Three processing limits have been added to the XML libraries. These are:

Description: Limits the number of groups an XPath expression can contain.

Type: integer

Value: A positive integer. A value less than or equal to 0 indicates no limit. If the value is not an integer, a NumberFormatException is thrown. Default 10.

Description: Limits the number of operators an XPath expression can contain.

Type: integer

Value: A positive integer. A value less than or equal to 0 indicates no limit. If the value is not an integer, a NumberFormatException is thrown. Default 100.

Description: Limits the total number of XPath operators in an XSL Stylesheet.

Type: integer

Value: A positive integer. A value less than or equal to 0 indicates no limit. If the value is not an integer, a NumberFormatException is thrown. Default 10000.

Supported processors

jdk.xml.xpathExprGrpLimit and jdk.xml.xpathExprOpLimit are supported by the XPath processor.

All three limits are supported by the XSLT processor.

Setting properties

For the XSLT processor, the properties can be changed through the TransformerFactory . For example,

        TransformerFactory factory = TransformerFactory.newInstance();
        factory.setAttribute("jdk.xml.xpathTotalOpLimit", "1000");

For both the XPath and XSLT processors, the properties can be set through the system property and jaxp.properties configuration file located in the conf directory of the Java installation. For example,

        System.setProperty("jdk.xml.xpathExprGrpLimit", "20");

or in the jaxp.properties file,

        jdk.xml.xpathExprGrpLimit=20
There are two known issues:
An XPath expression that contains a short form of the parent axis ".." can return incorrect results. See JDK-8284920 for details.
An invalid XPath expression that ends with a relational operator such as  ‘<’ ‘>’ and ‘=’ will cause the processor to erroneously throw StringIndexOutOfBoundsException instead of XPathExpressionException.  See JDK-8284548 for details.
JDK-8270504 (not public)
Other Notes
security-libs/java.security
➜ Only Expose Certificates With Proper Trust Settings as Trusted Certificate Entries in macOS KeychainStore
On macOS, only certificates with proper trust settings in the user keychain will be exposed as trusted certificate entries in the KeychainStore type of keystore. Also, calling the KeyStore::setCertificateEntry method or the keytool -importcert command on a KeychainStore keystore now fails with a KeyStoreException. Instead, call the macOS "security add-trusted-cert" command to add a trusted certificate into the user keychain.
JDK-8278449 (not public)
core-libs/javax.naming
➜ Parsing of URL Strings in Built-in JNDI Providers Is More Strict
The parsing of URLs in the LDAP, DNS, and RMI built-in JNDI providers has been made more strict. The strength of the parsing can be controlled by system properties:
  -Dcom.sun.jndi.ldapURLParsing="legacy" | "compat" | "strict"    (to control "ldap:" URLs)
  -Dcom.sun.jndi.dnsURLParsing="legacy" | "compat" | "strict"     (to control "dns:" URLs)
  -Dcom.sun.jndi.rmiURLParsing="legacy" | "compat" | "strict"     (to control "rmi:" URLs)
The default value is "compat" for all of the three providers.
The "legacy" mode turns the new validation off.
The "compat" mode limits incompatibilities.
The "strict" mode is stricter and may cause regression by rejecting URLs that an application might consider as valid.
In "compat" and "strict" mode, more validation is performed. As an example, in the URL authority component, the new parsing only accepts brackets around IPv6 literal addresses. Developers are encouraged to use java.net.URI constructors or its factory method to build URLs rather than handcrafting URL strings.
If an illegal URL string is found, a java.lang.IllegalArgumentException or a javax.naming.NamingException (or a subclass of it) is raised.
JDK-8278972 (not public)
Java™ SE Development Kit 11.0.14 (JDK 11.0.14)

January 18, 2022
The full version string for this update release is 11.0.14+8 (where "+" means "build"). The version number is 11.0.14.
IANA TZ Data 2021b, 2021c, 2021d, 2021e
JDK 11.0.14 contains IANA time zone data 2021b, 2021c, 2021d, 2021e.
Jordan now starts DST on February's last Thursday.
Samoa no longer observes DST.
Merge more location-based Zones whose timestamps agree since 1970.
Move some backward-compatibility links to 'backward'.
Rename Pacific/Enderbury to Pacific/Kanton.
Correct many pre-1993 transitions in Malawi, Portugal, etc.
zic now creates each output file or link atomically.
zic -L no longer omits the POSIX TZ string in its output.
zic fixes for truncation and leap second table expiration.
zic now follows POSIX for TZ strings using all-year DST.
Fix some localtime crashes and bugs in obscure cases.
zdump -v now outputs more-useful boundary cases.
tzfile.5 better matches a draft successor to RFC 8536.
A new file SECURITY.
Revert most 2021b changes to 'backward'.
Fix 'zic -b fat' bug in pre-1970 32-bit data.
Fix two Link line typos.
Distribute SECURITY file.
This release is intended as a bugfix release, to fix compatibility problems and typos reported since 2021b was released.
Fiji suspends DST for the 2021/2022 season.
'zic -r' marks unspecified timestamps with "-00".
Palestine will fall back 10-29 (not 10-30) at 01:00.
For more information, refer to Timezone Data Versions in the JRE Software.
Security Baselines
The security baselines for the Java Runtime Environment (JRE) at the time of the release of JDK 11.0.14 are specified in the following table:
Keeping the JDK up to Date
Oracle recommends that the JDK is updated with each Critical Patch Update.
In order to determine if a release is the latest, the Security Baseline page can
be used to determine which is the latest version for each release family.
Critical patch updates, which contain security vulnerability fixes, are announced one year in advance on
Critical Patch Updates, Security Alerts and Bulletins.
It is not recommended that this JDK (version 11.0.14) be used after the next critical patch update scheduled
for April 19, 2022.
New Features
security-libs/javax.crypto:pkcs11
➜ New SunPKCS11 Configuration Properties
SunPKCS11 provider adds new provider configuration attributes to better control native resources usage. The SunPKCS11 provider consumes native resources in order to work with native PKCS11 libraries. To manage and better control the native resources, additional configuration attributes are added to control the frequency of clearing native references as well as whether to destroy the underlying PKCS11 Token after logout.
The 3 new attributes for SunPKCS11 provider configuration file are:
destroyTokenAfterLogout (boolean, defaults to false) 
If set to true, when java.security.AuthProvider.logout() is called upon the SunPKCS11 provider instance, the underlying Token object will be destroyed and resources will be freed. This essentially renders the SunPKCS11 provider instance unusable after logout() calls. Note that a PKCS11 provider with this attribute set to true should not be added to the system provider list since the provider object is not usable after a logout() method call.
cleaner.shortInterval (integer, defaults to 2000, in milliseconds) 
This defines the frequency for clearing native references during busy period (such as, how often should the cleaner thread processes the no-longer-needed native references in the queue to free up native memory). Note that the cleaner thread will switch to the 'longInterval' frequency after 200 failed tries (such as, when no references are found in the queue).
cleaner.longInterval (integer, defaults to 60000, in milliseconds) 
This defines the frequency for checking native reference during non-busy period (such as, how often should the cleaner thread check the queue for native references). Note that the cleaner thread will switch back to the 'shortInterval' value if native PKCS11 references for cleaning are detected.
See JDK-8240256
security-libs/javax.net.ssl
➜ Configurable Extensions With System Properties
Two new system properties have been added. The system property, jdk.tls.client.disableExtensions, is used to disable TLS extensions used in the client. The system property, jdk.tls.server.disableExtensions, is used to disable TLS extensions used in the server. If an extension is disabled, it will be neither produced nor processed in the handshake messages.
The property string is a list of comma separated standard TLS extension names, as registered in the IANA documentation (for example, server_name, status_request, and signature_algorithms_cert). Note that the extension names are case sensitive. Unknown, unsupported, misspelled and duplicated TLS extension name tokens will be ignored.
Please note that the impact of blocking TLS extensions is complicated. For example, a TLS connection may not be able to be established if a mandatory extension is disabled. Please do not disable mandatory extensions, and do not use this feature unless you clearly understand the impact.
See JDK-8217633
Removed Features and Options
security-libs/java.security
➜ Removed Google's GlobalSign Root Certificate
The following root certificate from Google has been removed from the cacerts keystore:
+ alias name "globalsignr2ca [jdk]"
  Distinguished Name: CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2
See JDK-8225083
Other Notes
 
core-libs/java.nio
➜ Zip File System Provider Throws ZipException When Entry Name Element Contains "." or ".." 
The ZIP file system provider has been changed to reject existing ZIP files that contain entries with "." or ".." in name elements. ZIP files with these entries cannot be used as a file system. Invoking the java.nio.file.FileSystems.newFileSystem(...) methods throw ZipException if the ZIP file contains these entries.
 
See JDK-8251329
 
 

core-libs/java.time
➜ Update Timezone Data to 2021c
IANA Time Zone Database, on which JDK's Date/Time libraries are based, has made a tweak to some time zone rules since 2021c. Note that since this update, some of the time zone rules prior to the year 1970 have been modified according to the changes which were introduced with 2021b. For more detail, refer to the announcement of 2021b
See JDK-8274407
core-libs/javax.naming
➜ LDAP Channel Binding Support for Java GSS/Kerberos
A new JNDI environment property “com.sun.jndi.ldap.tls.cbtype” has been added to enable TLS Channel Binding data in LDAP authentication over SSL/TLS protocol to the Windows AD server. A possible value is “tls-server-end-point” - Channel Binding data is created on the base of the TLS server certificate. See the module description of the java.naming module.
See JDK-8245527
security-libs/javax.net.ssl
➜ SocketExceptions Are Not Wrapped Into SSLExceptions in SSLSocketImpl
This release reverts the behavior of SSLSocketImpl and SSLTransport introduced by JDK-8196584. SocketException will now be thrown as is instead of being suppressed into an SSLException.




