< back to search

shield Recommended update for xmlgraphics-commons, maven-script-interpreter, maven-parent, maven-invoker-plugin, maven-dependency-analyzer, maven-dependency-tree, picocli, plexus-classworlds, plexus-interactivity, xz-java, modello, junit5, jline3, javapackages-tools, exec-maven-plugin, dom4j, byte-buddy, aqute-bnd, apache-parent, apache-commons-collections4, apache-commons-exec, jansi, zstd-jni
SUSE-SLES-16.0-888

This update for xmlgraphics-commons, maven-script-interpreter, maven-parent, maven-invoker-plugin, maven-dependency-analyzer, maven-dependency-tree, picocli, plexus-classworlds, plexus-interactivity, xz-java, modello, junit5, jline3, javapackages-tools, exec-maven-plugin, dom4j, byte-buddy, aqute-bnd, apache-parent, apache-commons-collections4, apache-commons-exec, jansi, zstd-jni fixes the following issues: Changes in xmlgraphics-commons: - Update to 2.11 * Minor changes to support FOP 2.11 release + FOP-3236: Add all the needed namespaces to the parent element + FOP-3241: Add option to convert image to CMYK + XGC-142: Add generics to hints + XGC-143: Use mvn for bundle jar + XGC-145: Avoid parsing uri to read page number - JPMS: add Automatic-Module-Name to the manifest - Update to 2.10 Changes in maven-script-interpreter: - Upgrade to version 1.7 * New features and improvements + Refactor FileLogger to allow customizable output stream creation * Maintenance + Remove redundant diagnose logging + Update site descriptor to 2.0 + fix _extends pth in release-drafter + Upgrade parent pom to 45 + JUnit Jupiter best practices + feat: enable prevent branch protection rules + Enable Github Issues Changes in maven-parent: - Upgrade to Apache Maven parent POM version 48 * New features and improvements + Add configuration for rerunning failing integration tests * Bug Fixes + Fix enforce-bytecode-version configuration for ignored scopes * Maintenance + Update banner links + Simplify docs configuration + Remove taglist/jxr/checkstyle/surefire/pmd-reports + Update Maven logos Changes in maven-invoker-plugin: - Upgrade to upstream version 3.10.1 * Bug Fixes + Provide separate logs for each execution for rerunning jobs - Upgrade to upstream version 3.10.0 * New features and improvements + Implement simply retry mechanism for failed build jobs + Add support for disabling project cloning with "none" value in cloneProjectsTo + Support for multiple pre-build and post-build scripts for one test * Documentation updates + Remove old incompatibility notice about report file name from site documentation + docs: Clarify that toolchains can be selected by a version range. + Improve wording of some plugin parameters * Maintenance + Cleanups - Remove outdated invoker properties configurations in ITs + Simplify usage of toolchains + Refactor file utils usage and improve dependency configuration + JUnit Jupiter best practices + PlexusFileUtils Refaster recipes + chore: delete junit 3 references + feat: enable prevent branch protection rules + Use fluido-skin and site-plugin version from parent Changes in maven-dependency-analyzer: - Upgrade to upstream version 1.17.1 * New features and improvements + Optimize artifact lookup in DefaultProjectDependencyAnalyzer * Maintenance + Add tag-template to release-drafter configuration + Implement missing tests and cleanup TODOs in DependencyVisitorTest * Dependency updates + Update parent 48 + MSHARED-1410: Track used declared dependency usage by Changes in maven-dependency-tree: - Update to version 3.3.0 * Bug Fixes + MSHARED-1286: Display if dependency is optional in tree Changes in picocli: - Switch sources to the recent tip of upstream repository, since our PR has been accepted - Update to version 4.7.6 * Enhancements + PropertiesDefaultProvider should try to load properties from classpath (last). + Change log level from WARN to INFO when bean not found in ApplicationContext. + Don't show hidden commands in JLine3 command description. + Use ... vararg instead of array parameter to match overridden method signature. * Bugfixes: + defaultValue should not be applied in addition to user-specified value for options with a custom IParameterConsumer. + Fix NPE in jline3 Example.jar as ConfigurationPath cannot be null anymore. + fix bug for Optional<T> arguments with initial value. + @Option-annotated setter