Release v4.11.2
Release v4.11.2
jsoup 1.24.1
jsoup 1.24.1 is out now, with major improvements to CSS selectors and HTML parsing.
This release introduces an opt-in Web query mode, bringing selector behavior closer to CSS and browser DOM standards. It also adds new selectors and improves the correctness and performance of :has() queries. Web mode will become the default in 1.25.1; the selector migration guide explains how to get ready.
HTML parsing is now more closely aligned with the current HTML standard, including improvements to tables, formatting elements, templates, and customizable select elements. This release also adds processing instruction support, and includes a number of performance improvements and bug fixes.
There are some changes to existing behavior, including :root matching and limits on Response.bodyStream(). Please make sure to review the changes below before upgrading.
jsoup is a Java library for working with real-world HTML and XML. It provides a very convenient API for extracting and manipulating data, using the best of HTML5 DOM methods and CSS selectors.
Download jsoup now.
- Added an opt-in Web query mode to align jsoup's selectors with CSS and Web DOM standards. See the selector migration guide for more details. #2642
- Enable with
System.setProperty("jsoup.queryMode", "web"). Queries return matching descendants only, can match surrounding ancestors, and follow HTML/XML case rules. Attribute~=matches whitespace separated tokens instead of regexes. - You can
jsoup.queryMode=checkto help prepare for Web mode. Selectors return legacy results and print differences tostderr, with caller locations to help identify affected code. - Added
:scope,:matchesAttr(name, regex),|=attribute matching, and attribute case flagsiands. These work in both legacy and Web modes, so queries can be updated before switching modes. - Web mode will become the default in 1.25.1 and the only mode in 1.26.1.
- Enable with
- Added support for parsing processing instructions in HTML and XML, as
ProcessingInstructionnodes. This supports marker nodes such as<?marker name="country-options"?>, matched by<template for="country-options">in the HTML Standard's new declarative streaming syntax. Processing instructions can be selected with::pior::pi(target), and their data can be read and changed through the node's attribute methods. Change: when using the XML parser, ordinary<?target ...?>nodes are now represented byProcessingInstructioninstead ofXmlDeclaration; the<?xml ...?>declaration remains anXmlDeclaration. #2613 - Added
Parser.parseAttributes(String)to parse an attribute fragment using that parser's settings. :has()selectors with child and sibling combinators now run faster by limiting the search to the parts of the document where they can match. This particularly improves selectors such as:has(> a),:has(+ dd), and:has(+ div span). #2610- SVG-specific tag and attribute names are now automatically case corrected (e.g.
pathlengthbecomespathLength) when parsing HTML. #2630 - Improved the HTML parse across document boundaries by handling whitespace separately from subsequent text. This better preserves the input's whitespace through parse and serialize round-trips. #2632
- Improved HTML parsing performance for documents with misplaced elements, and DOM update performance. #2646
- Removed APIs previously deprecated and scheduled for removal in 1.24.1. #2597
Response.bodyStream()now observes the configured max body size and request timeout, consistent with the other response body methods. The default max size is 2 MB. You can configure that withmaxBodySize(0)before executing the request to disable the cap.Response.isTruncated()reports when the decoded response content exceeded the configured limit. #2598- Query selector parsing now limits each query to 128 structural steps, counting combinators, node selectors, and
:has(),:is(), and:not()expressions together. More complex queries throwSelectorParseExceptionduring parsing. Attributes.equals()andhashCode()now exclude internal attributes, such as source ranges and user data. #2633
- Corrected
:rootto match the tree's root element in both query modes. Previously, it matched the element the query was called on. Use:scopeto refer to that element. - Standardized parser normalization of tag and attribute names so that HTML comparisons use ASCII-only case folding, and accepted control characters are preserved, aligning name handling to the HTML and XML specs. #2594
- Named character references without a semicolon before
-or_now decode correctly in attribute values, matching HTML and browser behavior (e.g.,©-becomes©-). #2588 - Support downloads > 2GB via
Response.bodyStream()whenmaxBodySize(0)is configured. #2593 - Updated table and table-fragment parsing to place misnested content correctly per the HTML5 spec. For example,
<table><b><p>X</b>places the paragraph before the table. #2601 StreamParsernow preserves its progress if you use the sameParserto parse another document, or callElement.append(String)on a streamed element. Previously, these operations replaced the active parse state and prevented streaming from continuing correctly. #2605- Updated the adoption-agency algorithm to match the current HTML5 spec and to preserve formatting order when recovering misnested elements. #2604
:has()now correctly matches sibling alternatives and descendants of siblings. Given<div id=a></div><div><span></span></div>, both#a:has(+ div, > span)and#a:has(+ div span)select#a. #2610- Within node selectors,
:not()now correctly applies:contains()and:matches()to the node value. For example,::comment:not(:contains(foo))excludes comments containingfoo. #2610 - Updated
<select>parsing to the current HTML spec, retaining elements such as buttons and other markup that the previous rules discarded. #2611 - Template parsing now closes unclosed templates at EOF and handles forms correctly in template documents and fragments. #2614
- Fixed handling of null characters and initial newlines in HTML to better match the HTML spec, including
pre,listing, andtextareaelements. Leading newlines in these elements' text are preserved when saving and reparsing HTML. #2616 - Fixed several HTML parsing edge cases across malformed doctypes, misplaced text in tables, and whitespace in framesets to match the HTML spec. #2618
- If a HTML void element ends up with children (via DOM manipulation), those are no longer serialized in
html(). #2619 - Fixed a
ConcurrentModificationExceptionwhen emptying and reading separate childless elements concurrently. #2620 - Removed the old
command,device, andmenuitemtags, as they are no longer in the HTML spec. #2621 - Double-escaped script tags in body were being closed too early. #2627
Node.before(Node)andNode.after(Node)now leave the document unchanged when given the node itself, instead of throwing aNullPointerException. #2628- Fixed HTML parse of
<dialog>,<main>, and<search>so their start and end tags close open paragraphs correctly. #2629 - Updated the parse of malformed end tags such as
</ COMMENT >to match the spec (<!-- COMMENT -->). #2631 - Source position tracking no longer impacts the adoption algo when repeated HTML formatting tags are reconstructed after a paragraph closes. #2633
- Fixed fragment parsing to ignore
<body>and<frameset>start tags when the second open element is notbody, matching the HTML spec. #2634 - Updated how the tokeniser handles malformed doctypes, to remove duplicative tokens and error messages. #2635
- Corrected HTML tokenisation of malformed comments such as
<!---xand incomplete start tags such as<p id=, and improved their error reporting. #2636 - Fixed
FormElement.empty()retaining associations with removed controls. If an input node removed byempty()was subsequently inserted outside its original form, it could incorrectly reappear in that form'selements()andformData()results. #2646
My sincere thanks to everyone who contributed to this release! If you have any suggestions for the next release, I would love to hear them; please get in touch via jsoup discussions, or with me directly.
