Accepting request 1293479 from Java:packages

bsc#1246397, CVE-2025-48924

OBS-URL: https://build.opensuse.org/request/show/1293479
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apache-commons-lang3?expand=0&rev=13

apache-commons-lang3.changes

@@ -1,3 +1,382 @@
+-------------------------------------------------------------------
+Tue Jul 15 15:50:30 UTC 2025 - Fridrich Strba <fstrba@suse.com>
+
+- Update to 3.18.0 
+  * New features:
+    + Add Strings and refactor StringUtils
+    + LANG-1747: Add StopWatch.run([Failable]Runnable) and
+      get([Failable]Supplier)
+    + Add JavaVersion.JAVA_23
+    + Add JavaVersion.JAVA_24
+    + Add SystemUtils.IS_JAVA_23
+    + Add SystemUtils.IS_JAVA_24
+    + Add IntegerRange.toIntStream()
+    + Add LongRange.toLongStream()
+    + Add IntStrams.of(int...)
+    + Add ArrayUtils.containsAny(int[], int...)
+    + Add CalendarUtils.toLocalDate() #725
+    + Add SystemUtils.IS_OS_MAC_OSX_SEQUOIA
+    + Add BasicThreadFactory.builder() and deprecate
+      BasicThreadFactory.Builder()
+    + Add BasicThreadFactory.daemon()
+    + Add ArrayUtils.startsWith
+    + Add Predicates
+    + Add RegExUtils methods typed to CharSequence input and
+      deprecate old versions typed to String
+    + Add IterableStringTokenizer
+    + Add FailableIntToFloatFunction
+    + Add Validate.isTrue(boolean, Supplier<String>)
+    + Add EnumUtils.getFirstEnum(Class<E>, int, ToIntFunction<E>, E)
+    + Add FailableToBooleanFunction
+    + Add the @FunctionalInterface annotation to
+      org.apache.commons.lang3.concurrent.Computable
+    + Add SystemUtils.getJavaIoTmpDirPath()
+    + Add SystemUtils.getJavaHomePath()
+    + Add SystemUtils.getUserDirPath()
+    + Add SystemUtils.getUserHomePath()
+    + Add ArrayFill.fill(T[], FailableIntFunction))
+    + Add SystemProperties.JAVA_SECURITY_DEBUG
+    + Add SystemProperties.JAVA_SECURITY_KERBEROS_CONF
+    + Add SystemProperties.JAVA_SECURITY_KERBEROS_KDC
+    + Add SystemProperties.JAVA_SECURITY_KERBEROS_REAL
+    + Add ArrayFill.fill(boolean[], boolean) #1386
+    + Add ObjectUtils.getIfNull(Object, Object) and deprecate
+      defaultIfNull(Object, Object)
+    + org.apache.commons.lang3.mutable.Mutable now extends Supplier
+    + Add org.apache.commons.lang3.CharUtils.isHex(char)
+    + Add org.apache.commons.lang3.CharUtils.isOctal(char)
+    + Add org.apache.commons.lang3.concurrent.locks.LockingVisitors
+      .reentrantLockVisitor(Object)
+    + Add org.apache.commons.lang3.concurrent.locks.LockingVisitors
+      .create(Object, ReentrantLock)
+    + Add org.apache.commons.lang3.concurrent.locks.LockingVisitors
+      .ReentrantLockVisitor
+    + Add builders for LockingVisitors implementations
+    + Add EnumSet.stream(Class)
+    + Add org.apache.commons.lang3.SystemProperties.isPropertySet(String)
+  * Fixed Bugs:
+    + Fix flaky FileUtilsWaitForTest.testWaitForNegativeDuration()
+    + Pick up exec-maven-plugin version from parent POM
+    + Speed up and sanitize StopWatchTest
+    + Fix handling of non-ASCII letters and numbers in
+      RandomStringUtils #1273
+    + Rewrite ClassUtils.getClass(...) without recursion to avoid
+      StackOverflowError on very long inputs (bsc#1246397,
+      CVE-2025-48924)
+    + OSS-Fuzz Issue 42522972: apache-commons-text:
+      StringSubstitutorInterpolatorFuzzer: Security exception in
+      org.apache.commons.lang3.ClassUtils.getClass
+    + Remove trailing whitespace in StopWatch exception messages
+    + LANG-1754: Use getAllSuperclassesAndInterfaces() in
+      getMatchingMethod() #1289
+    + Add details to the ArrayFill Javadoc
+    + Add details to the ArraySorter Javadoc
+    + Fix broken URL to project location in Maven Central #1296
+    + LANG-1753: StringUtils.replaceEachRepeatedly regression in
+      3.11+ #1297
+    + Use simplified JUnit assertion methods #1298
+    + LANG-1682: Javadoc and test: Use Strings.CI.startsWithAny
+      method instead #1299
+    + Fix NullPointerException in FastDateParser.TimeZoneStrategy
+      .setCalendar(FastDateParser, Calendar, String) on Java 23
+    + LANG-1757: Fix NullPointerException in MethodUtils
+      .getMatchingAccessibleMethod((Class, String, Class...))
