/
changes.xml
1982 lines (1945 loc) · 92.2 KB
/
changes.xml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<?xml version="1.0" encoding="UTF-8"?>
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
-->
<!--
This file is also used by the maven-changes-plugin to generate the release notes.
Useful ways of finding items to add to this file are:
1. Add items when you fix a bug or add a feature (this makes the
release process easy :-).
2. Do a JIRA search for tickets closed since the previous release.
3. Use the report generated by the maven-changelog-plugin to see all
SVN commits. TBA how to use this with SVN.
To generate the release notes from this file:
mvn changes:announcement-generate -Prelease-notes [-Dchanges.version=m.n]
The <action> type attribute can be add,update,fix,remove.
-->
<document>
<properties>
<title>Apache Commons Compress Release Notes</title>
</properties>
<body>
<release version="1.21" date="not released, yet (Java 8)"
description="Release 1.21">
<action type="update" date="2020-03-07"
due-to="Peter Alfred Lee">
Made sure ZstdCompressorOutputStream no longer used
deprecated ZstOutputStream constructors.
Github Pull Request #94.
</action>
<action issue="COMPRESS-504" type="update" date="2020-03-16">
Make compression level of ParallelScatterZipCreator
configurable via a new constructor.
</action>
<action issue="COMPRESS-505" type="fix" date="2020-03-24">
Fix bugs in random access of 7z. Problems may happen
in a mixture use of random access and sequential access
of 7z.
Github Pull Request #95.
</action>
<action issue="COMPRESS-510" type="fix" date="2020-04-18">
Fix bugs in random access of 7z. Exceptions are thrown
when reading the first entry multiple times by random
access.
</action>
<action issue="COMPRESS-509" type="fix" date="2020-05-06"
due-to="Petr Vasak" dev="PeterLee">
Add '/' to directories with long name in tar. This is to
resolve the ambiguous behavior of the TarArchiveEntry.getName()
method between directory with short name and long name.
</action>
<action issue="COMPRESS-520" type="fix" date="2020-05-23" due-to="Robin Schimpf">
Removed the PowerMock dependency.
</action>
<action issue="COMPRESS-516" type="fix" date="2020-05-23">
Added improved checks to detect corrupted bzip2 streams and
throw the expected IOException rather than obscure
RuntimeExceptions.
See also COMPRESS-519.
</action>
<action issue="COMPRESS-517" type="fix" date="2020-05-23">
Improved parsing of X5455_ExtendedTimestamp ZIP extra field.
</action>
<action issue="COMPRESS-518" type="fix" date="2020-05-23">
ZipArchiveInputStream and ZipFile will now throw an
IOException rather than a RuntimeException if the zip64 extra
field of an entry could not be parsed.
</action>
<action issue="COMPRESS-523" type="fix" date="2020-05-23">
Improved detection of corrupt ZIP archives in ZipArchiveInputStream.
</action>
<action issue="COMPRESS-521" type="fix" date="2020-05-24">
Added improved checks to detect corrupted deflate64 streams and
throw the expected IOException rather than obscure
RuntimeExceptions.
See also COMPRESS-522, COMPRESS-525, COMPRESS-526, and COMPRESS-527.
</action>
<action issue="COMPRESS-515" type="fix" date="2020-05-22" due-to="ian-lavallee">
Add the archive name in the exception in the constructor of
ZipFIle to make it a more specific exception.
Github Pull Request #102.
</action>
<action issue="COMPRESS-530" type="fix" date="2020-05-26">
Throw IOException when it encounters a non-number while parsing pax header.
</action>
<action issue="COMPRESS-531" type="fix" date="2020-05-31">
Throw IOException when a a tar archive contains a PAX header
without any normal entry following it.
</action>
<action issue="COMPRESS-532" type="fix" date="2020-05-31">
Added improved checks to detect corrupted IMPLODED streams and
throw the expected IOException rather than obscure
RuntimeExceptions.
</action>
<action issue="COMPRESS-529" type="fix" date="2020-06-01">
Throw expected IOException instead of NumberFormatException if
it encounters non-numbers when parsing pax headers for tarball.
Throw IllegalArgumentException instead of RuntimeExceptions if
the file name is longer than 100 bytes with the longFileMode
of LONGFILE_ERROR, and address this in java docs.
Throw IllegalArgumentException instead of RuntimeExceptions if
the any of the numeric values of an entry exceeds the limits
of a traditional tar header while bigNumberMode is
BIGNUMBER_ERROR, and address this in java docs.
</action>
<action issue="COMPRESS-404" type="update" date="2020-06-08" due-to="theobisproject">
Update the class of variable file in TarArchiveEntry from
java.io.File to java.nio.file.Path. Corresponding constructors
and methods are also modified/added.
Github Pull Request #97.
</action>
<action issue="COMPRESS-539" type="update" date="2020-07-04" due-to="Robin Schimpf">
Reuse the record buffer in TarArchiveInputStream.
</action>
<action type="update" date="2020-08-08" due-to="Gary Gregory" dev="ggregory">
Add SevenZOutputFile.write(InputStream).
</action>
<action type="update" date="2020-08-08" due-to="Gary Gregory" dev="ggregory">
Add SevenZOutputFile.write(Path, OpenOption...).
