Key:

JDK-X  - https://bugs.openjdk.java.net/browse/JDK-X

CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY

New in release OpenJDK 8u352 (2022-10-18):

===========================================

Live versions of these release notes can be found at:

  * https://bit.ly/openjdk8u352

  * https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u352.txt

* Security fixes

  - JDK-8282252: Improve BigInteger/Decimal validation

  - JDK-8285662: Better permission resolution

  - JDK-8286511: Improve macro allocation

  - JDK-8286519: Better memory handling

  - JDK-8286526, CVE-2022-21619: Improve NTLM support

  - JDK-8286533, CVE-2022-21626: Key X509 usages

  - JDK-8286910, CVE-2022-21624: Improve JNDI lookups

  - JDK-8286918, CVE-2022-21628: Better HttpServer service

  - JDK-8288508: Enhance ECDSA usage

* Other changes

  - JDK-7131823: bug in GIFImageReader

  - JDK-7186258: InetAddress$Cache should replace currentTimeMillis with nanoTime for more precise and accurate

  - JDK-8028265: Add legacy tz tests to OpenJDK

  - JDK-8039955: [TESTBUG] jdk/lambda/LambdaTranslationTest1 - java.lang.AssertionError: expected [d:1234.000000] but found [d:1234,000000]

  - JDK-8049228: Improve multithreaded scalability of InetAddress cache

  - JDK-8071507: (ref) Clear phantom reference as soft and weak references do

  - JDK-8087283: Add support for the XML Signature here() function to the JDK XPath implementation

  - JDK-8130895: Test javax/swing/system/6799345/TestShutdown.java fails on Solaris11 Sparcv9

  - JDK-8136354: [TEST_BUG] Test  java/awt/image/RescaleOp/RescaleAlphaTest.java with Bad action for script

  - JDK-8139668: Generate README-build.html from markdown

  - JDK-8143847: Remove REF_CLEANER reference category

  - JDK-8147862: Null check too late in sun.net.httpserver.ServerImpl

  - JDK-8150669: C1 intrinsic for Class.isPrimitive

  - JDK-8155742: [Windows] robot.keyPress(KeyEvent.VK_ALT_GRAPH) throws java.lang.IllegalArgumentException in windows

  - JDK-8173339: AArch64: Fix minimum stack size computations

  - JDK-8173361: various crashes in JvmtiExport::post_compiled_method_load

  - JDK-8175797: (ref) Reference::enqueue method should clear the reference object before enqueuing

  - JDK-8178832: (ref) jdk.lang.ref.disableClearBeforeEnqueue property is ignored

  - JDK-8183107: PKCS11 regression regarding checkKeySize

  - JDK-8193780: (ref) Remove the undocumented "jdk.lang.ref.disableClearBeforeEnqueue" system property

  - JDK-8194873: right ALT key hotkeys no longer work in Swing components

  - JDK-8201793: (ref) Reference object should not support cloning

  - JDK-8214427: probable bug in logic of ConcurrentHashMap.addCount()

  - JDK-8232950: SUNPKCS11 Provider incorrectly check key length for PSS Signatures.

  - JDK-8233019: java.lang.Class.isPrimitive() (C1) returns wrong result if Klass* is aligned to 32bit

  - JDK-8235218: Minimal VM is broken after JDK-8173361

  - JDK-8235385: Crash on aarch64 JDK due to long offset

  - JDK-8245263: Enable TLSv1.3 by default on JDK 8u for Client roles

  - JDK-8254178: Remove .hgignore

  - JDK-8254318: Remove .hgtags

  - JDK-8256722: handle VC++:1927 VS2019 in  abstract_vm_version

  - JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)

  - JDK-8280963: Incorrect PrintFlags formatting on Windows

  - JDK-8282538: PKCS11 tests fail on CentOS Stream 9

  - JDK-8283849: AsyncGetCallTrace may crash JVM on guarantee

  - JDK-8285400: Add '@apiNote' to the APIs defined in Java SE 8 MR 3

  - JDK-8285497: Add system property for Java SE specification maintenance version

  - JDK-8287132: Retire Runtime.runFinalizersOnExit so that it always throws UOE

  - JDK-8287508: The tests added to jdk-8 by 8235385 are to be ported to jdk-11

  - JDK-8287521: Bump update version of OpenJDK: 8u352

  - JDK-8288763: Pack200 extraction failure with invalid size

  - JDK-8288865: [aarch64] LDR instructions must use legitimized addresses

  - JDK-8290000: Bump macOS GitHub actions to macOS 11

  - JDK-8292579: (tz) Update Timezone Data to 2022c

  - JDK-8292688: Support Security properties in security.testlibrary.Proc

Notes on individual issues:

===========================

core-libs/java.lang:

JDK-8201793: (ref) Reference object should not support cloning

==============================================================

`java.lang.ref.Reference::clone` method always throws

`CloneNotSupportedException`. `Reference` objects cannot be

meaningfully cloned. To create a new Reference object, call the

constructor to create a `Reference` object with the same referent and

reference queue instead.

JDK-8175797: (ref) Reference::enqueue method should clear the reference object before enqueuing

===============================================================================================

`java.lang.ref.Reference.enqueue` method clears the reference object

before it is added to the registered queue. When the `enqueue` method

is called, the reference object is cleared and `get()` method will

return null in OpenJDK 8u352.

Typically when a reference object is enqueued, it is expected that the

reference object is cleared explicitly via the `clear` method to avoid

memory leak because its referent is no longer referenced. In other

words the `get` method is expected not to be called in common cases

once the `enqueue`method is called. In the case when the `get` method

from an enqueued reference object and existing code attempts to access

members of the referent, `NullPointerException` may be thrown. Such

code will need to be updated.