+    + LANG-1698: Fix StackOverflowError in TypeUtils
+      .typeVariableToString(TypeVariable), TypeUtils.toString(Type)
+      on Java 17 and up
+    + LANG-1511: SystemUtils is missing important documentation
+    + Make Failable.run(FailableRunnable) null-safe
+    + Make Failable.accept(*) null-safe
+    + Improve container detection by mimicking systemd #1323
+    + Make LangCollectors.collect(...) null-safe
+    + Make LangCollectors.collect(...) null-safe
+    + Fix names of UTF-16 surrogate character test fixture
+      constants, see also #1326
+    + Moditect plugin generates split package warnings
+    + LocaleUtils.availableLocaleSet() uses predictable iteration
+      order
+    + LANG-1759: SerializationUtils.clone(Object) throws
+      ClassCastException when called with a Serializable lambda
+    + LANG-1759: [StringUtils::indexOfAnyBut] redesign due to
+      inconsistent/faulty behavior regarding UTF-16 surrogates #1327
+    + Undeprecate ObjectUtils.toString(Object)
+    + Fix Spotbugs [ERROR] Medium: The field org.apache.commons
+      .lang3.builder.DiffBuilder$SDiff.leftSupplier is transient but
+      isn't set by deserialization [org.apache.commons.lang3.builder
+      .DiffBuilder$SDiff] In DiffBuilder.java
+      SE_TRANSIENT_FIELD_NOT_RESTORED
+    + Fix Spotbugs [ERROR] Medium: The field org.apache.commons
+      .lang3.builder.DiffBuilder$SDiff.rightSupplier is transient but
+      isn't set by deserialization [org.apache.commons.lang3.builder
+      .DiffBuilder$SDiff] In DiffBuilder.java
+      SE_TRANSIENT_FIELD_NOT_RESTORED
+    + LANG-1762: StopWatch methods should not delegate to deprecated
+      methods
+    + Don't call TypeUtils.toString(Type) on every array item in
+      TypeUtils.parameterize[WithOwner](Type, Class, Map, Type>)
+      unless required
+    + Remove -nouses directive from maven-bundle-plugin. OSGi
+      package imports now state 'uses' definitions for package
+      imports, this doesn't affect JPMS
+      (from org.apache.commons:commons-parent:80)
+    + Instead of throwing a NullPointerException,
+      ArrayUtils.toStringArray(Object[]) should return "null" for
+      null elements like ArrayUtils.toStringArray(Object[], String)
+      returns its valueForNullElements
+    + LANG-1764: Deprecate NumericEntityUnescaper.OPTION in favor of
+      Apache Commons Text
+    + Several hash collisions in Fraction class
+    + LANG-1768: MutableLong and friends should provide better
+      parsing exceptions Javadocs
+    + Reimplement StringUtils.toCodePoints(CharSequence) to use
+      java.lang.CharSequence.codePoints()
+    + Reimplement StringUtils.capitalize(String) to use
+      java.lang.CharSequence.codePoints()
+    + Reimplement StringUtils.uncapitalize(String) to use
+      java.lang.CharSequence.codePoints()
+    + org.apache.commons.lang3.ClassUtils.getCanonicalName(String)
+      now throws an IllegalArgumentException for array dimensions
+      greater than 255
+    + Fix Javadoc typo and improve clarity in defaultIfBlank method
+      #1376
+    + LANG-1773: Apache Commons Lang no longer builds on Android
+      #1381
+    + LANG-1772: Restrict size of cache to prevent overflow errors
+      #1379
+    + LANG-1772: Reimplement
+      org.apache.commons.lang3.ClassUtils.hierarchy(Class,
+      Interfaces) using an AtomicReference
+    + Fix Javadoc code examples in DiffBuilder and
+      ReflectionDiffBuilder #1400
+    + Fix generics in org.apache.commons.lang3.stream.Streams
+      .toArray(Class) signature
+    + LANG-1727: EventListenerSupport doesn't document ordering of
+      events
+    + Fix edge-case NullPointerException in org.apache.commons.lang3
+      .SystemUtils.IS_OS_ANDROID