</action>
<action type="update" date="2020-08-08" due-to="Gary Gregory" dev="ggregory">
Add SevenZOutputFile.createArchiveEntry(Path, String, LinkOption...).
</action>
<action type="update" date="2020-08-08" due-to="Gary Gregory" dev="ggregory">
Add ArArchiveOutputStream.createArchiveEntry(Path, String, LinkOption...).
</action>
<action type="update" date="2020-08-08" due-to="Gary Gregory" dev="ggregory">
Add ArArchiveEntry(Path, String, LinkOption...).
</action>
<action type="update" date="2020-08-08" due-to="Gary Gregory" dev="ggregory">
Add ctor CpioArchiveEntry(Path, String, LinkOption...).
</action>
<action type="update" date="2020-08-08" due-to="Gary Gregory" dev="ggregory">
Add ctor CpioArchiveEntry(short, Path, String, LinkOption...).
</action>
<action type="update" date="2020-08-08" due-to="Gary Gregory" dev="ggregory">
Add CpioArchiveEntry.setTime(FileTime).
</action>
<action type="update" date="2020-08-08" due-to="Gary Gregory" dev="ggregory">
Add TarArchiveOutputStream.createArchiveEntry(Path, String, LinkOption...).
</action>
<action type="update" date="2020-08-08" due-to="Gary Gregory" dev="ggregory">
Add ctor TarArchiveEntry(Path, String, LinkOption...).
</action>
<action type="update" date="2020-08-08" due-to="Gary Gregory" dev="ggregory">
Add IOUtils.EMPTY_LINK_OPTIONS.
</action>
<action type="update" date="2020-08-08" due-to="Gary Gregory" dev="ggregory">
Add Path support to ZipArchiveOutputStream #123.
</action>
<action issue="COMPRESS-543" type="fix" date="2020-08-10"
due-to="wulf2333" dev="PeterLee">
Fix for test fails on Windows. The tests are failing because the
default charset is not UTF-8.
</action>
<action issue="COMPRESS-544" type="fix" date="2020-08-13"
due-to="Aditya Prasad" dev="PeterLee">
TarArchiveInputStream can not detect a truncated tar in skip()
and skipRecordPadding().
</action>
<action issue="COMPRESS-542" type="fix" date="2020-08-15"
due-to="theobisproject" dev="theobisproject">
Make the memory allocation in SevenZFile.readFilesInfo a lazy
allocation to avoid OOM when dealing some giant 7z archives.
Github Pull Request #120.
Also added sanity checks before even trying to parse an
archive and made SevenZFileOptions' maxMemorySizeInKb apply to
the stored metadata for an archive.
</action>
<action issue="COMPRESS-546" type="fix" date="2020-08-15"
due-to="Maksim Zuev" dev="PeterLee">
ZipArchiveInputStream should throw an exception if a corrputed
zip64 extra field is met.
</action>
<action type="fix" date="2020-08-22" dev="PeterLee">
Add a new maven profile in pom.xml for JDK14+ to ignore the
failing tests about Pack200.
</action>
<action issue="COMPRESS-548" type="fix" date="2020-08-24"
due-to="Maksim Zuev" dev="PeterLee">
Throw an IOException when reading the zip extra field if the
length is too short.
</action>
<action issue="COMPRESS-554" type="fix" date="2020-09-01"
due-to="Maksim Zuev" dev="PeterLee">
Throw an decleared IOException if a null entry is met when
reading a global pax header instead of a runtime NPE.
</action>
<action issue="COMPRESS-547" type="fix" date="2020-09-02"
due-to="Maksim Zuev" dev="PeterLee">
Add asserts for Arrays.copyOf in X0017_StrongEncryptionHeader.
</action>
<action issue="COMPRESS-550" type="add" date="2020-09-07"
due-to="Scott Frederick" dev="PeterLee">
Add writePreamble to ZipArchiveInputStream. This method could
write raw data to zip archive before any entry was written to
the zip archive.
For most of the time, this is used to create self-extracting
zip.
Github Pull Request #127.
</action>
<action type="fix" date="2020-09-24" dev="PeterLee">
Fix for the CFH signature detect in ZipArchiveInputStream.
The problem could be reproduced by a zip archive with Data
Descriptor and STORED, and without the Data Descriptor
signature.
</action>
<action issue="COMPRESS-553" type="fix" date="2020-10-07"
due-to="Maksim Zuev" dev="PeterLee">
The length validation in TarArchiveInputStream.parsePaxHeaders
should also consider the headers with length smaller than 1
and ignore these headers.
</action>
<action issue="COMPRESS-558" type="fix" date="2020-11-13"
due-to="Robin Schimpf" dev="Robin Schimpf">
Fix accidentally added '/' to file names.
This problem is caused by the incomplete fix of
COMPRESS-509.
Github Pull Request #151.
</action>
<action issue="COMPRESS-560" type="fix" date="2020-11-30"
due-to="Robin Schimpf" dev="Robin Schimpf">
As sparse entries can be successfully parsed now,
TarArchiveInputStream.canReadEntryData should return
true if the entry is a sparse entry.
Github Pull Request #153.