You can also follow me (@jhy@tilde.zone) on Mastodon (Fediverse) to receive occasional notes about jsoup releases.
netty-4.1.140.Final
- https://github.com/netty/netty/security/advisories/GHSA-m77g-r4c7-3w77 - out-of-bounds read in
netty-buffer - https://github.com/netty/netty/security/advisories/GHSA-rx4g-qxm6-238r - out-of-bounds read in
netty-buffer - https://github.com/netty/netty/security/advisories/GHSA-cqmg-wc9g-fpj8 - insufficient entropy in
netty-resolver-dns - https://github.com/netty/netty/security/advisories/GHSA-hc9x-r52h-gh4x - unbounded memory usage in
netty-codec-http2 - https://github.com/netty/netty/security/advisories/GHSA-42mp-m8rq-6rgj - insufficient control character neutralization in
netty-codec-http - https://github.com/netty/netty/security/advisories/GHSA-qhw9-p586-v948 - out-of-bounds read in
netty-buffer - https://github.com/netty/netty/security/advisories/GHSA-84gx-4cj4-rm7q - unbounded memory usage in
netty-codec-mqtt - https://github.com/netty/netty/security/advisories/GHSA-6xv6-9mgg-mfvc - mTLS auth bypass via session resumption in
netty-handler
- Auto-port 4.1: Reject Redis lines that start with LF by @netty-project-bot in https://github.com/netty/netty/pull/17806
- Auto-port 4.1: Do not let a negatively cached search domain shadow a positive one by @netty-project-bot in https://github.com/netty/netty/pull/17805
- Port 4.1: Choose server key types from client's signature algorithms for TLS 1.3 (#17764) by @normanmaurer in https://github.com/netty/netty/pull/17809
- Port 4.1: LocalChannel: Deliver data written by the peer before it closed (#17814) by @normanmaurer in https://github.com/netty/netty/pull/17815
- Port 4.1: Validate padding of HEADERS frames without priority (#17817) by @normanmaurer in https://github.com/netty/netty/pull/17819
- Port 4.1: Don't spin in SslHandler.wrapMultiple(...) when the engine consumes nothing (#17728) by @normanmaurer in https://github.com/netty/netty/pull/17822
- Port 4.1: Preserve invalid SNI names in
ReferenceCountedOpenSslEngine(#17781) by @normanmaurer in https://github.com/netty/netty/pull/17824 - Auto-port 4.1: Optimize redundant bounds checking in ByteBuf.setBytes by @netty-project-bot in https://github.com/netty/netty/pull/17827
- Port 4.1: Release the DNS response when a query future loses a cancel race (#17475) by @normanmaurer in https://github.com/netty/netty/pull/17828
- Auto-port 4.1: Fix HpackDynamicTable losing entries when filled to capacity by @netty-project-bot in https://github.com/netty/netty/pull/17846
- Port 4.1: Throw UnsupportedOperationException from AdaptiveByteBuf.memoryAddress() without an address (#17820) by @normanmaurer in https://github.com/netty/netty/pull/17842
- Port 4.1: Handle ed25519 and ed448 names in SignatureAlgorithmConverter (#17689) by @normanmaurer in https://github.com/netty/netty/pull/17850
- Auto-port 4.1: HAProxyMessage: validate the length of all TLV types by @netty-project-bot in https://github.com/netty/netty/pull/17845
- Port 4.1: Validate bzip2 Huffman code lengths before building decode tables (#17812) by @normanmaurer in https://github.com/netty/netty/pull/17855
- Port 4.1: Validate header values on DefaultHeaders.copy(), bulk add, entry setValue and ReadOnlyHttpHeaders (#17841) by @normanmaurer in https://github.com/netty/netty/pull/17854
- Port 4.1: Fix typos in comments/javadoc (#17390) by @normanmaurer in https://github.com/netty/netty/pull/17863
- Auto-port 4.1: HAProxyMessageEncoder: encode v1 PROXY UNKNOWN headers by @netty-project-bot in https://github.com/netty/netty/pull/17860
- Port 4.1: Throw DecompressionException on JdkZlib preset dictionary mismatch (#17838) by @normanmaurer in https://github.com/netty/netty/pull/17864
- Port 4.1: Fix silent failures and optimize error short-circuit in multi-threaded tests (#17106) by @normanmaurer in https://github.com/netty/netty/pull/17865
- Port 4.1: Apply certificate list size floor (#17674) by @normanmaurer in https://github.com/netty/netty/pull/17861
- Auto-port 4.1: Reject HTTP version numbers that overflow int by @netty-project-bot in https://github.com/netty/netty/pull/17859
- Port 4.1: HAProxyMessage: decode TLVs with an empty value at the end of the header (#17835) by @normanmaurer in https://github.com/netty/netty/pull/17877
- Port 4.1: Honor maxAllocation for brotli in DelegatingDecompressorFrameListener by @normanmaurer in https://github.com/netty/netty/pull/17881
- Auto-port 4.1: Reject invalid content-length in PUSH_PROMISE with a stream error by @netty-project-bot in https://github.com/netty/netty/pull/17875
- Auto-port 4.1: HAProxyMessageDecoder: fix v2 header framing with a non-zero reader index by @netty-project-bot in https://github.com/netty/netty/pull/17882
- Auto-port 4.1: IpSubnetFilter: Add tests for overlapping rules by @netty-project-bot in https://github.com/netty/netty/pull/17889
- Auto-port 4.1: Skip JNDI nameserver lookup on IBM i by @netty-project-bot in https://github.com/netty/netty/pull/17892
- Auto-port 4.1: Reset the h2c upgrade stream if the request can not be converted by @netty-project-bot in https://github.com/netty/netty/pull/17893
- Auto-port 4.1: Fix NPE in Http2FrameCodec when h2c upgrade fails by @netty-project-bot in https://github.com/netty/netty/pull/17899
- Auto-port 4.1: Don't size ZstdDecoder output buffers from the frame content size by @netty-project-bot in https://github.com/netty/netty/pull/17900
- Auto-port 4.1: Allow adaptive allocator magazine cleanup in BlockHound by @netty-project-bot in https://github.com/netty/netty/pull/17905
- Auto-port 4.1: Don't lose frames when a delimiter is split across reads by @netty-project-bot in https://github.com/netty/netty/pull/17909