+    + Fix edge-case NullPointerException in org.apache.commons.lang3
+      .SystemUtils.isJavaVersionAtLeast(JavaVersion)
+    + Fix edge-case NullPointerException in org.apache.commons.lang3
+      .SystemUtils.isJavaVersionAtMost(JavaVersion)
+    + Return the default enum if a SecurityException is caught in
+      getEnumSystemProperty()
+    + Fix edge-case NullPointerException in org.apache.commons.lang3
+      .EnumUtils.getEnum(Class, String, E)
+    + org.apache.commons.lang3.EnumUtils
+      .getFirstEnumIgnoreCase(Class, String, Function, E) now
+      returns the given default enum on null enumClass input
+    + org.apache.commons.lang3.EnumUtils.getEnumIgnoreCase(Class,
+      String, E) now returns the given default enum on null
+      enumClass input
+    + org.apache.commons.lang3.EnumUtils.getEnumIgnoreCase(Class,
+      String) now returns the given default enum on null enumClass
+      input
+    + Fix NullPointerException in org.apache.commons.lang3.compare
+      .ComparableUtils.ComparableCheckBuilder.equalTo(A)
+    + Fix NullPointerException in org.apache.commons.lang3.compare
+      .ComparableUtils.ComparableCheckBuilder.greaterThan(A)
+    + Fix NullPointerException in org.apache.commons.lang3.compare
+      .ComparableUtils.ComparableCheckBuilder.greaterThanOrEqualTo(A)
+    + Fix NullPointerException in org.apache.commons.lang3.compare
+      .ComparableUtils.ComparableCheckBuilder.lessThan(A)
+    + Fix NullPointerException in org.apache.commons.lang3.compare
+      .ComparableUtils.ComparableCheckBuilder.lessThanOrEqualTo(A)
+    + LANG-1776: Use GitHub URL in POM for improved automation
+      support
+
+-------------------------------------------------------------------
+Tue Apr  1 07:10:28 UTC 2025 - Gus Kenion <gus.kenion@suse.com>
+
+- Update to 3.17.0
+  * New features:
+    * RandomUtils.secure() now uses SecureRandom() instead of
+      SecureRandom.getInstanceStrong().
+    * RandomStringUtils.secure() now uses SecureRandom() instead of
+      SecureRandom.getInstanceStrong().
+    * Remove unused exception from deprecated
+      StringUtils.toString(byte[], String).
+    * Make RandomUtils.insecure() public.
+    * Add RandomUtils.secureStrong().
+    * Add RandomStringUtils.secureStrong().
+    * Add CalendarUtils.toLocalDateTime(Calendar).
+    * Add CalendarUtils.toLocalDateTime().
+    * Add CalendarUtils.toZonedDateTime(Calendar).
+    * Add CalendarUtils.toZonedDateTime().
+    * Add CalendarUtils.toOffsetDateTime(Calendar).
+    * Add CalendarUtils.toOffsetDateTime().
+  * Fixed Bugs:
+    * LANG-1760: Using RandomStringUtils.insecure() still leads to
+      using the secure() random.
+    * Deprecate static RandomUtils.next*() methods in favor or
+      .secure() and .insecure() versions.
+    * Deprecate static RandomStringUtils.random*() methods in favor
+      or .secure() and .insecure() versions.
+  * Changes:
+    * Bump org.hamcrest:hamcrest from 2.2 to 3.0 #1255.
+    * Bump org.easymock:easymock from 5.3.0 to 5.4.0 #1256.
+    * Bump org.codehaus.mojo:exec-maven-plugin from 3.3.0 to 3.4.1
+      #1262, #1264.
+    * Bump org.apache.commons:commons-parent from 72 to 73 #1265.
+
+-------------------------------------------------------------------
+Fri Aug  9 09:54:03 UTC 2024 - Gus Kenion <gus.kenion@suse.com>
+
+- Update to 3.16.0:
+  * New features:
+    + Add StopWatch.getSplitDuration() and deprecate
+      getSplitTime().
+    + Add StopWatch.getStartInstant() and deprecate getStartTime().
+    + Add StopWatch.getStopInstant() and deprecate getStopTime().
+    + Add StopWatch.getDuration() and deprecate getTime().
+    + Add Javadoc links from StopWatch to DurationUtils #1249.
