Author: ggregory
Date: Tue Feb 17 15:44:38 2026
New Revision: 82575
Log:
Publish commons-fileupload2 2.0.0-M5 Release
Added:
release/commons/fileupload/binaries/commons-fileupload2-2.0.0-M5-bin.tar.gz
- copied unchanged from r82574,
dev/commons/fileupload/2.0.0-M5-RC1/binaries/commons-fileupload2-2.0.0-M5-bin.tar.gz
release/commons/fileupload/binaries/commons-fileupload2-2.0.0-M5-bin.tar.gz.asc
- copied unchanged from r82574,
dev/commons/fileupload/2.0.0-M5-RC1/binaries/commons-fileupload2-2.0.0-M5-bin.tar.gz.asc
release/commons/fileupload/binaries/commons-fileupload2-2.0.0-M5-bin.tar.gz.sha512
- copied unchanged from r82574,
dev/commons/fileupload/2.0.0-M5-RC1/binaries/commons-fileupload2-2.0.0-M5-bin.tar.gz.sha512
release/commons/fileupload/binaries/commons-fileupload2-2.0.0-M5-bin.zip
- copied unchanged from r82574,
dev/commons/fileupload/2.0.0-M5-RC1/binaries/commons-fileupload2-2.0.0-M5-bin.zip
release/commons/fileupload/binaries/commons-fileupload2-2.0.0-M5-bin.zip.asc
- copied unchanged from r82574,
dev/commons/fileupload/2.0.0-M5-RC1/binaries/commons-fileupload2-2.0.0-M5-bin.zip.asc
release/commons/fileupload/binaries/commons-fileupload2-2.0.0-M5-bin.zip.sha512
- copied unchanged from r82574,
dev/commons/fileupload/2.0.0-M5-RC1/binaries/commons-fileupload2-2.0.0-M5-bin.zip.sha512
release/commons/fileupload/source/commons-fileupload2-2.0.0-M5-src.tar.gz
- copied unchanged from r82574,
dev/commons/fileupload/2.0.0-M5-RC1/source/commons-fileupload2-2.0.0-M5-src.tar.gz
release/commons/fileupload/source/commons-fileupload2-2.0.0-M5-src.tar.gz.asc
- copied unchanged from r82574,
dev/commons/fileupload/2.0.0-M5-RC1/source/commons-fileupload2-2.0.0-M5-src.tar.gz.asc
release/commons/fileupload/source/commons-fileupload2-2.0.0-M5-src.tar.gz.sha512
- copied unchanged from r82574,
dev/commons/fileupload/2.0.0-M5-RC1/source/commons-fileupload2-2.0.0-M5-src.tar.gz.sha512
release/commons/fileupload/source/commons-fileupload2-2.0.0-M5-src.zip
- copied unchanged from r82574,
dev/commons/fileupload/2.0.0-M5-RC1/source/commons-fileupload2-2.0.0-M5-src.zip
release/commons/fileupload/source/commons-fileupload2-2.0.0-M5-src.zip.asc
- copied unchanged from r82574,
dev/commons/fileupload/2.0.0-M5-RC1/source/commons-fileupload2-2.0.0-M5-src.zip.asc
release/commons/fileupload/source/commons-fileupload2-2.0.0-M5-src.zip.sha512
- copied unchanged from r82574,
dev/commons/fileupload/2.0.0-M5-RC1/source/commons-fileupload2-2.0.0-M5-src.zip.sha512
Replaced:
release/commons/fileupload/RELEASE-NOTES.txt
- copied unchanged from r82574,
dev/commons/fileupload/2.0.0-M5-RC1/RELEASE-NOTES.txt
Deleted:
dev/commons/fileupload/2.0.0-M5-RC1/RELEASE-NOTES.txt
dev/commons/fileupload/2.0.0-M5-RC1/binaries/commons-fileupload2-2.0.0-M5-bin.tar.gz
dev/commons/fileupload/2.0.0-M5-RC1/binaries/commons-fileupload2-2.0.0-M5-bin.tar.gz.asc
dev/commons/fileupload/2.0.0-M5-RC1/binaries/commons-fileupload2-2.0.0-M5-bin.tar.gz.sha512
dev/commons/fileupload/2.0.0-M5-RC1/binaries/commons-fileupload2-2.0.0-M5-bin.zip
dev/commons/fileupload/2.0.0-M5-RC1/binaries/commons-fileupload2-2.0.0-M5-bin.zip.asc
dev/commons/fileupload/2.0.0-M5-RC1/binaries/commons-fileupload2-2.0.0-M5-bin.zip.sha512