    

See JDK-8259662
hotspot/runtime
➜ OperatingSystemMXBean.getProcessCpuLoad Is Now Container Aware
For JVMs running in a container, OperatingSystemMXBean.getProcessCpuLoad now considers only the CPU resources available to the container when calculating CPU load. Prior to this change, the calculation included all CPUs on a host. After this change, management agents may report higher CPU usage by JVMs in containers that are constrained to a limited set of CPUs.
See JDK-8269851

Bug Fixes

This release also contains fixes for security vulnerabilities described in the Oracle Critical Patch Update.
➜ Issues fixed in 11.0.14:
 1 JDK-8249548 client-libs  backward focus traversal gets stuck in button group   2 JDK-8273436 client-libs  Backport JDK-8273426 caused build failure due to missing "All rights reserved."   3 JDK-8211999 client-libs java.awt Window positioning bugs due to overlapping GraphicsDevice bounds (Windows/HiDPI)   4 JDK-8272806 client-libs java.awt [macOS] "Apple AWT Internal Exception" when input method is changed   5 JDK-6722236 client-libs java.awt 3 Choice regression testcases are failing from 6u10_b26 build onwards   6 JDK-8015886 client-libs java.awt java/awt/Focus/DeiconifiedFrameLoosesFocus/DeiconifiedFrameLoosesFocus.java sometimes failed on ubuntu   7 JDK-8257242 client-libs java.awt [macOS] Java app crashes while switching input methods   8 JDK-8274326 client-libs javax.accessibility [macos] Ensure initialisation of sun/lwawt/macosx/CAccessibility in JavaComponentAccessibility.m   9 JDK-8274056 client-libs javax.accessibility JavaAccessibilityUtilities leaks JNI objects   10 JDK-8274381 client-libs javax.accessibility missing CAccessibility definitions in JNI code    11 JDK-8208747 client-libs javax.accessibility [a11y] [macos] In Optionpane Demo, inside ComponentDialog Example, unable to navigate to all items, with VO on   12 JDK-8270893 client-libs javax.imageio IndexOutOfBoundsException while reading large TIFF file   13 JDK-8239334 client-libs javax.swing Tab Size does not work correctly in JTextArea with setLineWrap on   14 JDK-8269951 client-libs javax.swing [macos] Focus not painted in JButton when setBorderPainted(false) is invoked   15 JDK-8259237 client-libs javax.swing Demo selection changes with left/right arrow key. No need to press space for selection.   16 JDK-8269850 core-libs  Most JDK releases report macOS version 12 as 10.16 instead of 12.0   17 JDK-8231717 core-libs java.lang Improve performance of charset decoding when charset is always compactable   18 JDK-8274779 core-libs java.net HttpURLConnection: HttpClient and HttpsClient incorrectly check request method when set to POST   19 JDK-8276536 core-libs java.time Update TimeZoneNames files to follow the changes made by JDK-8275766   20 JDK-8273924 core-libs java.util:i18n ArrayIndexOutOfBoundsException thrown in java.util.JapaneseImperialCalendar.add()   21 JDK-8187649 core-libs java.util:i18n ArrayIndexOutOfBoundsException in java.util.JapaneseImperialCalendar   22 JDK-8245527 core-libs javax.naming LDAP Channel Binding support for Java GSS/Kerberos   23 JDK-8195703 core-svc debugger BasicJDWPConnectionTest.java: 'App exited unexpectedly with 2'   24 JDK-8247469 core-svc javax.management getSystemCpuLoad() returns -1 on linux when some offline cpus are present and cpusets.effective_cpus is not available   25 JDK-8235211 core-svc tools serviceability/attach/RemovingUnixDomainSocketTest.java fails with AttachNotSupportedException: Unable to open socket file    26 JDK-8270886 hotspot compiler Crash in PhaseIdealLoop::verify_strip_mined_scheduling   27 JDK-8210392 hotspot compiler assert(Compile::current()->live_nodes() < Compile::current()->max_node_limit()) failed: Live Node limit exceeded limit   28 JDK-8223137 hotspot compiler Rename predicate 'do_unroll_only()' to 'is_unroll_only()'.   29 JDK-8223139 hotspot compiler Rename mandatory policy-do routines.    30 JDK-8223923 hotspot compiler C2: Missing interference with mismatched unsafe accesses    31 JDK-8223140 hotspot compiler Clean-up in 'ok_to_convert()'   32 JDK-8272570 hotspot compiler C2: crash in PhaseCFG::global_code_motion   33 JDK-8267652 hotspot compiler c2 loop unrolling by 8 results in reading memory past array   34 JDK-8263303 hotspot compiler C2 compilation fails with assert(found_sfpt) failed: no node in loop that's not input to safepoint   35 JDK-8268019 hotspot compiler C2: assert(no_dead_loop) failed: dead loop detected   36 JDK-8268672 hotspot compiler C2: assert(!loop->is_member(u_loop)) failed: can be in outer loop or out of both loops only   37 JDK-8252049 hotspot compiler Native memory leak in ciMethodData ctor   38 JDK-8231501 hotspot compiler VM crash in MethodData::clean_extra_data(CleanExtraDataClosure*): fatal error: unexpected tag 99    39 JDK-8223138 hotspot compiler Small clean-up in loop-tree support.   40 JDK-8271341 hotspot compiler Opcode() != Op_If && Opcode() != Op_RangeCheck) || outcnt() == 2 assert failure with Test7179138_1.java   41 JDK-8271340 hotspot compiler Crash PhaseIdealLoop::clone_outer_loop   42 JDK-8271459 hotspot compiler C2: Missing NegativeArraySizeException when creating StringBuilder with negative capacity   43 JDK-8257919 hotspot compiler [JVMCI] profiling info didn't change after reprofile   44 JDK-8263776 hotspot compiler [JVMCI] add helper to perform Java upcalls   45 JDK-8272131 hotspot compiler PhaseMacroExpand::generate_slow_arraycopy crash when clone null CallProjections.fallthrough_ioproj   46 JDK-8268261 hotspot compiler C2: assert(n != __null) failed: Bad immediate dominator info.   47 JDK-8272574 hotspot compiler C2: assert(false) failed: Bad graph detected in build_loop_late   48 JDK-8215889 hotspot gc assert(!_unloading) failed: This oop is not available to unloading class loader data with ZGC   49 JDK-8221584 hotspot jvmti SIGSEGV in os::PlatformEvent::unpark() in JvmtiRawMonitor::raw_exit while posting method exit event   50 JDK-8217348 hotspot jvmti assert(thread->is_Java_thread()) failed: just checking   51 JDK-8236177 hotspot runtime assert(status == 0) failed: error ETIMEDOUT(60), cond_wait   52 JDK-8218483 hotspot runtime Crash in "assert(_daemon_threads_count->get_value() > daemon_count) failed: thread count mismatch 5 : 5"   53 JDK-8222446 hotspot runtime  assert(C->env()->system_dictionary_modification_counter_changed()) failed: Must invalidate if TypeFuncs differ   54 JDK-8273229 hotspot runtime Update OS detection code to recognize Windows Server 2022   55 JDK-8274840 hotspot runtime Update OS detection code to recognize Windows 11   56 JDK-8273342 hotspot runtime Null pointer dereference in classFileParser.cpp:2817   57 JDK-8269668 hotspot runtime [aarch64] java.library.path not including /usr/lib64   58 JDK-8230674 hotspot runtime Heap dumps should exclude dormant CDS archived objects of unloaded classes   59 JDK-8272124 hotspot runtime Cgroup v1 initialization causes NullPointerException when cgroup path contains colon   60 JDK-8269934 hotspot runtime RunThese24H.java failed with EXCEPTION_ACCESS_VIOLATION in java_lang_Thread::get_thread_status   61 JDK-8181313 hotspot svc-agent SA: Remove libthread_db dependency on Linux   62 JDK-8225083 security-libs java.security Remove Google certificate that is expiring in December 2021   63 JDK-8273826 security-libs java.security Correct Manifest file name and NPE checks   64 JDK-8277224 security-libs java.security  sun.security.pkcs.PKCS9Attributes.toString() throws NPE   65 JDK-8269034 security-libs javax.crypto:pkcs11 AccessControlException for SunPKCS11 daemon threads   66 JDK-8240256 security-libs javax.crypto:pkcs11 Better resource cleaning for SunPKCS11 Provider   67 JDK-8270344 security-libs javax.net.ssl Session resumption errors   68 JDK-8217633 security-libs javax.net.ssl Configurable extensions with system properties   69 JDK-8268965 security-libs javax.net.ssl TCP Connection Reset when connecting simple socket to SSL server   70 JDK-8211148 tools javac var in implicit lambdas shouldn't be accepted for source < 11   71 JDK-8267459 tools jshell Pasting Unicode characters into JShell does not work. 
Java™ SE Development Kit 11.0.13 (JDK 11.0.13)

October 19, 2021
The full version string for this update release is 11.0.13+10 (where "+" means "build"). The version number is 11.0.13.
IANA TZ Data 2021a
For more information, refer to Timezone Data Versions in the JRE Software.
Security Baselines
The security baselines for the Java Runtime Environment (JRE) at the time of the release of JDK 11.0.13 are specified in the following table:
Keeping the JDK up to Date
Oracle recommends that the JDK is updated with each Critical Patch Update.
In order to determine if a release is the latest, the Security Baseline page can
be used to determine which is the latest version for each release family.
Critical patch updates, which contain security vulnerability fixes, are announced one year in advance on
Critical Patch Updates, Security Alerts and Bulletins.
It is not recommended that this JDK (version 11.0.13) be used after the next critical patch update scheduled
for January 18, 2022.
New Features
core-libs/java.io:serialization
➜ Context-specific Deserialization Filters
Allow applications to configure context-specific and dynamically-selected deserialization filters via a JVM-wide filter factory that is invoked to select a filter for each deserialization stream. The behavior is a strict subset of JEP 415: Context-Specific Deserialization Filters to allow a filter factory to be configured using a property configured on the command line or in the security properties file.
The behavior is opt-in based on the presence of the jdk.serialFilterFactory system property on the command line or the jdk.serialFilterFactory security property. If set, the JVM-wide filter factory selects the filter for each stream when the stream is constructed and when a stream-specific filter is set.
The JVM-wide filter factory is a java.util.function.BinaryOperator<java.io.ObjectInputFilter> function invoked when each ObjectInputStream is constructed and when the stream-specific filter is set using ObjectInputStream.setObjectInputFilter(ObjectInputFilter). The parameters are the current filter and a requested filter and the function returns the filter to be used for the stream. When invoked from the ObjectInputStream constructors, the first parameter is null and the second parameter is the static JVM-wide filter. When invoked from ObjectInputStream.setObjectInputFilter, the first parameter is the filter currently set on the stream (which was set in the constructor), and the second parameter is the filter given to ObjectInputStream.setObjectInputFilter.
A typical filter factory should use or merge the static JVM-wide filter with other application and context specific filters and the stream-specific filter, if one is set on the stream. The filter factory implementation can also use any contextual information at its disposal, for example, extracted from the application thread context, or its call stack, to compose and combine a new filter. It is not restricted to only use its two parameters.
Refer to Context-Specific Deserialization Filter and Serialization Filtering Guide for details.




    

JDK-8268624 (not public)
Removed Features and Options
security-libs/java.security
➜ Removed IdenTrust Root Certificate
The following root certificate from IdenTrust has been removed from the cacerts keystore:
+ alias name "identrustdstx3 [jdk]"
  Distinguished Name: CN=DST Root CA X3, O=Digital Signature Trust Co.
See JDK-8225082
hotspot/compiler
➜ Remove the Experimental AOT and JIT Compiler in OracleJDK 11u
The experimental Java-based JIT compiler, Graal JEP317, has been removed. Attempting to use it produces a JVMCI error: JVMCI compiler 'graal' not found.
The Java Ahead-of-Time compilation experimental tool jaotc has been removed. Using HotSpot VM AOT options defined by JEP295 produce "Unrecognized VM option" error on VM initialization.
Developers who wish to test the Graal compiler for either AOT or JIT compilation should use GraalVM.
JDK-8267704 (not public)
Other Notes
core-libs/java.lang
➜ Release Doesn't Correctly Recognize Windows 11 
This release doesn't correctly identify Windows 11. The property os.name is set to Windows 10 on Windows 11. In HotSpot error logs, the OS is identified as Windows 10; however, the HotSpot error log does show the Build number. Windows 11 has Build 22000.194 or above.
See JDK-8274840
install
➜ Change to Package Names in Linux RPM/DEB Installers 
On the Linux platform, the names of JDK packages provided by Java RPM and DEB installers have been changed. Names of JDK packages follow the jdk-<feature_release_version> pattern instead of the jdk-<update_release_version> pattern that was previously used. For example, the new names of JDK 11, 16, and 17 packages are jdk-11, jdk-16, and jdk-17 respectively.
The change to package names disables side-by-side installation of multiple JDKs of the same release family. Only one JDK per release family can be installed on a system with RPM and DEB installers.
If a user wants to have multiple update releases from the same family, the user must download the tar.gz bundles.
JDK-8266653 (not public)
security-libs/javax.net.ssl
➜ Updated the Default Enabled Cipher Suites Preference 
The default priority order of the cipher suites for TLS 1.0 to TLS 1.3 has been adjusted.
For TLS 1.3, TLS_AES_256_GCM_SHA384 is now preferred over TLS_AES_128_GCM_SHA256.
For TLS 1.0 to TLS 1.2, some of the intermediate suites have been lowered in priority as follows:
Cipher suites that do not preserve forward secrecy have been moved lower in priority than those that do support forward secrecy.
Cipher suites that use SHA-1 have been moved lower in priority.