method not invoked with default value when used in mixin for both command and subcommand. + Custom type converter for primitive boolean options should not be ignored. * BUILD fixes: + fix errorprone TruthSelfEquals warnings + Fix broken build. + Fix .gitattributes related CR/LF problems. + Add Error Prone. * CLEAN fix: + Remove unused extra format arguments. * DOC fixes: + Fix a few typos in CommandLine's JavaDoc. + Clarify documentation for negatable options. + Clarify that ParseResult passed to IExecutionExceptionHandler is the top-level parse result, not the parse result of the subcommand that failed. - Due to a bug in the upstream github repository, fetch sources from our private fork until https://github.com/remkop/picocli/pull/2347 gets integrated upstream - Create a second spec file picocli-extras to be able to build the picocli-shell-jline3 artifact without build cycles - Spec file cleanup - The binaries are compatible with java 1.8 - Reproducible builds: Do not create timestamps with bnd wrap - Update to version 4.7.5 * Enhancements: + Java 22 update: improve logic for detecting if the output stream is connected to a terminal. + Mask parameters in trace log when echo=false for interactive options and positional parameters. * Bugfixes: + Fix positional parameters bug with late-resolved arity variable. + Don't generate auto-complete for hidden attributes in picocli.shell.jline3.PicoCommand. + ArgGroup with exclusive=false and multiplicity=1 should require at least one option; fix regression and refine solution introduced in [#1848][#2030]. * DOC fixes: + Improve GraalVM documentation: add graalvm-native-image-plugin. + Commit html files with LF line-endings. - Fetch sources from upstream repository, since our pull request https://github.com/remkop/picocli/pull/2045 has been integrated - Update to version 4.7.4 * Fixes: + API: Add setter for name in picocli.shell.jline3.PicocliCommands. + Enhancement: Improved feedback on mistyped subcommands + Enhancement: prevent java.nio.charset.UnsupportedCharsetException: cp0 on windows, and fall back to the default charset if the charset provided by System property sun.stdout.encoding is invalid + Bugfix: Option "mapFallbackValue" ignored when inherited to subcommand + Bugfix: fix issue with required options in ArgGroup becoming optional when combined with DefaultValueProvider - Fetch sources using source service: this allows filter out binaries with spurious legal status and which we don't use for build - Due to a bug in the upstream github repository, fetch sources from our private fork until https://github.com/remkop/picocli/pull/2045 gets integrated upstream - Require java 9 for build so that we can build the module-info.java always - Build all classes with source/target 8 and the module-info.java with release 9, which makes the jars usable with java 8 and higher - Upgrade to version 4.7.3 * full changes from previous versions are in https://github.com/remkop/picocli/blob/v4.7.3/RELEASE-NOTES.md - Package artifacts: picocli-{codegen,shell-jline2} - JPMS: package module discriptors when building with java >= 9 - Take POMs from Maven Central - Build picocli using ant to avoid cycles - Upgrade to version 4.6.2 * full changes from previous versions are in https://github.com/remkop/picocli/blob/v4.6.2/RELEASE-NOTES.md - Initial packaging of picocli 4.0.4 Changes in picocli: - Update to version 4.7.7 * Enhancements: + picocli.shell.jline3.PicocliCommands::invoke now returns ParseResult instead of null + Avoid syntax error in auto-completion script for invalid option names and paramLabel values starting with a digit + Variable interpolation should work for ArgGroup.heading attribute * Bug fixes: + The built-in help subcommand should return the exit code of the subcommand's exitCodeOnUsageHelp value for the subcommand whose help was requested + Module info missing in all jars except the main picocli jar file + AutoComplete with jline3 was showing hidden commands + NullPointerException when using PropertiesDefaultProvider + negatable=true option in an ArgGroup should not add negated option twice + Duplicate help output for ArgGroup from a Mixin + Options get doubled in non validating ArgGroup when used in Mixin + Incorrect results when using ArgGroup + defaultValue + split + List/Set + DuplicateOptionAnnotationsException