</action>
<action issue="COMPRESS-559" type="fix" date="2020-12-10"
due-to="Robin Schimpf" dev="Robin Schimpf">
SparseFilesTest#testExtractPaxGNU should be skipped
if the version of GNU tar binary is 1.28.
Github Pull Request #152.
</action>
<action issue="COMPRESS-561" type="update" date="2020-12-22"
due-to="Arturo Bernal" dev="Arturo Bernal">
Some minor improvements.
Github Pull Request #157.
</action>
<action issue="COMPRESS-540" type="add" date="2020-01-09"
due-to="Robin Schimpf" dev="Robin Schimpf">
Added support for random access to the TAR packages.
Github Pull Request #113.
</action>
<action issue="COMPRESS-565" type="add" date="2021-02-14"
due-to="Michael L Heuer" dev="PeterLee">
Added support for BufferPool in ZstdCompressorInputStream.
Github Pull Request #165.
</action>
<action type="fix" date="2021-02-27" due-to="Fabian Meumertzheim">
Removed an empty loop that was just warming the planet for
certain ZIP archives.
Github Pull Request #172.
</action>
<action issue="COMPRESS-567" type="fix" date="2021-02-28">
Made some of the stream classes used internally throw
IOExceptions on illegal arguments rather than
RuntimeExceptions to make it more likely that corrupt archives
cause expected checked exceptions rather than RuntimException
for various formats.
Fixes a specific case for ZIP but affects other formats as
well.
</action>
<!-- UPDATE -->
<action type="update" date="2020-08-18">
Update from Java 7 to 8.
</action>
<action type="update" date="2020-08-10" due-to="Dependabot" dev="ggregory">
Update GitHub actions/checkout from v1 to v2.3.4, #114, #124, #139, #150.
</action>
<action type="update" date="2020-08-21" due-to="Dependabot, Gary Gregory" dev="ggregory">
Update actions/setup-java from v1.4.0 to v2, #125, #133, #141.
</action>
<action type="update" date="2020-08-21" due-to="Dependabot, Gary Gregory" dev="ggregory">
Update com.github.luben:zstd-jni from 1.4.4-7 to 1.4.8-7 #118, #159, #173, #174.
</action>
<action type="update" date="2020-08-21" due-to="Dependabot" dev="ggregory">
Update tests slf4j-api from 1.7.26 to 1.7.30 #117.
</action>
<action type="update" date="2020-08-21" due-to="Dependabot" dev="ggregory">
Update maven-pmd-plugin from 3.12.0 to 3.14.0, #115, #154.
</action>
<action type="update" date="2020-08-21" due-to="Dependabot" dev="ggregory">
Update maven-bundle-plugin from 3.5.1 to 5.1.2 #116, #180.
</action>
<action type="update" date="2020-11-01" due-to="Dependabot" dev="ggregory">
Bump memoryfilesystem from 1.3.0 to 2.1.0 #131.
</action>
<action type="update" due-to="Dependabot" dev="ggregory">
Bump actions/cache from v2 to v2.1.6, #164, #200.
</action>
<action type="update" due-to="Dependabot" dev="ggregory">
Bump junit from 4.13 to 4.13.2, #143, #167.
</action>
<action type="update" due-to="Dependabot" dev="ggregory">
Bump mockito-core from 1.10.19 to 3.11.1, #161, #170, #204.
</action>
<action type="update" due-to="Gary Gregory" dev="ggregory">
Bump commons.jacoco.version from 0.8.5 to 0.8.7 (Java 16 builds).
</action>
<action type="update" due-to="Gary Gregory" dev="ggregory">
Bump org.apache.felix:org.apache.felix.framework from 6.0.3 to 7.0.0 (Java 16 builds).
</action>
<action type="update" due-to="Gary Gregory" dev="ggregory">
Bump commons.japicmp.version from 0.14.3 to 0.15.3 (Java 16 builds).
</action>
<action issue="COMPRESS-569" type="fix" date="2021-03-06">
Checked the sizes read for archive entries and reject archives
as broken with negative entry sizes.
Fixes an infinite loop in the new TarFile class but affects
several formats.
</action>
<action issue="COMPRESS-552" type="fix" date="2021-03-07">
OSGi detection was broken and so we always cached whether
xz/brotli/zstd/lzma have been available even in OSGi
environments.
</action>
<action issue="COMPRESS-571" type="fix" date="2021-03-17">
SevenZFile.getEntries now return a copy of entries.
</action>
<action type="update" date="2020-08-21" due-to="Dependabot" dev="PeterLee">
Update com.github.luben:zstd-jni from 1.4.8-7 to 1.4.9-1 #176.
</action>
<action issue="COMPRESS-575" type="fix" date="2021-05-01">
Handling of sparse tar entries has been hardened to ensure bad
inputs cause expected IOExceptions rather than RuntimeExceptions.
</action>
<action type="update" date="2021-05-12">
Update org.tukaani:xz from 1.8 to 1.9
</action>
<action issue="COMPRESS-565" type="add" date="2021-05-19" due-to="Evgenii Bovykin" dev="PeterLee">
Add a new AlwaysWithCompatibility in Zip64Mode, this is a
compromise for some libraries including 7z and Expand-Archive
Powershell utility(and likely Excel).
And we will encode both the LFH offset and Disk Number Start
in the ZIP64 Extended Information Extra Field - even if only
the disk number needs to be encoded.
