bsc#1218414).

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 115.7.0 ESR (MFSA2024-02) (bsc#1218955): CVE-2024-0741: Out of bounds write in ANGLE CVE-2024-0742: Failure to update user input timestamp CVE-2024-0746: Crash when listing printers on Linux CVE-2024-0747: Bypass of Content Security Policy when directive unsafe-inline was set CVE-2024-0749: Phishing site popup could show local origin in address bar CVE-2024-0750: Potential permissions request bypass via clickjacking CVE-2024-0751: Privilege escalation through devtools CVE-2024-0753: HSTS policy on subdomain could bypass policy of upper domain CVE-2024-0755: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7

This update for apache-parent, apache-sshd fixes the following issues: apache-parent was updated from version 28 to 31: Version 31: New Features: Added maven-checkstyle-plugin to pluginManagement

Improvements: Set minimalMavenBuildVersion to 3.6.3 - the minimum used by plugins Using an SPDX identifier as the license name is recommended by Maven Use properties to define the versions of plugins

Bugs fixed: Updated documentation for previous changes apache-sshd was updated from version 2.7.0 to 2.12.0: Security issues fixed: CVE-2023-48795: Implemented OpenSSH "strict key exchange" protocol in apache-sshd version 2.12.0 (bsc#1218189)

CVE-2022-45047: Java unsafe deserialization vulnerability fixed in apache-sshd version 2.9.2 (bsc#1205463)

Other changes in version 2.12.0:

Bugs fixed: SCP client fails silently when error signalled due to missing file or lacking permissions Ignore unknown key types from agent or in OpenSSH host keys extension

New Features: Support GIT protocol-v2

Other changes in version 2.11.0: Bugs fixed: Added configurable timeout(s) to DefaultSftpClient Compare file keys in ModifiableFileWatcher. Fixed channel pool in SftpFileSystem. Use correct default OpenOptions in SftpFileSystemProvider.newFileChannel(). Use correct lock modes for SFTP FileChannel.lock(). ScpClient: support issuing commands to a server that uses a non-UTF-8 locale. SftpInputStreamAsync: fix reporting EOF on zero-length reads. Work-around a bug in WSFTP <= 12.9 SFTP clients. (Regression in 2.10.0) SFTP performance fix: override FilterOutputStream.write(byte[], int, int). Fixed a race condition to ensure SSHMSGCHANNELEOF is always sent before SSHMSGCHANNELCLOSE. Fixed error handling while flushing queued packets at end of KEX. Fixed wrong log level on closing an Nio2Session. Fixed detection of Android O/S from system properties. Consider all applicable host keys from the knownhosts files. SftpFileSystem: do not close user session. ChannelAsyncOutputStream: remove write future when done. SSHD-1332 (Regression in 2.10.0) Resolve ~ in IdentityFile file names in HostConfigEntry.

New Features: Use KeepAliveHandler global request instance in client as well Publish snapshot maven artifacts to the Apache Snapshots maven repository. Bundle sshd-contrib has support classes for the HAProxy protocol V2.

Other changes in version 2.10.0: Bugs fixed: Connection attempt not canceled when a connection timeout occurs Possible OOM in ChannelPipedInputStream SftpRemotePathChannel.transferFrom(...) ignores position argument Rooted file system can leak informations Failed to establish an SSH connection because the server identifier exceeds the int range

Improvements: Password in clear in SSHD server's logs

Other changes in version 2.9.2: Bugs fixed: SFTP worker threads got stuck while processing PUT methods against one specific SFTP server Use the maximum packet size of the communication partner ExplicitPortForwardingTracker does not unbind auto-allocated one Default SshClient FD leak because Selector not closed Reading again from exhausted ChannelExec#getInvertedOut() throws IOException instead of returning -1 Keeping error streams and input streams separate after ChannelExec#setRedirectErrorStream(true) is called Nio2Session.shutdownOutput() should wait for writes in progress

Test: Research intermittent failure in unit tests using various I/O service factories