on using negatable option in ArgGroup + boolean with arity=0 and defaultValue=false behaved unexpectedly * Documentation fixes: + User guide, CDI 2.0 (JSR 365) section: fix example and add warning about dynamic proxies + Fix line-endings in generated asciidoc HTML + Fix broken link + Add at least a link to how to use the CodeGen APT under Bazel - Switch sources to the recent tip of upstream repository, since our PR has been accepted - Update to version 4.7.6 * Enhancements + PropertiesDefaultProvider should try to load properties from classpath (last). + Change log level from WARN to INFO when bean not found in ApplicationContext. + Don't show hidden commands in JLine3 command description. + Use ... vararg instead of array parameter to match overridden method signature. * Bugfixes: + defaultValue should not be applied in addition to user-specified value for options with a custom IParameterConsumer. + Fix NPE in jline3 Example.jar as ConfigurationPath cannot be null anymore. + fix bug for Optional<T> arguments with initial value. + @Option-annotated setter method not invoked with default value when used in mixin for both command and subcommand. + Custom type converter for primitive boolean options should not be ignored. * BUILD fixes: + fix errorprone TruthSelfEquals warnings + Fix broken build. + Fix .gitattributes related CR/LF problems. + Add Error Prone. * CLEAN fix: + Remove unused extra format arguments. * DOC fixes: + Fix a few typos in CommandLine's JavaDoc. + Clarify documentation for negatable options. + Clarify that ParseResult passed to IExecutionExceptionHandler is the top-level parse result, not the parse result of the subcommand that failed. - Due to a bug in the upstream github repository, fetch sources from our private fork until https://github.com/remkop/picocli/pull/2347 gets integrated upstream - Create a second spec file picocli-extras to be able to build the picocli-shell-jline3 artifact without build cycles - Spec file cleanup Changes in plexus-classworlds: - Upgrade to version 2.11.0 * New features and improvements + Add Automatic-Module-Name to JAR manifest for JPMS compatibility * Bug Fixes + Restore Maven 2 compatibility - revert "Drop deprecated package org.codehaus.classworlds" - Upgrade to version 2.10.0 * Breaking changes + Drop deprecated package org.codehaus.classworlds * Maintenance + Add comprehensive test coverage improvements + JUnit Jupiter best practices + Some automatic code cleanups + Remove no longer needed code Changes in xz-java: - Upgrade to version 1.12 * Fix ArrayIndexOutOfBoundsException in the LZMA/LZMA2 encoder on x86-64 and ARM64 when running on Java 9 or newer. The affected code isn't used on Java 8. The bug is present in versions 1.10 and 1.11. If one cannot upgrade, one should set the property org.tukaani.xz.MatchLengthFinder=Basic to disable the affected code path. * Fix ArrayCache usage in LZMAInputStream. If ArrayCache was enabled, decompression was likely to fail quickly when the cache returns a cached array. ArrayCache is disabled by default. * The binaries of 1.12 in the Maven Central require Java 8 and contain optimized classes for Java >= 9 as multi-release JAR. They were built with OpenJDK 21.0.10 on GNU/Linux and can be reproduced using the following command: SOURCE_DATE_EPOCH=1772370000 TZ=UTC0 ant maven Changes in modello: - Upgrade to upstream version 2.7.0 * New features and improvements + XDOC: document required fields in generated model docs * Bug Fixes + Refactor PLURAL_EXCEPTIONS to use ThreadLocal for thread safety + Initialize model parameters in VelocityGenerator + Use correct getter method prefix for type "Boolean" Changes in modello: - Upgrade to upstream version 2.7.0 * New features and improvements + XDOC: document required fields in generated model docs * Bug Fixes + Refactor PLURAL_EXCEPTIONS to use ThreadLocal for thread safety + Initialize model parameters in VelocityGenerator + Use correct getter method prefix for type "Boolean" Changes in junit5: - Update to upstream version 5.14.4 * Principal changes: + Fixed a race condition in NodeTestTask.parentContext in Junit Platform + @EnabledOnJre and @DisabledOnJre once again work reliably when used with JRE.OTHER in a test running on a Java runtime whose version is higher than the version of the last