openjdk-lts (11.0.31+11-1ubuntu1~26.04.2) resolute-security; urgency=medium

  * Upload to Ubuntu 26.04.
  * d/rules: Do not validate control files for the old releases.

 -- Vladimir Petko <vladimir.petko@canonical.com>  Sun, 26 Apr 2026 21:25:42 +1200

openjdk-lts (11.0.31+11-1ubuntu1) stonking; urgency=medium

  * OpenJDK 11.0.31 release, build 11.
    - CVEs:
      + CVE-2026-22016: 8370529: Enhance Path Factories Redux
      + CVE-2026-34282: 8374557: Enhance TLS connection handling
      + CVE-2026-22021: 8371830: Enhance certificate chain validation
      + CVE-2026-22013: 8370615: Improve Kerberos credentialing
      + CVE-2026-23865: 8379158: Update FreeType to 2.14.2
      + CVE-2026-22018: 8370986: Enhance Zip file reading
      + CVE-2026-22007: 8369575: Enhance crypto algorithm support
      + CVE-2026-34268: 8371935: Enhance key generation
  * Ensure that all generated files are up to date:
    - The copyright generator now checks if the current directory contains
      an unpacked OpenJDK tree by verifying the presence of the
      ASSEMBLY_EXCEPTION file.
    - The copyright generator now drops common license text in-memory,
      without running a shell script that modifies the source tree.
    - d/rules: Add targets to generate all files and check that they match
      the ones provided in the source package.
    - d/rules: Add nogen DEB_BUILD_OPTION to disable file regeneration.
  * d/rules: Use '-' instead of '~' in opt version string, swap package
    version and distribution.
  * Add common GPL and Apache license headers to copyright generator.
  * d/t/problems.csv: Synchronize problemlist.
  * d/dbg.py: Fix syntax errors in gdb unwinder, do not install unwinder
    for zero, install hotspot unwinder in the correct directory.
    Disable debug traces. Load unwinder in the disabled state.
    Return iterator rather than list from OpenJDKFrameFilter.flatten().
    Remove unused code from NativeMethodInfo.
  * d/p/jdk-8224796.diff: Drop patch applied upstream.
  * d/copyright: Regenerate.

 -- Vladimir Petko <vladimir.petko@canonical.com>  Sun, 26 Apr 2026 18:31:19 +1200

openjdk-lts (11.0.30+7-1ubuntu1) resolute; urgency=medium

  * OpenJDK 11.0.30 release, build 7.
    - CVEs:
      + CVE-2026-21945: 8368032: Enhance Certificate Checking.
      + CVE-2026-21932: 8359501: Enhance Handling of URIs.
      + CVE-2026-21933: 8362632: Improve HttpServer Request handling.
      + CVE-2026-21925: 8341496: Improve JMX connections.

  [ Matthias Klose ]
  * d/rules: Adjust any_archs.

  [ Pushkar Kulkarni ]
  * d/t/jtreg-autopkgtest.*: Use locale name "C.UTF-8" on bionic
    and focal.

  [ Vladimir Petko ]
  * d/p/jdk-8354941-proposed.patch: Drop patch applied upstream.
  * Update override comments for unstripped-binary-or-object. We need to
    keep symbols for Native Memory Tracking to work.
  * d/{JB-doc.overrides.in, JB-jre-headless.overrides.in}: Add override
    for old FSF copyright address.
  * d/s/lintian-overrides: Override false positive debian-rules-calls-
    nproc. The utility is used to log the number of processors.
  * d/p/jdk-8224796.diff: Apply upstream patch to fix i386 ftbfs
    introduced by JDK-8224087 backport.

 -- Vladimir Petko <vladimir.petko@canonical.com>  Thu, 22 Jan 2026 13:00:42 +1300

openjdk-lts (11.0.29+7-1ubuntu1) resolute; urgency=medium

  * OpenJDK 11.0.29 release, build 7. Release notes:
    https://mail.openjdk.org/pipermail/jdk-updates-dev/2025-October/049111.html
    - CVEs:
      + CVE-2025-53057, 8360937: Enhance certificate handling.
      + CVE-2025-53066, 8356294: Enhance Path Factories.