See JDK-8163326
core-libs/javax.naming
➜ System Property to Control Reconstruction of Reference Address Objects by JDK's Built-in JNDI LDAP Implementation 
The scope of the com.sun.jndi.ldap.object.trustSerialData system property has been extended to control the deserialization of java objects from the javaReferenceAddress LDAP attribute.  This system property now controls the deserialization of java objects from the javaSerializedData and javaReferenceAddress LDAP attributes.
To prevent deserialization of java objects from these attributes, the system property can be set to false.  By default, the deserialization of java objects from javaSerializedData and javaReferenceAddress attributes is allowed.
JDK-8267712 (not public)
hotspot/runtime
➜ Release Doesn't Correctly Recognize Windows Server 2022 
This release doesn't correctly identify Windows Server 2022. The property os.name is set to Windows Server 2019 on Windows Server 2022. In HotSpot error logs the OS is identified as Windows Server 2019; however, the HotSpot error log does show the Build number. Windows Server 2022 has Build 20348, or above.
See JDK-8273229
security-libs/java.security
➜ Updated keytool to Create AKID From SKID of Issuing Certificate as Specified by RFC 5280
The gencert command of the keytool utility has been updated to create AKID from the SKID of the issuing certificate as specified by RFC 5280.
See JDK-8257497
security-libs/javax.crypto:pkcs11
➜ SunPKCS11 Initialization With NSS When External FIPS Modules Are in Security Modules Database 
The SunPKCS11 security provider can now be initialized with NSS when FIPS-enabled external modules are configured in the Security Modules Database (NSSDB). Before this change, when such a library was configured for NSS in non-FIPS mode, the SunPKCS11 provider would throw a RuntimeException with the message "FIPS flag set for non-internal module".
This change allows the JDK to work properly with recent NSS releases in GNU/Linux operating systems when the system-wide FIPS policy is turned on.
See JDK-8238555
hotspot
G1 adaptive IHOP does not account for reclamation of humongous objects by young GC
JDK-8246274
hotspot
G1 old gen allocation tracking is not in a separate class
hotspot
compiler
C2: nested locks optimization may create unbalanced monitor enter/exit code
JDK-8269304
hotspot
compiler
Regression ~5% in 2005 in b27
JDK-8266653 (Confidential)
install
install
Change update mode for JDK rpm/deb installers as it breaks "yum update" for JDK11+
JDK-8260680
tools
jshell
PipedOutputStream.write in a JShell throws error "pipe closed"
JDK-8247403
tools
jshell
JShell: No custom input (e.g. from GUI) possible with JavaShellToolBuilder
Java™ SE Development Kit 11.0.12 (JDK 11.0.12)

July 20, 2021
The full version string for this update release is 11.0.12+8 (where "+" means "build"). The version number is 11.0.12.
IANA TZ Data 2021a
JDK 11.0.12 contains IANA time zone data 2021a.
For more information, refer to Timezone Data Versions in the JRE Software.
Security Baselines
The security baselines for the Java Runtime Environment (JRE) at the time of the release of JDK 11.0.12 are
specified in the following table:
Keeping the JDK up to Date
Oracle recommends that the JDK is updated with each Critical Patch Update (CPU).
In order to determine if a release is the latest, the Security Baseline page can
be used to determine which is the latest version for each release family.
Critical patch updates, which contain security vulnerability fixes, are announced one year in advance on Critical Patch Updates, Security Alerts and Bulletins.
It is not recommended that this JDK (version 11.0.12) be used after the next critical patch update scheduled
for October 19, 2021.
New Features
security-libs/org.ietf.jgss:krb5
➜ Support cross-realm MSSFU
The support for the Kerberos MSSFU extensions [1] is now extended to cross-realm environments.
By leveraging the Kerberos cross-realm referrals enhancement introduced in the context of JDK-8215032, the 'S4U2Self' and 'S4U2Proxy' extensions may be used to impersonate user and service principals located on different realms.
[1] - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/3bff5864-8135-400e-bdd9-33b552051d94
See JDK-8005819
security-libs/java.security
➜ Customizing PKCS12 keystore Generation
New system and security properties have been added to enable users to customize the generation of PKCS #12 keystores. This includes algorithms and parameters for key protection, certificate protection, and MacData. The detailed explanation and possible values for these properties can be found in the "PKCS12 KeyStore properties" section of the java.security file.
Also, support for the following SHA-2 based HmacPBE algorithms has been added to the SunJCE provider: HmacPBESHA224, HmacPBESHA256, HmacPBESHA384, HmacPBESHA512, HmacPBESHA512/224, HmacPBESHA512/256
See JDK-8076190
Removed Features and Options
security-libs/java.security
➜ Removed Root Certificates with 1024-bit Keys
The following root certificates with weak 1024-bit RSA public keys have been removed from the cacerts keystore:
+ alias name "thawtepremiumserverca [jdk]"
  Distinguished Name: EMAILADDRESS=premium-server@thawte.com, CN=Thawte Premium Server CA, OU=Certification Services Division, O=Thawte Consulting cc, L=Cape Town, ST=Western Cape, C=ZA
+ alias name "verisignclass2g2ca [jdk]"
  Distinguished Name: OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For authorized use only", OU=Class 2 Public Primary Certification Authority - G2, O="VeriSign, Inc.", C=US
+ alias name "verisignclass3ca [jdk]"
  Distinguished Name: OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US
+ alias name "verisignclass3g2ca [jdk]"
  Distinguished Name: OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For authorized use only", OU=Class 3 Public Primary Certification Authority - G2, O="VeriSign, Inc.", C=US
+ alias name "verisigntsaca [jdk]"
  Distinguished Name: CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA
See JDK-8243559
security-libs/java.security
➜ Removed Telia Company's Sonera Class2 CA Certificate
The following root certificate has been removed from the cacerts truststore:
+ Telia Company
  + soneraclass2ca
    DN: CN=Sonera Class2 CA, O=Sonera, C=FI
See JDK-8225081
Other Notes
install/install
➜ Updated List of Capabilities Provided by JDK RPMs
The following capabilities have been removed from the list of what OracleJDK/OracleJRE RPMs provide: xml-commons-api, jaxp_parser_impl, and java-fonts. This clean-up of the list resolves existing and potential conflicts with modular RPMs.
There are other RPMs providing these capabilities, so there should be no impact on packages that depend on them. Package managers can use other rpms to satisfy the dependencies provided by the OracleJDK/OracleJRE RPMs before this change.
JDK-8263575 (not public)
install/install
➜ ADDLOCAL=ToolsFeature,SourceFeature Argument No Longer Needed For Windows JDK Installer
The ADDLOCAL=ToolsFeature,SourceFeature argument is no longer needed for the JDK installer silent mode.  All required files are now installed by default.
JDK-8262043 (not public)
security-libs/java.security
➜ Upgraded the Default PKCS12 Encryption and MAC Algorithms
The default encryption and MAC algorithms used in a PKCS #12 keystore have been updated. The new algorithms are based on AES-256 and SHA-256 and are stronger than the old algorithms that were based on RC2, DESede, and SHA-1. See the security properties starting with keystore.pkcs12 in the java.security file for detailed information.
For compatibility, a new system property named keystore.pkcs12.legacy is defined that will revert the algorithms to use the older, weaker algorithms. There is no value defined for this property.
See JDK-8153005
security-libs/java.security
➜ Disable SHA-1 JARs
JARs signed with SHA-1 algorithms are now restricted by default and treated as if they were unsigned. This applies to the algorithms used to digest, sign, and optionally timestamp the JAR. It also applies to the signature and digest algorithms of the certificates in the certificate chain of the code signer and the Timestamp Authority, and any CRLs or OCSP responses that are used to verify if those certificates have been revoked.
In order to reduce the compatibility risk for applications that have been previously timestamped or use private CAs, there are two exceptions to this policy:
Any JAR signed with SHA-1 algorithms and timestamped prior to January 01, 2019 will not be restricted.
Any JAR signed with a SHA-1 certificate that does not chain back to a Root CA included by default in the JDK cacerts keystore will not be restricted.
These exceptions may be removed in a future JDK release.
Users can, at their own risk, remove these restrictions by modifying the java.security configuration file (or overriding it using the java.security.properties system property) and removing "SHA1 jdkCA & usage SignedJAR & denyAfter 2019-01-01" from the jdk.certpath.disabledAlgorithms security property and "SHA1 jdkCA & denyAfter 2019-01-01" from the jdk.jar.disabledAlgorithms security property.
See JDK-8196415
security-libs/javax.net.ssl
➜ Improve Encoding of TLS Application-Layer Protocol Negotiation (ALPN) Values
Certain TLS ALPN values couldn't be properly read or written by the SunJSSE provider. This is due to the choice of Strings as the API interface and the undocumented internal use of the UTF-8 character set which converts characters larger than U+00007F (7-bit ASCII) into multi-byte arrays that may not be expected by a peer.
SunJSSE now encodes/decodes String characters as 8-bit ISO_8859_1/LATIN-1 characters. This means applications that used characters above U+000007F that were previously encoded using UTF-8 may need to either be modified to perform the UTF-8 conversion, or set the Java security property jdk.tls.alpnCharset to "UTF-8" revert the behavior.
See the updated guide at https://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/alpn.html for more information.
See JDK-8254631
core-libs/java.net
➜ URL FTP Protocol Handler: IPv4 Address Validation in Passive Mode
Client-side FTP support in the Java platform is available through the FTP URL stream protocol handler, henceforth referred to as the FTP Client.