- Port 4.1: Read SOCKS5 length octets unsigned in the legacy socks decoders (#17912) by @normanmaurer in https://github.com/netty/netty/pull/17916
- Port 4.1: Fix truncated output in Brotli decoders (#17870) by @normanmaurer in https://github.com/netty/netty/pull/17923
- Auto-port 4.1: Use assertInstanceOf/assertThrows instead of assertTrue/fail idioms in tests (#17633) by @normanmaurer in https://github.com/netty/netty/pull/17918
- Port: Wrap trailing ';' in Content-Disposition as ErrorDataDecoderException (#17895) by @chrisvest in https://github.com/netty/netty/pull/17931
- Port 4.1: Limit the number of queued tasks in NioEventLoopTest.testTaskRemovalOnShutdownThrowsNoUnsupportedOperationException (#17924) by @normanmaurer in https://github.com/netty/netty/pull/17930
- Kqueue: Deregister filters before closing the fd to avoid hitting a reused fd by @normanmaurer in https://github.com/netty/netty/pull/17939
- Auto-port 4.1: Keep WINDOW_UPDATE credit of reserved HTTP/2 streams on activation by @netty-project-bot in https://github.com/netty/netty/pull/17935
- Accept empty non-final fragments in PerMessageDeflateEncoder (#17943) by @chrisvest in https://github.com/netty/netty/pull/17953
- Verify toolchain downloads in release Dockerfiles against pinned SHA-256 (#17935) (#17940) by @normanmaurer in https://github.com/netty/netty/pull/17956
- Increase poll timeout in HttpContentCompressorTest.testExecutorPreserveOrdering by @normanmaurer in https://github.com/netty/netty/pull/17962
- Auto-port 4.1: HTTP/2: Don't pass the close promise to a deferred close by @netty-project-bot in https://github.com/netty/netty/pull/17959
- Port 4.1: Fix flaky Http2MultiplexTest.unhandledHttp2FramesShouldBePropagated (#17958) by @normanmaurer in https://github.com/netty/netty/pull/17964
- Auto-port 4.1: Kqueue: Add testsuite on macOS during PR validation by @netty-project-bot in https://github.com/netty/netty/pull/16471
- Auto-port 4.1: Fix endless value iterators in ReadOnlyHttpHeaders by @netty-project-bot in https://github.com/netty/netty/pull/17978
- Auto-port 4.1: Don't drop the last character in AsciiString.trim(CharSequence) by @netty-project-bot in https://github.com/netty/netty/pull/17993
- Auto-port 4.1: Fix the region copied by Unpooled.copiedBuffer(CharSequence, int, int, Charset) by @netty-project-bot in https://github.com/netty/netty/pull/17995
- Auto-port 4.1: Add HpackDecoder test for non-token HTTP/2 header names by @netty-project-bot in https://github.com/netty/netty/pull/17992
- Auto-port 4.1: Fix AsciiString.contains(...) false negatives after a partial match by @netty-project-bot in https://github.com/netty/netty/pull/17986
- Port 4.1: Fix flaky DatagramUnicastIPv6MappedTest on macOS (#17981) by @normanmaurer in https://github.com/netty/netty/pull/17989
- Auto-port 4.1: Treat DATA frames on reserved HTTP/2 streams as a connection error by @netty-project-bot in https://github.com/netty/netty/pull/17998
- Auto-port 4.1: Reject reply codes with non-digit characters in SmtpResponseDecoder by @netty-project-bot in https://github.com/netty/netty/pull/18005
- Port 4.1: Don't loop forever in AbstractDiskHttpData when the file is short (#17973) by @normanmaurer in https://github.com/netty/netty/pull/18004
- Auto-port 4.1: Http2: reject generic frames whose payload exceeds SETTINGS_MAX_FRAME_SIZE by @netty-project-bot in https://github.com/netty/netty/pull/18000
- Auto-port 4.1: Return null or the default from read-only headers for invalid values by @netty-project-bot in https://github.com/netty/netty/pull/18017
- Port 4.1: Check the second gzip magic byte in JdkZlibDecoder (#17972) by @normanmaurer in https://github.com/netty/netty/pull/18007
- Fix server-initiated WebSocket close handshake failing with "promise already done" (#17983) by @chrisvest in https://github.com/netty/netty/pull/18032
- Auto-port 4.1: Fix Snappy.encode(...) for input with a non-zero reader index by @netty-project-bot in https://github.com/netty/netty/pull/18031
- Auto-port 4.1: Cancel queued runs and runs of fork PRs when a PR is merged by @netty-project-bot in https://github.com/netty/netty/pull/18033
- Port 4.1: Don't use the network in the OCSP tests (#17908) (#17933) by @normanmaurer in https://github.com/netty/netty/pull/18038
- Port 4.1: MqttEncoder: Reject Variable Byte Integers larger than 268435455 (#17984) by @normanmaurer in https://github.com/netty/netty/pull/18025
- Port 4.1: Add test for DefaultFileRegion beyond 2 GiB and 4 GiB (#18018) by @normanmaurer in https://github.com/netty/netty/pull/18050
- Port 4.1: Only delete socket files when binding and closing UDS channels (#17980) by @normanmaurer in https://github.com/netty/netty/pull/18044
- Auto-port 4.1: Return the haystack's reader index from ByteBufUtil.indexOf(...) for an empty needle by @netty-project-bot in https://github.com/netty/netty/pull/18082
- Auto-port 4.1: Return -1 from StringUtil.decodeHexNibble(byte) for non-ASCII bytes by @netty-project-bot in https://github.com/netty/netty/pull/18083
- Auto-port 4.1: Fail to encode DNS messages that are too large for TCP by @netty-project-bot in https://github.com/netty/netty/pull/18081
- Auto-port 4.1: Don't return an entry twice when removing while iterating a primitive map by @netty-project-bot in https://github.com/netty/netty/pull/18087
- Auto-port 4.1: Mark disk-based HttpData as completed after setting empty content by @netty-project-bot in https://github.com/netty/netty/pull/18088
- Fix out-of-bounds read when validating UDS paths in the native code by @normanmaurer in https://github.com/netty/netty/pull/18016