JAVA_* constant in the JRE enum (Junit Jupiter) + Legacy XML reports now include the index of @ClassTemplate/@ParameterizedClass invocations in test names to make them unique (Junit Jupiter) + Legacy XML reports now include parent display names to make it easier to distinguish between invocations for different parameters (Junit Jupiter) - Follow the same pattern of Bundle-SymbolicName in the artifacts of junit5-minimal as in the rest of artifacts contained in the main junit5 package. And align the Bundle-SymbolicName to what the upstream gradle build produces Changes in jline3: - Update to upstream version 3.30.13 * Bug Fixes + fix: correct inverted bounds check in readBuffered methods + fix: remove proactive isNativeAccessEnabled() checks from terminal providers + fix: status bar duplication after vertical resize - Update to upstream version 3.30.11 * Bug Fixes + Add GraalVM native-image support for FFM terminal provider - Update to upstream version 3.30.10 * Bug Fixes + Catch LinkageError during provider loading + Prevent ArrayIndexOutOfBoundsException in KillRing.yankPop() + Fix off-by-one bounds check in KeyMap.unbind() + Handle EOF in color parsing to prevent infinite loop + Close HttpURLConnection in ConsoleEngineImpl.urlExists() + Guard AnsiConsole.providers() call to avoid NoSuchMethodError + Guard waitDirty against spurious wakeups + Restore waitDirty timeout in forced dump to prevent busy-loop spinning + Remove spurious (short) casts in Size setters + Fix AttributedStyle color chaining + Avoid NPE when closing terminal with null masterOutput + Close PTY streams before shutdown to prevent hang on macOS - Update to upstream version 3.30.9 * Bug Fixes + Suppress dumb terminal warning when no streams are TTYs In CI environments (like GitHub Actions), the "Unable to create a system terminal" warning is no longer emitted when falling back to a dumb terminal is expected because no TTY is available - Update to upstream version 3.30.8 * Bug Fixes + Fix JNI terminal failing to load on JDK 21.0.10+ - Module.isNativeAccessEnabled() was backported to some JDK 21 builds (e.g. 21.0.10), causing a false UnsupportedOperationException since the method returns false even though JNI works without --enable-native-access. JNI native access restrictions are only enforced from JDK 24+, so the check is now skipped on earlier versions. - Update to upstream version 3.30.7 * New Features & Improvements + Windows codepage auto-detection: Restored automatic detection of Windows console output codepage, fixing Unicode rendering issues since JLine 3.22 + MSYS2 environment detection: Expanded IS_MSYSTEM to detect all MSYS2 environments (UCRT64, CLANG64, CLANGARM64, MINGW32), fixing backspace in git-bash + JDK 24+ compatibility: Check native access before loading JNI library to prevent restricted method warnings + Unicode 16.0: Updated WCWidth character width tables to Unicode 16.0 + which command: Added which builtin command to ConsoleEngine + Display resize fix: Display.resize() now handles terminals with buffer wider than visible window + Terminal closure enforcement: Accessing terminal streams after close() now logs a warning by default, configurable via jline.terminal.closeMode property + Standard SPI: Terminal providers now use standard Java ServiceLoader for discovery + Key binding docs: Fixed incorrect example for binding terminal capabilities - use KeyMap.key() instead of raw getStringCapability() * Bug Fixes + Fix MenuSupport left/right navigation when GROUP_PERSIST is on + Fix StringIndexOutOfBoundsException in CompletionMatcherImpl + Fix doubled quotes when completing quoted words with multiple candidates + Fix ASCII fallback for box-drawing characters when alt charset is unsupported + Fix DefaultParser emitting trailing empty word for non-completion contexts + Fix Ctrl+C propagation as UserInterruptException in console-ui prompts + Fix newline binding for dumb terminal support in prompts + Fix BRACKETED_PASTE_OFF not sent when option is explicitly disabled + Fix terminal content preservation during resize with status bar + Fix inherited input stream being closed on Windows + Fix nested shell interruption handling + Fix Nano keypad state management + Fix auto-suggestion menu list not cleared when no completions match + Suppress IOException in PosixPtyTerminal