  [ Matthias Klose ]
  * d/{control*, rules}: build using gcc-15.

  [ Vladimir Petko ]
  * d/t/problems.csv: Synchronize problem list.
  * d/p/jdk-8354941-proposed.patch: Apply proposed patch to resolve ftbfs
    with glibc 2.42.
  * d/t/jtreg-autopkgtest.*: Force utf-8 encoding.
  * d/rules: force C99 standard to build with gcc-15.

 -- Pushkar Kulkarni <pushkar.kulkarni@canonical.com>  Thu, 23 Oct 2025 12:01:16 +0530

openjdk-lts (11.0.28+6-1ubuntu1) questing; urgency=medium

  * OpenJDK 11.0.28 release, build 6. See
    https://openjdk.org/groups/vulnerability/advisories/2025-07-15
    - CVEs:
      + CVE-2025-50059, 8350991: Improve HTTP client header handling
      + CVE-2025-30749, 8348989: Better Glyph drawing
      + CVE-2025-50106, 8360147: Better Glyph drawing redux
      + CVE-2025-30761, 8351422: Improve scripting supports
      + CVE-2025-30754, 8349594: Enhance TLS protocol support
    - Security fixes:
      + 8349111: Enhance Swing supports
      + 8345625: Better HTTP connections
    - Release notes:
      https://mail.openjdk.org/pipermail/jdk-updates-dev/2025-July/045612.html
  * d/watch: regenerate.
  * d/copyright: regenerate.
  * d/copyright-generator/copyright-gen.py: bump copyright year.
  * d/rules: use /usr/share/jtreg jtreg home for bionic.

 -- Vladimir Petko <vladimir.petko@canonical.com>  Thu, 17 Jul 2025 08:41:38 +1200

openjdk-lts (11.0.28~5ea-1ubuntu2) questing; urgency=medium

  * d/rules: use link file to provide symlink to ja man pages (LP:
    #2116572).
  * d/copyright: regenerate.

 -- Vladimir Petko <vladimir.petko@canonical.com>  Tue, 15 Jul 2025 10:30:48 +1200

openjdk-lts (11.0.28~5ea-1ubuntu1) questing; urgency=medium

  * OpenJDK 11.0.28+5 build (early access).
  * d/p/jdk-8359735.patch: fix process tests failing in Ubuntu 25.10
    (questing).

 -- Vladimir Petko <vladimir.petko@canonical.com>  Sat, 05 Jul 2025 18:18:05 +1200

openjdk-lts (11.0.28~3ea-1ubuntu1) questing; urgency=medium

  * OpenJDK 11.0.28+3 build (early access) (LP: #2114688).
  * d/t/problems.csv: Update based on recent JTREG runs.
  * d/rules: Disable dtrace on jammy armhf (was not enabled before and cannot
    be built due to a GCC ICE (see LP #2091225).

  [ Matthias Klose ]
  * Honour DEB_BUILD_OPTIONS=parallel=N while running jtreg tests (Helmut
    Grohne). Addresses: #1095920.

 -- Vladimir Petko <vladimir.petko@canonical.com>  Mon, 16 Jun 2025 09:02:57 +1200

openjdk-lts (11.0.26+4-1ubuntu1) plucky; urgency=medium

  * OpenJDK 11.0.26 release, build 4. Release notes:
    https://mail.openjdk.org/pipermail/jdk-updates-dev/2025-January/040826.html

    - CVEs:
      +  CVE-2025-21502 - 8330045: Enhance array handling.

  * d/rules: Dump complete hs_err_pid and replay_pid logs to stdout.
  * d/t/problems.csv: Add openjdk-24 and openjdk-25 to the problems.csv.
  * d/{copyright, watch}: regenerate.

  [ Matthias Klose ]
  * d/rules: Also dump logs for zero builds and for build failures.