- Auto-port 4.1: Release a SPDY DATA frame that exceeds the session window by @netty-project-bot in https://github.com/netty/netty/pull/18094
- Auto-port 4.1: Send zero-length datagrams instead of dropping or duplicating them by @netty-project-bot in https://github.com/netty/netty/pull/18107
- Auto-port 4.1: Reject request-only and response-only pseudo-headers in invalid contexts (RFC 9113) by @netty-project-bot in https://github.com/netty/netty/pull/18113
- Port 4.1: Read all pending data when the EOF is received before the connect is complete in kqueue (#18091) by @normanmaurer in https://github.com/netty/netty/pull/18116
- Port: Keep throttling the producer while the executor is shutting down in NioEventLoopTest (#18110) by @chrisvest in https://github.com/netty/netty/pull/18117
- Auto-port 4.1: Read the 4 byte Snappy literal length as unsigned by @netty-project-bot in https://github.com/netty/netty/pull/18120
- Port 4.1: Deliver all data a LocalChannel peer wrote before it closed (#18127) by @normanmaurer in https://github.com/netty/netty/pull/18128
- Port 4.1: Update sdkman sha (#18133) by @normanmaurer in https://github.com/netty/netty/pull/18136
- Auto-port 4.1: Update central-publishing-maven-plugin to 0.12.0 by @netty-project-bot in https://github.com/netty/netty/pull/18142
- Auto-port 4.1: Close an HTTP/2 stream only after its last merged DATA frame was written by @netty-project-bot in https://github.com/netty/netty/pull/18144
- Add JDK27 profiles by @chenrui333 in https://github.com/netty/netty/pull/18099
- Skip certificate verification when downloading the aarch64 toolchain by @normanmaurer in https://github.com/netty/netty/pull/18150
- Port 4.1: Use IP_MULTICAST_IF in leaveGroup and block without an interface (#18122) by @normanmaurer in https://github.com/netty/netty/pull/18152
- Auto-port 4.1: Don't lose the alert when the handshake fails in ReferenceCountedOpen… by @netty-project-bot in https://github.com/netty/netty/pull/18157
- Auto-port 4.1: Add guidance for LLM agents by @netty-project-bot in https://github.com/netty/netty/pull/18177
- Auto-port 4.1: Add a change review skill by @netty-project-bot in https://github.com/netty/netty/pull/18176
- Auto-port 4.1: Send bad_certificate alert when the TrustManager rejects the certificate by @netty-project-bot in https://github.com/netty/netty/pull/18181
- Quote revapi argument by @chrisvest in https://github.com/netty/netty/pull/18185
- Port: SslHandler: Size the unwrap output buffer for the plaintext, not the record (#18028) by @chrisvest in https://github.com/netty/netty/pull/18182
- Port: Add opt-in Origin validation to WebSocketServerProtocolHandler (hardening) (#17944) by @chrisvest in https://github.com/netty/netty/pull/18184
- Fix reporting of the wrong error when setting flags on an accepted fd fails by @normanmaurer in https://github.com/netty/netty/pull/18196
- Epoll: Verify the FileChannel is a FileChannelImpl before reading its fd by @normanmaurer in https://github.com/netty/netty/pull/18190
- KQueue: Verify the FileChannel is a FileChannelImpl before reading its fd by @normanmaurer in https://github.com/netty/netty/pull/18191
- Do not send uninitialized stack memory when sending a fd over a domain socket by @normanmaurer in https://github.com/netty/netty/pull/18197
- Fix read of uninitialized memory when accepting a connection on a domain socket by @normanmaurer in https://github.com/netty/netty/pull/18195
- Epoll: Fix signed integer overflow when calculating the epoll_wait timeout by @normanmaurer in https://github.com/netty/netty/pull/18194
- Fix underflow detection in netty_unix_util_timespec_subtract_ns by @normanmaurer in https://github.com/netty/netty/pull/18193
- Auto-port 4.1: Avoid reverse DNS lookup in IpSubnetFilterTest.testIpFilterRuleHandler by @netty-project-bot in https://github.com/netty/netty/pull/18200
- Port 4.1: Fix flaky SSLEngineTest.testSessionInvalidate with Conscrypt (#18198) by @normanmaurer in https://github.com/netty/netty/pull/18217
- Auto-port 4.1: Update to latest netty-jni-util release by @netty-project-bot in https://github.com/netty/netty/pull/18208
- Port 4.1: Don't encode Snappy copies with an offset that does not fit into 16 bits (#18055) by @normanmaurer in https://github.com/netty/netty/pull/18224
- Auto-port 4.1: Don't truncate binary memcache key and extras lengths by @netty-project-bot in https://github.com/netty/netty/pull/18225
- Auto-port 4.1: Revert "Update central-publishing-maven-plugin to 0.12.0 (#18140)" by @netty-project-bot in https://github.com/netty/netty/pull/18232
- Auto-port 4.1: Update to latest netty-tcnative release by @netty-project-bot in https://github.com/netty/netty/pull/18236
- 4.1 Merge fixes by @chrisvest in https://github.com/netty/netty/pull/18238
- @chenrui333 made their first contribution in https://github.com/netty/netty/pull/18099
Full Changelog: https://github.com/netty/netty/compare/netty-4.1.139.Final...netty-4.1.140.Final
Nightly
- [rb] download the Server jar with Selenium Manager instead of the GitHub API by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/18245
- [java] Escape quotes and backslashes in name locators sent to the driver by @Mochxd in https://github.com/SeleniumHQ/selenium/pull/18151
- [dotnet] [test] Unify assembly names for testing by @nvborisenko in https://github.com/SeleniumHQ/selenium/pull/18261
- [rb] Allocate websocket command ids atomically by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/18262
- [py] Add WebDriver cookie type annotations by @adamtheturtle in https://github.com/SeleniumHQ/selenium/pull/17537