Other changes in version 2.9.1: Bugs fixed: ClientSession.auth().verify() is terminated with timeout 2.9.0 release broken on Java 8 Infinite loop in org.apache.sshd.sftp.client.impl.SftpInputStreamAsync#doRead Deadlock during session exit Race condition is logged in ChannelAsyncOutputStream

Other changes in version 2.9.0: Bugs fixed: Deadlock on disconnection at the end of key-exchange Remote port forwarding mode does not handle EOF properly Public key authentication: wrong signature algorithm used (ed25519 key with ssh-rsa signature) Client fails window adjust above Integer.MAXVALUE class loader fails to load org.apache.sshd.common.cipher.BaseGCMCipher Shell is not getting closed if the command has already closed the OutputStream it is using. Sometimes async write listener is not called Unhandled SSHMSGCHANNELWINDOWADJUST leeds to SocketTimeoutException different host key algorithm used on rekey than used for the initial connection OpenSSH certificate is not properly encoded when critical options are included TCP/IP remote port forwarding with wildcard IP addresses doesn't work with OpenSSH UserAuthPublicKey: uses ssh-rsa signatures for RSA keys from an agent

New Features: Added support for Argon2 encrypted PUTTY key files Added support for merged inverted output and error streams of remote process

Improvements: Added support for "limits@openssh.com" SFTP extension Support host-based pubkey authentication in the client Send environment variable and open subsystem at the same time for SSH session

Other changes in version 2.8.0: Bugs fixed: Fixed wrong server key algorithm choice Expiration of OpenSshCertificates needs to compare timestamps as unsigned long SFTP Get downloads empty file from servers which supports EOF indication after data skip() doesn't work properly in SftpInputStreamAsync OpenMode and CopyMode is not honored as expected in version > 4 of SFTP api SftpTransferTest sometimes hangs (failure during rekeying) Race condition in KEX Fix the ciphers supported documentation Update tarLongFileMode to use POSIX WinsCP transfer failure to Apache SSHD Server Pubkey auth: keys from ssh-agent are used even if HostConfigEntry.isIdentitiesOnly() is true Support RSA SHA2 signatures via SSH agent NOTICE: wrong copyright year range Wrong creationTime in writeAttrs for SFTP sshd-netty logs all traffic on INFO level

New Features: Add support for chacha20-poly1305@openssh.com Parsing of ~/.ssh/config Host patterns fails with extra whitespace Support generating OpenSSH client certificates

Improvements: Add support for curve25519-sha256@libssh.org key exchange OpenSSH certificates: check certificate type OpenSSHCertificatesTest: certificates expire in 2030 Display IdleTimeOut in more user-friendly format sendChunkIfRemoteWindowIsSmallerThanPacketSize flag in ChannelAsyncOutputStream constructor configurable from outside using variable/config file Intercepting the server exception message from server in SSHD client Implement RFC 8332 server-sig-algs on the server Slow performance listing huge number of files on Apache SSHD server SFTP: too many LSTAT calls Support key constraints when adding a key to an SSH agent Add SFTP server side file custom attributes hook

This update for webkit2gtk3 fixes the following issues: CVE-2024-23222: Fixed type confusion that may lead to arbitrary code execution. (bsc#1219113)

This update for perl fixes the following issues: CVE-2023-31484: Enable TLS cert verification in CPAN (bsc#1210999).

This update for bouncycastle, jsch fixes the following issues: Updated jsch to version 0.2.15:

CVE-2023-48795: Fixed a prefix truncation issue that could lead to disclosure of sensitive information (bsc#1218134).

Updated bouncycastle to version 1.77.