 -- Vladimir Petko <vladimir.petko@canonical.com>  Wed, 22 Jan 2025 15:18:54 +1300

openjdk-lts (11.0.26~3ea-1ubuntu1) plucky; urgency=medium

  * OpenJDK 11.0.26+3 build (early access) (LP: #2092368).

  [ Pushkar Kulkarni ]
  * d/t/problems.csv: Update based on recent JTREG runs.

 -- Vladimir Petko <vladimir.petko@canonical.com>  Mon, 23 Dec 2024 09:41:59 +1300

openjdk-lts (11.0.25+9-1ubuntu1) plucky; urgency=medium

  * OpenJDK 11.0.25 release, build 9.

     - CVEs
       + CVE-2024-21208, 8328286: Enhance HTTP client
       + CVE-2024-21210, 8328544: Improve handling of vectorization
       + CVE-2024-21217, 8331446: Improve deserialization support
       + CVE-2024-21235, 8332644: Improve graph optimizations

     - Security fixes
       + JDK-8290367, JDK-8332643: Update default value and extend the scope
         of the com.sun.jndi.ldap.object.trustSerialData system property
       + JDK-8307383: Enhance DTLS connections
       + JDK-8328286: Enhance HTTP client
       + JDK-8328544: Improve handling of vectorization
       + JDK-8328726: Better Kerberos support
       + JDK-8331446: Improve deserialization support
       + JDK-8332644: Improve graph optimizations
       + JDK-8335713: Enhance vectorization analysis

  [ Vladimir Petko ]
  * d/rules: do not include dtrace support for S390x (JDK-8305174).
  * d/t/problems.csv: Disable jdk/sun/security/util/Debug/DebugOptions.java
    due to JDK-8339713.

 -- Pushkar Kulkarni <pushkar.kulkarni@canonical.com>  Thu, 17 Oct 2024 22:51:26 +0530

openjdk-lts (11.0.25~5ea-1ubuntu1) oracular; urgency=medium

  * OpenJDK 11.0.25+5 build (early access) (LP: #2080298).
  * d/copyright-generator/strip-common-licenses.sh: Add GPLv3 to the
    list of common licenses.
  * d/rules, d/control.in: Depend on pkgconf rather than pkg-config in
    bookworm and later releases. This resolves lintian warning
    build-depends-on-obsolete-package Build-Depends: pkg-config => pkgconf.
  * Build using GCC 14 on development versions.
  * d/t/problemlist.csv: Update problemlist.csv for July release.
  * d/copyright-generator/copyright-gen.py: remove spurious whitespaces.
  * Enable dtrace support.
  * Regenerate control files.

 -- Vladimir Petko <vladimir.petko@canonical.com>  Tue, 10 Sep 2024 08:53:42 +1200

openjdk-lts (11.0.24+8-1ubuntu3) oracular; urgency=medium

  * OpenJDK 11.0.24 release, build 8. Release notes:
    https://mail.openjdk.org/pipermail/jdk-updates-dev/2024-July/035797.html
    - CVEs
      + CVE-2024-21147: 8323231, RangeCheckElimination array index overflow.
      + CVE-2024-21145: 8324559, Out-of-bounds access in 2D image handling.
      + CVE-2024-21140: 8320548, Range Check Elimination (RCE) pre-loop limit
        overflow.
      + CVE-2024-21144: 8322106, Pack200 increase loading time due to improper
        header validation.
      + CVE-2024-21131: 8314794, potential UTF8 size overflow.
      + CVE-2024-21138: 8319859, Excessive symbol length can lead to infinite loop.
    - Security fixes
      + JDK-8303466: C2: failed: malformed control flow.
        Limit type made precise with MaxL/MinL.
      + JDK-8314794: Improve UTF8 String supports.
      + JDK-8319859: Better symbol storage.
      + JDK-8320097: Improve Image transformations.
      + JDK-8320548: Improved loop handling.
      + JDK-8322106: Enhance Pack 200 loading.
      + JDK-8323231: Improve array management.
      + JDK-8323390: Enhance mask blit functionality.
      + JDK-8324559: Improve 2D image handling.
      + JDK-8325600: Better symbol storage.
      + JDK-8327413: Enhance compilation efficiency.
  * No-Change upload to include OpenJDK bugs related to CVEs.

