release notes for 1.20
@@ -5,6 +5,61 @@ compression and archive formats. These include: bzip2, gzip, pack200,
lzma, xz, Snappy, traditional Unix Compress, DEFLATE, DEFLATE64, LZ4,
Brotli, Zstandard and ar, cpio, jar, tar, zip, dump, 7z, arj.
+Release 1.20
+------------
+
+Commons Compress 1.20 like any version of Commons Compress since 1.3
+can not be built from sources using Java 14 as Java 14 removes
+support for the Pack200 format. We will address this issue with the
+next release.
+
+Fixed Bugs:
+o SevenZFile could throw NullPointerException rather than
+ IOException for certain archives. In addition it now handles
+ certain empty archives more gracefully.
+ Issue: COMPRESS-492.
+o Deflate64CompressorInputStream.read would return 0 for some
+ inputs in violation of the InputStream.read contract.
+ Issue: COMPRESS-491.
+o SeekableInMemoryByteChannel's truncate didn't set position
+ according to the spec in an edge case.
+ Issue: COMPRESS-499.
+o BZip2CompressorInputStream now incorporates a similar patch as
+ the one that fixed CVE-2019-12900 in libbzip2.
+
+ Commons Compress has not been vulnerable to this CVE as it
+ would have rejected a file with too many selectors. With this
+ patch Commons Compress will be able to read certain archives
+ that would have caused errors in Compress 1.19. Thanks to Joseph Allemandou.
+
+Changes:
+o Update optional library com.github.luben:zstd-jni from
+ 1.4.0-1 to 1.4.4-7.
+ Issue: COMPRESS-493.
+o Update tests from org.apache.felix:org.apache.felix.framework
+ 6.0.2 to 6.0.3.
+o SevenZFile can now recover from a certain corruption that
+ seems to happen occasionally when split archives are created.
+ Issue: COMPRESS-497.
+ Thanks to Stefan Schlott.
+o Added random access support to SevenZFile.
+ Issue: COMPRESS-342.
+ Thanks to Peter Alfred Lee.
+o Added support for split ZIP archives.
+ Issue: COMPRESS-477.
+ Thanks to Peter Alfred Lee.
+o Added support for reading sparse entries to the TAR package.
+ Issue: COMPRESS-124.
+ Thanks to Peter Alfred Lee.
+o Update JUnit from 4.12 to 4.13.
+
+Removed:
+o Removed the extraction code from the example CLI class inside
+ of the SevenZ package. Not only is it superseeded by the
+ examples package, its implementation was vulnerable to the
+ ZipSlip attack.
+ Issue: COMPRESS-495.
+
Release 1.19
------------