JDK-8071507: (ref) Clear phantom reference as soft and weak references do

=========================================================================

This enhancement changes phantom references to be automatically

cleared by the garbage collector as soft and weak references.

An object becomes phantom reachable after it has been finalized. This

change may cause the phantom reachable objects to be GC'ed earlier -

previously the referent is kept alive until PhantomReference objects

are GC'ed or cleared by the application. This potential behavioral

change might only impact existing code that would depend on

PhantomReference being enqueued rather than when the referent be freed

from the heap.

security-libs/javax.net.ssl:

JDK-8282859: Enable TLSv1.3 by Default on JDK 8 for Client Roles

================================================================

The TLSv1.3 implementation is now enabled by default for client roles

in 8u352. It has been enabled by default for server roles since 8u272.

Note that TLS 1.3 is not directly compatible with previous

versions. Enabling it on the client may introduce compatibility issues

on either the server or the client side. Here are some more details on

potential compatibility issues that you should be aware of:

* TLS 1.3 uses a half-close policy, while TLS 1.2 and prior versions

  use a duplex-close policy. For applications that depend on the

  duplex-close policy, there may be compatibility issues when

  upgrading to TLS 1.3.

* The signature_algorithms_cert extension requires that pre-defined

  signature algorithms are used for certificate authentication. In

  practice, however, an application may use non-supported signature

  algorithms.

* The DSA signature algorithm is not supported in TLS 1.3. If a server

  is configured to only use DSA certificates, it cannot upgrade to TLS

  1.3.

* The supported cipher suites for TLS 1.3 are not the same as TLS 1.2

  and prior versions. If an application hard-codes cipher suites which

  are no longer supported, it may not be able to use TLS 1.3 without

  modifying the application code.

* The TLS 1.3 session resumption and key update behaviors are

  different from TLS 1.2 and prior versions. The compatibility should

  be minimal, but it could be a risk if an application depends on the

  handshake details of the TLS protocols.

The TLS 1.3 protocol can be disabled by using the jdk.tls.client.protocols

system property:

java -Djdk.tls.client.protocols="TLSv1.2" ...

Alternatively, an application can explicitly set the enabled protocols

with the javax.net.ssl APIs e.g.

sslSocket.setEnabledProtocols(new String[] {"TLSv1.2"});

or:

SSLParameters params = sslSocket.getSSLParameters();

params.setProtocols(new String[] {"TLSv1.2"});

slsSocket.setSSLParameters(params);

New in release OpenJDK 8u345 (2022-08-01):

===========================================

Live versions of these release notes can be found at:

  * https://bit.ly/openjdk8u345

  * https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u345.txt

* Other changes

  - JDK-8290832: It is no longer possible to change "user.dir" in the JDK8

  - JDK-8291568: Bump update version of OpenJDK: 8u345

Notes on individual issues:

===========================

core-libs/java.io:

JDK-8290832: It is no longer possible to change "user.dir" in the JDK8

======================================================================

A change, JDK-8194154, was introduced in the 8u342 release of OpenJDK

causing the JDK to ignore attempts to set the `user.dir` property.

While this change is suitable for a major release (it was originally

introduced in the initial release of OpenJDK 11), changing the

behaviour of such a property in an update release creates

compatibility issues in software that relies on the behaviour in prior

versions of OpenJDK 8.  As a result, we have reverted this change in

8u345.

New in release OpenJDK 8u342 (2022-07-19):

===========================================

Live versions of these release notes can be found at:

  * https://bitly.com/openjdk8u342

  * https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u342.txt

* Security fixes

  - JDK-8272243: Improve DER parsing

  - JDK-8272249: Better properties of loaded Properties

  - JDK-8277608: Address IP Addressing

  - JDK-8281859, CVE-2022-21540: Improve class compilation

  - JDK-8281866, CVE-2022-21541: Enhance MethodHandle invocations

  - JDK-8283190: Improve MIDI processing

  - JDK-8284370: Improve zlib usage

  - JDK-8285407, CVE-2022-34169: Improve Xalan supports

* Other changes

  - JDK-8031567: Better model for storing source revision information

  - JDK-8076190: Customizing the generation of a PKCS12 keystore

  - JDK-8129572: Cleanup usage of getResourceAsStream in jaxp

  - JDK-8132256: jaxp: Investigate removal of com/sun/org/apache/bcel/internal/util/ClassPath.java

  - JDK-8168926: C2: Bytecode escape analyzer crashes due to stack overflow

  - JDK-8170385: JDK-8031567 broke source bundles

  - JDK-8170392: JDK-8031567 broke builds from source bundles

  - JDK-8170530: bash configure output contains a typo in a suggested library name

  - JDK-8190753: (zipfs): Accessing a large entry (> 2^31 bytes) leads to a negative initial size for ByteArrayOutputStream

  - JDK-8194154: System property user.dir should not be changed

  - JDK-8202142: jfr/event/io/TestInstrumentation is unstable

  - JDK-8209771: jdk.test.lib.Utils::runAndCheckException error

  - JDK-8221988: add possibility to build with Visual Studio 2019

  - JDK-8223396: [TESTBUG] several jfr tests do not clean up files created in /tmp

  - JDK-8230865: [TESTBUG] jdk/jfr/event/io/EvilInstrument.java fails at-run shell MakeJAR.sh target

  - JDK-8235211: serviceability/attach/RemovingUnixDomainSocketTest.java fails with AttachNotSupportedException: Unable to open socket file

  - JDK-8244973: serviceability/attach/RemovingUnixDomainSocketTest.java fails "stderr was not empty"

  - JDK-8248876: LoadObject with bad base address created for exec file on linux

  - JDK-8253424: Add support for running pre-submit testing using GitHub Actions

  - JDK-8253865: Pre-submit testing using GitHub Actions does not detect failures reliably