+    + Add LangCollectors.collect(Collector, T...).
+    + Add RandomStringUtils.secure().
+    + Add RandomStringUtils.insecure().
+  * Fixed bugs:
+    + Reimplement StopWatch internals to use java.time.
+    + RandomStringUtils.random() with a negative character index
+      should throw IllegalArgumentException. Fixes LANG-1745.
+    + LocaleUtils.toLocale(String) cannot parse four segments.
+      Fixes LANG-1741.
+    + Use fewer intermediary strings in
+      DefaultExceptionContext.getFormattedExceptionMessage(String).
+    + Fix Javadoc in StringUtils.splitPreserveAllTokens() #1251.
+    + Deprecate ArraySort constructor for removal.
+    + Deprecate CharEncoding constructor for removal.
+    + Deprecate Conversion constructor for removal.
+    + Deprecate Conversion constructor for removal.
+    + Deprecate EntityArrays constructor for removal.
+    + Deprecate ObjectToStringComparator constructor for removal.
+    + Deprecate RuntimeEnvironment constructor for removal.
+- Includes changes from 3.15.0:
+  * New features:
+    + Customize text pattern in DiffResult#toString(). Fixes
+      LANG-1724.
+    + Add DiffBuilder.Builder.
+    + Add DiffBuilder.builder().
+    + Add ReflectionDiffBuilder.Builder.
+    + Add ReflectionDiffBuilder.builder().
+    + Add test in TypeUtilsTest #1151.
+    + Add Streams.failableStream(T), non-varargs variant.
+    + Add Streams.nonNull(T), non-varargs variant.
+    + Add ArrayUtils.nullTo(T[], T[]).
+    + Add T ArrayUtils.arraycopy(T, int, T, int, int) fluent style.
+    + Add T ArrayUtils.arraycopy(T, int, int, int, Function) fluent
+      style.
+    + Add SystemUtils.IS_JAVA_22.
+    + Add JavaVersion.JAVA_22.
+    + Add SystemProperties.getUserName(Supplier<String>).
+    + Add SystemProperties.getLineSeparator(Supplier<String>).
+    + Add
+    + SystemProperties.getJavaSpecificationVersion(Supplier<String>).
+    + Add SystemProperties constants and methods for system
+      properties as of Java 22.
+    + Add MethodUtils.getMethodObject(Class, String, Class...).
+    + Add null-safe Consumers.accept() and Functions.apply() #1215.
+      Fixes LANG-1733.
+    + Add SystemUtils.IS_OS_ANDROID.
+    + Add SystemUtils.IS_OS_MAC_OSX_SONOMA.
+    + Add RuntimeEnvironment.inContainer() #1241.
+    + Add AppendableJoiner and refactor string joining #1244.
+  * Fixed bugs:
+    + Improve Javadoc in ExceptionUtils #1136.
+    + Fixed two non-deterministic tests in EnumUtilsTest.java
+      #1131.
+    + Fix wrong number check that cause
+      StringIndexOutOfBoundsException #1140. Fixes LANG-1721.
+    + Rethrow NegativeArraySizeException as SerializationException
+      in SerializationUtils.deserialize(InputStream) #1141. Fixes
+      LANG-1722.
+    + Throw NumberFormatException instead of
+      IndexOutOfBoundsException in NumberUtils.getMantissa(String,
+      int) #1145. Fixes LANG-1723.
+    + Minor grammar fixes #1143.
+    + ArrayUtils will return null when adding two null arrays, but
+      undocumented. Fixes LANG-1713.
+    + Let parent POM figure out commons.spdx.version.
+    + Undeprecate ExceptionUtils.rethrow(Throwable). Fixes
+      LANG-1726.
+    + Test the Conversion class #1155. Fixes LANG-1702.
+    + Address minor redundancies after code inspection #1148.
+    + Allow EventListenerSupport to handle (and ignore) exception
+      from listeners allowing invocation of all listeners #1167.
+    + Deprecate AnnotationUtils 0-argument constructor.
+    + Deprecate ArchUtils 0-argument constructor.
+    + Deprecate ArrayUtils 0-argument constructor.
+    + Deprecate BooleanUtils 0-argument constructor.
+    + Deprecate CharSequenceUtils 0-argument constructor.
+    + Deprecate CharSetUtils 0-argument constructor.
+    + Deprecate CharUtils 0-argument constructor.
+    + Deprecate ClassLoaderUtils 0-argument constructor.
+    + Deprecate ClassPathUtils 0-argument constructor.
