Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package bcel for openSUSE:Factory checked in at 2026-10-08 15:13:05 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/bcel (Old) and /work/SRC/openSUSE:Factory/.bcel.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "bcel" Thu Oct 8 15:13:05 2026 rev:35 rq:1382999 version:6.13.0 Changes: -------- --- /work/SRC/openSUSE:Factory/bcel/bcel.changes 2024-09-23 15:19:02.509529471 +0200 +++ /work/SRC/openSUSE:Factory/.bcel.new.3698736/bcel.changes 2026-10-08 15:13:20.812651033 +0200 @@ -1,0 +2,193 @@ +Wed Oct 7 09:06:21 UTC 2026 - Fridrich Strba <[email protected]> + +- Update to version 6.13.0 + * New Features + + Add support for permitted subclasses + + Add RecordComponentInfo.getAttribute(byte tag) + + Add Const.MAJOR_27 + + Add Const.MINOR_27 + + Add and use ArrayType.isElementType(Type) + + Add Const.MAJOR_28 + + Add Const.MINOR_28 + * Fixed Bugs + + Fix constant pool module access test on Java 26 and above + + Deprecate org.apache.bcel.classfile.Utility.Utility() + + Deprecate org.apache.bcel.verifier.exc.Utility + .getStackTrace(Throwable) + + Fix all Javadoc warnings and enforce checks by default + + Escape constant pool names in generated HTML + + Escape referenced names in BCELFactory Java output + + Make wide flag thread-local in Utility.codeToString + + Read multianewarray dimensions as unsigned byte + + Site docs: clarify security model + + Read ConstantDynamic indices as unsigned shorts + + Validate index upper bound in CPInstruction, IINC and RET + setIndex + + Use correct attribute tag in NestHost and ModuleMainClass + + Propagate runtime-visible flag when parsing parameter + annotations + + Use fixedLength for parsed LOOKUPSWITCH length + + Fix ConstantPoolGen dedup key collisions for names with + delimiters + + Read unsigned bytecode operands in CodeHTML disassembler + + Deep-copy bootstrap arguments array in BootstrapMethod.copy() + + Use exclusive live-range end in LocalVariableTable + .getLocalVariable + + Build TABLESWITCH from sorted arrays in SWITCH + + Use array element type not basic type for primitive array + access + + Set length in INVOKEDYNAMIC constructor + + Reject CALOAD on non-char arrays in structural verification + + Add negative verifier tests for remaining array load/store + component type checks + + Validate u1 count bound in INVOKEINTERFACE and MULTIANEWARRAY + + Match wide local variable instruction length to dumped bytes + + Bound IINC increment to signed short + + Fix SpotBugs USO_UNSAFE_METHOD_SYNCHRONIZATION in ConstantUtf8 + + Nested Code/Record attributes drive unbounded parse-time + recursion in ClassParser + + Nested annotation element values recurse unboundedly; + MAX_ARRAY_DIMENSIONS cap bypassed + + Opcodes tableswitch and lookupswitch add boundary checks + + JustIce Pass 2 hangs on cyclic superclass chain of a + referenced exception class + + JustIce Pass 2 LVT check amplifies each 10-byte entry into + ~131k hashtable operations + + Pass 3b dataflow stores frames per instruction and clones + ever-growing execution chains + + Cubic handlers × range × subroutines scan in Subroutines + constructor hangs JustIce Pass 3b + + Subroutines.noRecursiveCalls enumerates exponentially many JSR + call paths + + Disassembler and Class2HTML re-implement the unchecked + switch-table allocation + + ConstantPool.constantToString recurses forever on + self-referencing CONSTANT_MethodHandle + + Utility.typeSignatureToString recurses per generic-nesting + level, unbounded, with quadratic substring copies + + Repositories cache classes under the input-defined this_class + name; global static Repository/VerifierFactory make the + poisoning ClassLoader-wide (bsc#1284400, CVE-2026-94114) + + Silent u2/u1 count truncation across dump paths corrupts + emitted bytecode + + Class2HTML emitters write attacker class-file strings into + HTML unescaped (stored XSS in reports) (bsc#1284399, + CVE-2026-105111) + + Class2HTML builds output file paths from the unvalidated class + name + + ClassPath.getBytes() sizes