- [py] Deprecate driver.webextension by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/18265
- [py] Return a protocol-neutral driver.script by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/18264
- [build] run the Redis-backed Grid suites from the Java smoke matrix instead of a separate workflow by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/18267
- fix(#18263): keep Selenium Manager stderr empty in --output json by @macoladik in https://github.com/SeleniumHQ/selenium/pull/18268
- [js] hold BiDi numbers to their declared ranges by @saiyam-jain-dev in https://github.com/SeleniumHQ/selenium/pull/18272
- [build] Add weekly CI check for Plausible pageview usage by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17900
- @macoladik made their first contribution in https://github.com/SeleniumHQ/selenium/pull/18268
Full Changelog: https://github.com/SeleniumHQ/selenium/compare/selenium-4.52.0...nightly
netty-4.2.20.Final
- https://github.com/netty/netty/security/advisories/GHSA-m77g-r4c7-3w77 - out-of-bounds read in
netty-buffer - https://github.com/netty/netty/security/advisories/GHSA-v2v6-vch9-4pcg - inefficient CPU computation in
netty-codec-http3 - https://github.com/netty/netty/security/advisories/GHSA-rx4g-qxm6-238r - out-of-bounds read in
netty-buffer - https://github.com/netty/netty/security/advisories/GHSA-cqmg-wc9g-fpj8 - insufficient entropy in
netty-resolver-dns - https://github.com/netty/netty/security/advisories/GHSA-hc9x-r52h-gh4x - unbounded memory usage in
netty-codec-http2 - https://github.com/netty/netty/security/advisories/GHSA-42mp-m8rq-6rgj - insufficient control character neutralization in
netty-codec-http - https://github.com/netty/netty/security/advisories/GHSA-w53r-xhgx-8582 - use-after-free in
netty-codec-classes-quic - https://github.com/netty/netty/security/advisories/GHSA-qhw9-p586-v948 - out-of-bounds read in
netty-buffer - https://github.com/netty/netty/security/advisories/GHSA-84gx-4cj4-rm7q - unbounded memory usage in
netty-codec-mqtt - https://github.com/netty/netty/security/advisories/GHSA-6xv6-9mgg-mfvc - mTLS auth bypass via session resumption in
netty-handlerandnetty-codec-quic
- IoUring: Fix empty writev submissions after sendmsg_zc by @dreamlike-ocean in https://github.com/netty/netty/pull/17782
- Do not let a negatively cached search domain shadow a positive one by @akilegaspi in https://github.com/netty/netty/pull/17623
- Fix musl verify job by @normanmaurer in https://github.com/netty/netty/pull/17801
- Reject Redis lines that start with LF by @yawkat in https://github.com/netty/netty/pull/17793
- Choose server key types from client's signature algorithms for TLS 1.3 by @eager-signal in https://github.com/netty/netty/pull/17764
- Port 4.2: LocalChannel: Deliver data written by the peer before it closed (#17814) by @normanmaurer in https://github.com/netty/netty/pull/17816
- Validate padding of HEADERS frames without priority by @bryce-anderson in https://github.com/netty/netty/pull/17817
- Don't spin in SslHandler.wrapMultiple(...) when the engine consumes nothing by @allthingssecurity in https://github.com/netty/netty/pull/17728
- Preserve invalid SNI names in
ReferenceCountedOpenSslEngineby @gavinbunney in https://github.com/netty/netty/pull/17781 - Optimize redundant bounds checking in ByteBuf.setBytes by @vpelikh in https://github.com/netty/netty/pull/17023
- Respect SETTINGS_QPACK_BLOCKED_STREAMS for unacknowledged QPACK entries by @allthingssecurity in https://github.com/netty/netty/pull/17754
- Release the DNS response when a query future loses a cancel race by @watson-ryan in https://github.com/netty/netty/pull/17475
- Lazily instantiate VarHandle JCTools queues via holder class by @arnabnandy7 in https://github.com/netty/netty/pull/17750
- Keep reading a closed QUIC stream until the end of its input by @allthingssecurity in https://github.com/netty/netty/pull/17755
- Throw UnsupportedOperationException from AdaptiveByteBuf.memoryAddress() without an address by @normanmaurer in https://github.com/netty/netty/pull/17820
- HAProxyMessage: validate the length of all TLV types by @yawkat in https://github.com/netty/netty/pull/17834
- Fix HpackDynamicTable losing entries when filled to capacity by @yawkat in https://github.com/netty/netty/pull/17831
- Make AdaptiveByteBuf.memoryAddress() faster by @lhotari in https://github.com/netty/netty/pull/17767
- Validate bzip2 Huffman code lengths before building decode tables by @Raghuvardhan-Reddy78 in https://github.com/netty/netty/pull/17812
- Validate header values on DefaultHeaders.copy(), bulk add, entry setValue and ReadOnlyHttpHeaders by @normanmaurer in https://github.com/netty/netty/pull/17841
- Throw DecompressionException on JdkZlib preset dictionary mismatch by @yawkat in https://github.com/netty/netty/pull/17838
- Reject HTTP version numbers that overflow int by @yawkat in https://github.com/netty/netty/pull/17836
- Apply certificate list size floor by @arnabnandy7 in https://github.com/netty/netty/pull/17674
- HAProxyMessageEncoder: encode v1 PROXY UNKNOWN headers by @yawkat in https://github.com/netty/netty/pull/17837
- HAProxyMessage: decode TLVs with an empty value at the end of the header by @yawkat in https://github.com/netty/netty/pull/17835
- Reject invalid content-length in PUSH_PROMISE with a stream error by @yawkat in https://github.com/netty/netty/pull/17867
- Honor maxAllocation for brotli in DelegatingDecompressorFrameListener by @yawkat in https://github.com/netty/netty/pull/17866
- HAProxyMessageDecoder: fix v2 header framing with a non-zero reader index by @yawkat in https://github.com/netty/netty/pull/17832