Github Pull Request #169.
</action>
<action issue="COMPRESS-566" type="add" date="2021-05-24"
due-to="Brett Okken">
gzip deflate buffer size is now configurable.
</action>
<action type="fix" date="2021-06-05">
The parser for GNU sparse tar headers could throw a
NullPointerExcpetion rather than an IOException if the archive
ended while more sparse headers were expected.
</action>
</release>
<release version="1.20" date="2020-02-08"
description="Release 1.20 (Java 7)">
<action issue="COMPRESS-493" type="update" date="2019-08-27">
Update optional library com.github.luben:zstd-jni from 1.4.0-1 to 1.4.4-7.
</action>
<action type="update" date="2019-08-27">
Update tests from org.apache.felix:org.apache.felix.framework 6.0.2 to 6.0.3.
</action>
<action issue="COMPRESS-492" type="fix" date="2019-08-28">
SevenZFile could throw NullPointerException rather than
IOException for certain archives. In addition it now handles
certain empty archives more gracefully.
</action>
<action issue="COMPRESS-491" type="fix" date="2019-09-01">
Deflate64CompressorInputStream.read would return 0 for some
inputs in violation of the InputStream.read contract.
</action>
<action issue="COMPRESS-495" type="remove" date="2019-10-12">
Removed the extraction code from the example CLI class inside
of the SevenZ package. Not only is it superseeded by the
examples package, its implementation was vulnerable to the
ZipSlip attack.
</action>
<action issue="COMPRESS-497" type="update" date="2019-10-12"
due-to="Stefan Schlott">
SevenZFile can now recover from a certain corruption that
seems to happen occasionally when split archives are created.
</action>
<action issue="COMPRESS-342" type="update" date="2019-11-07"
due-to="Peter Alfred Lee">
Added random access support to SevenZFile.
</action>
<action issue="COMPRESS-477" type="update" date="2019-12-15"
due-to="Peter Alfred Lee">
Added support for split ZIP archives.
</action>
<action issue="COMPRESS-124" type="update" date="2020-01-01"
due-to="Peter Alfred Lee">
Added support for reading sparse entries to the TAR package.
</action>
<action issue="COMPRESS-499" type="fix" date="2020-01-04">
SeekableInMemoryByteChannel's truncate didn't set position
according to the spec in an edge case.
</action>
<action type="fix" due-to="Joseph Allemandou" date="2020-01-21">
BZip2CompressorInputStream now incorporates a similar patch as
the one that fixed CVE-2019-12900 in libbzip2.
Commons Compress has not been vulnerable to this CVE as it
would have rejected a file with too many selectors. With this
patch Commons Compress will be able to read certain archives
that would have caused errors in Compress 1.19.
</action>
<action type="update" date="2020-01-25">
Update JUnit from 4.12 to 4.13.
</action>
</release>
<release version="1.19" date="2019-08-27"
description="Release 1.19
----------------------------------------
ZipArchiveInputStream and ZipFile will no longer throw an exception if
an extra field generally understood by Commons Compress is malformed
but rather turn them into UnrecognizedExtraField instances.
You can influence the way extra fields are parsed in more detail by
using the new getExtraFields(ExtraFieldParsingBehavior) method of
ZipArchiveEntry now.
Some of the ZIP extra fields related to strong encryption will now
throw ZipExceptions rather than ArrayIndexOutOfBoundsExceptions in
certain cases when used directly. There is no practical difference
when they are read via ZipArchiveInputStream or ZipFile.
">
<action type="fix" date="2018-09-07">
ZipArchiveInputStream could forget the compression level has
changed under certain circumstances.
</action>
<action issue="COMPRESS-466" type="add" date="2018-10-07">
It is now possible to skip parsing of local file headers when
using ZipFile which may speed up reading the archive at the
cost of potentially missing important information. See the
javadocs of the ZipFile class for details.
</action>
<action issue="COMPRESS-469" type="add" date="2018-11-10">
TarArchiveInputStream has a new constructor-arg lenient that
can be used to accept certain broken archives.
</action>
<action issue="COMPRESS-470" type="fix" date="2018-11-18">
Fixed another potential resource leak in
ParallelScatterZipCreator#writeTo.
</action>
<action issue="COMPRESS-475" type="add" date="2018-12-15">
ArjArchiveEntry and SevenZArchiveEntry now implement hashCode
and equals.
</action>
<action type="fix" date="2019-02-18" due-to="Alex Bertram">
ArArchiveInputStream could think it had hit EOF prematurely.
Github Pull Request #74.
</action>
<action type="update" date="2019-04-16" due-to="Robin Schimpf"
issue="COMPRESS-481">
SevenZFile now provides a way to cap memory consumption for
LZMA(2) compressed content.
Github Pull Request #76.
</action>
<action type="update" date="2019-04-18"
due-to="Rostislav Krasny" issue="COMPRESS-464">
The ARJ package has been updated to contain constants for more
recent specifications.
</action>
<action type="update" date="2019-04-30"
issue="COMPRESS-484">
Update optional library zstd-jni from 1.3.3-3 to 1.4.0-1.