  - JDK-8254054: Pre-submit testing using GitHub Actions should not use the deprecated set-env command

  - JDK-8254173: Add Zero, Minimal hotspot targets to submit workflow

  - JDK-8254175: Build no-pch configuration in debug mode for submit checks

  - JDK-8254282: Add Linux x86_32 builds to submit workflow

  - JDK-8255239: The timezone of the hs_err_pid log file is corrupted in Japanese locale

  - JDK-8255305: Add Linux x86_32 tier1 to submit workflow

  - JDK-8255352: Archive important test outputs in submit workflow

  - JDK-8255373: Submit workflow artifact name is always "test-results_.zip"

  - JDK-8255895: Submit workflow artifacts miss hs_errs/replays due to ZIP include mismatch

  - JDK-8256127: Add cross-compiled foreign architectures builds to submit workflow

  - JDK-8256277: Github Action build on macOS should define OS and Xcode versions

  - JDK-8256354: Github Action build on Windows should define OS and MSVC versions

  - JDK-8256393: Github Actions build on Linux should define OS and GCC versions

  - JDK-8256414: add optimized build to submit workflow

  - JDK-8256747: GitHub Actions: decouple the hotspot build-only jobs from Linux x64 testing

  - JDK-8257056: Submit workflow should apt-get update to avoid package installation errors

  - JDK-8259924: GitHub actions fail on Linux x86_32 with "Could not configure libc6:i386"

  - JDK-8260460: GitHub actions still fail on Linux x86_32 with "Could not configure libc6:i386"

  - JDK-8261107: ArrayIndexOutOfBoundsException in the ICC_Profile.getInstance(InputStream)

  - JDK-8263667: Avoid running GitHub actions on branches named pr/*

  - JDK-8266187: Memory leak in appendBootClassPath()

  - JDK-8274658: ISO 4217 Amendment 170 Update

  - JDK-8274751: Drag And Drop hangs on Windows

  - JDK-8278138: OpenJDK8 fails to start on Windows 8.1 after upgrading compiler to VS2017

  - JDK-8279669: test/jdk/com/sun/jdi/TestScaffold.java uses wrong condition

  - JDK-8281814: Debuginfo.diz contains redundant build path after backport JDK-8025936

  - JDK-8282225: GHA: Allow one concurrent run per PR only

  - JDK-8282458: Update .jcheck/conf file for 8u move to git

  - JDK-8282552: Bump update version of OpenJDK: 8u342

  - JDK-8283350: (tz) Update Timezone Data to 2022a

  - JDK-8284620: CodeBuffer may leak _overflow_arena

  - JDK-8284772: 8u GHA: Use GCC Major Version Dependencies Only

  - JDK-8285445: cannot open file "NUL:"

  - JDK-8285523: Improve test java/io/FileOutputStream/OpenNUL.java

  - JDK-8285591: [11] add signum checks in DSA.java engineVerify

  - JDK-8285727: [11u, 17u] Unify fix for JDK-8284920 with version from head

  - JDK-8286989: Build failure on macOS after 8281814

  - JDK-8287537: 8u JDK-8284620 backport broke AArch64 build

Notes on individual issues:

===========================

security-libs/java.security:

JDK-8215293: Customizing PKCS12 keystore Generation

===================================================

New system and security properties have been added to enable users to

customize the generation of PKCS #12 keystores. This includes

algorithms and parameters for key protection, certificate protection,

and MacData. The detailed explanation and possible values for these

properties can be found in the "PKCS12 KeyStore properties" section of

the `java.security` file.

Also, support for the following SHA-2 based HmacPBE algorithms has

been added to the SunJCE provider:

* HmacPBESHA224

* HmacPBESHA256

* HmacPBESHA384

* HmacPBESHA512

* HmacPBESHA512/224

* HmacPBESHA512/256

core-libs/java.io:

JDK-8285660: Enable Windows Alternate Data Streams by default

=============================================================

The Windows implementation of `java.io.File` has been changed so that

strict validity checks are **not** performed by default on file

paths. This includes allowing colons (':') in the path other than only

immediately after a single drive letter. It also allows paths that

represent NTFS Alternate Data Streams (ADS), such as

"filename:streamname". This restores the default behavior of

`java.io.File` to what it was prior to the April 2022 CPU in which

strict validity checks were not performed by default on file paths on

Windows. To re-enable strict path checking in `java.io.File`, the

system property `jdk.io.File.enableADS` should be set to `false` (case

ignored). This might be preferable, for example, if Windows special

device paths such as `NUL:` are *not* used.

New in release OpenJDK 8u332 (2022-04-22):

===========================================

Live versions of these release notes can be found at:

  * https://bit.ly/openjdk8u332

  * https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u332.txt

* Security fixes

  - JDK-8269938: Enhance XML processing passes redux

  - JDK-8270504, CVE-2022-21426: Better XPath expression handling

  - JDK-8272255: Completely handle MIDI files

  - JDK-8272261: Improve JFR recording file processing

  - JDK-8272594: Better record of recordings

  - JDK-8274221: More definite BER encodings

  - JDK-8275151, CVE-2022-21443: Improved Object Identification

  - JDK-8277227: Better identification of OIDs

  - JDK-8277672, CVE-2022-21434: Better invocation handler handling

  - JDK-8278008, CVE-2022-21476: Improve Santuario processing

  - JDK-8278356: Improve file creation

  - JDK-8278449: Improve keychain support

  - JDK-8278805: Enhance BMP image loading

  - JDK-8278972, CVE-2022-21496: Improve URL supports

  - JDK-8281388: Change wrapping of EncryptedPrivateKeyInfo

* Other changes

  - JDK-8033980: Xerces Update: datatype XMLGregorianCalendarImpl and DurationImpl

  - JDK-8035437: Xerces Update: xml/serialize/DOMSerializerImpl

  - JDK-8035577: Xerces Update: impl/xpath/regex/RangeToken.java

  - JDK-8037259: xerces update: xpointer update

  - JDK-8041523: Xerces Update: Serializer improvements from Xalan

  - JDK-8141508: java.lang.invoke.LambdaConversionException: Invalid receiver type

  - JDK-8162572: Update License Header for all JAXP sources

  - JDK-8167014: jdeps: Missing message: warn.skipped.entry

  - JDK-8198411: [TEST_BUG] Two java2d tests are unstable in mach5

  - JDK-8202822: Add .git to .hgignore

  - JDK-8205540: test/hotspot/jtreg/vmTestbase/nsk/jdb/trace/trace001/trace001.java fails with Debuggee did not exit after 15 <cont> commands

  - JDK-8209178: Proxied HttpsURLConnection doesn't send BODY when retrying POST request

  - JDK-8210283: Support git as an SCM alternative in the build

  - JDK-8218682: [TEST_BUG] DashOffset fails in mach5

  - JDK-8225690: Multiple AttachListener threads can be created

  - JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due to "exit code is 134"

  - JDK-8227815: Minimal VM: set_state is not a member of AttachListener

  - JDK-8240633: Memory leaks in the implementations of FileChooserUI

  - JDK-8241768: git needs .gitattributes

  - JDK-8247766: [aarch64] guarantee(val < (1U << nbits)) failed: Field too big for insn

  - JDK-8253147: The javax/swing/JPopupMenu/7154841/bug7154841.java fail on big screens

  - JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node

  - JDK-8266749: AArch64: Backtracing broken on PAC enabled systems

  - JDK-8270290: NTLM authentication fails if HEAD request is used

  - JDK-8273229: Update OS detection code to recognize Windows Server 2022

  - JDK-8273341: Update Siphash to version 1.0

  - JDK-8273575: memory leak in appendBootClassPath(), paths must be deallocated

  - JDK-8274524: SSLSocket.close() hangs if it is called during the ssl handshake

  - JDK-8277224: sun.security.pkcs.PKCS9Attributes.toString() throws NPE

  - JDK-8277488: Add expiry exception for Digicert (geotrustglobalca) expiring in May 2022

  - JDK-8279077: JFR crashes on Linux ppc due to missing crash protector in signal handler

  - JDK-8280060: The sun/rmi/server/Activation.java class use Thread.dumpStack()

  - JDK-8282300: Throws NamingException instead of InvalidNameException after JDK-8278972

  - JDK-8282397: createTempFile method of java.io.File is failing when called with suffix of spaces character

  - JDK-8284548: Invalid XPath expression causes StringIndexOutOfBoundsException

  - JDK-8284920: Incorrect Token type causes XPath expression to return empty result

  - JDK-8284936: Fix Java 7 bootstrap breakage due to use of Arrays.stream

* Shenandoah

  - JDK-8260632: Build failures after JDK-8253353

  - JDK-8282458: Update .jcheck/conf file for sh-jdk8u move to git

New in release OpenJDK 8u322 (2022-01-18):

===========================================

Live versions of these release notes can be found at:

  * https://bitly.com/openjdk8u322

  * https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u322.txt

* Security fixes

  - JDK-8264934, CVE-2022-21248: Enhance cross VM serialization

  - JDK-8268488: More valuable DerValues

  - JDK-8268494: Better inlining of inlined interfaces

  - JDK-8268512: More content for ContentInfo

  - JDK-8268795: Enhance digests of Jar files

  - JDK-8268801: Improve PKCS attribute handling

  - JDK-8268813, CVE-2022-21283: Better String matching

  - JDK-8269151: Better construction of EncryptedPrivateKeyInfo

  - JDK-8269944: Better HTTP transport redux

  - JDK-8270392, CVE-2022-21293: Improve String constructions

  - JDK-8270416, CVE-2022-21294: Enhance construction of Identity maps

  - JDK-8270492, CVE-2022-21282: Better resolution of URIs

  - JDK-8270498, CVE-2022-21296: Improve SAX Parser configuration management

  - JDK-8270646, CVE-2022-21299: Improved scanning of XML entities

  - JDK-8271962: Better TrueType font loading

  - JDK-8271968: Better canonical naming

  - JDK-8271987: Manifest improved manifest entries

  - JDK-8272014, CVE-2022-21305: Better array indexing

  - JDK-8272026, CVE-2022-21340: Verify Jar Verification

  - JDK-8272236, CVE-2022-21341: Improve serial forms for transport

  - JDK-8272272: Enhance jcmd communication

  - JDK-8272462: Enhance image handling

  - JDK-8273290: Enhance sound handling

  - JDK-8273748, CVE-2022-21349: Improve Solaris font rendering

  - JDK-8273756, CVE-2022-21360: Enhance BMP image support

  - JDK-8273838, CVE-2022-21365: Enhanced BMP processing

* Other changes

  - JDK-6801613: Cross-platform pageDialog and printDialog top margin entry broken

  - JDK-8011541: [TEST_BUG] closed/javax/swing/plaf/metal/MetalUtils/bug6190373.java fails NPE since 7u25b03

  - JDK-8025430: [TEST_BUG] javax/swing/JEditorPane/5076514/bug5076514.java failed since jdk8b108

  - JDK-8041928: MouseEvent.getModifiersEx gives wrong result

  - JDK-8042199: The build of J2DBench via makefile is broken after the JDK-8005402

  - JDK-8044365: (dc) MulticastSendReceiveTests.java failing with ENOMEM when joining group (OS X 10.9)