 -- Vladimir Petko <vladimir.petko@canonical.com>  Mon, 22 Jul 2024 08:41:26 +1200

openjdk-lts (11.0.24+8-1ubuntu2) oracular; urgency=medium

  * OpenJDK 11.0.24 release, build 8. Release notes:
    https://mail.openjdk.org/pipermail/jdk-updates-dev/2024-July/035797.html
    + CVEs
      - CVE-2024-21147
      - CVE-2024-21145
      - CVE-2024-21140
      - CVE-2024-21144
      - CVE-2024-21131
      - CVE-2024-21138
    + Security fixes
      - JDK-8303466: C2: failed: malformed control flow.
        Limit type made precise with MaxL/MinL.
      - JDK-8314794: Improve UTF8 String supports.
      - JDK-8319859: Better symbol storage.
      - JDK-8320097: Improve Image transformations.
      - JDK-8320548: Improved loop handling.
      - JDK-8322106: Enhance Pack 200 loading.
      - JDK-8323231: Improve array management.
      - JDK-8323390: Enhance mask blit functionality.
      - JDK-8324559: Improve 2D image handling.
      - JDK-8325600: Better symbol storage.
      - JDK-8327413: Enhance compilation efficiency.
  * No-Change upload to include upstream release notes.

 -- Vladimir Petko <vladimir.petko@canonical.com>  Mon, 22 Jul 2024 08:17:12 +1200

openjdk-lts (11.0.24+8-1ubuntu1) oracular; urgency=medium

  * OpenJDK 11.0.24 release, build 8.
    - CVEs:
      + CVE-2024-21147
      + CVE-2024-21145
      + CVE-2024-21140
      + CVE-2024-21144
      + CVE-2024-21131
      + CVE-2024-21138
    - Security Fixes:
      + JDK-8281658: New Security Category for -XshowSettings Launcher
        Option.
      + JDK-8316138: Added GlobalSign R46 and E46 Root CA Certificates.
      + JDK-8256660: Disabled DTLS 1.0.
      + JDK-8326891: Native Executables and Libraries on Linux Use
        RPATH Instead of RUNPATH.
  * d/copyright: regenerate copyright.
  * d/rules, d/t/*: collate all excluded tests into d/problemlist.csv.
  * d/p/jdk-8336529-proposed.patch: fix time_t migration issue on armhf -
    openjdk is unable to set file last modified timestamp.
  * d/p/jdk-8334895-proposed.patch: refresh patch.
  * d/rules: enable upstream release.
  * d/rules: relax jtreg7 version condition for backports.
  * d/rules: use gcc-10 for focal to resolve riscv gcc crash.

 -- Vladimir Petko <vladimir.petko@canonical.com>  Thu, 18 Jul 2024 19:36:07 +1200

openjdk-lts (11.0.24~6ea-1ubuntu2) oracular; urgency=medium

  * d/rules: include /usr/share/dpkg/buildflags.mk to avoid configure
    failure due to the undefined variables.

 -- Vladimir Petko <vladimir.petko@canonical.com>  Wed, 26 Jun 2024 08:34:02 +1200

openjdk-lts (11.0.24~6ea-1ubuntu1) oracular; urgency=medium

  * New upstream snapshot 11.0.24~6ea (LP: #2069917).
  * d/p/*: refresh patches.
  * d/rules, d/control: use jtreg7, enable jtreg.
  * d/JB-demo.overrides.in: add jar-contains-source override for
    SwingSet demo jar.
  * d/rules, d/copyright-generator/copyright-gen.py, d/copyright:
    exclude test/jdk/sun/management/windows/revokeall.exe from orig
    tarball, format d/copyright-generator/copyright-gen.py.
  * d/p/8307977-proposed.diff: rename to jdk-8307977-proposed.patch.
  * d/p/jdk-8334502.patch: fix iso8601_utctime armhf function.
  * d/p/jtreg-location.diff: drop patch as it is no longer needed for
    jtreg7.