</action>
<action type="update" date="2019-08-07"
due-to="Hervé Boutemy, Tibor Digana"
issue="COMPRESS-485">
ParallelScatterZipCreator now writes the entries to the
gathered output in the same order they have been added.
Github Pull Requests #78 and #79.
</action>
<action type="fix" date="2019-08-08" issue="COMPRESS-490">
Throw IOException rather than RuntimeExceptions for certain
malformed LZ4 or Snappy inputs.
</action>
<action type="update" date="2019-08-09" issue="COMPRESS-486">
The Expander and Archive example classes can leak resources
they have wrapped around passed in streams or channels. The
methods consuming streams and channels have been adapted to
give the calling code a chance to deal with those wrapper
resources.
</action>
<action type="update" date="2019-08-16" issue="COMPRESS-479">
ZipArchiveInputStream and ZipFile no longer assume Commons
Compress would understand extra fields better than the writer
of the archive and silently turn extra fields that Commons
Compress should understand into UnrecognizedExtraFields if
parsing said fields fails.
It is now possible to take more control over the extra field
parsing process with a new overload of
ZipArchiveEntry#getExtraFields.
</action>
<action type="fix" date="2019-08-18" issue="COMPRESS-482">
ZipArchiveInputStream failed to read stored entries with a
data descriptor if the data descriptor didn't use the
signature invented by InfoZIP.
</action>
<action type="update" date="2019-08-18" issue="COMPRESS-483">
ZipArchiveInputStream will now throw an exception if reading a
stored entry with a data descriptor and the data descriptor
doesn't match what it has actually read.
The most common case for a situation like this is a stored ZIP
archive inside of the archive ZipArchiveInputStream currently
reads. In such a case ZipArchiveInputStream would happily
extract the contained archive and stop once the central
directory of the inner archive has been hit. This is a case
where ZipArchiveInputStream simply can not be used and only
ZipFile is able to read the archive.
The only other explanation is a broken archive. So the
exception prevents users from thinking they had successfully
read the contents of the archive.
</action>
<action type="add" date="2019-08-18" issue="COMPRESS-231"
due-to="Tim Underwood">
Added a MultiReadOnlySeekableByteChannel class
that can be used to concatenate the parts of a multi volume 7z
archive so that SevenZFile can read them.
</action>
<action type="update" date="2019-08-20" issue="COMPRESS-478">
The 7zip tools provide a default name for archive entries
without name; SevenZFile returns a null name for such
entries. A new method getDefaultName has been added to derive
the same name the 7zip tools would use and an option has been
added that sets SevenZArchiveEntry's name to the default name
if it is not contained inside the archive.
</action>
<action type="fix" date="2019-08-20">
NioZipEncoding#encode could enter an infinite loop for certain
inputs.
</action>
</release>
<release version="1.18" date="2018-08-16"
description="Release 1.18
----------------------------------------
This release changes the OSGi Manifest entry Bundle-SymbolicName from
org.apache.commons.compress to org.apache.commons.commons-compress.
">
<action type="fix" date="2018-06-15" due-to="DidierLoiseau">
The example Expander class has been vulnerable to a path
traversal in the edge case that happens when the target
directory has a sibling directory and the name of the target
directory is a prefix of the sibling directory's name.
</action>
<action issue="COMPRESS-456" type="fix" date="2018-06-19">
Changed the OSGi Import-Package to also optionally import
javax.crypto so encrypted archives can be read.
</action>
<action issue="COMPRESS-457" type="fix" date="2018-07-01">
Changed various implementations of the close method to better
ensure all held resources get closed even if exceptions are
thrown during the closing the stream.
</action>
<action issue="COMPRESS-455" type="fix" date="2018-07-01">
ZipArchiveInputStream can now detect the APK Signing Block
used in signed Android APK files and treats it as an "end of
archive" marker.
</action>
<action issue="COMPRESS-459" type="fix" date="2018-07-11"
due-to="Jens Reimann">
The cpio streams didn't handle archives using a multi-byte
encoding properly.
</action>
<action issue="COMPRESS-460" type="add" date="2018-07-28"
due-to="Carmi Grushko">
It is now possible to specify the arguments of zstd-jni's
ZstdOutputStream constructors via Commons Compress as well.
</action>
<action issue="COMPRESS-463" type="fix" date="2018-08-09">
ZipArchiveInputStream#read would silently return -1 on a
corrupted stored entry and even return > 0 after hitting the
end of the archive.
</action>
<action issue="COMPRESS-462" type="fix" date="2018-08-10">
ArArchiveInputStream#read would allow to read from the stream
without opening an entry at all.
</action>
</release>
<release version="1.17" date="2018-06-03"
description="Release 1.17">
<action type="fix" date="2018-02-06">
Removed the objenesis dependency from the pom as it is not
needed at all.
</action>
<action issue="COMPRESS-446" type="fix" date="2018-03-29">
Fixed resource leak in ParallelScatterZipCreator#writeTo.
</action>
<action type="update" date="2018-04-01" due-to="Marchenko Sergey">
Fixed some code examples.
Github Pull Request #63.
</action>
<action issue="COMPRESS-447" type="fix" date="2018-04-22">
Certain errors when parsing ZIP extra fields in corrupt
archives are now turned into ZipException, they used to
manifest as ArrayIndexOutOfBoundsException before.