- IpSubnetFilter: Add tests for overlapping rules by @Raghuvardhan-Reddy78 in https://github.com/netty/netty/pull/17765
- Avoid allocating NIO buffer views in AdaptiveByteBuf.setBytes(int, ByteBuf, int, int) by @lhotari in https://github.com/netty/netty/pull/17840
- Skip JNDI nameserver lookup on IBM i by @manish-9245 in https://github.com/netty/netty/pull/17872
- Reset the h2c upgrade stream if the request can not be converted by @yawkat in https://github.com/netty/netty/pull/17869
- Don't size ZstdDecoder output buffers from the frame content size by @Raghuvardhan-Reddy78 in https://github.com/netty/netty/pull/17896
- Fix NPE in Http2FrameCodec when h2c upgrade fails by @yawkat in https://github.com/netty/netty/pull/17871
- Allow adaptive allocator magazine cleanup in BlockHound by @cj848 in https://github.com/netty/netty/pull/17849
- GroupsConverter: fix the x25519mlkem768 group name by @normanmaurer in https://github.com/netty/netty/pull/17898
- Don't count insertions twice in QPACK Insert Count Increments by @allthingssecurity in https://github.com/netty/netty/pull/17756
- Don't lose frames when a delimiter is split across reads by @allthingssecurity in https://github.com/netty/netty/pull/17665
- Register JFR events only once a Flight Recorder exists by @yawkat in https://github.com/netty/netty/pull/17614
- Improve OcspServerCertificateValidatorTest.connectUsingHttpAndValidateCertificateUsingOcspTest() by @normanmaurer in https://github.com/netty/netty/pull/17913
- Don't use the network in OcspClientTest.simpleOcspQueryTest by @normanmaurer in https://github.com/netty/netty/pull/17908
- Read SOCKS5 length octets unsigned in the legacy socks decoders by @Raghuvardhan-Reddy78 in https://github.com/netty/netty/pull/17912
- Fix truncated output in Brotli decoders by @yawkat in https://github.com/netty/netty/pull/17870
- Reject truncated QPACK prefixed integers in field section decode by @Raghuvardhan-Reddy78 in https://github.com/netty/netty/pull/17778
- Resolve malloc/free via dlsym(RTLD_DEFAULT) in CleanerJava24Linker by @jwils in https://github.com/netty/netty/pull/17811
- Wrap trailing ';' in Content-Disposition as ErrorDataDecoderException by @HwangRock in https://github.com/netty/netty/pull/17895
- Auto-port 4.2: Limit the number of queued tasks in NioEventLoopTest.testTaskRemovalOnShutdownThrowsNoUnsupportedOperationException by @netty-project-bot in https://github.com/netty/netty/pull/17927
- Avoid reflection when obtaining the process ID on Java 9+ by @zsewasdsdsd in https://github.com/netty/netty/pull/17873
- Keep WINDOW_UPDATE credit of reserved HTTP/2 streams on activation by @allthingssecurity in https://github.com/netty/netty/pull/17611
- IoUring: Apply IOV_MAX to each write instead of to all writes until submit by @dreamlike-ocean in https://github.com/netty/netty/pull/17932
- Add consistent TLS certificate compression support by @arnabnandy7 in https://github.com/netty/netty/pull/17548
- Port 4.2: Don't use the network in OcspServerCertificateValidatorTest.connectUsingHttpAndValidateCertificateUsingOcspTest (#17933) by @normanmaurer in https://github.com/netty/netty/pull/17941
- Avoid unnecessary String allocation in WebSocketServerProtocolHandshakeHandler by @fru1tworld in https://github.com/netty/netty/pull/16666
- Port 4.2: io_uring: Don't let msgHdrMemoryArray() clear the iovecs of a pending zero-copy write (#17937) by @normanmaurer in https://github.com/netty/netty/pull/17946
- Refresh CA bundle before downloading the aarch64 GCC toolchain by @normanmaurer in https://github.com/netty/netty/pull/17948
- Accept empty non-final fragments in PerMessageDeflateEncoder by @normanmaurer in https://github.com/netty/netty/pull/17943
- Exclude the ProcessHandle stub from Surefire in common and buffer by @franz1981 in https://github.com/netty/netty/pull/17949
- Verify toolchain downloads in release Dockerfiles against pinned SHA-256 (#17935) by @normanmaurer in https://github.com/netty/netty/pull/17940
- HTTP/2: Don't pass the close promise to a deferred close by @idelpivnitskiy in https://github.com/netty/netty/pull/17955
- Port 4.2: Fix flaky Http2MultiplexTest.unhandledHttp2FramesShouldBePropagated (#17958) by @normanmaurer in https://github.com/netty/netty/pull/17966
- Fix endless value iterators in ReadOnlyHttpHeaders by @CCCLL in https://github.com/netty/netty/pull/17961
- Hash all 8-byte blocks in SipHash.macHash(...) when position is not 0 by @Marti2203 in https://github.com/netty/netty/pull/17974
- Fix AsciiString.contains(...) false negatives after a partial match by @CCCLL in https://github.com/netty/netty/pull/17975
- Auto-port 4.2: Increase poll timeout in HttpContentCompressorTest.testExecutorPreserveOrdering by @netty-project-bot in https://github.com/netty/netty/pull/17976
- Don't invert IP_MULTICAST_LOOP_DISABLED in NioDatagramChannelConfig by @Marti2203 in https://github.com/netty/netty/pull/17969
- Fix flaky DatagramUnicastIPv6MappedTest on macOS by @normanmaurer in https://github.com/netty/netty/pull/17981
- Add HpackDecoder test for non-token HTTP/2 header names by @normanmaurer in https://github.com/netty/netty/pull/17979
- Don't drop the last character in AsciiString.trim(CharSequence) by @Marti2203 in https://github.com/netty/netty/pull/17968
- Fix the region copied by Unpooled.copiedBuffer(CharSequence, int, int, Charset) by @Marti2203 in https://github.com/netty/netty/pull/17971
- Port 4.1: Don't invert IP_MULTICAST_LOOP_DISABLED in NioDatagramChann… by @normanmaurer in https://github.com/netty/netty/pull/17991
- Treat DATA frames on reserved HTTP/2 streams as a connection error by @yawkat in https://github.com/netty/netty/pull/17868