pump threads during close + Do not raise native signals on Windows if not enabled + AnsiConsole now fails on repeated uninstalls + Allow single-digit options like -1 in Options parser + Fix setting line reader options via system properties + Support ls /, pseudo pipe operators, and ignore unknown pipe names Changes in javapackages-tools: - Upgrade to upstream version 6.5.1 * Changes Remove Codecov call from GitHub CI workflow Remove unused and outdated Vagrantfile Java launcher script improvements Add jpackage_script manpage Implement feature contitionals Fix installation of jpackage_script.7 manpage - Make the gradle and ivy support configurable Changes in exec-maven-plugin: - Upgrade to upstream version 3.6.3 * Documentation updates + Document thread group isolation limitation in java goal * Maintenance + JUnit 5 best practices + Move ExecJavaMojoTest, ExecMojoTest to JUnit 5 + Add support for JEP 512 for for package-private static main method + Move to JUnit 5 - Upgrade to upstream version 3.6.2 * New features and improvements + Add JPMS ServiceLoader Support with Multi-Release JAR - Upgrade to upstream version 3.6.1 * Bug Fixes + Revert change from #480 - plugin dependencies must be resolved from plugin repositories - Upgrade to upstream version 3.6.0 * New features and improvements + [ExecMojo]Add getShebang method to correctly set the command line executable name JEP 512 Support * Bug Fixes + fix inheritIo option + Fix for #479 - Wrong repositories used to collect deps * Maintenance + Use JSR-330 for component injection + Re-run failed tests + Restore default matrix build * Dependency updates + Use Maven 3.9.11 in dependencies, still requires 3.6.3 as minimum Changes in dom4j: - Upgrade to upstream version 2.1.5 * Changes: + Remove unnecessary constant conditional + Remove misleading no-op lines incorrectly trying to disable external entities Changes in byte-buddy: - Update to v1.18.8 * Changes of v1.18.8 + Improve support for repeatable builds + Fix reordering of exception table in type initializers when instrumenting * Changes of v1.18.7 + Introduce new versioning concept with -jdk5 suffix for backwards-compatible jar and Java 8 baseline for regular jar * No tag v1.18.6 * Changes of v1.18.5 + Eagerly resolve of canonical files during attach emulation to avoid failure when process ends before file can be deleted + Add super classes to hash code / equals computation in Advice that were missing * Changes of v1.18.4 + Add support for new build description in Android 9 Changes in aqute-bnd: - Remove unnecessary dependency on jline Changes in aqute-bnd: - The maven build considers the SOURCE_DATE_EPOCH automatically now Changes in apache-parent: - Update to 38: * Maintenance + Update banner links Changes in apache-commons-collections4: - Upgrade to upstream version 4.5.0 * New features + Add IteratorUtils.toSet(Iterator) + Add IteratorUtils.toSet(Iterator, int) + Add EnumerationUtils.toSet(Enumeration) + COLLECTIONS-693: Please add OWASP Dependency Check to the build Changes in apache-commons-exec: - Upgrade to version 1.6.0 * New features: + TimeoutObserver now extends Consumer<Watchdog> + Add org.apache.commons.exec.Watchdog.getTimeout() * Fixed Bugs: + Watchdog.builder().get() now uses a default timeout of 30 seconds instead of throwing a NullPointerException + ExecuteWatchdog.builder().get() now uses a default timeout of 30 seconds instead of throwing a NullPointerException + Calling org.apache.commons.exec.Watchdog.Builder .setTimeout(Duration) with null now resets to the default INFINITE_TIMEOUT_DURATION timeout + Calling org.apache.commons.exec.ExecuteWatchdog.Builder .setTimeout(Duration) with null now resets to the default INFINITE_TIMEOUT_DURATION timeout + Calling org.apache.commons.exec.Watchdog.Builder .setThreadFactory(ThreadFactory) with null now resets to the default java.util.concurrent.Executors.defaultThreadFactory() + Calling org.apache.commons.exec.ExecuteWatchdog.Builder .setThreadFactory(ThreadFactory) with null now resets to the default java.util.concurrent.Executors.defaultThreadFactory() + Fix Checkstyle issues + Fix StringUtils.quoteArgument(String) when input contains single and double quotes #309 + Fix Apache RAT plugin console warnings - Upgrade to version 1.5.0 * New features: + Add Maven property