  - JDK-8048021: Remove @version tag in jaxp repo

  - JDK-8049348: compiler/intrinsics/bmi/verifycode tests on lzcnt and tzcnt use incorrect assumption about REXB prefix usage

  - JDK-8060027: Tests java/beans/XMLEncoder/Test4903007.java and java/beans/XMLEncoder/java_awt_GridBagLayout.java

  - JDK-8066588: javax/management/remote/mandatory/connection/RMIConnector_NPETest.java fails to compile

  - JDK-8066652: Default TimeZone is GMT not local if user.timezone is invalid on Mac OS

  - JDK-8069034: gc/g1/TestEagerReclaimHumongousRegionsClearMarkBits.java nightly failure

  - JDK-8077590: windows_i586_6.2-product-c2-runThese8_Xcomp_vm failing after win compiler upgrade

  - JDK-8080287: The image of BufferedImage.TYPE_INT_ARGB and BufferedImage.TYPE_INT_ARGB_PRE is blank

  - JDK-8140329: [TEST_BUG] test FullScreenAfterSplash.java failed because image was not generated

  - JDK-8140472: java/net/ipv6tests/TcpTest.java failed intermittently with java.net.BindException: Address already in use: NET_Bind

  - JDK-8147051: StaxEntityResolverWrapper should create StaxXMLInputSource with a resolver indicator

  - JDK-8148915: Intermittent failures of bug6400879.java

  - JDK-8176837: SunPKCS11 provider needs to check more details on PKCS11 Mechanism

  - JDK-8177393: Result of RescaleOp for 4BYTE_ABGR images may be 25% black

  - JDK-8177536: Avoid Apple Peer-to-Peer interfaces in networking tests

  - JDK-8182036: Load from initializing arraycopy uses wrong memory state

  - JDK-8183369: RFC unconformity of HttpURLConnection with proxy

  - JDK-8183543: Aarch64: C2 compilation often fails with "failed spill-split-recycle sanity check"

  - JDK-8187450: JNI local refs exceeds capacity warning in NetworkInterface::getAll

  - JDK-8187649: ArrayIndexOutOfBoundsException in java.util.JapaneseImperialCalendar

  - JDK-8190482: InnocuousThread creation should not require the caller to possess enableContextClassLoaderOverride

  - JDK-8190793: Httpserver does not detect truncated request body

  - JDK-8196572: Tests ColConvCCMTest.java and MTColConvTest.java fail

  - JDK-8202788: Explicitly reclaim cached thread-local direct buffers at thread exit

  - JDK-8210058: Algorithmic Italic font leans opposite angle in Printing

  - JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs instead of aliased B&W glyphs

  - JDK-8225082: Remove IdenTrust certificate that is expiring in September 2021

  - JDK-8225083: Remove Google certificate that is expiring in December 2021

  - JDK-8226806: [macOS 10.14] Methods of Java Robot should be called from appropriate thread

  - JDK-8231254: (fs) Add test for macOS Catalina changes to protect system software

  - JDK-8231438: [macOS] Dark mode for the desktop is not supported

  - JDK-8232178: MacVolumesTest failed after upgrade to MacOS Catalina

  - JDK-8232226: [macos 10.15] test/jdk/java/awt/color/EqualityTest/EqualityTest.java may fail

  - JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/DrawImageBG/SystemBgColorTest.java fails

  - JDK-8236897: Fix the copyright header for pkcs11gcm2.h

  - JDK-8237499: JFR: Include stack trace in the ThreadStart event

  - JDK-8239886: Minimal VM build fails after JDK-8237499

  - JDK-8261397: Try Catch Method Failing to Work When Dividing An Integer By 0

  - JDK-8262731: [macOS] Exception from "Printable.print" is swallowed during "PrinterJob.print"

  - JDK-8272342: [TEST_BUG] java/awt/print/PrinterJob/PageDialogMarginTest.java catches all exceptions

  - JDK-8273308: PatternMatchTest.java fails on CI

  - JDK-8273342: Null pointer dereference in classFileParser.cpp:2817

  - JDK-8273826: Correct Manifest file name and NPE checks

  - JDK-8273968: JCK javax_xml tests fail in CI

  - JDK-8274407: (tz) Update Timezone Data to 2021c

  - JDK-8274467: TestZoneInfo310.java fails with tzdata2021b

  - JDK-8274468: TimeZoneTest.java fails with tzdata2021b

  - JDK-8274595: DisableRMIOverHTTPTest failed: connection refused

  - JDK-8274779: HttpURLConnection: HttpClient and HttpsClient incorrectly check request method when set to POST

  - JDK-8275766: (tz) Update Timezone Data to 2021e

  - JDK-8275849: TestZoneInfo310.java fails with tzdata2021e

  - JDK-8276536: Update TimeZoneNames files to follow the changes made by JDK-8275766

Notes on individual issues:

===========================

security-libs/java.security:

JDK-8271434: Removed IdenTrust Root Certificate

===============================================

The following root certificate from IdenTrust has been removed from

the `cacerts` keystore:

Alias Name: identrustdstx3 [jdk]

Distinguished Name: CN=DST Root CA X3, O=Digital Signature Trust Co.