    

The following system property has been added for validation of server addresses in FTP passive mode.
jdk.net.ftp.trustPasvAddress.
In this release, the FTP Client has been enhanced to reject an address sent by a server, in response to a PASV command from the FTP Client, when that address differs from the address which the FTP Client initially connected.
To revert to the prior behavior, the jdk.net.ftp.trustPasvAddress system property can be set to true. The affect of setting this property is that the FTP Client accepts and uses the address value returned in reply to a PASV command
JDK-8258432 (not public)
Bug Fixes

This release also contains fixes for security vulnerabilities described in the Oracle Critical Patch Update. For a more complete list of the bug fixes included in this release, see the JDK 11.0.12 Bug Fixes page.
Java™ SE Development Kit 11.0.11 (JDK 11.0.11)

April 20, 2021
The full version string for this update release is 11.0.11+9 (where "+" means "build"). The version number is 11.0.11.
IANA TZ Data 2020e, 2020f, 2021a
JDK 11.0.11 contains IANA time zone data 2020e, 2020f, 2021a.
  * Volgograd switches to Moscow time on 2020-12-27 at 02:00.
 * South Sudan changes from +03 to +02 on 2021-02-01 at 00:00.
For more information, refer to Timezone Data Versions in the JRE Software.
Security Baselines
The security baselines for the Java Runtime Environment (JRE) at the time of the release of JDK 11.0.11 are
specified in the following table:
Oracle recommends that the JDK is updated with each Critical Patch Update (CPU).
In order to determine if a release is the latest, the Security Baseline page can
be used to determine which is the latest version for each release family.
Critical patch updates, which contain security vulnerability fixes, are announced one year in advance on
Critical Patch Updates, Security Alerts and Bulletins.
It is not recommended that this JDK (version 11.0.11) be used after the next critical patch update scheduled
for July 20, 2021.
New Features
tools
➜ jdeps --print-module-deps Reports Transitive Dependences
jdeps --print-module-deps, --list-deps, and --list-reduce-deps options have been enhanced as follows.
By default, they perform transitive module dependence analysis on libraries on the class path and module path, both directly and indirectly, as required by the given input JAR files or classes. Previously, they only reported the modules required by the given input JAR files or classes.  The --no-recursive option can be used to request non-transitive dependence analysis.
By default, they flag any missing dependency, i.e. not found from class path and module path, as an error.   The --ignore-missing-deps option can be used to suppress missing dependence errors. Note that a custom image is created with the list of modules output by jdeps when using the  --ignore-missing-deps option for a non-modular application. Such an application, running on the custom image, might fail at runtime when missing dependence errors are suppressed.
See JDK-8213909
Other Notes
core-libs/javax.naming
➜ New System and Security Properties to Control Reconstruction of Remote Objects by JDK's Built-in JNDI RMI and LDAP Implementations
jdk.jndi.object.factoriesFilter: This system and security property allows a serial filter to be specified that controls the set of object factory classes permitted to instantiate objects from object references returned by naming/directory systems. The factory class named by the reference instance is matched against this filter during remote reference reconstruction. The filter property supports pattern-based filter syntax with the format specified by JEP 290. This property applies both to the JNDI/RMI and the JNDI/LDAP built-in provider implementations. The default value allows any object factory class specified in the reference to recreate the referenced object.
com.sun.jndi.ldap.object.trustSerialData: This system property allows control of the deserialization of java objects from the javaSerializedData LDAP attribute. To prevent deserialization of java objects from the attribute, the system property can be set to false value. By default, deserialization of java objects from the javaSerializedData attribute is allowed.
JDK-8244473 (not public)
security-libs/java.security
➜ Added 2 HARICA Root CA Certificates
The following root certificates have been added to the cacerts truststore:
+ HARICA
  + haricarootca2015
    DN: CN=Hellenic Academic and Research Institutions RootCA 2015, O=Hellenic Academic and Research Institutions Cert. Authority, L=Athens, C=GR
  + haricaeccrootca2015
    DN: CN=Hellenic Academic and Research Institutions ECC RootCA 2015, O=Hellenic Academic and Research Institutions Cert. Authority, L=Athens, C=GR
See JDK-8256421
security-libs/javax.net.ssl
➜ Disable TLS 1.0 and 1.1
TLS 1.0 and 1.1 are versions of the TLS protocol that are no longer considered secure and have been superseded by more secure and modern versions (TLS 1.2 and 1.3).
These versions have now been disabled by default. If you encounter issues, you can, at your own risk, re-enable the versions by removing "TLSv1" and/or "TLSv1.1" from the jdk.tls.disabledAlgorithms security property in the java.security configuration file.
See JDK-8202343
core-libs/java.nio.charsets
➜ Modified the MS950 charset Encoder's Conversion Table
In this release, some of the one-way byte-to-char mappings have been aligned with the preferred mappings provided by the Unicode Consortium.
See JDK-8232161
core-libs/java.lang
➜ Less Ambiguous Processing of ProcessBuilder Quotes on Windows
>
In the java.lang.ProcessBuilder implementation on Windows, the system property jdk.lang.Process.allowAmbiguousCommands=false ensures, for each argument, that double-quotes are properly encoded in the command string passed to Windows CreateProcess. An argument with a final trailing double-quote preceded by a backslash is encoded as a literal double-quote; previously, the argument including the double-quote would be joined with the next argument. An empty argument is encoded as a pair of double-quotes ("") resulting in a zero length string passed for the argument to the process; previously, it was silently ignored. An argument containing double-quotes, other than first and last, is encoded to preserve the double-quotes when passed to the process; previously, the embedded double-quotes would be dropped and not passed to the process. If a security manager is set, such as in WebStart applications, double-quotes are encoded as described. When there is no security manager, there is no change to existing behavior; the jdk.lang.Process.allowAmbiguousCommands property can be set to true: jdk.lang.Process.allowAmbiguousCommands=true or false. If left unset, it is the same as setting it to true.
JDK-8250568 (not public)
Bug Fixes

This release also contains fixes for security vulnerabilities described in the Oracle Critical Patch Update. For a more complete list of the bug fixes included in this release, see the JDK 11.0.11 Bug Fixes page.
core-libs
java.lang
Failed to launch JVM because of NullPointerException occured on System.props
JDK-8258878
core-libs
java.time
(tz) Upgrade time-zone data to tzdata2020e
JDK-8259048
core-libs
java.time
(tz) Upgrade time-zone data to tzdata2020f
Java™ SE Development Kit 11.0.10 (JDK 11.0.10)

January 19, 2021
The full version string for this update release is 11.0.10+8 (where "+" means "build"). The version number is 11.0.10.
IANA Data 2020d

JDK 11.0.10 contains IANA time zone data version 2020d. For more information, refer to Timezone Data Versions in the JRE Software.
Security Baselines

The security baselines for the Java Runtime Environment (JRE) at the  time of the release of JDK 11.0.10 are specified in the following table:
Keeping the JDK up to Date

Oracle recommends that the JDK is updated with each Critical Patch Update (CPU).  In order to determine if a release is the latest, the Security Baseline page can be used to determine which is the latest version for each release family.
Critical patch updates, which contain security vulnerability fixes, are announced one year in advance on Critical Patch Updates, Security Alerts and Bulletins. It is not recommended that this JDK (version 11.0.10) be used after the next critical patch update scheduled for April 20, 2021. 
New Features
security-libs/java.security
➜ -groupname Option Added to keytool Key Pair Generation
A new -groupname option has been added to keytool -genkeypair so that a user can specify a named group when generating a key pair. For example, keytool -genkeypair -keyalg EC -groupname secp384r1 will generate an EC key pair by using the secp384r1 curve. Because there might be multiple curves with the same size, using the -groupname option is preferred over the -keysize option.
See JDK-8213400
security-libs/javax.net.ssl
➜ Support for certificate_authorities Extension
The "certificate_authorities" extension is an optional extension introduced in TLS 1.3. It is used to indicate the certificate authorities (CAs) that an endpoint supports and should be used by the receiving endpoint to guide certificate selection.
With this JDK release, the "certificate_authorities" extension is supported for TLS 1.3 in both the client and the server sides.  This extension is always present for client certificate selection, while it is optional for server certificate selection.
Applications can enable this extension for server certificate selection by setting the jdk.tls.client.enableCAExtension system property to true.  The default value of the property is false.
Note that if the client trusts more CAs than the size limit of the extension (less than 2^16 bytes), the extension is not enabled.  Also, some server implementations do not allow handshake messages to exceed 2^14 bytes.  Consequently, there may be interoperability issues when jdk.tls.client.enableCAExtension is set to true and the client trusts more CAs than the server implementation limit.
See JDK-8206925
core-libs/java.lang
➜ POSIX_SPAWN Option on Linux
As an additional way to launch processes on Linux, the jdk.lang.Process.launchMechanism property can be set to POSIX_SPAWN. This option has been available for a long time on other *nix platforms. The default launch mechanism (VFORK) on Linux is unchanged, so this additional option does not affect existing installations.
POSIX_SPAWN mitigates rare pathological cases when spawning child processes, but it has not yet been excessively tested. Prudence is advised when using POSIX_SPAWN in productive installations.
See JDK-8212828
security-libs/javax.net.ssl
➜ Support for X25519 and X448 in TLS
The named elliptic curve groups x25519 and x448 are now available for JSSE key agreement in TLS versions 1.0 to 1.3, with x25519 being the most preferred of the default enabled named groups. The default ordered list is now:
    x25519, secp256r1, secp384r1, secp521r1, x448,
    ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192
The default list can be overridden by using the system property jdk.tls.namedGroups.
See JDK-8252226
security-libs/java.security
➜ jarsigner Preserves POSIX File Permission and symlink Attributes
When signing a file that contains POSIX file permission or symlink attributes, jarsigner now preserves these attributes in the newly signed file but warns that these attributes are unsigned and not protected by the signature. The same warning is printed during the jarsigner -verify operation for such files.
Note that the jar tool does not read/write these attributes. This change is more visible to tools like unzip where these attributes are preserved.
See JDK-8218021
Other Notes
client-libs/2d
➜ Oracle JDK11u for Solaris Now Requires harfbuzz to be Installed
Oracle JDK-11.0.10 and later for Solaris 11 requires that
the OS provide the package library/desktop/harfbuzz as part of the
system installation. This package is provided for Solaris 11.3 and later.
$ pkg info harfbuzz
       Name: library/desktop/harfbuzz
     Summary: HarfBuzz is an OpenType text shaping engine
   Description: HarfBuzz is a library for text shaping, which converts
          unicode text to glyph indices and positions. HarfBuzz is
          used directly by libraries such as Pango, and the layout
          engines in firefox.
     Category: Desktop (GNOME)/Libraries
      State: Installed
    Publisher: solaris
This is a desktop library, but the font processing it does is part of some common backend server workloads. It should always be considered as required.
If this library is missing, then the pkg mechanism will require it during installation of the JDK.
If installing the JDK by using a tar.gz bundle (for example) and the library/desktop/harfbuzz package is missing, a runtime link failure will occur when this package is needed.
JDK-8251907 (not public)
core-libs/java.time
➜




    
 JDK time-zone data upgraded to tzdata2020d
The JDK update incorporates tzdata2020d. The main change is
Palestine ends DST earlier than predicted, on 2020-10-24.
Please refer to https://mm.icann.org/pipermail/tz-announce/2020-October/000062.html for more information.
See JDK-8255226
core-libs/java.time
➜ JDK time-zone data upgraded to tzdata2020c
The JDK update incorporates tzdata2020c. The main change is
Fiji starts DST later than usual, on 2020-12-20.
Please refer to https://mm.icann.org/pipermail/tz-announce/2020-October/000060.html for more information.
See JDK-8254982
core-libs/java.time
➜ US/Pacific-New Zone Name Removed as Part of tzdata2020b
Following the JDK's update to tzdata2020b, the long-obsolete files named pacificnew and systemv have been removed. As a result, the "US/Pacific-New" Zone name declared in the pacificnew data file is no longer available for use.
Information regarding this update can be viewed at https://mm.icann.org/pipermail/tz-announce/2020-October/000059.html
See JDK-8254177
Java™ SE Development Kit 11.0.9 (JDK 11.0.9)

