DJL v0.37.0 Release

This is the v0.37.0 release of DJL.

Changes

• Bundled .java compilation and remote URL loading are now configurable, with tightened defaults (#3875)
• Bumped log4j to 2.26.0 (#3877)
• onnxruntime: allow sub-managers after NDManager.cap() (#3870)
• Docs: fixed a typo (#3874)

Behavior changes

Two loading behaviors changed their defaults in #3875. Both previous behaviors remain available, but from this release each has to be enabled explicitly:

Behavior	Default	To restore
Compile bundled .java sources at model load	off	DJL_COMPILE_JAVA=true or -Dai.djl.compile_java=true
Unrestricted remote URL loading	off	DJL_ALLOW_INSECURE_URL=true or -Dai.djl.allow_insecure_url=true

Utils.openUrl now limits remote fetches to public http(s) destinations, resolves redirects explicitly with a bounded hop count, and allows file: and jar: only where they denote a local read. Loading from local directories, s3://, gs://, public http(s) archives, the djl:// model zoo and Hugging Face is unchanged. See the PR description for the full list and the flags.

Known issues / limitations

• A model whose translator is available only as a raw .java file under lib/classes/ will not have it compiled by default; an error-level log names the flag. Models shipping a precompiled .class or .jar, or supplying a translator programmatically, are unaffected.
• Loading a model over http(s) from a host that resolves to a private address now fails by default. Set the flag above if you serve models from an internal mirror.

Contributors

Thank you to the following community members for contributing to this release:

Rohit Kumar Srivastava, Vaibhav Srivastava, dev_Hakaze