JDK-8272535: Removed Google's GlobalSign Root Certificate

=========================================================

The following root certificate from Google has been removed from the

`cacerts` keystore:

Alias Name: globalsignr2ca [jdk]

Distinguished Name: CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2

core-libs/java.time:

JDK-8274857:  Update Timezone Data to 2021c

===========================================

IANA Time Zone Database, on which JDK's Date/Time libraries are based,

has been updated to version 2021c

(https://mm.icann.org/pipermail/tz-announce/2021-October/000067.html). Note

that with this update, some of the time zone rules prior to the year

1970 have been modified according to the changes which were introduced

with 2021b. For more detail, refer to the announcement of 2021b

(https://mm.icann.org/pipermail/tz-announce/2021-September/000066.html)

New in release OpenJDK 8u312 (2021-10-19):

===========================================

Live versions of these release notes can be found at:

  * https://bitly.com/openjdk8u312

  * https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u312.txt

* Security fixes

  - JDK-8130183, CVE-2021-35588: InnerClasses: VM permits wrong Throw ClassFormatError if InnerClasses attribute's inner_class_info_index is 0

  - JDK-8161016: Strange behavior of URLConnection with proxy

  - JDK-8163326, CVE-2021-35550: Update the default enabled cipher suites preference

  - JDK-8254967, CVE-2021-35565: com.sun.net.HttpsServer spins on TLS session close

  - JDK-8263314: Enhance XML Dsig modes

  - JDK-8265167, CVE-2021-35556: Richer Text Editors

  - JDK-8265574: Improve handling of sheets

  - JDK-8265580, CVE-2021-35559: Enhanced style for RTF kit

  - JDK-8265776: Improve Stream handling for SSL

  - JDK-8266097, CVE-2021-35561: Better hashing support

  - JDK-8266103: Better specified spec values

  - JDK-8266109: More Resilient Classloading

  - JDK-8266115: More Manifest Jar Loading

  - JDK-8266137, CVE-2021-35564: Improve Keystore integrity

  - JDK-8266689, CVE-2021-35567: More Constrained Delegation

  - JDK-8267086: ArrayIndexOutOfBoundsException in java.security.KeyFactory.generatePublic

  - JDK-8267712: Better LDAP reference processing

  - JDK-8267729, CVE-2021-35578: Improve TLS client handshaking

  - JDK-8267735, CVE-2021-35586: Better BMP support

  - JDK-8268193: Improve requests of certificates

  - JDK-8268199: Correct certificate requests

  - JDK-8268506: More Manifest Digests

  - JDK-8269618, CVE-2021-35603: Better session identification

  - JDK-8269624: Enhance method selection support

  - JDK-8270398: Enhance canonicalization

  - JDK-8270404: Better canonicalization

* Other changes

  - JDK-6847157: java.lang.NullPointerException: HDC for component at sun.java2d.loops.Blit.Blit

  - JDK-7146776: deadlock between URLStreamHandler.getHostAddress and file.Handler.openconnection

  - JDK-7188942: Remove support of pbuffers in OGL Java2d pipeline

  - JDK-8004148: NPE in sun.awt.SunToolkit.getWindowDeactivationTime

  - JDK-8022323: [JavaSecurityScanner] review package com.sun.management.* Native methods should be private

  - JDK-8027154: [TESTBUG] Test java/awt/Mouse/GetMousePositionTest/GetMousePositionWithPopup.java fails

  - JDK-8035001: TEST_BUG: the retry logic in RMID.start() should check that the subprocess hasn't terminated

  - JDK-8035424: (reflect) Performance problem in sun.reflect.generics.parser.SignatureParser

  - JDK-8042557: compiler/uncommontrap/TestSpecTrapClassUnloading.java fails with: GC triggered before VM initialization completed

  - JDK-8054118: java/net/ipv6tests/UdpTest.java failed intermittently

  - JDK-8065215: Print warning summary at end of configure

  - JDK-8072767: DefaultCellEditor for comboBox creates ActionEvent with wrong source object

  - JDK-8079891: Store configure log in $BUILD/configure.log

  - JDK-8080082: configure fails if you create an empty directory and then run configure from it

  - JDK-8086003: Test fails on OSX with java.lang.RuntimeException 'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3' missing

  - JDK-8131062: aarch64: add support for GHASH acceleration

  - JDK-8134869: AARCH64: GHASH intrinsic is not optimal

  - JDK-8134989: java/net/MulticastSocket/TestInterfaces.java failed due to unexpected IP address

  - JDK-8156584: Initialization race in sun.security.x509.AlgorithmId.get

  - JDK-8157404: Unable to read certain PKCS12 keystores from SequenceInputStream

  - JDK-8166673: The new implementation of Robot.waitForIdle() may hang

  - JDK-8170467: (reflect) Optimize SignatureParser's use of StringBuilders

  - JDK-8194246: JVM crashes when calling getStackTrace if stack contains a method that is a member of a very large class

  - JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails

  - JDK-8202837: PBES2 AlgorithmId encoding error in PKCS12 KeyStore

  - JDK-8206189: sun/security/pkcs12/EmptyPassword.java fails with Sequence tag error

  - JDK-8214418: half-closed SSLEngine status may cause application dead loop

  - JDK-8214513: A PKCS12 keystore from Java 8 using custom PBE parameters cannot be read in Java 11

  - JDK-8220786: Create new switch to redirect error reporting output to stdout or stderr

  - JDK-8222751: closed/test/jdk/sun/security/util/DerIndefLenConverter/IndefBerPkcs12.java fail

  - JDK-8229243: SunPKCS11-Solaris provider tests failing on Solaris 11.4

  - JDK-8231222: fix pkcs11 P11_DEBUG guarded native traces

  - JDK-8237495: Java MIDI fails with a dereferenced memory error when asked to send a raw 0xF7

  - JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong handling of stoppedMixers

  - JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in Windows Print

  - JDK-8241248: NullPointerException in sun.security.ssl.HKDF.extract(HKDF.java:93)

  - JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header files

  - JDK-8247469: getSystemCpuLoad() returns -1 on linux when some offline cpus are present and cpusets.effective_cpus is not available

  - JDK-8248901: Signed immediate support in .../share/assembler.hpp is broken.