October 20, 2020
The full version string for this update release is 11.0.9+7 (where "+" means "build"). The version number is 11.0.9.
IANA Data 2020a

JDK 11.0.9 contains IANA time zone data version 2020a. For more information, refer to Timezone Data Versions in the JRE Software.
Security Baselines

The security baselines for the Java Runtime Environment (JRE) at the  time of the release of JDK 11.0.9 are specified in the following table:
Keeping the JDK up to Date

Oracle recommends that the JDK is updated with each Critical Patch Update (CPU).  In order to determine if a release is the latest, the Security Baseline page can be used to determine which is the latest version for each release family.
Critical patch updates, which contain security vulnerability fixes, are announced one year in advance on Critical Patch Updates, Security Alerts and Bulletins. It is not recommended that this JDK (version 11.0.9) be used after the next critical patch update scheduled for January 19, 2021. 
New Features
security-libs/java.security
➜ Weak Named Curves in TLS, CertPath, and Signed JAR Disabled by Default
Weak named curves are disabled by default by adding them to the following disabledAlgorithms security properties: jdk.tls.disabledAlgorithms,  jdk.certpath.disabledAlgorithms, and jdk.jar.disabledAlgorithms.  The named curves are listed below.
With 47 weak named curves to be disabled, adding individual named curves to each disabledAlgorithms property would be overwhelming. To relieve this, a new security property, jdk.disabled.namedCurves, is implemented that can list the named curves common to all of the disabledAlgorithms properties. To use the new property in the disabledAlgorithms properties, precede the full property name with the keyword include.  Users can still add individual named curves to disabledAlgorithms properties separate from this new property.  No other properties can be included in the disabledAlgorithms properties.
To restore the named curves, remove the include jdk.disabled.namedCurves either from specific or from all  disabledAlgorithms security properties.
To restore one or more curves, remove the specific named curve(s) from the jdk.disabled.namedCurves property.
Curves that are disabled through jdk.disabled.namedCurves include the following:
secp112r1, secp112r2, secp128r1, secp128r2, secp160k1, secp160r1, secp160r2, secp192k1, secp192r1, secp224k1,  secp224r1, secp256k1, sect113r1, sect113r2, sect131r1, sect131r2, sect163k1, sect163r1, sect163r2, sect193r1, sect193r2, sect233k1, sect233r1, sect239k1, sect283k1, sect283r1, sect409k1, sect409r1, sect571k1, sect571r1, X9.62 c2tnb191v1, X9.62 c2tnb191v2, X9.62 c2tnb191v3, X9.62 c2tnb239v1, X9.62 c2tnb239v2, X9.62 c2tnb239v3, X9.62 c2tnb359v1, X9.62 c2tnb431r1, X9.62 prime192v2, X9.62 prime192v3,  X9.62 prime239v1, X9.62 prime239v2, X9.62 prime239v3, brainpoolP256r1, brainpoolP320r1, brainpoolP384r1, brainpoolP512r1
Curves that remain enabled are:  secp256r1, secp384r1, secp521r1, X25519, X448
See JDK-8233228
security-libs/org.ietf.jgss:krb5
➜ Support for Kerberos Cross-Realm Referrals (RFC 6806)
The Kerberos client has been enhanced with the support of principal name canonicalization and cross-realm referrals, as defined by the RFC 6806 protocol extension.
As a result of this new feature, the Kerberos client can take advantage of more dynamic environment configurations and does not necessarily need to know (in advance) how to reach the realm of a target principal (user or service).
Support is enabled by default and 5 is the maximum number of referral hops allowed. To turn it off, set the sun.security.krb5.disableReferrals security or system property to false. To configure a custom maximum number of referral hops, set the sun.security.krb5.maxReferrals security or system property to any positive value.
See further information in JDK-8223172.
See JDK-8215032
security-libs/javax.net.ssl
➜ Improve Certificate Chain Handling
A new system property, jdk.tls.maxHandshakeMessageSize, has been added to set the maximum allowed size for the handshake message in TLS/DTLS handshaking. The default value of the system property is 32768  (32 kilobytes).
A new system property, jdk.tls.maxCertificateChainLength, has been added to set the maximum allowed length of the certificate chain in TLS/DTLS handshaking. The default value of the system property is 10.
JDK-8245417 (not public)
security-libs/java.security
➜ Tools Warn If Weak Algorithms Are Used
The keytool and jarsigner tools have been updated to warn users when weak cryptographic algorithms are used in keys, certificates, and signed JARs before they are disabled. The weak algorithms are set in the jdk.security.legacyAlgorithms security property in the java.security configuration file. In this release, the tools issue warnings for the SHA-1 hash algorithm and 1024-bit RSA/DSA keys.
See JDK-8172404
security-libs/org.ietf.jgss:krb5
➜ Support for canonicalize in krb5.conf
The 'canonicalize' flag in the krb5.conf file is now supported by the JDK Kerberos implementation. When set to true, RFC 6806 name canonicalization is requested by clients in TGT requests to KDC services (AS protocol). Otherwise, and by default, it is not requested.
The new default behavior is different from JDK 14 and previous releases where name canonicalization was always requested by clients in TGT requests to KDC services (provided that support for RFC 6806 was not explicitly disabled with the sun.security.krb5.disableReferrals system or security properties).
See JDK-8239385
Other notes
core-libs/javax.naming
➜ Added Property to Control LDAP Authentication Mechanisms Allowed to Authenticate Over Clear Connections
A new environment property,
jdk.jndi.ldap.mechsAllowedToSendCredentials, has been added to
control which LDAP authentication mechanisms are allowed to send
credentials over clear LDAP connections - a connection not secured
with TLS. An encrypted LDAP connection is a connection opened
by using ldaps scheme, or a connection opened by using ldap scheme
and then upgraded to TLS with a STARTTLS extended operation.
The value of the property, which is by default not set, is a comma
separated list of the mechanism names that are permitted to authenticate
over a clear connection. If a value is not specified for the property, then all mechanisms
are allowed. If the specified value is an empty list, then no mechanisms are
allowed (except  for none and anonymous). The default value for this property is 'null'
( i.e. System.getProperty("jdk.jndi.ldap.mechsAllowedToSendCredentials") returns 'null'). To explicitly permit all mechanisms to authenticate over a clear connection, the property
value can be set to "all". If a connection is downgraded from
encrypted to clear, then only the mechanisms that are explicitly permitted are allowed.
The property can be supplied to the LDAP context environment map, or
set globally as a system property. When both are supplied, the
environment map takes precedence.
Note: none and anonymous authentication mechanisms are exempted
from these rules and are always allowed regardless of the property value.
JDK-8237990 (not public)
security-libs/java.security
➜ Added 3 SSL Corporation Root CA Certificates
The following root certificates have been added to the cacerts truststore:
+ SSL Corporation
  + sslrootrsaca
    DN: CN=SSL.com Root Certification Authority RSA, O=SSL Corporation, L=Houston, ST=Texas, C=US
  + sslrootevrsaca
    DN: CN=SSL.com EV Root Certification Authority RSA R2, O=SSL Corporation, L=Houston, ST=Texas, C=US
  + sslrooteccca
    DN: CN=SSL.com Root Certification Authority ECC, O=SSL Corporation, L=Houston, ST=Texas, C=US
See JDK-8243320
security-libs/java.security
➜ Added Entrust Root Certification Authority - G4 certificate

The following root certificate has been added to the cacerts truststore:
+ Entrust
  + entrustrootcag4
    DN: CN=Entrust Root Certification Authority - G4, OU="(c) 2015 Entrust, Inc. - for authorized use only", 
    OU=See www.entrust.net/legal-terms, O="Entrust, Inc.", C=US
See JDK-8243321
core-libs/java.util:i18n
➜ Localized Time Zone Name Inconsistency Between English and Other Locales
English time zone names provided by the CLDR locale provider are now correctly synthesized following the CLDR spec, rather than substituted from the COMPAT provider. For example, SHORT style names are no longer synthesized abbreviations of LONG style names, but instead produce GMT offset formats.
See JDK-8236548
core-libs/java.io:serialization
➜ Enhanced Support of Proxy Class
The deserialization of java.lang.reflect.Proxy objects can be limited by setting the system property jdk.serialProxyInterfaceLimit.
The limit is the maximum number of interfaces allowed per Proxy in the stream.
Setting the limit to zero prevents any Proxies from being deserialized including Annotations, a limit of less than 2 might interfere with RMI operations.
JDK-8236862 (not public)
Bug Fixes

This release also contains fixes for security vulnerabilities described in the Oracle Critical Patch Update. For a more complete list of the bug fixes included in this release, see the JDK 11.0.9 Bug Fixes page.
security-libs
java.security
Unexpected NoSuchAlgorithmException when using secure random impl from BCFIPS provider
8247925 (Confidential)
JDK8u251- XSL transformer fails with TransformerConfigurationException
Java™ SE Development Kit 11.0.8 (JDK 11.0.8)

July 14, 2020
The full version string for this update release is 11.0.8+10 (where "+" means "build"). The version number is 11.0.8.
IANA Data 2020a

JDK 11.0.8 contains IANA time zone data version 2020a. For more information, refer to Timezone Data Versions in the JRE Software.
Security Baselines

The security baselines for the Java Runtime Environment (JRE) at the  time of the release of JDK 11.0.8 are specified in the following table:
Keeping the JDK up to Date

Oracle recommends that the JDK is updated with each Critical Patch Update (CPU).  In order to determine if a release is the latest, the Security Baseline page can be used to determine which is the latest version for each release family.
Critical patch updates, which contain security vulnerability fixes, are announced one year in advance on Critical Patch Updates, Security Alerts and Bulletins. It is not recommended that this JDK (version 11.0.8) be used after the next critical patch update scheduled for October 20, 2020. 
New Features
security-libs/javax.net.ssl
➜ New System Properties to Configure the TLS Signature Schemes 

Two new System Properties are added to customize the TLS signature schemes in JDK.  jdk.tls.client.SignatureSchemes is added for TLS client side, and jdk.tls.server.SignatureSchemes for server side.
Each System Property contains a comma-separated list of supported signature scheme names, which specifying the signature schemes that could be used for the TLS connections.
The names are described in the "Signature Schemes" section of the Java Security Standard Algorithm Names Specification.
See JDK-8242141
security-libs/javax.xml.crypto
➜ Apache Santuario Library Updated to Version 2.1.4 

The Apache Santuario library has been upgraded to version 2.1.4. As a result, a new system property com.sun.org.apache.xml.internal.security.parser.pool-size has been introduced.