</action>
<action issue="COMPRESS-445" type="update" date="2018-04-22"
due-to="Andreas Beeker">
The streams returned by ZipFile and most other decompressing
streams now provide information about the number of compressed
and uncompressed bytes read so far. This may be used to detect
a ZipBomb if the compression ratio exceeds a certain
threshold, for example.
For SevenZFile a new method returns the statistics for the
current entry.
</action>
<action issue="COMPRESS-443" type="add" date="2018-04-25">
Added a unit test that is supposed to fail if we break the
OSGi manifest entries again.
</action>
<action issue="COMPRESS-449" type="add" date="2018-05-02">
Add a new SkipShieldingInputStream class that can be used with
streams that throw an IOException when skip is invoked.
</action>
<action issue="COMPRESS-451" type="fix" date="2018-05-04">
IOUtils.copy now verifies the buffer size is bigger than 0.
</action>
<action issue="COMPRESS-452" type="add" date="2018-05-09">
New constructors have been added to SevenZFile that accept
char[]s rather than byte[]s in order to avoid a common error
of using the wrong encoding when creating the byte[]. This
change may break source compatibility for client code that
uses one of the constructors expecting a password and passes
in null as password. We recommend to change the code to use a
constructor without password argument.
</action>
<action issue="COMPRESS-453" type="update" date="2018-05-24">
Added a workaround for a bug in AdoptOpenJDK for S/390 to
BZip2CompressorInputStream.
</action>
<action issue="COMPRESS-454" type="fix" date="2018-05-30">
ZipArchiveInputStream failed to read some files with stored
entries using a data descriptor.
</action>
</release>
<release version="1.16.1" date="2018-02-10"
description="Release 1.16.1">
<action issue="COMPRESS-442" type="fix" date="2018-02-06">
Fixed the OSGi manifest entry for imports that has been broken
in 1.16.
</action>
</release>
<release version="1.16" date="2018-02-05"
description="Release 1.16">
<action issue="COMPRESS-423" type="add" date="2017-10-17"
due-to="Andre F de Miranda">
Add read-only support for Zstandard compression based on the
Zstd-jni project.
</action>
<action issue="COMPRESS-425" type="add" date="2017-10-22">
Added auto-detection for Zstandard compressed streams.
</action>
<action issue="COMPRESS-430" type="fix" date="2017-11-25"
due-to="Bruno P. Kinoshita">
Synchronized iteration over a synchronizedList in ParallelScatterZipCreator.
</action>
<action issue="COMPRESS-432" type="fix" date="2017-12-22">
ZipFile could get stuck in an infinite loop when parsing ZIP
archives with certain strong encryption headers.
</action>
<action issue="COMPRESS-435" type="update" date="2017-12-27"
due-to="BELUGA BEHR">
Replaces instanceof checks with a type marker in LZ77 support code.
</action>
<action issue="COMPRESS-426" type="add" date="2017-12-28">
Added write-support for Zstandard compression.
</action>
<action issue="COMPRESS-424" type="fix" date="2017-12-30">
Added improved checks to detect corrupted bzip2 streams and
throw the expected IOException rather than obscure
RuntimeExceptions.
</action>
<action type="update" date="2018-01-04">
Updated XZ for Java dependency to 1.8 in order to pick up bug
fix to LZMA2InputStream's available method.
</action>
<action type="update" date="2018-01-05" issue="COMPRESS-429"
due-to="Damiano Albani">
ZipArchiveEntry now exposes how the name or comment have been
determined when the entry was read.
</action>
<action issue="COMPRESS-380" type="add" date="2018-01-09"
due-to="Christian Marquez Grabia">
Added read-only DEFLATE64 support to ZIP archives and as
stand-alone CompressorInputStream.
</action>
<action issue="COMPRESS-438" type="update" date="2018-01-10">
ZipFile.getInputStream will now always buffer the stream
internally in order to improve read performance.
</action>
<action issue="COMPRESS-440" type="update" date="2018-01-12"
due-to="Dawid Weiss">
Speed improvement for DEFLATE64 decompression.
</action>
<action issue="COMPRESS-437" type="add" date="2018-01-13">
Added read-only DEFLATE64 support to 7z archives.
</action>
<action issue="COMPRESS-436" type="update" date="2018-01-14">
Added a few extra sanity checks for the rarer compression
methods used in ZIP archives.
</action>
<action issue="COMPRESS-441" type="update" date="2018-01-14">
Simplified the special handling for the dummy byte required by
zlib when using java.util.zip.Inflater.
</action>
<action type="update" date="2018-01-18" due-to="Shahab Kondri">
Various code cleanups.
Github Pull Request #61.
</action>
<action type="update" date="2018-01-29">
TarArchiveEntry's preserveLeadingSlashes constructor argument
has been renamed and can now also be used to preserve the
drive letter on Windows.
</action>
</release>
<release version="1.15" date="2017-10-17"
description="Release 1.15
----------------------------------------
TarArchiveOutputStream now ensures record size is 512 and block size is
a multiple of 512 as any other value would create invalid tar
archives. This may break compatibility for code that deliberately
wanted to create such files.">
<action issue="COMPRESS-394" type="fix" date="2017-05-22">
Make sure "version needed to extract" in local file header and
central directory of a ZIP archive agree with each other.
