A local information disclosure vulnerability in TemporaryFolder has been fixed. See the published security advisory for details.
Pull request #1669: Make FrameworkField constructor public
Prior to this change, custom runners could make FrameworkMethod instances, but not FrameworkField instances. This small change allows for both now, because FrameworkField's constructor has been promoted from package-private to public.