 -- Vladimir Petko <vladimir.petko@canonical.com>  Thu, 20 Jun 2024 10:30:43 +1200

openjdk-lts (11.0.23+9-1ubuntu1) noble; urgency=high

  * OpenJDK 11.0.23 release, build 9.
    - CVE-2024-21011, 8319851: Improve exception logging.
    - CVE-2024-21068, 8322122: Enhance generation of addresses.
    - 8318340: Improve RSA key implementations.
    - CVE-2024-21012, 8315708: Enhance HTTP/2 client usage.
    - CVE-2024-21094, 8317507: Already fixed in November 2023:
      C2 compilation fails with "Exceeded _node_regs array".
    - CVE-2024-21085, 8322114: Improve Pack 200 handling.

  [ Pushkar Kulkarni ]
  * Use 64-bit clock_* function on archs like armhf.

 -- Matthias Klose <doko@ubuntu.com>  Wed, 17 Apr 2024 16:23:29 +0200

openjdk-lts (11.0.23~7ea-1ubuntu4) noble; urgency=medium

  * d/rules: disable jtreg tests due to jtreg i386 uninstallability.

 -- Vladimir Petko <vladimir.petko@canonical.com>  Wed, 17 Apr 2024 08:28:35 +1200

openjdk-lts (11.0.23~7ea-1ubuntu3) noble; urgency=medium

  * d/patches: Use clock_*64 functions on archs like armhf
    (LP: #2059005)

 -- Pushkar Kulkarni <pushkar.kulkarni@canonical.com>  Thu, 11 Apr 2024 20:16:13 +0530

openjdk-lts (11.0.23~7ea-1ubuntu2) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- William Grant <wgrant@ubuntu.com>  Mon, 01 Apr 2024 18:05:16 +1100

openjdk-lts (11.0.23~7ea-1ubuntu1) noble; urgency=medium

  * OpenJDK 11.0.23+7 build (early access).

  * Merge changes from openjdk-11 11.0.23~7-1.
    - Update cups dependencies for time_t64.
    - copyright-generator: Derive release from debian/rules.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 21 Mar 2024 02:30:11 +0100

openjdk-lts (11.0.22+7-3ubuntu1) noble; urgency=medium

  * Merge changes from openjdk-11 11.0.22+7-2.
    - Add zero support for loong64 (Leslie Zhai). Closes: #1060821.
    - d/changelog: Whitespace cleanup.
    - Update build dependency on libfontconfig-dev.
    - Apply proposed patch for JDK-8307977. Closes: #1034600.
    - d/t/jtreg-autopkgtest.*: Set jtreg home property correctly.
  * Merge changes from openjdk-11 11.0.22+7-3.
    - libcups2, libfontconfig1: Make it a recommends in jre-headless,
      a dependency in jre.
    - Make the dependencies for libfontmanager.so and libjsound.so
      recommendations in jre-headless, and dependencies in jre.
    - Drop build dependencies on libgtk2 | libgtk3.
    - Disable running the tests for the time_t64 bootstrap.

 -- Matthias Klose <doko@ubuntu.com>  Mon, 11 Mar 2024 16:39:50 +0100

openjdk-lts (11.0.22+7-0ubuntu3) noble; urgency=medium

  * No-change rebuild against libpng16-16t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 29 Feb 2024 07:39:23 +0000

openjdk-lts (11.0.22+7-0ubuntu2) noble; urgency=medium

  * No-change rebuild to correct the previous changelog entry (LP: #2050390)