dev/commons/fileupload/2.0.0-M5-RC1/source/commons-fileupload2-2.0.0-M5-src.tar.gz
dev/commons/fileupload/2.0.0-M5-RC1/source/commons-fileupload2-2.0.0-M5-src.tar.gz.asc
dev/commons/fileupload/2.0.0-M5-RC1/source/commons-fileupload2-2.0.0-M5-src.tar.gz.sha512
dev/commons/fileupload/2.0.0-M5-RC1/source/commons-fileupload2-2.0.0-M5-src.zip
dev/commons/fileupload/2.0.0-M5-RC1/source/commons-fileupload2-2.0.0-M5-src.zip.asc
dev/commons/fileupload/2.0.0-M5-RC1/source/commons-fileupload2-2.0.0-M5-src.zip.sha512
Copied: release/commons/fileupload/RELEASE-NOTES.txt (from r82574,
dev/commons/fileupload/2.0.0-M5-RC1/RELEASE-NOTES.txt)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ release/commons/fileupload/RELEASE-NOTES.txt Tue Feb 17 15:44:38
2026 (r82575, copy of r82574,
dev/commons/fileupload/2.0.0-M5-RC1/RELEASE-NOTES.txt)
@@ -0,0 +1,442 @@
+Apache Commons FileUpload 2.0.0-M5 Release Notes
+------------------------------------------------
+
+The Apache Commons FileUpload team is pleased to announce the release of
Apache Commons FileUpload 2.0.0-M5.
+
+The Apache Commons FileUpload component provides a simple yet flexible means of
+adding support for multipart file upload functionality to Servlets and web
+applications. This version requires Java 11 or above.
+
+
+This release requires Java 11.
+
+Changes in version 2.0.0-M5 include:
+
+New features:
+o Add AbstractFileUpload support for a maximum part header
size #429. Thanks to Ryan J Murphy.
+o FILEUPLOAD-367: Jakarta and Javax
ServletFileUpload.isMultipartContent(HttpServletRequest) should allow PUT and
PATCH request methods in addition to POST. Thanks to Gary Gregory.
+o FILEUPLOAD-367: Add AbstractFileUpload.isMultipartRequestMethod(String).
Thanks to Gary Gregory.
+
+Fixed Bugs:
+o Better exception message in
org.apache.commons.fileupload2.core.AbstractFileUpload.parseRequest(RequestContext).
Thanks to Chenjp, Gary Gregory.
+o FILEUPLOAD-295: Clarified the precise meaning of isInMemory(), get(),
getPath(), etc. in DiskFileItem
+o Better exception type and message if a multipart/mixed part
is presented without a boundary defined Thanks to Coverity Scan.
+o Rename MultipartInput.Builder.[get|set]PartHeaderSizeMax()
to [get|set]MaxPartHeaderSize(). Thanks to Gary Gregory.
+o Rename MultipartInput.getPartHeaderSizeMax() to
getMaxPartHeaderSize(). Thanks to Gary Gregory.
+o Rename AbstractFileUpload.[get|set]SizeMax() to
AbstractFileUpload.[get|set]MaxSize(). Thanks to Gary Gregory.
+o Rename AbstractFileUpload.[get|set]FileSizeMax() to
AbstractFileUpload.[get|set]MaxFileSize(). Thanks to Gary Gregory.
+o Rename AbstractFileUpload.[get|set]FileCountMax() to
AbstractFileUpload.[get|set]MaxFileCount(). Thanks to Gary Gregory.
+o Minor readability and cleanup improvements in DiskFileItem
#458. Thanks to tPionTech.
+o Fix Apache RAT plugin console warnings. Thanks to Gary
Gregory.
+
+Changes:
+o Bump org.apache.commons:commons-parent from 84 to 96 #444,
#459, #463. Thanks to Gary Gregory, Dependabot.
+o Bump org.apache.commons:commons-lang3 from 3.17.0 to 3.20.0
#427. Thanks to Gary Gregory.
+o Bump commons-io:commons-io from 2.19.0 to 2.21.0. Thanks to
Gary Gregory.