+    + Deprecate ClassUtils 0-argument constructor.
+    + Deprecate ConstructorUtils 0-argument constructor.
+    + Deprecate DateFormatUtils 0-argument constructor.
+    + Deprecate DateUtils 0-argument constructor.
+    + Deprecate Diff.getType().
+    + Deprecate DiffBuilder.DiffBuilder(T, T, ToStringStyle).
+    + Deprecate DiffBuilder.DiffBuilder(T, T, ToStringStyle,
+      boolean).
+    + Deprecate DurationFormatUtils 0-argument constructor.
+    + Deprecate DurationUtils 0-argument constructor.
+    + Deprecate EnumUtils 0-argument constructor.
+    + Deprecate EventUtils 0-argument constructor.
+    + Deprecate FieldUtils 0-argument constructor.
+    + Deprecate IEEE754rUtils 0-argument constructor.
+    + Deprecate InheritanceUtils 0-argument constructor.
+    + Deprecate IntStreams 0-argument constructor.
+    + Deprecate LocaleUtils 0-argument constructor.
+    + Deprecate LockingVisitors 0-argument constructor.
+    + Deprecate MemberUtils 0-argument constructor.
+    + Deprecate MethodUtils 0-argument constructor.
+    + Deprecate NumberUtils 0-argument constructor.
+    + Deprecate ObjectUtils 0-argument constructor.
+    + Deprecate RandomStringUtils 0-argument constructor.
+    + Deprecate RandomUtils 0-argument constructor.
+    + Deprecate ReflectionDiffBuilder.ReflectionDiffBuilder(T, T,
+      ToStringStyle).
+    + Deprecate RegExUtils 0-argument constructor.
+    + Deprecate SerializationUtils 0-argument constructor.
+    + Deprecate Streams 0-argument constructor.
+    + Deprecate StringEscapeUtils 0-argument constructor.
+    + Deprecate StringUtils 0-argument constructor.
+    + Deprecate Suppliers 0-argument constructor.
+    + Deprecate SystemProperties 0-argument constructor.
+    + Deprecate ThreadUtils 0-argument constructor.
+    + Deprecate TypeUtils 0-argument constructor.
+    + Make ArrayFill null-safe.
+    + Make ArraySorter null-safe.
+    + Make ArrayUtils.removeAll() null-safe.
+    + Fix Java version in README.md #1170.
+    + StringUtils.stripAccents() should handle ligatures, UTF32
+      math blocks, etc. #1201.
+    + TypeUtils.toString(Type) StackOverflowError for an inner
+      class in the inner class parameterized enclosing class #657.
+      Fixes LANG-1524.
+    + Deprecate SystemUtils.getUserName(String) in favor of
+      SystemProperties.getUserName(Supplier).
+    + Make LockVisitor.acceptReadLocked(FailableConsumer)
+      null-safe.
+    + Make LockVisitor.applyWriteLocked(FailableConsumer)
+      null-safe.
+    + Make ObjectUtils.getFirstNonNull(Supplier...) null-safe.
+    + Make SystemProperties.getLineSeparator(Supplier).
+    + StringUtils.stripAccents(String) doesn't handle "\u0111" and
+      "\u0110" (Vietnamese) #1216.
+    + StringUtils.stripAccents(String) doesn't handle I with bar.
+    + StringUtils.stripAccents(String) doesn't handle U with bar.
+    + StringUtils.stripAccents(String) doesn't handle T with
+      stroke.
+    + Fix Javadoc for FluentBitSet.setInclusive(int, int) #1222.
+      Fixes LANG-1735.
+    + Same Javadoc changes as [TEXT-234] #1223.
+    + Remove duplicate static data in
+      SerializationUtils.ClassLoaderAwareObjectInputStream.
+    + Reimplement RandomUtils and RandomStringUtils on top of
+      SecureRandom#getInstanceStrong() #1235.
+    + DiffBuilder: Type constraint for method append(...,
+      DiffResult) too strict #786. Fixes LANG-1657.
+
 -------------------------------------------------------------------
 Tue May 14 12:36:22 UTC 2024 - Fridrich Strba <fstrba@suse.com>
 

apache-commons-lang3.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package apache-commons-lang3
 #
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2025 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -19,7 +19,7 @@
 %define base_name lang3
 %define short_name commons-%{base_name}
 Name:           apache-%{short_name}
-Version:        3.14.0
+Version:        3.18.0
 Release:        0
 Summary:        Apache Commons Lang Package
 License:        Apache-2.0