Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package jsoup for openSUSE:Factory checked in at 2026-09-07 11:29:47 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/jsoup (Old) and /work/SRC/openSUSE:Factory/.jsoup.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "jsoup" Mon Sep 7 11:29:47 2026 rev:6 rq:1375652 version:1.23.2 Changes: -------- --- /work/SRC/openSUSE:Factory/jsoup/jsoup.changes 2024-10-02 21:36:17.713642367 +0200 +++ /work/SRC/openSUSE:Factory/.jsoup.new.1265/jsoup.changes 2026-09-07 11:31:26.902452700 +0200 @@ -1,0 +2,1075 @@ +Wed Aug 26 11:46:54 UTC 2026 - Fridrich Strba <[email protected]> + +- Upgrade to upstream version 1.23.2 + * Changes of 1.23.2 + + Improvement: Improved consecutive StreamParser.selectFirst() + calls during progressive parsing, so later matches are + returned with their parsed contents when earlier selections + had left them as parser lookahead. E.g., given + <title>One</title><p id=hit>Full</p><p>Next</p>, selecting + title and then #hit now advances the partial lookahead and + returns <p id="hit">Full</p>, rather than returning an empty + <p id="hit"></p> before its content is parsed. The updated + readiness tracking follows StreamParser’s normal emission + order across implicit HTML structure and parser recovery. + + Improvement: Improved XML parser performance and memory use + for documents with many nested namespace declarations by + recording namespace changes within each element scope + (bsc#1275912, CVE-2026-75140). + + Improvement: Improved W3CDom conversion performance for + documents with many nested namespace declarations. The W3C + converter now uses the same optimized namespace tracking as + the XML parser. + + Improvement: Improved W3CDom XML conversion to retain + processing instructions, comments outside the root element, + and CDATA sections, which were previously dropped or converted + to text. + + Improvement: DOM mutation methods, including child insertion + and replacement, now reject operations that would create a + cycle, such as making a node its own child or moving an + ancestor beneath a descendant. + + Improvement: Added Elements#before(Node), after(Node), + prepend(Node), and append(Node) to match the existing HTML + string methods. + + Improvement: Large file-backed uploads through + Connection.requestBodyStream(InputStream) now stream directly + with the JDK HttpClient on Java 11+, rather than being loaded + fully into memory first. + + Improvement: Extended Java 11+ HTTP client reuse from requests + sharing a Jsoup.newSession() to ordinary Jsoup.connect() + calls, reducing transport thread and connection setup churn + under sustained request loads. Sessions with custom + authentication or SSL contexts continue to use their own + client. + + Change: Aligned the XML parser stack depth and lookups to the + configured maximum, which now defaults to 512 for both HTML + and XML. Use Parser#setMaxDepth(int) to configure. + + Bugfix: Fixed W3CDom namespace conversion in several cases: + - Namespace declarations and prefixed attributes now carry the + correct namespace URI, so namespace-aware DOM lookups work + as expected. + - Attributes added after parsing, or included through subtree + conversion, now use inherited prefix declarations. + - Namespace declarations now apply regardless of attribute + order, and an empty declaration shadows an inherited binding + only within its scope. + - With namespace awareness disabled, inherited and undeclared + prefixes now receive the declarations needed for XML + serialization. + - Valid HTML names that are not XML QNames, such as a:b:c, are + normalized. Attributes that still cannot be represented are + skipped, and unrepresentable elements no longer change the + surrounding tree. + + Bugfix: Fixed W3CDom conversion of programmatically created or + renamed elements whose names can be represented in a jsoup + HTML DOM but are not valid XML names, such as 1abc. These + names are now normalized (e.g. _1abc) instead of causing a + NullPointerException. + + Bugfix: Fixed XML doctype serialization when a system + identifier contains a double quote, which could otherwise + produce invalid XML. + + Bugfix: XML serialization now repairs element and attribute + names that start with an invalid character, rather than + outputting null elements or dropping attributes. For example, + an attribute named 1a is written as _1a. Additional leading + underscores keep repaired attribute names unique if they + conflict with another attribute. + + Bugfix: Supplementary Unicode characters are now escaped + correctly when serializing with non-UTF, non-ASCII output + charsets such as ISO-8859-1. Previously, characters could be + emitted unescaped when their low 16-bit value was + representable by the configured charset, causing replacement + or corruption when the output was encoded. + + Bugfix: Fixed the JDK HttpClient implementation to accept + responses missing a Content-Type header, matching the + HttpURLConnection implementation. + + Bugfix: Fixed HTTP response content-type matching to handle + media