+
+
+For complete information on Apache Commons FileUpload, including instructions
on how to submit bug reports,
+patches, or suggestions for improvement, see the Apache Commons FileUpload
website:
+
+https://commons.apache.org/proper/commons-fileupload/
+
+Download it from
https://commons.apache.org/proper/commons-fileupload/download_fileupload.cgi
+
+------------------------------------------------------------------------------
+Apache Commons FileUpload 2.0.0-M4 Release Notes
+------------------------------------------------
+
+The Apache Commons FileUpload team is pleased to announce the release of
Apache Commons FileUpload 2.0.0-M4.
+
+The Apache Commons FileUpload component provides a simple yet flexible means of
+adding support for multipart file upload functionality to Servlets and web
+applications. This version requires Java 11 or above.
+
+
+This release requires Java 11.
+
+Changes in version 2.0.0-M4 include:
+
+New features:
+o SECURITY - CVE-2025-48976. Add partHeaderSizeMax, a new
limit that sets a maximum number of bytes for each individual multipart header.
The default is 512 bytes. Thanks to Mark Thomas.
+
+Fixed Bugs:
+o Simplify exception handling in FileItem API #309. Thanks to
Basil Crow.
+
+
+
+For complete information on Apache Commons FileUpload, including instructions
on how to submit bug reports,
+patches, or suggestions for improvement, see the Apache Commons FileUpload
website:
+
+https://commons.apache.org/proper/commons-fileupload/
+
+Download it from
https://commons.apache.org/proper/commons-fileupload/download_fileupload.cgi
+
+------------------------------------------------------------------------------
+Apache Commons FileUpload 2.0.0-M3 Release Notes
+------------------------------------------------
+
+The Apache Commons FileUpload team is pleased to announce the release of
Apache Commons FileUpload 2.0.0-M3.
+
+The Apache Commons FileUpload component provides a simple yet flexible means of
+adding support for multipart file upload functionality to Servlets and web
+applications. This version requires Java 11 or above.
+
+
+This release requires Java 11.
+
+Changes in version 2.0.0-M3 include:
+
+New features:
+o Handle multipart/related Requests without
content-disposition header. Thanks to mufasa1976, Gary Gregory.
+
+Fixed Bugs:
+o [site] Fix instantiation of DiskFileItemFactory in
migration guide #273. Thanks to Gregor Dschung.
+o FILEUPLOAD-355: [site] Update code example: Use IOUtils instead of Streams
utils class. Thanks to Ana, Gary Gregory.
+o Replace internal use of Locale.ENGLISH with Locale.ROOT.
Thanks to Gary Gregory.
+o Pick up JUnit version from parent POM. Thanks to Gary
Gregory.
+o FILEUPLOAD-356: [site] Fix incorrect link to changes report in Commons
FileUpload #357. Thanks to Mattias Reichel, GirirajSinghRathore, Gary Gregory.
+o Fix changes report link for new version of Maven Changes
plugin from commons-parent 79 #388. Thanks to Filipe Roque.
+o Fix SpotBugs multithreading issues in DiskFileItem. Thanks
to Gary Gregory.
+
+Changes:
+o Bump org.apache.commons:commons-parent from 66 to 83 #283,
#294, #335, #343, #345, #351, #356, #360, #368. Thanks to Gary Gregory.
+o Bump commons-io:commons-io from 2.16.0 to 2.19.0 #297,
#352, #377. Thanks to Gary Gregory.
+o Bump org.apache.maven.plugins:maven-javadoc-plugin from
3.6.3 to 3.7.0 #319. Thanks to Gary Gregory.
+o Bump org.codehaus.mojo:taglist-maven-plugin from 3.0.0 to
3.1.0 #327. Thanks to Gary Gregory.
+o Bump org.apache.commons:commons-lang3 from 3.14.0 to 3.17.0
#331, #338, #346. Thanks to Gary Gregory.
+
+
+For complete information on Apache Commons FileUpload, including instructions
on how to submit bug reports,
+patches, or suggestions for improvement, see the Apache Commons FileUpload
website:
+
+https://commons.apache.org/proper/commons-fileupload/
+
+Download it from
https://commons.apache.org/proper/commons-fileupload/download_fileupload.cgi
+
+------------------------------------------------------------------------------
+
+Apache Commons FileUpload 2.0.0-M2 Release Notes
+------------------------------------------------
+
+The Apache Commons FileUpload team is pleased to announce the release of
Apache Commons FileUpload 2.0.0-M2.
