Sync from SUSE:SLFO:Main apache-commons-io revision 5932c427361ec4b7c7c97978af7f3614

apache-commons-io-build.xml

@@ -10,7 +10,7 @@
 
   <property name="project.groupId" value="commons-io"/>
   <property name="project.artifactId" value="commons-io"/>
-  <property name="project.version" value="2.16.1"/>
+  <property name="project.version" value="2.18.0"/>
   <property name="project.name" value="Apache Commons IO"/>
   <property name="project.description" value="The Apache Commons IO library 
 contains utility classes, stream implementations, file filters, 

apache-commons-io.changes

@@ -1,3 +1,159 @@
+-------------------------------------------------------------------
+Fri Jan 24 15:08:26 UTC 2025 - Gus Kenion <gus.kenion@suse.com>
+
+- Upgrade to 2.18.0
+  * New features
+    + Add @FunctionalInterface to ClassNameMatcher.
+    + Add ValidatingObjectInputStream.Builder and
+      ValidatingObjectInputStream.builder().
+    + Add a "Safe Deserialization" section to the User Guide for
+      the site.
+    + Add IORandomAccessFile.
+    + Add RandomAccessFileMode.io(String).
+    + Add FileAlterationObserver.Builder() and deprecate most
+      constructors.
+    + Add IOUtils.readLines(CharSequence).
+    + Add ValidatingObjectInputStream.ObjectStreamClassPredicate to
+      allow configuration reuse.
+    + Add RandomAccessFileMode.accept(Path,
+      IOConsumer<RandomAccessFile>).
+    + Add RandomAccessFileMode.apply(Path,
+      IOFunction<RandomAccessFile>, T).
+    + Add IOIntConsumer.
+    + Add ProxyInputStream.AbstractBuilder. Supports setting a
+      consumer for ProxyInputStream.afterRead(int).
+    + Add support to AutoCloseInputStream for setting a consumer
+      for ProxyInputStream.afterRead(int).
+    + Add support to BOMInputStream for setting a consumer for
+      ProxyInputStream.afterRead(int).
+    + Add support to BoundedInputStream for setting a consumer for
+      ProxyInputStream.afterRead(int).
+    + Add support to BoundedInputStream for setting a consumer for
+      BoundedInputStream.onMaxLength(long, long).
+    + Add support to ChecksumInputStream for setting a consumer for
+      ProxyInputStream.afterRead(int).
+    + Add support to ThrottledInputStream for setting a consumer
+      for ProxyInputStream.afterRead(int).
+    + Add support to ObservableInputStream for setting a consumer
+      for ProxyInputStream.afterRead(int).
+    + Add support to MessageDigestCalculatingInputStream for
+      setting a consumer for ProxyInputStream.afterRead(int).
+    + Add support to MessageDigestInputStream for setting a
+      consumer for ProxyInputStream.afterRead(int).
+  * Fixed Bugs
+    + Clean ups in unit tests.
+    + Fix some Javadoc issues.
+    + RandomAccessFileMode.toString() is more helpful for debugging
+      when it inherits from Enum.
+    + Fix implicit narrowing conversion in compound assignment in
+      UnsynchronizedBufferedReader.skip(long).
+    + IO-860:  Missing reserved file names in FileSystem.WINDOWS
+      (superscript digits for COM and LPT).
+    + IO-856:  FileUtils.listFiles(final File, String[], boolean)
+      can throw NoSuchFileException #697, #699.
+    + IO-859:  FileUtils.forceDelete on non-existent file on Windows
+      throws IOException rather than FileNotFoundException.
+    + Use Unicode escapes for superscript characters. #701.
+    + IO-863:  Recent incompatible change to FileUtils.listFiles re
+      extensions, see also IO-856.
+    + IO-857:  Javadoc: Update details for PathUtils "clean"
+      behavior.
+  * Changes
+    + Bump org.apache.commons:commons-parent from 74 to 78 #670,
+      #676, #679, #688.
+    + Bump commons.bytebuddy.version from 1.15.1 to 1.15.10 #672,
+      #673, #685, #686, #694, #696, #698.
+    + Update AbstractStreamBuilder getters from protected to
+      public.
+
+
+-------------------------------------------------------------------
+Fri Oct  4 19:23:58 UTC 2024 - Fridrich Strba <fstrba@suse.com>
+
+- Upgrade to 2.17.0
+  * New features:
+    + Add IOIterator.adapt(Iterable)