Also ensure the version is set to 2.0 if DEFLATE is used.
</action>
<action issue="COMPRESS-395" type="fix" date="2017-05-22">
Don't use a data descriptor in ZIP archives when copying a raw
entry that already knows its size and CRC information.
</action>
<action issue="COMPRESS-413" type="fix" date="2017-05-22" due-to="Simon Spero">
Travis build redundantly repeats compilation and tests redundantly #43.
</action>
<action issue="COMPRESS-397" type="add" date="2017-05-22">
Added magic MANIFEST entry Automatic-Module-Name so the module
name will be org.apache.commons.compress when the jar is used
as an automatic module in Java9.
</action>
<action issue="COMPRESS-396" type="fix" date="2017-05-23">
The MANIFEST of 1.14 lacks an OSGi Import-Package for XZ for
Java.
</action>
<action issue="COMPRESS-406" type="fix" date="2017-06-12"
due-to="Simon Spero">
BUILDING.md now passes the RAT check.
</action>
<action issue="COMPRESS-405" type="add" date="2017-06-15"
due-to="Simon Spero ">
Added a new utility class FixedLengthBlockOutputStream that
can be used to ensure writing always happens in blocks of a
given size.
</action>
<action issue="COMPRESS-412" type="fix" date="2017-06-17"
due-to="Michael Hausegger">
Made sure ChecksumCalculatingInputStream receives valid
checksum and input stream instances via the constructor.
</action>
<action issue="COMPRESS-407" type="fix" date="2017-06-24"
due-to="Simon Spero ">
TarArchiveOutputStream now verifies the block and record sizes
specified at construction time are compatible with the tar
specification. In particular 512 is the only record size
accepted and the block size must be a multiple of 512.
At the same time the default block size in
TarArchiveOutputStream has been changed from 10240 to 512
bytes.
</action>
<action issue="COMPRESS-400" type="add" date="2017-06-26"
due-to="Simon Spero ">
It is now possible to specify/read custom PAX headers when
writing/reading tar archives.
</action>
<action issue="COMPRESS-415" type="fix" date="2017-06-27">
Fixed class names of CpioArchiveEntry and
CpioArchiveInputStream in various Javadocs.
</action>
<action issue="COMPRESS-416" type="fix" date="2017-07-04"
due-to="Simon Spero ">
The code of the extended timestamp zip extra field incorrectly
assumed the time was stored as unsigned 32-bit int and thus
created incorrect results for years after 2037.
</action>
<action issue="COMPRESS-410" type="fix" date="2017-07-05"
due-to="Simon Spero ">
Removed ZipEncoding code that became obsolete when we started
to require Java 5 as baseline long ago.
</action>
<action issue="COMPRESS-417" type="fix" date="2017-07-19">
The tar package will no longer try to parse the major and
minor device numbers unless the entry represents a character
or block special file.
</action>
<action issue="COMPRESS-421" type="fix" date="2017-10-06"
due-to="Roel Spilker">
When reading tar headers with name fields containing embedded
NULs, the name will now be terminated at the first NUL byte.
</action>
<action issue="COMPRESS-409" type="fix" date="2017-10-08">
Simplified TarArchiveOutputStream by replacing the internal
buffering with new class FixedLengthBlockOutputStream.
</action>
</release>
<release version="1.14" date="2017-05-14"
description="Release 1.14">
<action issue="COMPRESS-378" type="fix" date="2017-01-09">
SnappyCompressorInputStream slides the window too early
leading to ArrayIndexOutOfBoundsExceptions for some streams.
</action>
<action issue="COMPRESS-246" type="add" date="2017-01-10">
Added write support for Snappy.
</action>
<action issue="COMPRESS-358" type="update" date="2017-01-10">
The blocksize for FramedSnappyCompressorInputStream can now be
configured as some IWA files seem to be using blocks larger
than the default 32k.
</action>
<action issue="COMPRESS-379" type="fix" date="2017-01-15"
due-to="Guillaume Boué">
ZipArchiveEntry#isUnixSymlink now only returns true if the
corresponding link flag is the only file-type flag set.
</action>
<action issue="COMPRESS-271" type="add" date="2017-02-07">
Added support for LZ4 (block and frame format).
</action>
<action type="update" date="2017-02-15" due-to="Thomas Meyer">
BZip2CompressorInputstream now uses BitInputStream internally.
Pull Request #13.
</action>
<action type="fix" date="2017-03-29" due-to="Daniel Collin">
Fixed an integer overflow in CPIO's CRC calculation.
Pull Request #17.
</action>
<action issue="COMPRESS-385" type="add" date="2017-04-18">
Add static detect(InputStream in) to CompressorStreamFactory
and ArchiveStreamFactory
</action>
<action issue="COMPRESS-387" type="fix" date="2017-04-18">
Make unit tests work on Windows paths with spaces in their names.
</action>
<action issue="COMPRESS-388" type="update" date="2017-04-25"
due-to="Zbynek Vyskovsky">
Improved performance for concurrent reads from ZipFile when
reading from a file.
</action>
<action issue="COMPRESS-382" type="add" date="2017-04-25"
due-to="Tim Allison">
Added a way to limit amount of memory ZCompressorStream may
use.