+
+The Apache Commons FileUpload component provides a simple yet flexible means of
+adding support for multipart file upload functionality to Servlets and web
+applications. This version requires Java 11 or above.
+
+
+2.0.0-M2 Release
+
+Changes in version 2.0.0-M2 include:
+
+New features:
+o Fix off-by-one error when checking fileSizeMax in
FileItemInputImpl #235. Thanks to James Reeves.
+o FILEUPLOAD-352: NullPointerException in DiskFileItem#toString. Thanks to
Bj�rn Kautler, Gary Gregory.
+o Fail fast on null inputs to
org.apache.commons.fileupload2.core.AbstractRequestContext.AbstractRequestContext(Function,
LongSupplier, T). Thanks to Gary Gregory.
+o Complete refactoring in JakartaServletRequestContext.
Thanks to Gary Gregory.
+o Fix "Implicit narrowing conversion in compound assignment"
from https://github.com/apache/commons-fileupload/security/code-scanning/118.
Thanks to Gary Gregory.
+o Refactor to support Jakarta Servlet 5 and 6. Thanks to Gary
Gregory.
+o Generate some OSGi metadata. Thanks to Michal H Siemaszko,
Gary Gregory.
+
+Fixed Bugs:
+o Pick up Maven Moditect plugin version from parent POM.
Thanks to Gary Gregory.
+
+Changes:
+o Bump Java from 8 to 11. Thanks to Dependabot.
+o Bump commons-parent from 58 to 65. Thanks to Gary Gregory.
+o Bump commons-lang3 from 3.12.0 to 3.14.0. Thanks to Gary
Gregory.
+o Bump commons-io from 2.13.0 to 2.15.1. Thanks to Gary
Gregory.
+
+
+For complete information on Apache Commons FileUpload, including instructions
on how to submit bug reports,
+patches, or suggestions for improvement, see the Apache Commons FileUpload
website:
+
+https://commons.apache.org/proper/commons-fileupload/
+
+Download it from
https://commons.apache.org/proper/commons-fileupload/download_fileupload.cgi
+
+------------------------------------------------------------------------------
+
+Apache Commons FileUpload 2.0.0-M1 Release Notes
+------------------------------------------------
+
+The Apache Commons FileUpload Parent team is pleased to announce the release
of Apache Commons FileUpload Parent 2.0.0-M1.
+
+The Apache Commons FileUpload component provides a simple yet flexible means of
+adding support for multipart file upload functionality to servlets and web
+applications.
+
+This version requires Java 11 or later.
+
+Note also that the base package name has changed to
org.apache.commons.fileupload2,
+so source changes will be required.
+
+The Maven coordinates have also changed to:
+
+ <groupId>org.apache.commons</groupId>
+ <artifactId>commons-fileupload2</artifactId>
+
+They were previously:
+ <groupId>commons-fileupload</groupId>
+ <artifactId>commons-fileupload</artifactId>
+
+
+2.0.0-M1 Release
+
+Changes in version 2.0.0-M1 include:
+
+New features:
+o Add github/codeql-action from #144. Thanks to Gary Gregory.
+o Add the package org.apache.fileupload2.jaksrvlt, for
compliance with Jakarta Servlet API 5.0.
+o Making FileUploadException a subclass of IOException.
(Mibor API simplification.)
+o Add a configurable limit (disabled by default) for the
number of files to upload per request.
+
+Fixed Bugs:
+o Changing Maven coordinates, and package name, due to binary
incompatible changes.
+o FILEUPLOAD-293: DiskFileItem.write(File) had been changed to use
FileUtils.moveFile internally, preventing an existing file as the target.
+o FILEUPLOAD-296: Performance gains by reusing an internal buffer. Thanks to
David Georg Reochelt.
+o FILEUPLOAD-274: RFC 5987 compliance Thanks to Merbin J Anselm.
+o Slight optim: resuse the index position instead of
recomputing it #49. Thanks to Emmanuel L�charny.
+o FILEUPLOAD-340: Make commons-fileupload2 a JPMS module by adding
module-info.class.
+o FILEUPLOAD-341: Move Exception classes out of the impl package. Thanks to
Martin Grigorov.
+o Rework exceptions to use propagated exception causes
(introduced in Java 1.4). Thanks to Gary Gregory.
+o All custom exception extend FileUploadException. Thanks to
Gary Gregory.
+o All custom exceptions serialVersionUID value is now 2.
Thanks to Gary Gregory.