types case-insensitively and recognize structured +xml + suffixes, including vendor-specific media types. + + Bugfix: HTTP request URL normalization now percent-encodes + ASCII control characters, DEL, and embedded fragment + delimiters, keeping normalized URLs valid for HTTP requests + while preserving existing escapes. + + Bugfix: Corrected multipart form encoding to percent-escape CR + and LF in field names and filenames, matching the HTML form + submission specification. Multipart file content-types + containing CR or LF are now rejected with a + ValidationException. + + Bugfix: Aligned trailing comment placement with the HTML + specification: comments after </body> remain children of the + html element, while comments after </html> remain children of + the document. + + Bugfix: When using the optional re2j regular expression + engine, memory allocation errors caused by complex selector + patterns at match time are now normalized to a + ValidationException with a Pattern complexity error message. + + Bugfix: Fixed parsing of malformed SVG and MathML content so + that breakout HTML tags are placed according to the HTML + specification. + + Bugfix: Fixed deeply nested malformed HTML parsing that could + lose the document body because stack lookups did not align to + the configured maximum parser depth. + + Bugfix: Aligned RCDATA, RAWTEXT, and script-data parsing with + the HTML specification: malformed end tags no longer consume + following markup, unclosed title/textarea content stays text + through EOF, and custom text tags match exact names. + + Bugfix: Improved URL validation during HTTP/HTTPS URL + resolution and cleaning; resolved URLs without a host are now + rejected instead of being accepted based only on their scheme + prefix, aligning to RFC 9110. Valid relative links and + non-HTTP(S) schemes are unchanged. + + Bugfix: Redirects with malformed single-slash HTTP locations + now use standard URL resolution to align with browsers. + + Bugfix: Template fragment parsing now handles unmatched + </template> tags without throwing a ValidationException. + + Bugfix: Improved source tracking for adopted formatting + elements and malformed markup ending at EOF. + * Changes of 1.23.1 + + Improvement: Reduced retained memory when parsing with source + position tracking enabled (Parser#setTrackPosition(true)). + Source ranges are now stored in compact parser-owned span + records instead of node and attribute user data, and Position + objects are created lazily when source ranges are read. This + cuts tracked DOM retained size by about 50-60% on + representative benchmark documents, while keeping + Node#sourceRange(), Element#endSourceRange(), and + Attribute#sourceRange() behavior intact. + + Improvement: Added Element#classList(), an immutable snapshot + of an element’s class names in attribute order. Use hasClass() + when you just need to test for one class, classList() when you + want to read or iterate classes without needing a mutable + result, and classNames() when you want the existing mutable, + deduplicated set that can be written back with + classNames(Set). The class APIs now share an HTML-whitespace + scanner, which also makes classNames() faster and lighter on + allocation, especially when walking many elements without + class names. + + Improvement: Aligned HTML parser scope classification with the + current HTML spec for select, foreignObject, and template. + + Improvement: Simplified the HTML tree builder’s scope, + implied-end-tag, and special-element checks by caching + parser-only options on Tag. That improves HTML parser + throughput by about 10% on small inputs and up to about 30% on + larger inputs in the benchmark fixtures. + + Improvement: Improved HTML parser throughput stability by + making hot tokeniser scan paths compile more predictably. + + Improvement: <noscript> fallback markup is now parsed into an + inspectable DOM subtree in both the document head and body. + The fallback acts as a contained parsing island, so malformed + markup cannot disrupt the surrounding document structure, + while normal HTML tokenization still applies within it. This + also improves round-trip serialization. + + Improvement: Improved redirect credential handling as a + defense-in-depth measure: explicit authorization headers and + request cookies are no longer forwarded across origins, + reducing exposure through open redirects and aligning with + HTTP guidance. Cookies managed by a CookieStore continue to + follow their configured scope. + + Improvement: Elements can now append their outer HTML, + including their own tags, directly to an Appendable with + Node#outerHtml(Appendable), without first creating a String. + This complements Element#html(Appendable), which appends inner + HTML only. + + Improvement: Aligned CDATA tokenization with the HTML spec: + CDATA syntax in HTML content is parsed as a bogus comment, + while it remains supported in SVG, MathML, and XML. Also + improved namespace-aware fragment parsing so SVG and MathML + contexts, HTML integration points, and context-sensitive + tokenizer states are handled correctly. + + Improvement: When using the optional re2j regular expression + engine, stack overflows caused by complex selector patterns + are now normalized to a ValidationException with a Pattern + complexity error message. + + Bugfix: Fixed HTML parsing of mixed-case RCDATA end tags after + tag-shaped text. For example, <title><p>Foo</TiTLE> and + <textarea><img src=x></TeXtArEa> now keep the tag-shaped + content as text instead of promoting it to markup. + + Bugfix: Fixed W3CDom XML conversion so plain XML elements + don’t serialize with the reserved XML namespace as the default + namespace. Explicit XML namespaces and xml:* attributes are + still preserved. + + Bugfix: Preserve control characters in parsed tag names. + + Bugfix: Updated HTTP redirects to follow the specification: + 307 and 308 preserve the request method and content, 301 and + 302 only change POST to GET, and Location is followed only for + 301, 302, 303, 307, and 308 responses. Streamed request bodies + are not buffered; if an automatic redirect requires replaying + one, execution fails, so the caller can resend with a fresh + stream. + + Bugfix: Corrected the Cleaner’s same-site link detection to + compare hostnames rather than URL prefixes when applying + rel=nofollow. + + Build change: Cleaned up the Maven build for the multi-release + JAR so Java 8 and Java 11+ sources compile as separate source + sets. This avoids spurious Java 8 compiler warnings from + newer-language overlay sources, keeps long-running parser + checks behind an explicit profile, and preserves the same + published artifacts and runtime behavior. + + Build change: Improved parallelism and tuned timing in our + integration tests, so that a full mvn clean verify drops from + ~ 1m18s to ~ 21 seconds. + * Changes of 1.22.2 + + Improvement: Expanded and clarified NodeTraversor support for + in-place DOM rewrites during NodeVisitor.head(). Current-node + edits such as remove, replace, and unwrap now recover more + predictably, while traversal stays within the original root + subtree. This makes single-pass tree cleanup and normalization + visitors easier to write, for example when unwrapping + presentational elements or replacing text nodes as you walk + the DOM. + + Documentation: clarified that a configured Cleaner may be + reused across concurrent threads, and that shared Safelist + instances should not be mutated while in use. + + Improvement: Updated the default HTML TagSet for current HTML + elements: added dialog, search, picture, and slot; made ins, + del, button, audio, video, and canvas inline by default + (Tag#isInline(), aligned to phrasing content in the spec); and + added readable Element.text() boundaries for controls and + embedded objects via the new Tag.TextBoundary option. This + improves pretty-printing and keeps normalized text from + running adjacent words together. + + Android (R8/ProGuard): added a rule to ignore the optional + re2j dependency when not present. + + Bugfix: Fixed a NodeTraversor regression in 1.21.2 where + removing or replacing the current node during head() could + revisit the replacement node and loop indefinitely. The + traversal docs now also clarify which inserted nodes are + visited in the current pass. + + Bugfix: Parsing during charset sniffing no longer fails if an + advisory available() call throws IOException, as seen on JDK 8 + HttpURLConnection. + + Bugfix: Cleaner no longer makes relative URL attributes in the + input document absolute when cleaning or validating a + Document. URL normalization now applies only to the cleaned + output, and Safelist.isSafeAttribute() is side effect free. + + Bugfix: Cleaner no longer duplicates enforced attributes when + the input Document preserves attribute case. A case-variant + source attribute is now replaced by the enforced attribute in + the cleaned output. + + Bugfix: If a per-request SOCKS proxy is configured, jsoup now + avoids using the JDK HttpClient, because the JDK would + silently ignore that proxy and attempt to connect directly. + Those requests now fall back to the legacy HttpURLConnection + transport instead, which does support SOCKS. + + Bugfix: Connection.Response.streamParser() and + DataUtil.streamParser(Path, ...) could fail on small inputs + without a declared charset, if the initial 5 KB charset sniff + fully consumed the input and closed it before the stream parse + began. + + Bugfix: In XML mode, doctypes with an internal subset, such as + <!DOCTYPE root [<!ENTITY name "value">]>, now round-trip + correctly. The subset is preserved as raw text only; entities + are not expanded and external DTDs are not loaded. + + Build change: Migrated the integration test server from Jetty + to Netty, which actively maintains support for our minimum JDK + target (8). + * Changes of 1.22.1 + + Improvement: Added support for using the re2j regular + expression engine for regex-based CSS selectors (e.g. + [attr~=regex], :matches(regex)), which ensures linear-time + performance for regex evaluation. This allows safer handling + of arbitrary user-supplied query regexes. To enable, add the + com.google.re2j dependency to your classpath, e.g.: + + <dependency> + <groupId>com.google.re2j</groupId> + <artifactId>re2j</artifactId> + <version>1.8</version> + </dependency> + + (If you already have that dependency in your classpath, but + you want to keep using the Java regex engine, you can disable + re2j via System.setProperty("jsoup.useRe2j", "false").) You + can confirm that the re2j engine has been enabled correctly by + calling Regex.usingRe2j(). + + Improvement: Added an instance method Parser#unescape(String, + boolean) that unescapes HTML entities using the parser’s + configuration (e.g. to support error tracking), complementing + the existing static utility Parser.unescapeEntities(String, + boolean). + + Improvement: Added a configurable maximum parser depth (to + limit the number of open elements on stack) to both HTML and + XML parsers. The HTML parser now defaults to a depth of 512 to + match browser behavior, and protect against unbounded stack + growth, while the XML parser keeps unlimited depth by default, + but can opt into a limit via Parser.setMaxDepth(). + + Build: added CI coverage for JDK 25. + + Build: added a CI fuzzer for contextual fragment parsing (in ++++ 778 more lines (skipped) ++++ between /work/SRC/openSUSE:Factory/jsoup/jsoup.changes ++++ and /work/SRC/openSUSE:Factory/.jsoup.new.1265/jsoup.changes Old: ---- jsoup-1.15.3.tar.xz New: ---- _scmsync.obsinfo build.specials.obscpio jsoup-1.23.2.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ jsoup.spec ++++++ --- /var/tmp/diff_new_pack.qfmuRU/_old 2026-09-07 11:31:27.791483862 +0200 +++ /var/tmp/diff_new_pack.qfmuRU/_new 2026-09-07 11:31:27.797484073 +0200 @@ -1,7 +1,7 @@ # # spec file for package jsoup # -# Copyright (c) 2024 SUSE LLC +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -17,20 +17,21 @@ Name: jsoup -Version: 1.15.3 +Version: 1.23.2 Release: 0 Summary: Java library for working with HTML License: MIT Group: Development/Libraries/Java URL: https://jsoup.org/ -# ./generate-tarball.sh Source0: %{name}-%{version}.tar.xz Source1: %{name}-build.xml BuildRequires: ant BuildRequires: fdupes BuildRequires: java-devel >= 1.8 BuildRequires: javapackages-local >= 6 +BuildRequires: jspecify BuildRequires: jsr-305 +BuildRequires: re2j BuildArch: noarch %description @@ -62,8 +63,8 @@ %build mkdir -p lib -build-jar-repository -s lib jsr-305 -%{ant} -f %{name}-build.xml jar javadoc +build-jar-repository -s lib jspecify jsr-305 re2j +ant -f %{name}-build.xml jar javadoc %install # jar @@ -79,7 +80,7 @@ %fdupes -s %{buildroot}%{_javadocdir} %files -f .mfiles -%doc README.md CHANGES +%doc README.md CHANGES.md %license LICENSE %files javadoc ++++++ _scmsync.obsinfo ++++++ mtime: 1788355365 commit: 9a9f25dbe896410c5a9dc6ccdb077f9bc344978649ffad17629c5a070c6174ac url: https://src.opensuse.org/java-packages/jsoup revision: 9a9f25dbe896410c5a9dc6ccdb077f9bc344978649ffad17629c5a070c6174ac projectscmsync: https://src.opensuse.org/java-packages/_ObsPrj ++++++ _service ++++++ --- /var/tmp/diff_new_pack.qfmuRU/_old 2026-09-07 11:31:27.899487648 +0200 +++ /var/tmp/diff_new_pack.qfmuRU/_new 2026-09-07 11:31:27.903487789 +0200 @@ -1,17 +1,17 @@ <services> - <service name="tar_scm" mode="disabled"> + <service name="tar_scm" mode="manual"> <param name="scm">git</param> <param name="url">https://github.com/jhy/jsoup.git</param> - <param name="revision">jsoup-1.15.3</param> + <param name="revision">jsoup-1.23.2</param> <param name="match-tag">jsoup-*</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">jsoup-(.*)</param> <param name="exclude">src/test/resources</param> </service> - <service name="recompress" mode="disabled"> + <service name="recompress" mode="manual"> <param name="file">*.tar</param> <param name="compression">xz</param> </service> - <service name="set_version" mode="disabled"/> + <service name="set_version" mode="manual"/> </services> ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-09-02 15:22:45.000000000 +0200 @@ -0,0 +1 @@ +.osc ++++++ jsoup-1.15.3.tar.xz -> jsoup-1.23.2.tar.xz ++++++ ++++ 54034 lines of diff (skipped) ++++++ jsoup-build.xml ++++++ --- /var/tmp/diff_new_pack.qfmuRU/_old 2026-09-07 11:31:28.324502546 +0200 +++ /var/tmp/diff_new_pack.qfmuRU/_new 2026-09-07 11:31:28.336502967 +0200 @@ -11,7 +11,7 @@ <property name="project.name" value="jsoup Java HTML Parser"/> <property name="project.groupId" value="org.jsoup"/> <property name="project.artifactId" value="jsoup"/> - <property name="project.version" value="1.15.3"/> + <property name="project.version" value="1.23.2"/> <property name="project.description" value="jsoup is a Java library for working with real-world HTML. It provides a very convenient API for extracting and manipulating data, using the best of DOM, CSS, and jquery-like methods. jsoup implements the WHATWG HTML5 specification, and parses HTML to the same DOM as modern browsers do."/> <property name="project.organization.name" value="Jonathan Hedley"/> <property name="project.build.sourceEncoding" value="UTF-8"/>