+    + Add getInputStream() for 'https' and 'http' in URIOrigin 
+      #630. Fixes IO-831
+    + Add IOSupplier.getUnchecked()
+    + Add CloseShieldInputStream.systemIn(InputStream)
+    + Add NullInputStream.init()
+    + Add AbstractInputStream and refactor duplicate code
+    + Add UnsynchronizedReader
+    + Add UnsynchronizedBufferedReader
+  * Fixes:
+    + FileUtilsWaitForTest does not test anything useful.
+      Fixes IO-858.
+    + Add missing unit tests
+    + FileUtils.lastModifiedFileTime(File) calls 
+      Objects.requireNonNull() on the wrong object
+    + PathUtils.deleteOnExit(Path) calls Objects.requireNonNull() 
+      on the wrong object
+    + Deprecate LineIterator.nextLine() in favor of next()
+    + Fix PMD UnnecessaryFullyQualifiedName
+    + Add test for CircularByteBuffer clear() #620
+    + PathUtils.isPosix(Path, LinkOption...) should return false on 
+      null input
+    + AutoCloseInputStream(InputStream) uses 
+      ClosedInputStream.INSTANCE when its input is null
+    + Avoid NullPointerException in ProxyInputStream.available() 
+      when the underlying input stream is null
+    + Avoid NullPointerException in ProxyInputStream.markSupported()
+      when the underlying input stream is null
+    + Avoid NullPointerException in ProxyInputStream.mark(int) when 
+      the underlying input stream is null
+    + BufferedFileChannelInputStream.available() returns 0 before 
+      any reads
+    + BufferedFileChannelInputStream.available() should return 0 
+      instead of -1 at the end of the stream
+    + BufferedFileChannelInputStream.available() should return 0 
+      when the stream is closed instead of throwing an exception
+    + CharSequenceInputStream.available() should return 0 after the 
+      stream is closed
+    + BoundedInputStream.available() should return 0 when the 
+      stream is closed
+    + CircularInputStream.available() should return 0 when the 
+      stream is closed
+    + InfiniteCircularInputStream.available() should return 0 when 
+      the stream is closed
+    + ChecksumInputStream(InputStream, Checksum, long, long) should 
+      fail-fast on null Checksum input
+    + Deprecate NullInputStream.INSTANCE in favor of constructors
+    + NullInputStream.available() should return 0 after the stream 
+      is closed
+    + MemoryMappedFileInputStream.available() should return 0 after 
+      the stream is closed
+    + RandomAccessFileInputStream.available() should return 0 after 
+      the stream is closed
+    + ReaderInputStream.available() should return 0 after the 
+      stream is closed
+    + AutoCloseInputStream does not call handleIOException() on 
+      close() when the proxied stream throws an IOException
+    + BoundedInputStream does not call handleIOException() on 
+      close() when the proxied stream throws an IOException
+    + NullInputStream.read(*) should throw IOException when it is 
+      closed
+    + NullInputStream.read(byte[]) should return 0 when the input 
+      byte array in length 0
+    + NullInputStream.read(byte[], int, int) should return 0 when 
+      the input byte array in length 0 or requested length is 0
+    + MarkShieldInputStream.read(*) should throw IOException when 
+      it is closed
+    + Replace deprecated constant FileFileFilter.FILE in Javadoc 
+      #657
+    + Pick up exec-maven-plugin version from parent POM
+  * Updates:
+    + Bump tests commons.bytebuddy.version from 1.14.13 to 1.15.1 
+      #615, #621, #631, #635, #642, #658, #663, #665
+    + Bump tests commons-codec:commons-codec from 1.16.1 to 1.17.1 
+      #644
+    + Bump org.codehaus.mojo:exec-maven-plugin from 3.2.0 to 3.4.1 
+      #632, #652, #659
+    + Bump org.apache.commons:commons-parent from 69 to 74 #628, 
+      #637, #649, #661, #664
+    + Bump org.apache.commons:commons-lang3 from 3.14.0 to 3.17.0 
+      #645, #653, #666
+
 -------------------------------------------------------------------
 Mon Apr 29 13:12:59 UTC 2024 - Gus Kenion <gus.kenion@suse.com>
 