+o FILEUPLOAD-350: FileUploadByteCountLimitException ctor switches fileName
and fieldName parameters #216. Thanks to Ernesto Reinaldo Barreiro.
+o [StepSecurity] ci: Harden GitHub Actions #224. Thanks to
step-security-bot, Gary Gregory.
+
+Changes:
+o Bump actions/cache from 2.1.6 to 3.0.8 #128, #140. Thanks
to Dependabot, Gary Gregory.
+o Bump actions/checkout from 2.3.4 to 3.0.2 #125. Thanks to
Dependabot, Gary Gregory.
+o Bump build actions/setup-java from 1.4.3 to 3.8.0 #142,
#175, #180, #182. Thanks to Gary Gregory.
+o Bump Java compiler level to 1.8.
+o Bump commons-io:commons-io 2.6 to 2.13.0, #104, #221.
Thanks to Gary Gregory, Dependabot.
+o Bump junit-jupiter from 5.5.2 to 5.9.1 #31, #130, #156,
#166. Thanks to Dependabot.
+o Bump maven-pmd-plugin from 3.13.0 to 3.19.0 #48, #162.
Thanks to Dependabot.
+o Bump commons.japicmp.version from 0.13.0 to 0.16.0. Thanks
to Gary Gregory.
+o Bump spotbugs-maven-plugin from 4.2.3 to 4.7.3.0 #103,
#133, #141, #146, #155, #163, #179. Thanks to Dependabot.
+o Bump spotbugs from 4.2.3 to 4.7.3, ignore EI_EXPOSE_REP,
and EI_EXPOSE_REP2, #152, #161, #174. Thanks to Dependabot.
+o Bump biz.aQute.bndlib from 6.0.0 to 6.4.0 #129, #181.
Thanks to Dependabot.
+o Bump commons-parent from 52 to 58, #167, #183, #194. Thanks
to Gary Gregory, Dependabot.
+o Bump maven-checkstyle-plugin from 3.1.2 to 3.2.0 #160.
Thanks to Dependabot.
+
+Removed:
+o Remove deprecated constructors in MultipartStream. Thanks
to Gary Gregory.
+o Remove deprecated RequestContext.getContentLength(). Thanks
to Gary Gregory.
+o Remove deprecated
JakSrvltRequestContext.getContentLength(). Thanks to Gary Gregory.
+o Remove deprecated PortletRequestContext.getContentLength().
Thanks to Gary Gregory.
+o Remove deprecated ServletRequestContext.getContentLength().
Thanks to Gary Gregory.
+o Remove deprecated FileUploadBase.MAX_HEADER_SIZE. Thanks to
Gary Gregory.
+o Remove deprecated FileUploadBase.createItem(Map, boolean).
Thanks to Gary Gregory.
+o Remove deprecated FileUploadBase.getFieldName(Map). Thanks
to Gary Gregory.
+o Remove deprecated FileUploadBase.getFileName(Map). Thanks
to Gary Gregory.
+o Remove deprecated FileUploadBase.getHeader(Map, String).
Thanks to Gary Gregory.
+o Remove deprecated FileUploadBase.parseHeaders(String).
Thanks to Gary Gregory.
+o Replace
org.apache.commons.fileupload2.util.mime.Base64Decoder with java.util.Base64.
Thanks to Gary Gregory.
+o Replace LimitedInputStream with BoundedInputStream. Thanks
to Gary Gregory.
+o FileItemHeadersImpl is no longer Serializable. Thanks to
Gary Gregory.
+o Reuse Java's InvalidPathException instead of the custom
InvalidFileNameException. Thanks to Gary Gregory.
+
+For complete information on Apache Commons FileUpload Parent, including
instructions on how to submit bug reports,
+patches, or suggestions for improvement, see the Apache Commons FileUpload
Parent website:
+
+https://commons.apache.org/proper/commons-fileupload/
+
+------------------------------------------------------------------------------
+
+Apache Commons FileUpload 1.6.0 Release Notes
+---------------------------------------------
+
+The Apache Commons FileUpload team is pleased to announce the release of
Apache Commons FileUpload 1.6.0.
+
+The Apache Commons FileUpload component provides a simple yet flexible means
of adding support for multipart
+file upload functionality to servlets and web applications.
+
+This release requires Java 8.
+
+Changes in this version include:
+
+New features:
+o [1.x] Enable multipart/related on FileUpload #314. Thanks
to mufasa1976, Jochen Wiedmann, Gary Gregory.