</action>
<action issue="COMPRESS-386" type="add" date="2017-04-25"
due-to="Tim Allison">
Added a way to limit amount of memory ZCompressorStream may
use.
</action>
<action issue="COMPRESS-382" type="add" date="2017-04-25"
due-to="Tim Allison">
Added a way to limit amount of memory LZMACompressorStream and
XZCompressorInputStream may use.
</action>
<action issue="COMPRESS-389" type="fix" date="2017-04-26">
Internal location pointer in ZipFile could get incremented
even if nothing had been read.
</action>
<action issue="COMPRESS-392" type="add" date="2017-05-02" due-to="Philippe Mouawad">
Add Brotli decoder based on the Google Brotli library.
</action>
<action issue="COMPRESS-390" type="add" date="2017-05-04"
due-to="Zbynek Vyskovsky">
ZipEntry now exposes its data offset.
</action>
<action issue="COMPRESS-393" type="fix" date="2017-05-07">
LZMACompressorOutputStream#flush would throw an exception
rather than be the NOP it promised to be.
</action>
<action issue="COMPRESS-391" type="add" date="2017-05-11"
due-to="Zbynek Vyskovsky">
Using ZipArchiveEntry's setAlignment it is now possible to
ensure the data offset of an entry starts at a file position
that at word or page boundaries.
A new extra field has been added for this purpose.
</action>
</release>
<release version="1.13" date="2016-12-29"
description="Release 1.13 - API compatible to 1.12 but requires Java 7 at runtime.">
<action issue="COMPRESS-360" type="update" date="2016-06-25" dev="ggregory">
Update Java requirement from 6 to 7.
</action>
<action issue="COMPRESS-363" type="fix" date="2016-07-01">
BitInputStream could return bad results when overflowing
internally - if two consecutive reads tried to read more than
64 bits.
</action>
<action issue="COMPRESS-366" type="update" date="2016-10-07">
Clarified which TarArchiveEntry methods are useless for
entries read from an archive.
</action>
<action issue="COMPRESS-364" type="fix" date="2016-10-07"
due-to="Mike Mole">
ZipArchiveInputStream.closeEntry does not properly advance to
next entry if there are junk bytes at end of data section
</action>
<action issue="COMPRESS-327" type="add" date="2016-10-12">
SevenZFile, SevenZOutputFile, ZipFile and
ZipArchiveOutputStream can now work on non-file resources if
they can be accessed via SeekableByteChannel.
</action>
<action issue="COMPRESS-368" type="add" date="2016-11-15">
Allow compressor extensions through a standard JRE ServiceLoader.
</action>
<action issue="COMPRESS-369" type="add" date="2016-11-15">
Allow archive extensions through a standard JRE ServiceLoader.
</action>
<action issue="COMPRESS-373" type="add" date="2016-11-29">
Add write support for the legacy LZMA format, this requires XZ
for Java 1.6.
</action>
<action issue="COMPRESS-374" type="add" date="2016-11-29">
Add write support for the legacy LZMA stream to 7z, this
requires XZ for Java 1.6.
</action>
<action issue="COMPRESS-375" type="add" date="2016-12-04"
due-to="Plamen Totev">
Allow the clients of ParallelScatterZipCreator to provide
ZipArchiveEntryRequestSupplier.
</action>
<action issue="COMPRESS-367" type="fix" date="2016-12-09"
due-to="Mike Mole">
ZipArchiveInputStream now throws an Exception if it encounters
a broken ZIP archive rather than signaling end-of-archive.
</action>
<action issue="COMPRESS-377" type="fix" date="2016-12-20">
ScatterZipOutputStream didn't close the StreamCompressor
causing a potential resource leak.
</action>
<action issue="COMPRESS-372" type="add" date="2016-12-20">
Add a version-independent link to the API docs of the latest
release.
</action>
</release>
<release version="1.12" date="2016-06-21"
description="Release 1.12 - API compatible to 1.11 but requires Java 6 at runtime.
------------
Release 1.12 changes the behavior of BZip2CompressorOutputStream's
finalize method so that it no longer invokes finish. This is going to
break code that relied on the finalizer to clean up an unfinished
stream. The code will need to be changed to call finish or
close itself. Note that a finalizer is not guaranteed to run, so
the feature was not 100% effective in any case.
">
<action issue="COMPRESS-349" type="update" date="2016-04-09" dev="ggregory">
Update requirement from Java 5 to 6.
</action>
<action issue="COMPRESS-350" type="update" date="2016-04-09" dev="ggregory">
TarArchiveEntry wastefully allocates empty arrays.
</action>
<action issue="COMPRESS-348" type="fix" date="2016-04-24">
SevenZFile.read() throws an IllegalStateException for empty entries.
</action>
<action issue="COMPRESS-353" type="update" date="2016-05-06" dev="ggregory">
Javadoc for BZip2CompressorInputStream(InputStream, boolean) should refer to IOEx, not NPE.
</action>
<action issue="COMPRESS-354" type="update" date="2016-05-16">
PureJavaCrc32C in the snappy package is now final so it is now
safe to call a virtual method inside the constructor.
</action>
<action issue="COMPRESS-355" type="fix" date="2016-05-20"