- Http2: reject generic frames whose payload exceeds SETTINGS_MAX_FRAME_SIZE by @AbhishekShukla1289 in https://github.com/netty/netty/pull/17779
- Don't loop forever in AbstractDiskHttpData when the file is short by @Marti2203 in https://github.com/netty/netty/pull/17973
- Check the second gzip magic byte in JdkZlibDecoder by @Marti2203 in https://github.com/netty/netty/pull/17972
- Reject reply codes with non-digit characters in SmtpResponseDecoder by @Marti2203 in https://github.com/netty/netty/pull/17970
- Return null or the default from read-only headers for invalid values by @CCCLL in https://github.com/netty/netty/pull/17967
- MqttEncoder: Reject Variable Byte Integers larger than 268435455 by @normanmaurer in https://github.com/netty/netty/pull/17984
- Fix server-initiated WebSocket close handshake failing with "promise already done" by @normanmaurer in https://github.com/netty/netty/pull/17983
- Fix Snappy.encode(...) for input with a non-zero reader index by @Marti2203 in https://github.com/netty/netty/pull/18019
- Fill every remaining byte in the Java 8 SplittableRandom.nextBytes fallback by @Marti2203 in https://github.com/netty/netty/pull/18009
- Cancel queued runs and runs of fork PRs when a PR is merged by @normanmaurer in https://github.com/netty/netty/pull/18026
- Complete the TCP fast open connect before notifying the initial write by @normanmaurer in https://github.com/netty/netty/pull/18008
- Only delete socket files when binding and closing UDS channels by @normanmaurer in https://github.com/netty/netty/pull/17980
- Port 4.1: Complete the TCP fast open connect before notifying the initial write… by @normanmaurer in https://github.com/netty/netty/pull/18039
- Use a long file offset when splicing a DefaultFileRegion with io_uring by @Marti2203 in https://github.com/netty/netty/pull/18018
- Read tv_nsec from the correct offset in QuicheSendInfo.getAtNanos by @normanmaurer in https://github.com/netty/netty/pull/18045
- Don't truncate the token length of QUIC Initial packets to an int by @normanmaurer in https://github.com/netty/netty/pull/18046
- Port 4.1: Don't use the network in testsuite-jpms OCSPTest (#18043) by @normanmaurer in https://github.com/netty/netty/pull/18051
- Don't use a negative index in QuicCodecDispatcher by @normanmaurer in https://github.com/netty/netty/pull/18048
- Reject too long UDS paths in sendTo instead of truncating them by @normanmaurer in https://github.com/netty/netty/pull/18022
- Fix FastLz.readU16 when the reader index is not 0 by @normanmaurer in https://github.com/netty/netty/pull/18054
- Fail to encode DNS messages that are too large for TCP by @normanmaurer in https://github.com/netty/netty/pull/18058
- Return the haystack's reader index from ByteBufUtil.indexOf(...) for an empty needle by @CCCLL in https://github.com/netty/netty/pull/18073
- Return -1 from StringUtil.decodeHexNibble(byte) for non-ASCII bytes by @CCCLL in https://github.com/netty/netty/pull/18072
- Fix flaky AutoScalingEventExecutorChooserFactoryTest on Windows by @normanmaurer in https://github.com/netty/netty/pull/18079
- Port 4.1: Fix FastLz.readU16 when the reader index is not 0 (#18054) by @normanmaurer in https://github.com/netty/netty/pull/18077
- Port 4.1: Reject too long UDS paths in sendTo instead of truncating t… by @normanmaurer in https://github.com/netty/netty/pull/18076
- Don't return an entry twice when removing while iterating a primitive map by @CCCLL in https://github.com/netty/netty/pull/18070
- Mark disk-based HttpData as completed after setting empty content by @CCCLL in https://github.com/netty/netty/pull/18069
- Don't sign-extend the trailing bytes in SipHash by @normanmaurer in https://github.com/netty/netty/pull/18047
- Release a SPDY DATA frame that exceeds the session window by @Marti2203 in https://github.com/netty/netty/pull/18089
- Port 4.2: Fix out-of-bounds read when validating UDS paths in the native code (#18016) by @normanmaurer in https://github.com/netty/netty/pull/18096
- Update Brotli4j version to 1.24.0 by @hyperxpro in https://github.com/netty/netty/pull/18097
- Grow KQueueEventArray correctly in realloc by @normanmaurer in https://github.com/netty/netty/pull/18102
- Update Brotli4j version to 1.24.0 (#18097) by @normanmaurer in https://github.com/netty/netty/pull/18104
- Port 4.1: Grow KQueueEventArray correctly in realloc (#18102) by @normanmaurer in https://github.com/netty/netty/pull/18106
- Send zero-length datagrams instead of dropping or duplicating them by @Marti2203 in https://github.com/netty/netty/pull/18098
- Read all pending data when the EOF is received before the connect is complete in kqueue by @normanmaurer in https://github.com/netty/netty/pull/18091
- Reject request-only and response-only pseudo-headers in invalid contexts (RFC 9113) by @rajan-github in https://github.com/netty/netty/pull/17752
- Keep throttling the producer while the executor is shutting down in NioEventLoopTest by @normanmaurer in https://github.com/netty/netty/pull/18110
- Read the 4 byte Snappy literal length as unsigned by @normanmaurer in https://github.com/netty/netty/pull/18056
- Call FFM directly in the cleaners and link malloc/free on first use by @franz1981 in https://github.com/netty/netty/pull/17791
- Deliver all data a LocalChannel peer wrote before it closed by @allthingssecurity in https://github.com/netty/netty/pull/18127
- Load the native library in IoUringSharedIovArrayTest by @normanmaurer in https://github.com/netty/netty/pull/18130
- Do not fail update-sdkman-sha.sh when run without arguments by @normanmaurer in https://github.com/netty/netty/pull/18134