    

This new system property sets the pool size of the internal DocumentBuilder cache used when processing XML Signatures. The function is equivalent to the org.apache.xml.security.parser.pool-size system property used in Apache Santuario and has the same default value of 20.
See JDK-8231507
infrastructure
➜ Toolchain Upgrade to Xcode 10.1 

Build Environment Update for macOS Moved to Xcode 10.1 On macOS, the toolchain used to build the JDK has been upgraded from Xcode 4.5 to Xcode 10.1.
JDK-8232007 (not public)
install/install
➜ Oracle JDK Installer for Windows Provides Executables (javac, etc) in a Path Reachable From Any Command Prompt
The Oracle JDK installer for Windows provides java.exe, javaw.exe, javac.exe, and jshell.exe commands in a system location so that users can run Java applications without needing to provide the path to the Oracle JDK's installation folder.
JDK-8222383 (not public)
Removed Features and Options
security-libs/java.security
➜ Removal of Comodo Root CA Certificate 

The following expired Comodo root CA certificate was removed from the cacerts keystore:
alias name "addtrustclass1ca [jdk]"
Distinguished Name: CN=AddTrust Class 1 CA Root, OU=AddTrust TTP Network, O=AddTrust AB, C=SE
See JDK-8225069
security-libs/java.security
➜ Removal of DocuSign Root CA Certificate 

The following expired DocuSign root CA certificate was removed from the cacerts keystore:
alias name "keynectisrootca [jdk]"
Distinguished Name: CN=KEYNECTIS ROOT CA, OU=ROOT, O=KEYNECTIS, C=FR
See JDK-8225068
Other notes
core-libs/java.io:serialization
➜ Improved Serialization Handling
When setting a serialization filter by using java.io.ObjectInputStream.setObjectInputFilter the method must be called before reading any objects from the stream. If the methods readObject or readUnshared are called, the setObjectInputFilter method throws IllegalStateException.
JDK-8234836 (not public)
core-libs/java.util:collections
➜ Better Listing of Arrays 

The preferred way to copy a collection is to use a "copy constructor." For example, to copy a collection into a new ArrayList, one would write new ArrayList<>(collection). In certain circumstances, an additional, temporary copy of the collection's contents might be made in order to improve robustness. If the collection being copied is exceptionally large, then the application should be (aware of/monitor) the significant resources required involved in making the copy.
JDK-8231800 (not public)
security-libs/javax.net.ssl
➜ Default SSLEngine Should Create in Server Role 

In JDK 11 and later, javax.net.ssl.SSLEngine by default used client mode when handshaking. As a result, the set of default enabled protocols may differ to what is expected. SSLEngine would usually be used in server mode. From this JDK release onwards, SSLEngine will default to server mode. The javax.net.ssl.SSLEngine.setUseClientMode​(boolean mode) method may be used to configure the mode.
See JDK-8237474
core-svc/java.lang.management
➜ OperatingSystemMXBean Methods Inside a Container Return Container Specific Data 

When executing in a container, or other virtualized operating environment, the following OperatingSystemMXBean methods in this release return container specific information, if available. Otherwise, they return host specific data:
getFreePhysicalMemorySize()

getTotalPhysicalMemorySize()
getFreeSwapSpaceSize()
getTotalSwapSpaceSize()
getSystemCpuLoad()
See JDK-8226575
security-libs
➜ Default SSL Session Cache Size Updated to 20480 

The default SSL session cache size has been updated to 20480 in this JDK release
See JDK-8210985
client-libs/javax.swing
➜ Deprecated NSWindowStyleMaskTexturedBackground 

After an upgrade of the macOS SDK used to build the JDK, the behavior of the apple.awt.brushMetalLook and textured Swing properties has changed. When these properties are set, the title of the frame is still visible. It is recommended that the apple.awt.transparentTitleBar property be set to true to make the title of the frame invisible again. The apple.awt.fullWindowContent property can also be used.
Please note that Textured window support was implemented by using the NSTexturedBackgroundWindowMask value of NSWindowStyleMask. However, this was deprecated in macOS 10.12 along with NSWindowStyleMaskTexturedBackground, which was deprecated in macOS 10.14.
For additional information, refer to the following documentation:
apple.awt.brushMetalLook 
apple.awt.transparentTitleBar
apple.awt.fullWindowContent
See JDK-8240995
Bug Fixes