This update for suse-build-key fixes the following issues: This update runs a import-suse-build-key script. The previous libzypp-post-script based installation is replaced with a systemd timer and service (bsc#1217215 bsc#1216410 jsc#PED-2777). - suse-build-key-import.service - suse-build-key-import.timer It imports the future SUSE Linux Enterprise 15 4096 bit RSA key primary and reserve keys. After successful import the timer is disabled. To manually import them you can also run: rpm --import /usr/lib/rpm/gnupg/keys/gpg-pubkey-3fa1d6ce-63c9481c.asc rpm --import /usr/lib/rpm/gnupg/keys/gpg-pubkey-d588dc46-63c939db.asc Bugfix added since last update: run rpm commands in import script only when libzypp is not active. bsc#1219189 bsc#1219123

This update for tomcat fixes the following issues: Updated to Tomcat 9.0.85: CVE-2023-45648: Improve trailer header parsing (bsc#1216118). CVE-2023-42794: FileUpload: remove tmp files to avoid DoS on Windows (bsc#1216120). CVE-2023-42795: Improve handling of failures during recycle() methods (bsc#1216119). CVE-2023-46589: Fixed HTTP request smuggling due to incorrect headers parsing (bsc#1217649) CVE-2024-22029: Fixed escalation to root from tomcat user via %post script. (bsc#1219208) The following non-security issues were fixed: Fixed the file permissions for server.xml (bsc#1217768, bsc#1217402). Find the full release notes at: https://tomcat.apache.org/tomcat-9.0-doc/changelog.html

This update for salt fixes the following issues: Security issues fixed: CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master (bsc#1219430) CVE-2024-22232: Prevent directory traversal attacks in the master's servefile method (bsc#1219431) Bugs fixed: Ensure that pillar refresh loads beacons from pillar without restart Fix the aptpkg.py unit test failure Prefer unittest.mock to python-mock in test suite Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) Revert changes to set Salt configured user early in the stack (bsc#1216284) Align behavior of some modules when using salt-call via symlink (bsc#1215963) Fix gitfs "env" and improve cache cleaning (bsc#1193948) Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed

This update for webkit2gtk3 fixes the following issues: Update to version 2.42.5 (bsc#1219604): CVE-2024-23222: Fixed processing maliciously crafted web content that may have led to arbitrary code execution (bsc#1219113). CVE-2024-23206: Fixed fingerprint user via maliciously crafted webpages (bsc#1219604). CVE-2024-23213: Fixed processing web content that may have led to arbitrary code execution (bsc#1219604). CVE-2023-40414: Fixed processing web content that may have led to arbitrary code execution (bsc#1219604). CVE-2014-1745: Fixed denial-of-service or potentially disclose memory contents while processing maliciously crafted files (bsc#1219604). CVE-2023-42833: Fixed processing web content that may have led to arbitrary code execution (bsc#1219604).

This update for postgresql12 fixes the following issues: Upgrade to 12.18: CVE-2024-0985: Tighten security restrictions within REFRESH MATERIALIZED VIEW CONCURRENTLY (bsc#1219679).

This update for postgresql13 fixes the following issues: Upgrade to 13.14: CVE-2024-0985: Tighten security restrictions within REFRESH MATERIALIZED VIEW CONCURRENTLY (bsc#1219679).

This update for docker fixes the following issues: Vendor latest buildkit v0.11 including bugfixes for the following: CVE-2024-23653: BuildKit API doesn't validate entitlement on container creation (bsc#1219438). CVE-2024-23652: Fixed arbitrary deletion of files (bsc#1219268). CVE-2024-23651: Fixed race condition in mount (bsc#1219267).

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 115.8.0 ESR (MFSA 2024-06) (bsc#1220048): CVE-2024-1546: Out-of-bounds memory read in networking channels CVE-2024-1547: Alert dialog could have been spoofed on another site CVE-2024-1548: Fullscreen Notification could have been hidden by select element CVE-2024-1549: Custom cursor could obscure the permission dialog CVE-2024-1550: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants CVE-2024-1551: Multipart HTTP Responses would accept the Set-Cookie header in response parts CVE-2024-1552: Incorrect code generation on 32-bit ARM devices

CVE-2024-1553: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8

Recommend libfido2-udev on codestreams that exist, in order to try to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)

This update for bind fixes the following issues: CVE-2023-2828: Fixed denial-of-service against recursive resolvers related to cache-cleaning algorithm (bsc#1212544).