- Port 4.2: Update sdkman sha (#18133) by @normanmaurer in https://github.com/netty/netty/pull/18135
- Make ZlibCertificateCompressionAlgorithm public by @daschl in https://github.com/netty/netty/pull/18131
- Round up the NIO select timeout again to not busy spin (#18137) by @DavideD in https://github.com/netty/netty/pull/18138
- Update central-publishing-maven-plugin to 0.12.0 by @normanmaurer in https://github.com/netty/netty/pull/18140
- Close an HTTP/2 stream only after its last merged DATA frame was written by @allthingssecurity in https://github.com/netty/netty/pull/18126
- Use IP_MULTICAST_IF in leaveGroup and block without an interface by @Marti2203 in https://github.com/netty/netty/pull/18122
- Add opt-in Origin validation to WebSocketServerProtocolHandler (hardening) by @normanmaurer in https://github.com/netty/netty/pull/17944
- Auto-port 4.2: Add JDK27 profiles by @netty-project-bot in https://github.com/netty/netty/pull/18148
- IoUring:Refactor io_uring write lifecycle management by @dreamlike-ocean in https://github.com/netty/netty/pull/17757
- Do not run javadoc for netty-varhandle-stub by @normanmaurer in https://github.com/netty/netty/pull/18151
- Don't lose the alert when the handshake fails in ReferenceCountedOpen… by @normanmaurer in https://github.com/netty/netty/pull/18155
- Fix buffer over-read in netty_boringssl_password_callback by @normanmaurer in https://github.com/netty/netty/pull/18163
- Fix freeing of invalid EVP_PKEY handle when parsing a private key fails by @normanmaurer in https://github.com/netty/netty/pull/18159
- Fix use of out-of-scope variable in netty_quiche_conn_new_scid by @normanmaurer in https://github.com/netty/netty/pull/18162
- Fix freeing of uninitialized dynamicMethods in netty_quiche_JNI_OnLoad by @normanmaurer in https://github.com/netty/netty/pull/18161
- Fix use of uninitialized pointers in quic_certificate_cb by @normanmaurer in https://github.com/netty/netty/pull/18160
- Add a change review skill by @chrisvest in https://github.com/netty/netty/pull/18071
- Add guidance for LLM agents by @chrisvest in https://github.com/netty/netty/pull/18036
- SslHandler: Size the unwrap output buffer for the plaintext, not the record by @watson-ryan in https://github.com/netty/netty/pull/18028
- Send bad_certificate alert when the TrustManager rejects the certificate by @normanmaurer in https://github.com/netty/netty/pull/18164
- Auto-port 4.2: Quote revapi argument by @netty-project-bot in https://github.com/netty/netty/pull/18187
- Avoid reverse DNS lookup in IpSubnetFilterTest.testIpFilterRuleHandler by @normanmaurer in https://github.com/netty/netty/pull/18188
- IoUring: Verify the FileChannel is a FileChannelImpl before reading its fd by @normanmaurer in https://github.com/netty/netty/pull/18192
- Update to latest netty-jni-util release by @normanmaurer in https://github.com/netty/netty/pull/18189
- Fix flaky SSLEngineTest.testSessionInvalidate with Conscrypt by @normanmaurer in https://github.com/netty/netty/pull/18198
- Auto-port 4.2: Fix reporting of the wrong error when setting flags on an accepted fd fails by @netty-project-bot in https://github.com/netty/netty/pull/18201
- Auto-port 4.2: KQueue: Verify the FileChannel is a FileChannelImpl before reading its fd by @netty-project-bot in https://github.com/netty/netty/pull/18204
- Auto-port 4.2: Do not send uninitialized stack memory when sending a fd over a domain socket by @netty-project-bot in https://github.com/netty/netty/pull/18209
- Auto-port 4.2: Fix underflow detection in netty_unix_util_timespec_subtract_ns by @netty-project-bot in https://github.com/netty/netty/pull/18214
- Auto-port 4.2: Epoll: Verify the FileChannel is a FileChannelImpl before reading its fd by @netty-project-bot in https://github.com/netty/netty/pull/18202
- Auto-port 4.2: Epoll: Fix signed integer overflow when calculating the epoll_wait timeout by @netty-project-bot in https://github.com/netty/netty/pull/18213
- Auto-port 4.2: Fix read of uninitialized memory when accepting a connection on a domain socket by @netty-project-bot in https://github.com/netty/netty/pull/18212
- Don't encode Snappy copies with an offset that does not fit into 16 bits by @normanmaurer in https://github.com/netty/netty/pull/18055
- Don't truncate binary memcache key and extras lengths by @Raghuvardhan-Reddy78 in https://github.com/netty/netty/pull/18041
- Revert "Update central-publishing-maven-plugin to 0.12.0 (#18140)" by @normanmaurer in https://github.com/netty/netty/pull/18230
- Update to latest netty-tcnative release by @normanmaurer in https://github.com/netty/netty/pull/18231
- 4.2 Merge fixes by @chrisvest in https://github.com/netty/netty/pull/18237
- @akilegaspi made their first contribution in https://github.com/netty/netty/pull/17623
- @Raghuvardhan-Reddy78 made their first contribution in https://github.com/netty/netty/pull/17812
- @manish-9245 made their first contribution in https://github.com/netty/netty/pull/17872
- @cj848 made their first contribution in https://github.com/netty/netty/pull/17849
- @zsewasdsdsd made their first contribution in https://github.com/netty/netty/pull/17873
- @CCCLL made their first contribution in https://github.com/netty/netty/pull/17961
- @Marti2203 made their first contribution in https://github.com/netty/netty/pull/17974
- @AbhishekShukla1289 made their first contribution in https://github.com/netty/netty/pull/17779
- @DavideD made their first contribution in https://github.com/netty/netty/pull/18138
Full Changelog: https://github.com/netty/netty/compare/netty-4.2.19.Final...netty-4.2.20.Final