This release also contains fixes for security vulnerabilities described in the Oracle Critical Patch Update.
➜ Issues fixed in 11.0.8:
 1 JDK-6933331 client-libs 2d (d3d/ogl) java.lang.IllegalStateException: Buffers have not been created   2 JDK-8196181 client-libs 2d sun/java2d/GdiRendering/InsetClipping.java fails   3 JDK-8209113 client-libs 2d Use WeakReference for lastFontStrike for created Fonts   4 JDK-8214481 client-libs 2d freetype path does not disable TrueType hinting with AA+FM hints   5 JDK-8224109 client-libs 2d Text spaced incorrectly by drawString under rotation with fractional metrics   6 JDK-8234398 client-libs 2d Replace ID2D1Factory::GetDesktopDpi with GetDeviceCaps   7 JDK-8235904 client-libs 2d Infinite loop when rendering huge lines   8 JDK-8236996 client-libs 2d Incorrect Roboto font rendering on Windows with subpixel antialiasing   9 JDK-8239091 client-libs 2d Reversed arguments in call to strstr in freetype "debug" code.   10 JDK-8176359 client-libs java.awt Frame#setMaximizedbounds not working properly in multi screen environments   11 JDK-8196019 client-libs java.awt java/awt/Window/Grab/GrabTest.java fails on Windows   12 JDK-8211301 client-libs java.awt [macos] support full window content options   13 JDK-8225126 client-libs java.awt Test SetBoundsPaintTest.html failed on Windows when desktop is scaled   14 JDK-8226806 client-libs java.awt [macOS 10.14] Methods of Java Robot should be called from appropriate thread   15 JDK-8231438 client-libs java.awt [macOS] Dark mode for the desktop is not supported   16 JDK-8231564 client-libs java.awt setMaximizedBounds is broken with large display scale and multiple monitors   17 JDK-8233573 client-libs java.awt Toolkit.getScreenInsets(GraphicsConfiguration) may throw ClassCastException   18 JDK-8233707 client-libs java.awt systemScale.cpp could not compile with VS2019   19 JDK-8234107 client-libs java.awt Several AWT modal dialog tests failing on Linux after JDK-8231991   20 JDK-8237221 client-libs java.awt [macos] java/awt/MenuBar/SeparatorsNavigation/SeparatorsNavigation.java fails   21 JDK-8238575 client-libs java.awt DragSourceEvent.getLocation() returns wrong value on HiDPI screens (Windows)   22 JDK-8242174 client-libs java.awt [macos] The NestedModelessDialogTest test make the macOS unstable   23 JDK-8242498 client-libs java.awt Invalid "sun.awt.TimedWindowEvent" object leads to JVM crash   24 JDK-8226253 client-libs javax.accessibility JAWS reports wrong number of radio buttons when buttons are hidden   25 JDK-8238842 client-libs javax.imageio AIOOBE in GIFImageReader.initializeStringTable   26 JDK-8221445 client-libs javax.sound FastSysexMessage constructor crashes MIDI receiption thread   27 JDK-8040630 client-libs javax.swing Popup menus and tooltips flicker with previous popup contents when first shown   28 JDK-8198339 client-libs javax.swing Test javax/swing/border/Test6981576.java is unstable   29 JDK-8183369 core-libs java.net RFC unconformity of HttpURLConnection with proxy   30 JDK-8210147 core-libs java.net adjust some WSAGetLastError usages in windows network coding   31 JDK-8232854 core-libs java.net URLClassLoader.close() doesn't close cached JAR file on Windows when load() fails   32 JDK-8044365 core-libs java.nio (dc) MulticastSendReceiveTests.java failing with ENOMEM when joining group (OS X 10.9)   33 JDK-8221531 core-libs java.nio Incorrect copyright header in src/java.base/windows/native/libnio/ch/FileChannelImpl.c    34 JDK-8205399 core-libs java.util:collections Set node color on pinned HashMap.TreeNode deletion   35 JDK-8160768 core-libs javax.naming Add capability to custom resolve host/domain names within the default JNDI LDAP provider   36 JDK-8214440 core-libs javax.naming ldap over a TLS connection negotiate failed with "javax.net.ssl.SSLPeerUnverifiedException: hostname of the server '' does not match the hostname in the server's certificate"   37 JDK-8217606 core-libs javax.naming LdapContext#reconnect always opens a new connection   38 JDK-8240523 core-libs javax.naming JCK Test Case api/modulegraph/index.html#ModuleGraphTest failed in CI   39 JDK-8193879 core-svc debugger Java debugger hangs on method invocation   40 JDK-8239055 core-svc debugger Wrong implementation of VMState.hasListener   41 JDK-8206179 core-svc javax.management com/sun/management/OperatingSystemMXBean/GetCommittedVirtualMemorySize.java fails with Committed virtual memory size illegal value   42 JDK-8132849 hotspot compiler Increased stop time in cleanup phase because of single-threaded walk of thread stacks in NMethodSweeper::mark_active_nmethods()   43 JDK-8156207 hotspot compiler Resource allocated BitMaps are often cleared unnecessarily   44 JDK-8163511 hotspot compiler Allocation of compile task fails with assert: "Leaking compilation tasks?"   45 JDK-8187078 hotspot compiler -XX:+VerifyOops finds numerous problems when running JPRT   46 JDK-8208277 hotspot compiler Code cache heap (-XX:ReservedCodeCacheSize) doesn't work with 1GB LargePages   47 JDK-8209420 hotspot compiler Track membars for volatile accesses so they can be properly optimized   48 JDK-8209439 hotspot compiler C2 library_call can potentially ignore Math.pow intrinsic or use null pointer   49 JDK-8209684 hotspot compiler Intrinsics that assume some input non null should use GraphKit::must_be_not_null()   50 JDK-8209686 hotspot compiler cleanup arguments to PhaseIdealLoop() constructor   51 JDK-8210284 hotspot compiler "assert((av & 0x00000001) == 0) failed: unsupported V8" on Solaris 11.4   52 JDK-8210389 hotspot compiler C2: assert(n->outcnt() != 0 || C->top() == n || n->is_Proj()) failed: No dead instructions after post-alloc   53 JDK-8211129 hotspot compiler compiler/whitebox/ForceNMethodSweepTest.java fails after JDK-8132849   54 JDK-8211233 hotspot compiler MemBarNode::trailing_membar() and MemBarNode::leading_membar() need to handle dying subgraphs better   55 JDK-8211332 hotspot compiler code_size2 (defined in stub_routines_x86.hpp) is too small on new Skylake CPUs   56 JDK-8211740 hotspot compiler [AOT] -XX:AOTLibrary doesn't accept windows path   57 JDK-8211743 hotspot compiler [AOT] crash in ScopeDesc::decode_body() when JVMTI walks AOT frames    58 JDK-8214344 hotspot compiler C2: assert(con.basic_type() != T_ILLEGAL) failed: elembt=byte; loadbt=void; unsigned=0   59 JDK-8214444 hotspot compiler Wrong strncat limits in dfa.cpp   60 JDK-8214857 hotspot compiler "bad trailing membar" assert failure at memnode.cpp:3220   61 JDK-8214862 hotspot compiler assert(proj != __null) at compile.cpp:3251   62 JDK-8215551 hotspot compiler Missing case label in nmethod::reloc_string_for()   63 JDK-8215555 hotspot compiler TieredCompilation C2 threads can excessively block handshakes   64 JDK-8216151 hotspot compiler [Graal] Module jdk.internal.vm.compiler.management has not been granted accessClassInPackage.org.graalvm.compiler.debug   65 JDK-8216154 hotspot compiler C4819 warnings at HotSpot sources on Windows   66 JDK-8216541 hotspot compiler CompiledICHolders of VM locked unloaded nmethods are released too late   67 JDK-8217230 hotspot compiler assert(t == t_no_spec) failure in NodeHash::check_no_speculative_types()    68 JDK-8217447 hotspot compiler Develop flag TraceICs is broken   69 JDK-8219214 hotspot compiler Infinite Loop in CodeSection::dump()   70 JDK-8219919 hotspot compiler RuntimeStub's name lost with PrintFrameConverterAssembly   71 JDK-8220341 hotspot compiler Class redefinition fails with assert(!is_unloaded()) failed: unloaded method on the stack   72 JDK-8221482 hotspot compiler Initialize VMRegImpl::regName[] earlier to prevent assert during PrintStubCode   73 JDK-8221782 hotspot compiler [Graal] Module jdk.internal.vm.compiler.management has not been granted accessClassInPackage.jdk.vm.ci.services   74 JDK-8225567 hotspot compiler Wrong file headers with 8202414 fix changeset   75 JDK-8225783 hotspot compiler Incorrect use of binary operators on booleans in type.cpp   76 JDK-8226198 hotspot compiler use of & instead of && in LibraryCallKit::arraycopy_restore_alloc_state   77 JDK-8226879 hotspot compiler Memory leak in Type::hashcons   78 JDK-8227034 hotspot compiler Graal crash with gcbasher   79 JDK-8227632 hotspot compiler Incorrect PrintCompilation message: made not compilable on levels 0 1 2 3 4    80 JDK-8229855 hotspot compiler C2 fails with assert(false) failed: bad AD file   81 JDK-8231515 hotspot compiler [Graal] Crash during exception throwing in InterpreterRuntime::resolve_invoke   82 JDK-8232106 hotspot compiler [x86] C2: SIGILL due to usage of SSSE3 instructions on processors which don't support it   83 JDK-8233019 hotspot compiler java.lang.Class.isPrimitive() (C1) returns wrong result if Klass* is aligned to 32bit   84 JDK-8233364 hotspot compiler Fix undefined behavior in Canonicalizer::do_ShiftOp   85 JDK-8235332 hotspot compiler TestInstanceCloneAsLoadsStores.java fails with -XX:+StressGCM   86 JDK-8235762 hotspot compiler JVM crash in SWPointer during C2 compilation   87 JDK-8235984 hotspot compiler C2: assert(out->in(PhiNode::Region) == head || out->in(PhiNode::Region) == slow_head) failed: phi must be either part of the slow or the fast loop   88 JDK-8236285 hotspot compiler [JVMCI] improve TranslatedException traces   89 JDK-8236709 hotspot compiler struct SwitchRange in HS violates C++ One Definition Rule   90 JDK-8236759 hotspot compiler ShouldNotReachHere in PhaseIdealLoop::verify_strip_mined_scheduling   91 JDK-8237045 hotspot compiler JVM uses excessive memory with -XX:+EnableJVMCI -XX:JVMCICounterSize=2147483648   92 JDK-8237086 hotspot compiler assert(is_MachReturn()) running CTW with fix for JDK-8231291   93 JDK-8237375 hotspot compiler SimpleThresholdPolicy misses CounterDecay timestamp initialization   94 JDK-8237945 hotspot compiler CTW: C2 compilation fails with assert(just_allocated_object(alloc_ctl) == ptr) failed: most recent allo   95 JDK-8237951 hotspot compiler CTW: C2 compilation fails with "malformed control flow"   96 JDK-8238190 hotspot compiler [JVMCI] Fix single implementor speculation for diamond shapes.   97 JDK-8238356 hotspot compiler CodeHeap::blob_count() overestimates the number of blobs   98 JDK-8238438 hotspot compiler SuperWord::co_locate_pack picks memory state of first instead of last load   99 JDK-8238756 hotspot compiler C2: assert(((n) == __null || !VerifyIterativeGVN || !((n)->is_dead()))) failed: can not use dead node   100 JDK-8238765 hotspot compiler PhaseCFG::schedule_pinned_nodes cannot handle precedence edges from unmatched CFG nodes correctly   101 JDK-8238811 hotspot compiler C2: assert(i >= req() || i == 0 || is_Region() || is_Phi()) with -XX:+VerifyGraphEdges   102 JDK-8239142 hotspot compiler C2's UseUniqueSubclasses optimization is broken for array accesses   103 JDK-8239456 hotspot compiler [win][x86] vtable stub generation: assert failure (code size estimate)   104 JDK-8239852 hotspot compiler java/util/concurrent tests fail with -XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed: verification should have failed   105 JDK-8239931 hotspot compiler [win][x86] vtable stub generation: assert failure (code size estimate) follow-up   106 JDK-8240220 hotspot compiler IdealLoopTree::dump_head predicate printing is broken   107 JDK-8240223 hotspot compiler Use consistent predicate order in and with PhaseIdealLoop::find_predicate   108 JDK-8240576 hotspot compiler JVM crashes after transformation in C2 IdealLoopTree::merge_many_backedges   109 JDK-8240831 hotspot compiler [JVMCI] Export missing vmStructs entries used by JVMCI compilers   110 JDK-8240905 hotspot compiler assert(mem == (Node*)1 || mem == mem2) failed: multiple Memories being matched at once?   111 JDK-8240976 hotspot compiler [JVMCI] MethodProfileWidth flag is broken   112 JDK-8241556 hotspot compiler Memory leak if -XX:CompileCommand is set   113 JDK-8241900 hotspot compiler Loop unswitching may cause dependence on null check to be lost   114 JDK-8242108 hotspot compiler Performance regression after fix for JDK-8229496   115 JDK-8242357 hotspot compiler [JVMCI] Incorrect use of JVMCI_CHECK_ on return statement   116 JDK-8243467 hotspot compiler [BACKOUT] JDK-8132849 and JDK-8211129 from 11.0.8-oracle   117 JDK-8204834 hotspot gc Fix confusing "allocate" naming in OopStorage   118 JDK-8221534 hotspot gc Incorrect copyright header in src/jdk.hotspot.agent/share/classes/sun/jvm/hotspot/gc/z/ZPageTableEntry.java    119 JDK-8231779 hotspot gc crash HeapWord*ParallelScavengeHeap::failed_mem_allocate   120 JDK-8189633 hotspot runtime Missing -Xcheck:jni checking for DeleteWeakGlobalRef   121 JDK-8203911 hotspot runtime Test runtime/modules/getModuleJNI/GetModule fails with -Xcheck:jni   122 JDK-8209850 hotspot runtime Allow NamedThreads to use GlobalCounter critical sections   123 JDK-8209976 hotspot runtime Improve iteration over non-JavaThreads   124 JDK-8210303 hotspot runtime VM_HandshakeAllThreads fails assert with "failed: blocked and not walkable"   125 JDK-8212933 hotspot runtime Thread-SMR: requesting a VM operation whilst holding a ThreadsListHandle can cause deadlocks   126 JDK-8213250 hotspot runtime CDS archive creation aborts due to metaspace object allocation failure    127 JDK-8219241 hotspot runtime Provide basic virtualization related info in the hs_error file on linux/windows x86_64   128 JDK-8219562 hotspot runtime Line of code in osContainer_linux.cpp#L102 appears unreachable   129 JDK-8222720 hotspot runtime Provide extended VMWare/vSphere virtualization related info in the hs_error file on linux/windows x86_64   130 JDK-8224793 hotspot runtime os::die() does not honor CreateCoredumpOnCrash option   131 JDK-8240529 hotspot runtime CheckUnhandledOops breaks NULL check in Modules::define_module   132 JDK-8241296 hotspot runtime Segfault in JNIHandleBlock::oops_do()   133 JDK-8241464 hotspot runtime [11u] Backport: make rehashing be a needed guaranteed safepoint cleanup action   134 JDK-8241660 hotspot runtime Add virtualization information output to hs_err file on macOS   135 JDK-8237589 other-libs other Fix copyright header formatting   136 JDK-7092821 security-libs java.security java.security.Provider.getService() is synchronized and became scalability bottleneck   137 JDK-8228613 security-libs java.security java.security.Provider#getServices order is no longer deterministic   138 JDK-8231387 security-libs java.security java.security.Provider.getService returns random result due to race condition with mutating methods in the same class   139 JDK-8238452 security-libs java.security Keytool generates wrong expiration date if validity is set to 2050/01/01   140 JDK-8246613 security-libs java.security Choose the default SecureRandom algo based on registration ordering   141 JDK-8240983 security-libs javax.crypto Incorrect copyright header in Apache Santuario 2.1.3 files   142 JDK-8238898 security-libs javax.crypto:pkcs11 Missing hash characters for header on license file   143 JDK-8209333 security-libs javax.net.ssl Socket reset issue for TLS 1.3 socket close    144 JDK-8211339 security-libs javax.net.ssl NPE during SSL handshake caused by HostnameChecker   145 JDK-8215711 security-libs javax.net.ssl Missing key_share extension for (EC)DHE key exchange should alert missing_extension   146 JDK-8223482 security-libs javax.net.ssl Unsupported ciphersuites may be offered by a TLS client   147 JDK-8223940 security-libs javax.net.ssl Private key not supported by chosen signature algorithm   148 JDK-8233621 security-libs javax.net.ssl Mismatch in jsse.enableMFLNExtension property name   149 JDK-8235874 security-libs javax.net.ssl The ordering of Cipher Suites is not maintained provided through “jdk.tls.client.cipherSuites” and “jdk.tls.server.cipherSuites” system property.   150 JDK-8236039 security-libs javax.net.ssl JSSE Client does not accept status_request extension in CertificateRequest messages for TLS 1.3   151 JDK-8239798 security-libs javax.net.ssl SSLSocket closes socket both socket endpoints on a SocketTimeoutException   152 JDK-8242294 security-libs javax.net.ssl JSSE Client does not throw SSLException when an alert occurs during handshaking   153 JDK-8246031 security-libs javax.net.ssl SSLSocket.getSession() doesn't close connection for timeout/ interrupts   154 JDK-8163251 security-libs javax.smartcardio Hard coded loop limit prevents reading of smart card data greater than 8k   155 JDK-8210197 tools javac javac can't tell during speculative attribution if a diamond expression is creating an anonymous inner class or not   156 JDK-8213908 tools javac AssertionError in DeferredAttr at setOverloadKind   157 JDK-8214345 tools javac infinite recursion while checking super class   158 JDK-8218268 tools javac Javac treats Manifest Class-Path entries as Paths instead of URLs   159 JDK-8200432 tools javadoc(tool) javadoc fails with ClassCastException on {@link byte[]}   160 JDK-8212233 tools javadoc(tool) javadoc fails on jdk12 with "The code being documented uses modules but the packages defined in $URL are in the unnamed module."   161 JDK-8214856 tools javadoc(tool) Errors with JSZip in web console after upgrade to 3.1.5   162 JDK-8236700 tools javadoc(tool) Upgrading JSZip from v3.1.5 to v3.2.2   163 JDK-8216261 tools javap Javap ignores default modifier on interfaces   164 JDK-8217093 tools launcher Support extended-length paths in parse_manifest.c on Windows   165 JDK-8240629 tools launcher argfiles parsing broken for argfiles with comment cross 4096 bytes chunk   166 JDK-8221533 xml jaxp Incorrect copyright header in DurationDayTimeImpl.java, DurationYearMonthImpl.java and XMLStreamException.java   167 JDK-8242470 xml jaxp Update Xerces to Version 2.12.1 
Java SE 11.0.7 Advanced - Bundled Patch Release (BPR) - Bug Fixes and Updates
The following sections summarize changes made in all Java SE 11.0.7 BPR releases. The BPR releases are listed below in date order, most current BPR first. Note that bug fixes in previous BPRs are also included in the current BPR.




