JLine 4.5.0

JLine 4.5.0 brings four security fixes, two new features, twenty bug fixes, and a batch of maintenance improvements.

This release addresses four moderate-severity vulnerabilities: a heap overflow in the native CLibrary.ioctl() binding, world-readable editor temp files, history expansion applied to masked (password) input, and a multi-frame bypass of the NEW-ENVIRON variable limit in the Telnet server. It also hardens WebTerminal against DNS rebinding and clickjacking, and fixes a broad set of reader/terminal correctness issues contributed by the community.

🔒 Security Fixes

• GHSA-p73x-fv3x-mvv6 — Prevent heap overflow in CLibrary.ioctl(int, long, int[]) (#2412) @gnodet
• GHSA-7whq-538g-8928 — Create editor temp files with owner-only permissions (#2343) @uchiha-bug-hunter
• GHSA-rcc3-r7r7-qvg2 — Skip history expansion for masked input (#2346) @uchiha-bug-hunter
• GHSA-7qh2-r6cc-r47w — Enforce NEW-ENVIRON variable limit across frames to prevent memory exhaustion (#2415) @gnodet

✨ New Features

• Allow disabling the JLine shutdown hook (#2325) @ItsDeadlyProgrammer
• Use detailed command description via describe() in command help (#2318) @FSeidinger

🐛 Bug Fixes

• Resolve the Nano overwrite check against the editor root (#2414) @uchiha-bug-hunter
• Add mach_absolute_time() fallback for clock_gettime on macOS and mac-x86 target (#2410) @gnodet
• Match multi-line history entries against history-ignore (#2406) @uchiha-bug-hunter
• Keep text killed at masked prompts out of the shared kill ring (#2356) @uchiha-bug-hunter
• Buffer the output of dumb system terminals (#2353) @Pankraz76
• AnsiConsole asks the terminal's own provider whether the other stream is a TTY (#2352) @knutwannheden
• Forbid framing of the WebTerminal page (#2351) @uchiha-bug-hunter
• Drop 8-bit C1 control sequences in ansiAppend (#2350) @uchiha-bug-hunter
• Skip history expansion for masked input (#2346) @uchiha-bug-hunter
• Reject DNS-rebound Host headers in WebTerminal (#2345) @uchiha-bug-hunter
• Stop treating ambiguous and neutral symbols as wide in WCWidth (#2344) @wleeaf
• Use Locale.ROOT when converting terminal flag and OS names (#2342) @vidhan843426
• NonBlockingReader.available() always returns 0 (#2339) @gnodet
• Honor buffer ranges and cached EOF in nonblocking readers (#2337) @PHJ2000
• Honor echo flags for line discipline signal characters (#2336) @PHJ2000
• Preserve incremental search prompts with autosuggestions (#2335) @PHJ2000
• Clear tail tips when setTailTip receives null (#2334) @PHJ2000
• Retain reader cursor tracking on status resize (#2326) @snowyukitty
• AnsiConsole.systemInstall() no longer redirects the non-terminal stream to the wrong fd (#2317) @gnodet

🧰 Maintenance

• Make history trimming linear instead of quadratic (#2413) @ptweezy
• Rework native library generation: Docker cross-compilation infrastructure with automated CI rebuild workflow and macOS crossbuild images (#2411) @gnodet
• Unify OSC/non-OSC string states with belTerminatesString flag (#2372) @gnodet