its buffer from the forged ZIP + uncompressed-size field + + PMG attribute ignores declared length, enabling BCEL-vs-JVM + parse divergence + + Signature.matchGJIdent recurses unboundedly on nested generic + signatures (Signature.translate) + + Utility.decode fixed 3x buffer breaks the encode/decode round + trip and throws unchecked AIOOBE + + BCELifier interpolates attacker class/package names into + generated Java source unescaped + + Verifier pass 3a delayed checks are quadratic in attribute and + code size + + Verifier cache grows unboundedly with attacker-chosen class + names + + Static WIDE ThreadLocal survives exceptions, corrupting the + next class's disassembly on the same thread + + Utility.JavaReader escape decoding: OOB table index, bad-hex + crash, silent non-canonical aliasing + * Changes + + Bump org.apache.commons:commons-parent from 95 to 104 + + Bump org.jetbrains.kotlin:kotlin-stdlib from 2.3.0 to 2.4.20 + + Bump commons-io:commons-io from 2.21.0 to 2.22.0 + + Bump jna.version from 5.18.1 to 5.19.1 + + [test] Bump org.apache.commons:commons-collections4 from 4.5.0 + to 4.6.0 +- Changes of version 6.12.0 + * New Features + + Add Const.MAJOR_26 + + Add Const.MINOR_26 + * Fixed Bugs + + Fix infinite loop in example.TransitiveHull + + Fix Apache RAT plugin console warnings + + Fix malformed Javadoc comments + + Make the build reproducible on the Azul JDK + + Fix infinite loop in JavaClass.findField() on invalid input + + Fix infinite loop in JavaClass.getAllInterfaces() on invalid + input + + Fix infinite loop in JavaClass.getSuperClasses() on invalid + input + + Exception message in Args.requireU4() refers to the wrong data + type + + Exception message in Args.requireU2() refers to the wrong + upper range value + + Code.Code(int, int, DataInput, ConstantPool) now throws a + ClassFormatException if the code array is greater than the + JVM specification allows + + Code.Code(int, int, int, int, byte[], CodeException[], + Attribute[], ConstantPool) now throws a ClassFormatException + if the code array is greater than the JVM specification allows + + Code.setCode(byte[]) now throws a ClassFormatException if the + code array is greater than the JVM specification allows + + ClassDumper.dump() should not call the input stream it didn't + open; fixes IOException when calling DumpClass.main + (ClassDumper.java:351) + + org.apache.bcel.classfile.ConstantPool.ConstantPool(Constant[]) + now uses varagrs: ConstantPool(Constant...) + + org.apache.bcel.classfile.Deprecated now requires its the + attribute_length item be zero + + org.apache.bcel.classfile.Synthetic now requires its the + attribute_length item be zero + + The size of an Attribute unknown to the JVM specification is + limited to 1 MB and is overridden with the system property + BCEL.Attribute.Unknown.max_attribute_length + * Changes + + Bump org.apache.commons:commons-parent from 89 to 95 + + [test] Bump org.jetbrains.kotlin:kotlin-stdlib from 2.2.20 to + 2.3.0 + + Bump commons-io:commons-io from 2.20.0 to 2.21.0 + + Bump commons-lang3 from 3.19.0 to 3.20.0 + + [test] Bump org.apache.commons:commons-exec from 1.5.0 to + 1.6.0 +- Changes of version 6.11.0 + * New Features + + Add Const.MAJOR_25 + + Add Const.MINOR_25 + + Add experimental CycloneDX VEX file + + Refactor to use new Maven POM variable ecj.version + * Fixed Bugs + + Replace internal use of Locale.ENGLISH with Locale.ROOT + + BCEL-375: Wrong permissions on bcel .jar file in binary + .tar.gz distribution file + + BCEL-376: ClassPath.close() throws + UnsupportedOperationException when created with + system-classpath + + ClassPath.getResources(String) can use an ArrayList instead of + a Vector + + Fix SpotBugs [ERROR] Medium: Operation on the "created" shared + variable in "ConstantUtf8" class is not atomic [org.apache + .bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 119] + AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE + + Fix SpotBugs [ERROR] Medium: Operation on the "considered" + shared variable in "ConstantUtf8" class