    

Changes in Java SE 11.0.7.0.1-oracle
Please note that fixes from the prior BPR are included in this version.
Java™ SE Development Kit 11.0.7 (JDK 11.0.7)

April 14, 2020
The full version string for this update release is 11.0.7+8 (where "+" means "build"). The version number is 11.0.7.
IANA Data 2019c

JDK 11.0.7 contains IANA time zone data version 2019c. For more information, refer to Timezone Data Versions in the JRE Software.
Security Baselines

The security baselines for the Java Runtime Environment (JRE) at the  time of the release of JDK 11.0.7 are specified in the following table:
Keeping the JDK up to Date

Oracle recommends that the JDK is updated with each Critical Patch Update (CPU).  In order to determine if a release is the latest, the Security Baseline page can be used to determine which is the latest version for each release family.
Critical patch updates, which contain security vulnerability fixes, are announced one year in advance on Critical Patch Updates, Security Alerts and Bulletins. It is not recommended that this JDK (version 11.0.7) be used after the next critical patch update scheduled for July 14, 2020.  
New Features
security-libs/javax.crypto
  ➜   Support for MS Cryptography Next Generation (CNG) 

The SunMSCAPI provider now supports reading private keys in Cryptography Next Generation (CNG) format. This means that RSA and EC keys in CNG format are loadable from Windows keystores, such as "Windows-MY". Signature algorithms related to EC (SHA1withECDSA, SHA256withECDSA, etc.) are also supported.
See JDK-8026953
Bug Fixes

This release also contains fixes for security vulnerabilities described in the Oracle Critical Patch Update. For a more complete list of the bug fixes included in this release, see the JDK 11.0.7 Bug Fixes page.
Java SE 11.0.6 Advanced - Bundled Patch Release (BPR) - Bug Fixes and Updates
The following sections summarize changes made in all Java SE 11.0.6 BPR releases. The BPR releases are listed below in date order, most current BPR first. Note that bug fixes in previous BPRs are also included in the current BPR.
 Changes in Java SE 11.0.6.0.2-oracle

Bug Fixes
client-libs
java.awt
[macos] Problem with backslashes on macOS/JIS keyboard: Java ignores system settings
8234786
client-libs
java.awt
Fix for JDK-8214578 breaks OS X 10.12 compatibility
Java™ SE Development Kit 11.0.6 (JDK 11.0.6)

January 14, 2020
The full version string for this update release is 11.0.6+8 (where "+" means "build"). The version number is 11.0.6.
IANA Data 2019c

JDK 11.0.6 contains IANA time zone data version 2019c. For more information, refer to Timezone Data Versions in the JRE Software.
Security Baselines

The security baselines for the Java Runtime Environment (JRE) at the  time of the release of JDK 11.0.6 are specified in the following table:
Keeping the JDK up to Date

Oracle recommends that the JDK is updated with each Critical Patch Update (CPU).  In order to determine if a release is the latest, the Security Baseline page can be used to determine which is the latest version for each release family.
Critical patch updates, which contain security vulnerability fixes, are announced one year in advance on Critical Patch Updates, Security Alerts and Bulletins. It is not recommended that this JDK (version 11.0.6) be used after the next critical patch update scheduled for April 14, 2020.  
New Features
security-libs/javax.security
 ➜    Allow SASL Mechanisms to Be Restricted 

A security property named jdk.sasl.disabledMechanisms has been added that can be used to disable SASL mechanisms. Any disabled mechanism will be ignored if it is specified in the mechanisms argument of Sasl.createSaslClient or the mechanism argument of Sasl.createSaslServer. The default value for this security property is empty, which means that no mechanisms are disabled out-of-the-box.
See JDK-8200400
security-libs/javax.crypto:pkcs11
➜    SunPKCS11 Provider Upgraded with Support for PKCS#11 v2.40 

The SunPKCS11 provider has been updated with support for PKCS#11 v2.40. This version adds support for more algorithms such as the AES/GCM/NoPadding cipher, DSA signatures using SHA-2 family of message digests, and RSASSA-PSS signatures when the corresponding PKCS11 mechanisms are supported by the underlying PKCS11 library.
 
See JDK-8080462
Other notes
core-libs/java.rmi
➜ Improve Registry Support
The java.rmi.Remote marker interface identifies interfaces containing methods that can be invoked remotely by using the following specification:
Methods declared in interfaces that directly or indirectly extend java.rmi.Remote can be invoked remotely
Methods declared in interfaces that do not extend Remote directly or indirectly cannot be invoked remotely
This affects remote objects in the java.rmi.registry.Registry and any other remote object.
JDK-8230967 (not public)
security-libs/java.security
 ➜    New Checks on Trust Anchor Certificates

New checks have been added to ensure that trust anchors are CA certificates and contain proper extensions. Trust anchors are used to validate certificate chains used in TLS and signed code. Trust anchor certificates must include a Basic Constraints extension with the cA field set to true. Also, if they include a Key Usage extension, the keyCertSign bit must be set.
A new system property named jdk.security.allowNonCaAnchor has been introduced to restore the previous behavior, if necessary. If the property is set to the empty String or "true" (case-insensitive), trust anchor certificates can be used if they do not have proper CA extensions.
The default value of this property, if not set, is "false".
Note that the property does not apply to X.509 v1 certificates (since they don't support extensions).
This property is currently used by the JDK implementation. It is not guaranteed to be supported by other Java SE implementations.
 
JDK-8230318 (not public)
security-libs/java.security
 ➜    Exact Match Required for Trusted TLS Server Certificate 

A TLS server certificate must be an exact match of a trusted certificate on the client in order for it to be trusted when establishing a TLS connection.
 
JDK-8227758 (not public)
security-libs/java.security
  ➜    Added LuxTrust Global Root 2 Certificate 

The following root certificate has been added to the cacerts truststore:
hotspot/compiler
➜    Turn off AOT by Default and Change Related Flags to Experimental 

Following AOT support related flags have been made experimental: UseAOT, PrintAOT and AOTLibrary. Also default value of UseAOT has been changed from enabled to disabled.
See JDK-8227439
hotspot/gc
➜ Epsilon GC handled checked array stores incorrectly
Epsilon GC may have violated the specification requirements by accepting the type-incompatible store into the array, instead of throwing the ArrayStoreException. This is now handled correctly, both in this release, and associated backports. Users are advised to upgrade as soon as possible.
See JDK-8215724

Bug Fixes

The following are some of the notable bug fixes included in this release:
security-libs/javax.crypto:pkcs11
➜    Memory Growth Issue in SunPKCS11 Fixed 

A memory growth issue in the SunPKCS11 cryptographic provider that affects the NSS back-end has been fixed.

A system property, sun.security.pkcs11.disableKeyExtraction has been introduced to disable the fix. A "true" value disables the fix, while a "false" value (default) keeps it enabled.
When enabled, PKCS#11 attributes of the NSS native keys are copied to Java byte buffers after key creation. Once used, NSS keys are destroyed and native heap space is freed up. If NSS keys are required again, they are recreated with the previously saved attributes.
Further information and implementation details can be found in the CSR: JDK-8213430
  
See JDK-6913047
core-libs/java.io:serialization
 ➜    Better Serial Filter Handling 

The jdk.serialFilter system property can only be set on the command line. If the filter has not been set on the command line, it can be set can be set with java.io.ObjectInputFilter.Config.setSerialFilter. Setting the jdk.serialFilter with java.lang.System.setProperty has no effect.
   
JDK-8231422 (not public)
This release also contains fixes for security vulnerabilities described in the Oracle Critical Patch Update. For a more complete list of the bug fixes included in this release, see the JDK 11.0.6 Bug Fixes page.
Java SE 11.0.5 Advanced - Bundled Patch Release (BPR) - Bug Fixes and Updates
The following sections summarize changes made in all Java SE 11.0.5 BPR releases. The BPR releases are listed below in date order, most current BPR first. Note that bug fixes in previous BPRs are also included in the current BPR.
Changes in Java SE 11.0.5.0.3-oracle+1
Bug Fixes
Java™ SE Development Kit 11.0.5 (JDK 11.0.5)

October 15, 2019
The full version string for this update release is 11.0.5+10 (where "+" means "build"). The version number is 11.0.5.
IANA Data 2019b

JDK 11.0.5 contains IANA time zone data version 2019b. For more information, refer to Timezone Data Versions in the JRE Software.
Security Baselines

The security baselines for the Java Runtime Environment (JRE) at the  time of the release of JDK 11.0.5 are specified in the following table:
Keeping the JDK up to Date

Oracle recommends that the JDK is updated with each Critical Patch Update (CPU).  In order to determine if a release is the latest, the Security Baseline page can be used to determine which is the latest version for each release family.




    

Critical patch updates, which contain security vulnerability fixes, are announced one year in advance on Critical Patch Updates, Security Alerts and Bulletins. It is not recommended that this JDK (version 11.0.5) be used after the next critical patch update scheduled for January 14, 2020.
New Features
security-libs/java.security

➜New Java Flight Recorder (JFR) Security Events

Four new JFR events have been added to the security library area. These events are disabled by default and can be enabled via the JFR configuration files or via standard JFR options.
jdk.SecurityPropertyModification
Records Security.setProperty(String key, String value) method calls
jdk.TLSHandshake
Records TLS handshake activity. The event fields include:
Peer hostname
Peer port
TLS protocol version negotiated
TLS cipher suite negotiated
Certificate id of peer client
➜Using the JDK or JRE on macOS Catalina (10.15)

Changes introduced in macOS 10.15 (Catalina) have caused JCK test failures which will prevent Java from being supported on macOS 10.15.  If you still want to install and test then please see https://www.oracle.com/java/technologies/javase/jdk-jre-macos-catalina.html.

JDK-8230057 (not public)
security-libs/javax.net.ssl
➜Remove Obsolete NIST EC Curves from the Default TLS Algorithms

This change removes older non-NIST Suite B EC curves from the default Named Groups used during TLS negotiation. The curves removed are sect283k1, sect283r1, sect409k1, sect409r1, sect571k1, sect571r1, and secp256k1.
To re-enable these curves, use the jdk.tls.namedGroups system property. The property contains a comma-separated list within quotation marks of enabled named groups in preference order. For example:
java -Djdk.tls.namedGroups="secp256r1, secp384r1, secp521r1, sect283k1, sect283r1, sect409k1, 
sect409r1, sect571k1, sect571r1, secp256k1, ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192" ...