project.build.outputTimestamp for build reproducibility + Add CommandLine.CommandLine(Path) + Add Executor.getWorkingDirectoryPath() + Add DefaultExecutor.Builder.setWorkingDirectory(Path) + Add CommandLauncher.exec(CommandLine, Map<String, String>, Path) * Fixed Bugs: + EXEC-122: Document PumpStreamHandler stream thread-safety requirements + Fix CI only running on Ubuntu and improve OS-specific tests + Fix PMD UnnecessaryFullyQualifiedName in DefaultExecutor + Fix PMD EmptyCatchBlock by allowing commented blocks + Fix PMD EmptyControlStatement by allowing commented blocks + Replace OS.OS_* use of Locale.ENGLISH with Locale.ROOT + Deprecate DebugUtils.DebugUtils() + Deprecate MapUtils.MapUtils() + Deprecate StringUtils.StringUtils() + Fix Javadoc warnings + Fix SpotBugs AT_STALE_THREAD_WRITE_OF_PRIMITIVE: Shared primitive variable "shouldDestroy" in one thread may not yield the value of the most recent write from another thread [org.apache.commons.exec.ShutdownHookProcessDestroyer $ProcessDestroyerThread] + Fix SpotBugs AT_STALE_THREAD_WRITE_OF_PRIMITIVE: Shared primitive variable "added" in one thread may not yield the value of the most recent write from another thread [org.apache.commons.exec.ShutdownHookProcessDestroyer] - Upgrade to version 1.4.0 * New features: + Add ShutdownHookProcessDestroyer.isEmpty() + Add DefaultExecuteResultHandler.waitFor(Duration) + Add Watchdog.Watchdog(Duration) + Add ExecuteWatchdog.ExecuteWatchdog(Duration) + Add PumpStreamHandler.setStopTimeout(Duration) and deprecate PumpStreamHandler.setStopTimeout(long) + Add DefaultExecutor.Builder + Add DaemonExecutor.Builder + Add ExecuteWatchdog.Builder + Add Watchdog.Builder * Fixed Bugs: + EXEC-105: Fix code snippet in tutorial page + EXEC-100: Sync org.apache.commons.exec.OS with the newest Ant source file. + EXEC-64: DefaultExecutor swallows IOException cause instead of propagating it (work-round for Java 1.5) + Java-style Array declaration and remove empty finally block + Use JUnit 5 assertThrows() + [StepSecurity] ci: Harden GitHub Actions + Port from JUnit 4 to 5 + [Javadoc] CommandLine.toCleanExecutable(final String dirtyExecutable) IllegalArgumentException #61 + ExecuteException propagates its cause to its IOException superclass + Propagate exception in DebugUtils.handleException(String, Exception) + Deprecate StringUtils.toString(String[], String) in favor of String.join(CharSequence, CharSequence...) + EXEC-78: No need to use System.class.getMethod("getenv",...) any more + EXEC-70: Delegate thread creation to java.util.concurrent.ThreadFactory + Avoid NullPointerException in MapUtils.prefix(Map, String) * Removed: + Deprecate DefaultExecuteResultHandler.waitFor(long) + Deprecate ExecuteWatchdog.ExecuteWatchdog(long) + Deprecate Watchdog.Watchdog(long) + Drop obsolete and unmaintained Ant build + Drop CLIRR plugin, replaced by JApiCmp Changes in jansi: - Upgrade to upstream release 2.4.3 * Changes: + Fix native library loading failure on certain JDK/OS combinations. JansiLoader.contentsEquals() compared full 8192-byte buffers instead of only the bytes actually read from each stream. On the final chunk, stale or overwritten bytes beyond the read count could cause a false "Content differs" mismatch, preventing the native library from loading. + Fix missing synchronisation in AnsiConsole + Deprecate WindowsSupport + Fix JVM crash when running javaw + Fix terminal width support on MINGW + Send both SCO and DEC command for save/restore cursor position + Fix wrong output encoding on Windows with JDK >= 19 + Improve robustness of initial cleanup + Fix infinite loop bug + Fix invalid string input + Require JDK 8 at runtime and JDK 11 at build time + Remove @author tags in code + Add module-info through moditect + Support windows on ARM + Only increment counter if install successful + Add missing space in SunOS-sparcv9_CCFLAGS + Fix project's name + Fix windows-arm64 DLL name

  • Release Date
    Jun 5 2026
  • References
  • Type
    recommended
  • Severity
    moderate

cloud_download Downloads

SUSE Linux Enterprise Server 16.0 aarch64
SUSE Linux Enterprise Server 16.0 ppc64le
SUSE Linux Enterprise Server 16.0 s390x
SUSE Linux Enterprise Server for SAP applications 16.0 ppc64le
SUSE Linux Enterprise Server for SAP applications 16.0 x86_64
SUSE Linux Enterprise Server 16.0 x86_64