is not atomic [org + .apache.bcel.classfile.ConstantUtf8] At ConstantUtf8.java: + [line 137] AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE + + Fix SpotBugs [ERROR] Medium: Operation on the "skipped" shared + variable in "ConstantUtf8" class is not atomic [org.apache + .bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 134] + AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE + + org.apache.bcel.util.ClassPath + .addJdkModules(String, List<String>) now reads the system + property "jdk.module.path" instead of "java.modules.path" + + Fix ConstantPoolModuleAccessTest failures on Java 25 + + 377: Fix testing on Java 24 and up + * Changes + + Bump org.apache.commons:commons-parent from 72 to 89 + + Bump org.apache.commons:commons-lang3 from 3.14.0 to 3.19.0 + + Bump org.jetbrains.kotlin:kotlin-stdlib from 2.0.0 to 2.2.20 + + Bump commons-io:commons-io from 2.16.1 to 2.20.0 + + Bump jna.version from 5.14.0 to 5.18.1 + + Bump org.codehaus.mojo:taglist-maven-plugin from 3.1.0 to + 3.2.1 + + Bump org.apache.commons:commons-collections4 from 4.5.0-M2 to + 4.5.0 + + Bump org.apache.commons:commons-exec from 1.4.0 to 1.5.0 + +------------------------------------------------------------------- @@ -6,4 +199,4 @@ - a minimum of Java 8. - + Fix PMD UnnecessaryFullyQualifiedName. - + Fix PMD EmptyCatchBlock by allowing commented blocks. - + Fix PMD EmptyControlStatement by allowing commented blocks. + a minimum of Java 8 + + Fix PMD UnnecessaryFullyQualifiedName + + Fix PMD EmptyCatchBlock by allowing commented blocks + + Fix PMD EmptyControlStatement by allowing commented blocks @@ -11,4 +204,4 @@ - JasminVisitor. - + SpotBugs checks should ignore code generated by JavaCC. - + Fix SpotBugs URF_UNREAD_FIELD in ClassDumper. - + Fix SpotBugs DM_DEFAULT_ENCODING in JasminVisitor. + JasminVisitor + + SpotBugs checks should ignore code generated by JavaCC + + Fix SpotBugs URF_UNREAD_FIELD in ClassDumper + + Fix SpotBugs DM_DEFAULT_ENCODING in JasminVisitor @@ -16 +209 @@ - ASTFunAppl. + ASTFunAppl @@ -18,3 +211,3 @@ - Mini.Environment. - + Fix SpotBugs DM_DEFAULT_ENCODING in Mini.MiniC. - + Fix SpotBugs WMI_WRONG_MAP_ITERATOR in Package.go(String[]). + Mini.Environment + + Fix SpotBugs DM_DEFAULT_ENCODING in Mini.MiniC + + Fix SpotBugs WMI_WRONG_MAP_ITERATOR in Package.go(String[]) @@ -22,8 +215,8 @@ - TransitiveHull.getIgnored(). - + Add accessors to model and unit tests, Javadoc #183. - + Add Const.MAJOR_22. - + Add Const.MINOR_22. - + Add Const.MAJOR_23. - + Add Const.MINOR_23. - + Add Const.MAJOR_24. - + Add Const.MINOR_24. + TransitiveHull.getIgnored() + + Add accessors to model and unit tests, Javadoc + + Add Const.MAJOR_22 + + Add Const.MINOR_22 + + Add Const.MAJOR_23 + + Add Const.MINOR_23 + + Add Const.MAJOR_24 + + Add Const.MINOR_24 @@ -31 +223,0 @@ - #322, #332. @@ -33 +225 @@ - 2.0.0 #309, #318. + 2.0.0 @@ -35,2 +227,2 @@ - to 4.5.0-M2. - + Bump org.apache.commons:commons-parent from 69 to 71. + to 4.5.0-M2 + + Bump org.apache.commons:commons-parent from 69 to 71 @@ -38,4 +230,4 @@ - 3.1.0 #331. - * Includes changes from 6.9.0 Maintenance and bug fix release. - + Add Support for Java 16 records #290. - + Add null guard for InstructionFactory.createInvoke() #289. + 3.1.0 + * Includes changes from 6.9.0 Maintenance and bug fix release + + Add Support for Java 16 records + + Add null guard for InstructionFactory.createInvoke() @@ -43 +235 @@ - org.apache.bcel.classfile.DescendingVisitor.accept(E[]). + org.apache.bcel.classfile.DescendingVisitor.accept(E[]) @@ -46 +238 @@ - AnnotationEntryGen[]). + AnnotationEntryGen[]) @@ -49 +241 @@ - ConstantPoolGen, boolean). + ConstantPoolGen, boolean) @@ -52,9 +244 @@ - ElementValue[], ConstantPoolGen). - + Avoid possible NullPointerException in - org.apache.bcel.generic.ClassGen.setMethods(Method[]). - + Avoid possible NullPointerException in - org.apache.bcel.generic.ClassGen.unpackAnnotations(Attribute[]). - + Avoid possible NullPointerException in - org.apache.bcel.classfile.ParameterAnnotationEntry.createParameterAnnotationEntries(Attribute[]). - + Avoid