This update for Java fixes the following issues: apache-commons-codec was updated to version 1.16.1: Changes in version 1.16.1:

New features:

Added Maven property project.build.outputTimestamp for build reproducibility

Bugs fixed:

Correct error in Base64 Javadoc Added minimum Java version in changes.xml Documentation update for the org.apache.commons.codec.digest. package Precompile regular expression in UnixCrypt.crypt(byte[], String) Fixed possible IndexOutOfBoundException in PhoneticEngine.encode method Fixed possible ArrayIndexOutOfBoundsException in QuotedPrintableCodec.encodeQuotedPrintable() method Fixed possible StringIndexOutOfBoundException in MatchRatingApproachEncoder.encode() method Fixed possible ArrayIndexOutOfBoundException in RefinedSoundex.getMappingCode() Fixed possible IndexOutOfBoundsException in PercentCodec.insertAlwaysEncodeChars() method Deprecated UnixCrypt 0-argument constructor Deprecated Md5Crypt 0-argument constructor Deprecated Crypt 0-argument constructor Deprecated StringUtils 0-argument constructor Deprecated Resources 0-argument constructor Deprecated Charsets 0-argument constructor Deprecated CharEncoding 0-argument constructor

Changes in version 1.16.0:

Remove duplicated words from Javadocs

Use Standard Charset object Use String.contains() functions Avoid use toString() or substring() in favor of a simplified expression Fixed byte-skipping in Base16 decoding Fixed several typos, improve writing in some javadocs BaseNCodecOutputStream.eof() should not throw IOException. Javadoc improvements and cleanups. Deprecated BaseNCodec.isWhiteSpace(byte) and use Character.isWhitespace(int). Added support for Blake3 family of hashes Added github/codeql-action Bump actions/cache from v2 to v3.0.10 Bump actions/setup-java from v1.4.1 to 3.5.1 Bump actions/checkout from 2.3.2 to 3.1.0 Bump commons-parent from 52 to 58 Bump junit from 4.13.1 to 5.9.1 Bump Java 7 to 8. Bump japicmp-maven-plugin from 0.14.3 to 0.17.1. Bump jacoco-maven-plugin from 0.8.5 to 0.8.8 (Fixes Java 15 builds). Bump maven-surefire-plugin from 2.22.2 to 3.0.0-M7 Bump maven-javadoc-plugin from 3.2.0 to 3.4.1. Bump animal-sniffer-maven-plugin from 1.19 to 1.22. Bump maven-pmd-plugin from 3.13.0 to 3.19.0 Bump pmd from 6.47.0 to 6.52.0. Bump maven-checkstyle-plugin from 2.17 to 3.2.0 Bump checkstyle from 8.45.1 to 9.3 Bump taglist-maven-plugin from 2.4 to 3.0.0 Bump jacoco-maven-plugin from 0.8.7 to 0.8.8. apache-commons-compress was updated to version 1.26: Changes in version 1.26:

Security issues fixed:

CVE-2024-26308: Fixed allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress (bsc#1220068) CVE-2024-25710: Fixed loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress (bsc#1220070)

New Features:

Added and use ZipFile.builder(), ZipFile.Builder, and deprecate constructors Added and use SevenZFile.builder(), SevenZFile.Builder, and deprecate constructors Added and use ArchiveInputStream.getCharset() Added and use ArchiveEntry.resolveIn(Path) Added Maven property project.build.outputTimestamp for build reproducibility

Bugs fixed:

Check for invalid PAX values in TarArchiveEntry Fixed zero size headers in ArjInputStream Fixes and tests for ArInputStream Fixes for dump file parsing Improved CPIO exception detection and handling Deprecated SkipShieldingInputStream without replacement (nolonger used) Reuse commons-codec, don't duplicate class PureJavaCrc32C (removed package-private class) Reuse commons-codec, don't duplicate class XXHash32 (deprecated class) Reuse commons-io, don't duplicate class Charsets (deprecated class) Reuse commons-io, don't duplicate class IOUtils (deprecated methods) Reuse commons-io, don't duplicate class BoundedInputStream (deprecated class) Reuse commons-io, don't duplicate class FileTimes (deprecated TimeUtils methods) Reuse Arrays.equals(byte[], byte[]) and deprecate ArchiveUtils.isEqual(byte[], byte[]) Added a null-check for the class loader of OsgiUtils Added a null-check in Pack200.newInstance(String, String) Deprecated ChecksumCalculatingInputStream in favor of java.util.zip.CheckedInputStream Deprecated CRC32VerifyingInputStream.CRC32VerifyingInputStream(InputStream, long, int) FramedSnappyCompressorOutputStream produces incorrect output when writing a large buffer Fixed TAR directory entries being misinterpreted as files Deprecated unused method FileNameUtils.getBaseName(String) Deprecated unused method FileNameUtils.getExtension(String) ArchiveInputStream.BoundedInputStream.read() incorrectly adds 1 for EOF to the bytes read count Deprecated IOUtils.read(File, byte[]) Deprecated IOUtils.copyRange(InputStream, long, OutputStream, int) ZipArchiveOutputStream multi archive updates metadata in incorrect file Deprecated ByteUtils.InputStreamByteSupplier Deprecated ByteUtils.fromLittleEndian(InputStream, int) Deprecated ByteUtils.toLittleEndian(DataOutput, long, int) Reduce duplication by having ArchiveInputStream extend FilterInputStream Support preamble garbage in ZipArchiveInputStream Fixed formatting the lowest expressable DOS time Dropped reflection from ExtraFieldUtils static initialization Preserve exception causation in ExtraFieldUtils.register(Class)

Changes in version 1.25:

For the full list of changes please consult: https://commons.apache.org/proper/commons-compress/changes-report.html#a1.25.0

Changes in version 1.24:

For the full list of changes please consult: https://commons.apache.org/proper/commons-compress/changes-report.html#a1.24.0

Changes in version 1.23:

For the full list of changes please consult: https://commons.apache.org/proper/commons-compress/changes-report.html#a1.23.0

Changes in version 1.22:

For the full list of changes please consult: https://commons.apache.org/proper/commons-compress/changes-report.html#a1.22 apache-commons-io was updated to version 2.15.1: Changes in version 2.15.1:

For the full list of changes please consult: https://commons.apache.org/proper/commons-io/changes-report.html#a2.15.1

Changes in version 2.15.0:

For the full list of changes please consult: https://commons.apache.org/proper/commons-io/changes-report.html#a2.15.0

Changes in version 2.14.0:

For the full list of changes please consult: https://commons.apache.org/proper/commons-io/changes-report.html#a2.14.0 javapackages-meta: Syncing the version with javapackages-tools 6.2.0 Remove unnecessary dependencies maven was updated to version 3.9.6: Changes in version 3.9.6:

Bugs fixed:

Error message when modelVersion is 4.0 is confusing

Improvements:

Colorize transfer messages Support ${project.basedir} in file profile activation Allow to exclude plugins from validation

Tasks:

Maven Resolver Provider classes ctor change Undeprecate wrongly deprecated repository metadata Deprecated org.apache.maven.repository.internal.MavenResolverModule maven-resolver-provider: introduce NAME constants.