  - JDK-8259338: Add expiry exception for identrustdstx3 alias to VerifyCACerts.java test

  - JDK-8262000: jdk/jfr/event/gc/detailed/TestPromotionFailedEventWithParallelScavenge.java failed with "OutOfMemoryError: Java heap space"

  - JDK-8262829: Native crash in Win32PrintServiceLookup.getAllPrinterNames()

  - JDK-8263311: Watch registry changes for remote printers update instead of polling

  - JDK-8263382: java/util/logging/ParentLoggersTest.java failed with "checkLoggers: getLoggerNames() returned unexpected loggers"

  - JDK-8264752: SIGFPE crash with option FlightRecorderOptions:threadbuffersize=30M

  - JDK-8265238: [8u] [macos] build failure in OpenJDK8u after JDK-8211301 in older xcode

  - JDK-8265836: OperatingSystemImpl.getCpuLoad() returns incorrect CPU load inside a container

  - JDK-8265978: make test should look for more locations when searching for exit code

  - JDK-8266206: Build failure after JDK-8264752 with older GCCs

  - JDK-8268103: JNI functions incorrectly return a double after JDK-8265836

  - JDK-8268965: TCP Connection Reset when connecting simple socket to SSL server

  - JDK-8269594: assert(_handle_mark_nesting > 1) failed: memory leak: allocating handle outside HandleMark

  - JDK-8269763: The JEditorPane is blank after JDK-8265167

  - JDK-8269810: [8u] Update generated_configure.sh after JDK-8250876 backport

  - JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports incorrect process cpu usage in containers

  - JDK-8269859: BacktraceBuilder._cprefs needs to be accessed as unsigned short

  - JDK-8269882: stack-use-after-scope in NewObjectA

  - JDK-8269953: config.log is not in build directory after 8u backport of JDK-8079891

  - JDK-8270137: Kerberos Credential Retrieval from Cache not Working in Cross-Realm Setup

  - JDK-8271466: StackGap test fails on aarch64 due to "-m64"

  - JDK-8272124: Cgroup v1 initialization causes NullPointerException when cgroup path contains colon

  - JDK-8272214: [8u] Build failure after backport of JDK-8248901

  - JDK-8272714: [8u] Build failure after backport of JDK-8248901 with MSVC 2013

* Shenandoah

  - [backport] JDK-8269661: JNI_GetStringCritical does not lock char array

  - Re-cast JNI critical strings patch to be Shenandoah-specific

Notes on individual issues:

===========================

core-libs/java.net:

JDK-8164200: Modified HttpURLConnection behavior when no suitable proxy is found

================================================================================

The behavior of HttpURLConnection when using a ProxySelector has been

modified with this JDK release. HttpURLConnection used to fall back to

a DIRECT connection attempt if the configured proxy(s) failed to make

a connection. This release introduces a change whereby no DIRECT

connection will be attempted in such a scenario. Instead, the

HttpURLConnection.connect() method will fail and throw an IOException

which occurred from the last proxy tested.

security-libs/javax.net.ssl:

JDK-8219551: Updated the Default Enabled Cipher Suites Preference

=================================================================

The preference of the default enabled cipher suites has been

changed. The compatibility impact should be minimal. If needed,

applications can customize the enabled cipher suites and the

preference. For more details, refer to the SunJSSE provider

documentation and the JSSE Reference Guide documentation.

New in release OpenJDK 8u302 (2021-07-20):

===========================================

Live versions of these release notes can be found at:

  * https://bitly.com/openjdk8u302

  * https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u302.txt

* Security fixes

  - JDK-8256157: Improve bytecode assembly

  - JDK-8256491: Better HTTP transport

  - JDK-8258432, CVE-2021-2341: Improve file transfers

  - JDK-8260453: Improve Font Bounding

  - JDK-8260960: Signs of jarsigner signing

  - JDK-8260967, CVE-2021-2369: Better jar file validation

  - JDK-8262380: Enhance XML processing passes

  - JDK-8262403: Enhanced data transfer

  - JDK-8262410: Enhanced rules for zones

  - JDK-8262477: Enhance String Conclusions

  - JDK-8262967: Improve Zip file support

  - JDK-8264066, CVE-2021-2388: Enhance compiler validation

  - JDK-8264079: Improve abstractions

  - JDK-8264460: Improve NTLM support

* Other changes

  - JDK-6878250: (so) IllegalBlockingModeException thrown when reading from a closed SocketChannel's InputStream

  - JDK-6990210: [TEST_BUG] EventDispatchThread/HandleExceptionOnEDT/HandleExceptionOnEDT.java fails on gnome

  - JDK-7059970: Test case: javax/imageio/plugins/png/ITXtTest.java is not closing a file

  - JDK-7106851: Test should not use System.exit

  - JDK-8019470: Changes needed to compile JDK 8 on MacOS with clang compiler

  - JDK-8028618: [TEST BUG] javax/swing/JScrollBar/bug4202954/bug4202954.java fails

  - JDK-8030123: java/beans/Introspector/Test8027648.java fails

  - JDK-8032050: Clean up for java/rmi/activation/Activatable/shutdownGracefully/ShutdownGracefully.java

  - JDK-8033289: clang: clean up unused function warning

  - JDK-8034856: gcc warnings compiling src/solaris/native/sun/security/pkcs11

  - JDK-8034857: gcc warnings compiling src/solaris/native/sun/management

  - JDK-8035000: clean up ActivationLibrary.DestroyThread

  - JDK-8035054: JarFacade.c should not include ctype.h

  - JDK-8035287: gcc warnings compiling various libraries files

  - JDK-8036095: RMI tests using testlibrary.RMID and testlibrary.JavaVM do not pass through vmoptions

