<?xml version="1.0"?>
<!--
     Licensed to the Apache Software Foundation (ASF) under one or more
     contributor license agreements.  See the NOTICE file distributed with
     this work for additional information regarding copyright ownership.
     The ASF licenses this file to You under the Apache License, Version 2.0
     (the "License"); you may not use this file except in compliance with
     the License.  You may obtain a copy of the License at

          http://www.apache.org/licenses/LICENSE-2.0

     Unless required by applicable law or agreed to in writing, software
     distributed under the License is distributed on an "AS IS" BASIS,
     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     See the License for the specific language governing permissions and
     limitations under the License.
  -->
<document>
  <properties>
    <title>Commons Collections Changes</title>
  </properties>
  <body>

  <release version="3.2.2" date="2015-11-18" description="This is a bugfix release.">
    <action issue="COLLECTIONS-580" dev="tn" type="update">
      Serialization support for unsafe classes in the functor package is disabled
      by default as this can be exploited for remote code execution attacks.
      To re-enable the feature the system property "org.apache.commons.collections.enableUnsafeSerialization"
      needs to be set to "true".
      Classes considered to be unsafe are: CloneTransformer, ForClosure, InstantiateFactory,
      InstantiateTransformer, InvokerTransformer, PrototypeCloneFactory,
      PrototypeSerializationFactory, WhileClosure.
    </action>
    <action issue="COLLECTIONS-538" dev="tn" type="fix" due-to="Trejkaz">
      "ExtendedProperties" will now use a privileged action to access the
      "file.separator" system property. In case the class does not have
      permission to read system properties, the "File#separator" field will
      be used instead.
    </action>
    <action issue="COLLECTIONS-447" dev="tn" type="fix" due-to="Jeffrey Barnes">
      Tree traversal with a TreeListIterator will not be affected anymore by
      the removal of an element directly after a call to previous().
    </action>
    <action issue="COLLECTIONS-444" dev="tn" type="fix" due-to="Thomas Vahrst, John Vasileff">
      SetUniqueList.set(int, Object) now works correctly if the object to be inserted
      is already placed at the given position.
    </action>
    <action issue="COLLECTIONS-350" dev="bayard" type="fix" due-to="Michael Akerman">
      Removed debug output in "MapUtils#getNumber(Map)".
    </action>
    <action issue="COLLECTIONS-335" dev="jochen" type="fix" due-to="sebb">
      Fixed cache assignment for "TreeBidiMap#entrySet".
    </action>
    <action issue="COLLECTIONS-334" dev="jochen" type="fix" due-to="sebb">
      Synchronized access to lock in "StaticBucketMap#size()".
    </action>
    <action issue="COLLECTIONS-307" dev="bayard" type="fix" due-to="Christian Semrau">
      "SetUniqueList#subList()#contains(Object)" will now correctly check the subList
      rather than the parent list.
    </action>
    <action issue="COLLECTIONS-304" dev="bayard" type="fix" due-to="Rafał Figas,Bjorn Townsend">
      "SetUniqueList#set(int, Object)" will now correctly enforce the uniqueness constraint.
    </action>
    <action issue="COLLECTIONS-294" dev="bayard" type="fix" due-to="Benjamin Bentmann">
      "CaseInsensitiveMap" will now convert input strings to lower-case in a
      locale-independent manner.
    </action>
    <action issue="COLLECTIONS-266" dev="bayard" type="fix" due-to="Joerg Schaible">
      "MultiKey" will now be correctly serialized/de-serialized.
    </action>
    <action issue="COLLECTIONS-261" dev="bayard" type="fix" due-to="ori">
      "Flat3Map#remove(Object)" will now return the correct value mapped to the removed key
      if the size of the map is less or equal 3.
    </action>
    <action issue="COLLECTIONS-249" dev="bayard" type="fix" due-to="Joe Kelly">
      "SetUniqueList.addAll(int, Collection)" now correctly add the collection at the
      provided index.
    </action>
    <action issue="COLLECTIONS-228" dev="scolebourne" type="fix">
      "MultiValueMap#put(Object, Object)" and "MultiValueMap#putAll(Object, Collection)"
      now correctly return if the map has changed by this operation.
    </action>
    <action issue="COLLECTIONS-219" dev="scolebourne" type="fix" due-to="Tom Leccese">
      "CollectionUtils#removeAll" wrongly called "ListUtils#retainAll".
    </action>
    <action issue="COLLECTIONS-217" dev="scolebourne" type="fix" due-to="Matt Bishop">
      Calling "setValue(Object)" on any Entry returned by a "Flat3Map" will now
      correctly set the value for the current entry.
    </action>
  </release>
  </body>
</document>