Dependency upgrade:

Updated to Resolver 1.9.16 Upgraded Sisu version to 0.9.0.M2 Upgraded Resolver version to 1.9.18 Upgraded to parent POM 41 Upgraded default plugin bindings maven-assembly-plugin: Explicitely require commons-io:commons-io and commons-codec:common-codes artifacts that are optional in apache-commons-compress maven-doxia was updated to version 1.12.0: Changes in version 1.12.0:

Upgraded to FOP 2.2 Fixed rendering links and paragraphs inside tables Rewrite .md and .markdown links to .html Upgraded HttpComponents: httpclient to 4.5.8 and httpcore to 4.4.11 Escape links to xml based figureGraphics image elements SECURITY: Use HTTPS to resolve dependencies in Maven Build Removed old Maven 1 and 2 info Updated commons-lang to 3.8.1 Dropped dependency to outdated Log4j Fixed Java 7 compatibility that was broken Import tests from maven-site-plugin Fixed crosslinks starting with a dot in markdown files Replace deprecated class from commons-lang Fill in some generic types maven-doxia-sitetools was updated to version 1.11.1: Changes in version 1.11.1:

Bugs fixed:

CLIRR can't find previous version

Improvements:

Removed all &#xA0; in default-site-macros.vm and replace by a space Improved documentation on site.xml inheritance vs interpolation

Tasks:

Deprecated Doxia Sitetools Doc Renderer

Dependency upgrade:

Fixed javadoc issues with JDK 8 when generating documentation Wrong coordinates for jaicore: hyphen should be underscore Use latest JUnit version 4.13.2 Upgraded Plexus Utils to 3.3.0 Upgraded Plexus Interpolation to 1.26 Upgraded Maven Doxia to 1.10 Upgraded Maven Doxia to 1.11.1 maven-jar-plugin was updated to version 3.3.0: Changes in version 3.3.0:

Bugs fixed:

outputTimestamp not applied to module-info; breaks reproducible builds

Task:

Updated plugin (requires Maven 3.2.5+) Java 8 as minimum

Dependency upgrade:

Upgraded Plexus Utils to 3.3.1 Removed override for Plexus Archiver to fix order of META-INF/ and META-INF/MANIFEST.MF entries Upgraded Parent to 36 Updated Plexus Utils to 3.4.2 Upgraded Parent to 37 maven-jar-plugin was updated to version 3.6.0: Changes from version 3.6.0:

Bugs fixed:

Setting maven.javadoc.isoffline seems to have no effect javadoc site is broken for projects that contain modules Alternative doclet page points to an SEO spammy page [REGRESSION] Transitive dependencies of docletArtifact missing Unresolvable link in javadoc tag with value ResourcesBundleMojo#getAttachmentClassifier() found in ResourcesBundleMojo IOException --> NullPointerException in JavadocUtil.copyResource JavadocReportTest.testExceptions is broken javadoc creates invalid --patch-module statements javadoc plugin can not deal with transitive filename based modules

Improvements:

Clean up deprecated and unpreferred methods in JavadocUtil Cleanup dependency declarations as best possible Allow building javadoc "the old fashioned way" after Java 8

Tasks:

Dropped use of deprecated localRepository mojo parameter Make build pass with Java 20 Refresh download page

Dependency upgrade:

Updated to commons-io 2.13.0 Updated plexus-archiver from 4.7.1 to 4.8.0 Upgraded Parent to 40

Changes from version 3.5.0:

Bugs fixed:

Invalid anchors in Javadoc and plugin mojo Plugin duplicates classes in Java 8 all-classes lists javadoc site creation ignores configuration parameters

Improvements:

Deprecated parameter "stylesheet" Parse stderr output and suppress informational lines Link to Javadoc references from JDK 17 Migrate components to JSR 330, get rid of maven-artifact-transfer, update to parent 37

Tasks:

Removed remains of org.codehaus.doxia.sink.Sink

Dependency upgrades:

Upgraded plugins in ITs Upgraded to Maven 3.2.5 Updated Maven Archiver to 3.6.0 Upgraded Maven Reporting API to 3.1.1/Complete with Maven Reporting Impl 3.2.0 Upgraded commons-text to 1.10.0 Upgraded Parent to 39 Upgraded plugins and components maven-reporting-api was updated to version 3.1.1: Restore binary compat for MavenReport maven-reporting-impl was updated to version 3.2.0: Changes in version 3.2.0:

Improvement:

Render with a skin when report is run in standalone mode

Dependency upgrades:

Upgraded Maven Reporting API to 3.1.1 Upgraded plugins and components in project and ITs maven-resolver was updated to version 1.9.18: Changes in version 1.9.18:

Bugs fixed:

Sporadic AccessDeniedEx on Windows Undo FileUtils changes that altered non-Windows execution path

Improvements:

Native transport should retry on HTTP 429 (Retry-After)

Task:

Deprecated Guice modules Get rid of component name string literals, make them constants and reusable Expose configuration for inhibiting Expect-Continue handshake in 1.x Refresh download page Resolver should not override given HTTP transport default use of expect-continue handshake maven-resources-plugin was updated to version 3.3.1: Changes in version 3.3.1:

Bugs fixed:

Resource plugin's handling of symbolic links changed in 3.0.x, broke existing behavior Resource copying not using specified encoding java.nio.charset.MalformedInputException: Input length = 1 Filtering of Maven properties with long names is not working after transition from 2.6 to 3.2.0 Valid location for directory parameter is always required Symlinks cause copying resources to fail FileUtils.copyFile() fails with source file having lastModified = 0

New Features:

Added ability to flatten folder structure into target directory when copying resources

Improvements:

Make tests jar reproducible Describe from and to in "Copying xresources" info message

Task:

Dropped plexus legacy Updated to parent POM 39, reformat sources Updated plugin (requires Maven 3.2.5+) Require Java 8

Dependency upgrade:

Upgraded maven-plugin parent to 36 Upgraded Maven Filtering to 3.3.0 Upgraded plexus-utils to 3.5.1 Upgraded to maven-filtering 3.3.1 sbt: Fixed RPM package build with maven 3.9.6 and maven-resolver 1.9.18 xmvn: Modify the xmvn-install script to work with new apache-commons-compress Recompiling RPM package to resolve package building issues with maven-lib

This update for nodejs16 fixes the following issues: Security issues fixed: CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). CVE-2024-24758: ignore proxy-authorization header (bsc#1220017). CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).

This update for nodejs14 fixes the following issues: Security issues fixed: CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).

This update for nodejs12 fixes the following issues: Security issues fixed: CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).

This update for gstreamer-plugins-bad fixes the following issues: CVE-2023-44446: Fixed use-after-free remote code execution vulnerability via MXF file (bsc#1217213).

This update for jetty-minimal fixes the following issues: CVE-2024-22201: Fixed denial-of-service via HTTP/2 connection leak (bsc#1220437).

This update for MozillaFirefox fixes the following issues: Firefox was updated to Extended Support Release 115.2.0 ESR (MFSA 2023-36) (bsc#1214606). CVE-2023-4574: Fixed memory corruption in IPC ColorPickerShownCallback (bmo#1846688) CVE-2023-4575: Fixed memory corruption in IPC FilePickerShownCallback (bmo#1846689) CVE-2023-4576: Fixed integer Overflow in RecordedSourceSurfaceCreation (bmo#1846694) CVE-2023-4577: Fixed memory corruption in JIT UpdateRegExpStatics (bmo#1847397) CVE-2023-4051: Fixed full screen notification obscured by file open dialog (bmo#1821884) CVE-2023-4578: Fixed Out of Memory Exception in SpiderMonkey could have triggered an (bmo#1839007) CVE-2023-4053: Fixed full screen notification obscured by external program (bmo#1839079) CVE-2023-4580: Fixed push notifications saved to disk unencrypted (bmo#1843046) CVE-2023-4581: Fixed XLL file extensions downloadable without warnings (bmo#1843758) CVE-2023-4582: Fixed buffer Overflow in WebGL glGetProgramiv (bmo#1773874) CVE-2023-4583: Fixed browsing Context potentially not cleared when closing Private Window (bmo#1842030) CVE-2023-4584: Fixed memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529) CVE-2023-4585: Fixed memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2(bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999).