@@ -328,6 +484,8 @@ Wed Oct 18 12:52:58 UTC 2023 - David Anes <david.anes@suse.com>
 - Update to 2.14.0:
   * Lots of new features, fixes and updates.
   * https://commons.apache.org/proper/commons-io/changes-report.html#a2.14.0
+  * Fixes bsc#1231298, CVE-2024-47554: untrusted input to XmlStreamReader
+    can lead to uncontrolled resource consumption
 
 -------------------------------------------------------------------
 Tue Apr 19 15:34:30 UTC 2022 - David Anes <david.anes@suse.com>

apache-commons-io.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package apache-commons-io
 #
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2025 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -19,7 +19,7 @@
 %define base_name  io
 %define short_name commons-%{base_name}
 Name:           apache-%{short_name}
-Version:        2.16.1
+Version:        2.18.0
 Release:        0
 Summary:        Utilities to assist with developing IO functionality
 License:        Apache-2.0
@@ -28,6 +28,7 @@ URL:            https://commons.apache.org/%{base_name}
 Source0:        https://archive.apache.org/dist/commons/%{base_name}/source/%{short_name}-%{version}-src.tar.gz
 Source1:        https://archive.apache.org/dist/commons/%{base_name}/source/%{short_name}-%{version}-src.tar.gz.asc
 Source2:        %{name}-build.xml
+Source100:      https://downloads.apache.org/commons/KEYS#/%{name}.keyring
 BuildRequires:  ant >= 1.6
 BuildRequires:  fdupes
 BuildRequires:  java-devel >= 1.8
@@ -54,9 +55,7 @@ This package provides %{summary}.
 cp %{SOURCE2} build.xml
 
 %build
-%{ant} \
-	-Dcompiler.source=1.8 \
-    jar javadoc
+ant jar javadoc
 
 %install
 # jars

commons-io-2.16.1-src.tar.gz.asc

@@ -1,11 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQEzBAABCgAdFiEELbTx7w+nYezE6pNchv3H4qESYssFAmYPUwsACgkQhv3H4qES
-Ysv5oQf/YZinFfV1MVn3FYenDNLq49p88JWf596c+oCHRTKxvj94F6hW+Ol9p2P/
-lSbRGtyNE+kHZYXIk0U8/AtMjDpKwcKJrLdKg4jcK30QvFmidLgad45jDoyDcvsK
-rIsReOVPAou253eIJILgKLiOvMPtwC9/0tfYmApX11Xp0OyJCO9MqI8aFkXwMQzN
-xLwJ0ZthmM5oA524UR8rs0E03e/HWmeWMDwwDlnztjifqKG6ap8oe8MicDvY4FVR
-p75IxT85rg0jv9MTkb1VPE4WA+WRc7PWxUVuinfTxXCTlkUumQmMqxxOE6nVPPSd
-C+Qb4bNTVQgA9n6qCahFia292rjCSQ==
-=z2kg
------END PGP SIGNATURE-----

commons-io-2.18.0-src.tar.gz.asc

@@ -0,0 +1,11 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQEzBAABCgAdFiEELbTx7w+nYezE6pNchv3H4qESYssFAmc4ucQACgkQhv3H4qES
+YsukGggAiXozeW54LgOGltf0kzgCmFCU0nbAgpaWh3VEl0Xwi+i33HkDVk6chC91
+XwA3gNsrGJcRX2ka6TlYm1kjGBaoyhRGOECrUadzWWR1vRpFke7PQuNp+fVAuZ2Y
+js1w4ow7/mbBodujDfh2fLsv/kmoRTQlWcN2S9rfbKU5okq1qB0JDqnQjnRQVfsF
++UEr1kQ+BoHtPvxBg9pgS6N4xrgvntpBMKLHXPuCJDH7VcZbxxbnT7HBmgkPll19
+qkpTEtc77QDvPhD4SSpnpPK6bnlTLOjEG4SQejoB8IJIXYQ9Z+VejfAiVrXXSGvn
+MF2o4rAv45iXIroYwSftXLzR3txULQ==
+=0ngH
+-----END PGP SIGNATURE-----