  - JDK-8037825: Fix warnings and enable "warnings as errors" in serviceability native libraries

  - JDK-8042891: Format issues embedded in macros for two g1 source files

  - JDK-8043264: hsdis library not picked up correctly on expected paths

  - JDK-8043646: libosxapp.dylib fails to build on Mac OS 10.9 with clang

  - JDK-8047939: [TESTBUG] Rewrite test/runtime/8001071/Test8001071.sh

  - JDK-8055754: filemap.cpp does not compile with clang

  - JDK-8064909: FragmentMetaspace.java got OutOfMemoryError

  - JDK-8066508: JTReg tests timeout on slow devices when run using JPRT

  - JDK-8066807: langtools/test/Makefile should use -agentvm not -samevm

  - JDK-8071374: -XX:+PrintAssembly -XX:+PrintSignatureHandlers crash fastdebug VM with assert(limit == __null || limit <= nm->code_end()) in RelocIterator::initialize

  - JDK-8073446: TimeZone getOffset API does not return a dst offset between years 2038-2137

  - JDK-8074835: Resolve disabled warnings for libj2gss

  - JDK-8074836: Resolve disabled warnings for libosxkrb5

  - JDK-8075071: [TEST_BUG] TimSortStackSize2.java: OOME: Java heap space: MaxHeap shrinked by MaxRAMFraction

  - JDK-8077364: "if( !this )" construct prevents build on Xcode 6.3

  - JDK-8078855: [TEST_BUG] javax/swing/JComboBox/8032878/bug8032878.java fails in WindowsClassicLookAndFeel

  - JDK-8081764: [TEST_BUG] Test javax/swing/plaf/aqua/CustomComboBoxFocusTest.java fails on Windows, Solaris Sparcv9 and Linux but passes on MacOSX

  - JDK-8129511: PlatformMidi.c:83 uses malloc without malloc header

  - JDK-8130308: Too low memory usage in TestPromotionFromSurvivorToTenuredAfterMinorGC.java

  - JDK-8130430: [TEST_BUG] remove unnecessary internal calls from javax/swing/JRadioButton/8075609/bug8075609.java

  - JDK-8132148: G1 hs_err region dump legend out of sync with region values

  - JDK-8132709: [TESTBUG] gc/g1/TestHumongousShrinkHeap.java might fail on embedded

  - JDK-8134672: [TEST_BUG] Some tests should check isDisplayChangeSupported

  - JDK-8134883: C1 hard crash in range check elimination in Nashorn test262parallel

  - JDK-8136592: [TEST_BUG] Fix 2 platform-specific closed regtests for jigsaw

  - JDK-8138820: JDK Hotspot build fails with Xcode 7.0.1

  - JDK-8151786: [TESTBUG] java/beans/XMLEncoder/Test4625418.java timed out intermittently

  - JDK-8159898: Negative array size in java/beans/Introspector/Test8027905.java

  - JDK-8166046: [TESTBUG] compiler/stringopts/TestStringObjectInitialization.java fails with OOME

  - JDK-8166724: gc/g1/TestHumongousShrinkHeap.java fails with OOME

  - JDK-8172188: JDI tests fail due to "permission denied" when creating temp file

  - JDK-8177809: File.lastModified() is losing milliseconds (always ends in 000)

  - JDK-8178403: DirectAudio in JavaSound may hang and leak

  - JDK-8180478: tools/launcher/MultipleJRE.sh fails on Windows because of extra-''

  - JDK-8183910: gc/arguments/TestAggressiveHeap.java fails intermittently

  - JDK-8190332: PngReader throws NegativeArraySizeException/OOM error when IHDR width is very large

  - JDK-8190679: java/util/Arrays/TimSortStackSize2.java fails with "Initial heap size set to a larger value than the maximum heap size"

  - JDK-8191955: AArch64: incorrect prefetch distance causes an internal error

  - JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java fails

  - JDK-8199265: java/util/Arrays/TimSortStackSize2.java fails with OOM

  - JDK-8200550: Xcode 9.3 produce warning -Wexpansion-to-defined

  - JDK-8202299: Java Keystore fails to load PKCS12/PFX certificates created in WindowsServer2016

  - JDK-8203196: C1 emits incorrect code due to integer overflow in _tableswitch keys

  - JDK-8205014: com/sun/jndi/ldap/DeadSSLLdapTimeoutTest.java failed with "Read timed out"

  - JDK-8206243: java -XshowSettings fails if memory.limit_in_bytes overflows LONG.max

  - JDK-8206925: Support the certificate_authorities extension

  - JDK-8209996: [PPC64] Fix JFR profiling

  - JDK-8214345: infinite recursion while checking super class

  - JDK-8217230: assert(t == t_no_spec) failure in NodeHash::check_no_speculative_types()

  - JDK-8217348: assert(thread->is_Java_thread()) failed: just checking

  - JDK-8225081: Remove Telia Company CA certificate expiring in April 2021

  - JDK-8225116: Test OwnedWindowsLeak.java intermittently fails

  - JDK-8228757: Fail fast if the handshake type is unknown

  - JDK-8230428: Cleanup dead CastIP node code in formssel.cpp

  - JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails intermittently with NPE

  - JDK-8231841: AArch64: debug.cpp help() is missing an AArch64 line for pns

  - JDK-8231949: [PPC64, s390]: Make async profiling more reliable

  - JDK-8234011: (zipfs) Memory leak in ZipFileSystem.releaseDeflater()

  - JDK-8239053: [8u] clean up undefined-var-template warnings

  - JDK-8239400: [8u] clean up undefined-var-template warnings

  - JDK-8241649: Optimize Character.toString

  - JDK-8241829: Cleanup the code for PrinterJob on windows