possible NullPointerException in - org.apache.bcel.generic.ClassGen.ClassGen(JavaClass). + ElementValue[], ConstantPoolGen) @@ -62 +246,6 @@ - org.apache.bcel.generic.FieldGenOrMethodGen.addAll(Attribute[]). + org.apache.bcel.generic.ClassGen.setMethods(Method[]) + + Avoid possible NullPointerException in org.apache.bcel.generic + .ClassGen.unpackAnnotations(Attribute[]) + + Avoid possible NullPointerException in org.apache.bcel + .classfile.ParameterAnnotationEntry + .createParameterAnnotationEntries(Attribute[]) @@ -64,78 +253,72 @@ - org.apache.bcel.classfile.ParameterAnnotationEntry.createParameterAnnotationEntries(Attribute[]). - + Avoid NullPointerException after calling - org.apache.bcel.classfile.MethodParameters.setParameters(MethodParameter[]) - with null. - + Avoid NullPointerException after calling - org.apache.bcel.classfile.ParameterAnnotations.setParameterAnnotationTable(ParameterAnnotationEntry[]) - with null. - + Avoid NullPointerException after calling - org.apache.bcel.classfile.LocalVariableTypeTable.setLocalVariableTable(LocalVariable[]) - with null. - + Avoid NullPointerException after calling ++++ 270 more lines (skipped) ++++ between /work/SRC/openSUSE:Factory/bcel/bcel.changes ++++ and /work/SRC/openSUSE:Factory/.bcel.new.3698736/bcel.changes Old: ---- bcel-6.10.0-src.tar.gz New: ---- _scmsync.obsinfo bcel-6.13.0-src.tar.gz build.specials.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ bcel.spec ++++++ --- /var/tmp/diff_new_pack.c6cRd8/_old 2026-10-08 15:13:22.782733591 +0200 +++ /var/tmp/diff_new_pack.c6cRd8/_new 2026-10-08 15:13:22.783733633 +0200 @@ -1,7 +1,7 @@ # # spec file for package bcel # -# Copyright (c) 2024 SUSE LLC +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -17,7 +17,7 @@ Name: bcel -Version: 6.10.0 +Version: 6.13.0 Release: 0 Summary: Byte Code Engineering Library License: Apache-2.0 @@ -27,10 +27,14 @@ Source1: %{name}-build.xml BuildRequires: ant BuildRequires: apache-commons-lang3 +BuildRequires: apache-commons-io BuildRequires: fdupes BuildRequires: java-devel >= 1.8 BuildRequires: javapackages-local >= 6 -#!BuildIgnore: xalan-j2 xerces-j2 xml-apis xml-resolver +#!BuildIgnore: xalan-j2 +#!BuildIgnore: xerces-j2 +#!BuildIgnore: xml-apis +#!BuildIgnore: xml-resolver BuildArch: noarch %description @@ -68,8 +72,8 @@ %build mkdir -p lib -build-jar-repository -s lib apache-commons-lang3 -%ant jar javadoc +build-jar-repository -s lib apache-commons-lang3 commons-io +ant jar javadoc %install # jar @@ -77,7 +81,7 @@ install -m 644 target/%{name}-%{version}.jar %{buildroot}%{_javadir}/%{name}.jar # pom mkdir -p %{buildroot}%{_mavenpomdir} -%mvn_install_pom pom.xml %{buildroot}%{_mavenpomdir}/%{name}.pom +%{mvn_install_pom} pom.xml %{buildroot}%{_mavenpomdir}/%{name}.pom %add_maven_depmap %{name}.pom %{name}.jar -a "bcel:bcel" # javadoc mkdir -p %{buildroot}%{_javadocdir}/%{name} ++++++ _scmsync.obsinfo ++++++ mtime: 1791365723 commit: bf86c2d634c278c13fc40b56bd10019a7869e977f50bf9ec86c16d80605640e7 url: https://src.opensuse.org/java-packages/bcel revision: bf86c2d634c278c13fc40b56bd10019a7869e977f50bf9ec86c16d80605640e7 projectscmsync: https://src.opensuse.org/java-packages/_ObsPrj ++++++ bcel-6.10.0-src.tar.gz -> bcel-6.13.0-src.tar.gz ++++++ ++++ 86948 lines of diff (skipped) ++++++ bcel-build.xml ++++++ --- /var/tmp/diff_new_pack.c6cRd8/_old 2026-10-08 15:13:23.365758023 +0200 +++ /var/tmp/diff_new_pack.c6cRd8/_new 2026-10-08 15:13:23.367758106 +0200 @@ -10,8 +10,8 @@ <property name="project.groupId" value="org.apache.bcel"/> <property name="project.artifactId" value="bcel"/> - <property name="project.version" value="6.10.0"/> - <property name="spec.version" value="6.10"/> + <property name="project.version" value="6.13.0"/> + <property name="spec.version" value="6.13"/> <property name="compiler.source" value="1.8"/> <property name="compiler.target" value="${compiler.source}"/> ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-10-07 11:35:23.000000000 +0200 @@ -0,0 +1 @@ +.osc