 -- Pushkar Kulkarni <pushkar.kulkarni@canonical.com>  Sat, 20 Jan 2024 15:57:19 +0530

openjdk-lts (11.0.22+7-0ubuntu1) noble; urgency=medium

  * OpenJDK 11.0.22 release, build 7
    - CVEs:
      + CVE-2024-20918
      + CVE-2024-20919
      + CVE-2024-20921
      + CVE-2024-20945
      + CVE-2024-20952
    - Security fixes:
      + JDK-8308204: Enhanced certificate processing.
      + JDK-8314295: Enhance verification of verifier.
      + JDK-8314307: Improve loop handling.
      + JDK-8314468: Improve Compiler loops.
      + JDK-8316976: Improve signature handling.
      + JDK-8317547: Enhance TLS connection support.
      + JDK-8314284: Enhance Nashorn performance (CVE-2024-20926).
    Release notes:
      https://www.oracle.com/java/technologies/javase/11-0-22-relnotes.html#R11_0_22
  * Merge changes from openjdk-11 11.0.22+7-1 (LP: #2049715)
      [ Vladimir Petko ]
     - Generate d/watch to cope with early access and release builds.
     - d/rules: Trim trailing whitespaces from debian/control.

      [ Pushkar Kulkarni ]
     - Minor improvements to the copyright-generator.

      [ Pushkar Kulkarni ]
     - debian/copyright: Update copyrights and notices, using a generator script.

      [ Vladimir Petko ]
     - d/copyright: Fix lintian warning.

      [ Matthias Klose ]
     - d/copyright: Fix source location.

 -- Pushkar Kulkarni <pushkar.kulkarni@canonical.com>  Thu, 18 Jan 2024 13:52:07 +0530

openjdk-lts (11.0.21+9-0ubuntu1) noble; urgency=medium

  * OpenJDK 11.0.21 release, build 9.
    - CVE-2023-22081.
    - Release notes:
      https://mail.openjdk.org/pipermail/jdk-updates-dev/2023-October/026351.html
  * d/source/lintian.overrides: use openjdk-lts package name.
  * Disable jtreg tests on RISC-V due to the infrastructure issue.
  * Merge changes from openjdk-11 11.0.21+9-1 (LP: #2039754).
    - d/test: update problemlist.
    - d/p: drop exclude-broken-tests.patch.
    - d/p/reproducible-properties-timestamp.diff: use the privileged action
      to read the system property (JDK-8272157, 914278).
    - d/copyright: remove liblcms from excluded files.
    - d/t/jtreg-autopkgtest.{sh,in}: JDK-8232153 - set NSS_DEFAULT_DB_TYPE
      to let sun/security/pkcs11/Secmod/AddTrustedCert.java pass.

      [ Matthias Klose ]
    - Build using GCC 13 on development versions.
    - Explicitly configure --without-jtreg with the nocheck profile

      [ Pushkar Kulkarni ]
    - Handle limited ECC capabilities of NSS on older releases.

 -- Vladimir Petko <vladimir.petko@canonical.com>  Thu, 26 Oct 2023 16:16:27 +1300

openjdk-lts (11.0.20+8-1ubuntu1) mantic; urgency=high

  * OpenJDK 11.0.20 release, build 8.
    - CVE-2023-22041, CVE-2023-25193, CVE-2023-22045,
      CVE-2023-22049, CVE-2023-22036, CVE-2023-22006.
    - Release notes:
      https://www.oracle.com/java/technologies/javase/11-0-20-relnotes.html#R11_0_20

  * Merge changes from 11.0.20+8-1:
  * Link with --no-as-needed. Closes: #1031521.
  * Provide versioned java-runtime, java-runtime-headless, java-sdk
    and java-sdk-headless virtual packages (Emmanuel Bourg).
  * Configure --with-stdc++lib=static on ia64.
  * Bump standards version.
  * Refresh patches.

  [ Vladimir Petko ]
  * debian/copyright: convert to a machine-readable format.
   debian/copyright: align excludes statement with openjdk-17.

 -- Pushkar Kulkarni <pushkar.kulkarni@ubuntu.com>  Wed, 19 Jul 2023 10:45:13 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog openjdk-11-doc`.