+o Add JApiCmp to the default Maven goal. Thanks to Gary
Gregory.
+o Add partHeaderSizeMax, a new limit that sets a maximum
number of bytes for each individual multipart header. The default is 512 bytes.
Thanks to Mark Thomas.
+
+Fixed Bugs:
+o Replace use of Locale.ENGLISH with Locale.ROOT. Thanks to
Gary Gregory.
+o Remove unused exception from FileUploadBase.createItem(Map,
boolean). Thanks to Gary Gregory.
+o Migrate from deprecated API in
DiskFileItem.getOutputStream(). Thanks to Gary Gregory.
+o Use try-with-resources. Thanks to Gary Gregory.
+o Port to Java 1.4 Throwable APIs (!). Thanks to Gary Gregory.
+o Remove -nouses directive from maven-bundle-plugin. OSGi
package imports now state 'uses' definitions for package imports, this doesn't
affect JPMS (from org.apache.commons:commons-parent:80). Thanks to Gary Gregory.
+o DiskFileItem.getInputStream() now uses NIO. Thanks to Gary
Gregory.
+o Last statement in DiskFileItem.finalize() method should be
a call to super.finalize(). Thanks to Gary Gregory.
+o
org.apache.commons.fileupload.FileUploadBase.FileUploadIOException is now a
proper Java 1.4-style exception (propagates its cause to super). Thanks to Gary
Gregory.
+o Use java.util.Base64 instead of custom code. Thanks to Gary
Gregory.
+
+Changes:
+o Bump Java from 6 to 8. Thanks to Gary Gregory.
+o Bump org.apache.commons:commons-parent from 62 to 84,
upgrades Doxia from 1 to 2. Thanks to Gary Gregory.
+o Bump commons-io from 2.11.0 to 2.19.0. Thanks to Gary
Gregory.
+o Bump javax.servlet:servlet-api from 2.4 to 2.5. Thanks to
Gary Gregory.
+o Bump JUnit from junit:junit:4.13.2
org.junit.vintage:junit-vintage-engine from parent POM. Thanks to Gary Gregory.
+
+
+Historical list of changes:
https://commons.apache.org/proper/commons-fileupload/changes.html
+
+For complete information on Apache Commons FileUpload, including instructions
on how to submit bug reports,
+patches, or suggestions for improvement, see the Apache Commons FileUpload
website:
+
+https://commons.apache.org/proper/commons-fileupload/
+
+Download page:
https://commons.apache.org/proper/commons-fileupload/download_fileupload.cgi
+
+Apache Commons Team
+
+------------------------------------------------------------------------------
+
+ Apache Commons FileUpload 1.5 RELEASE NOTES
+
+The Apache Commons FileUpload team is pleased to announce the release of
Apache Commons FileUpload 1.5.
+
+The Apache Commons FileUpload component provides a simple yet flexible means of
+adding support for multipart file upload functionality to servlets and web
+applications. Version 1.3 onwards requires Java 6 or later.
+
+No client code changes are required to migrate from version 1.4 to 1.5.
+
+Changes in version 1.5 include:
+
+New features:
+o Add a configurable limit (disabled by default) for the
number of files to upload per request.
+
+Fixed Bugs:
+o FILEUPLOAD-293: DiskFileItem.write(File) had been changed to use
FileUtils.moveFile internally, preventing an existing file as the target.
+o Improve parsing speed. Thanks to David Georg Reichelt.
+
+Changes:
+o Bump Commons IO to 2.11.0
+o FILEUPLOAD-328 Switch from Cobertura code coverage to Jacoco code
coverage. Thanks to Arturo Bernal.
+o Bump JUnit to 4.13.2
+
+
+For complete information on Apache Commons FileUpload, including instructions
on how to submit bug reports,
+patches, or suggestions for improvement, see the Apache Commons FileUpload
website:
+
+https://commons.apache.org/proper/commons-fileupload/
+
+------------------------------------------------------------------------------
+
+ Apache Commons FileUpload 1.4 RELEASE NOTES
+
+The Apache Commons FileUpload team is pleased to announce the release of
Apache Commons FileUpload 1.4.
+
+The Apache Commons FileUpload component provides a simple yet flexible means of
+adding support for multipart file upload functionality to servlets and web
+applications. Version 1.3 onwards requires Java 6 or later.
+
+
+1.4 Release
+
+Changes in version 1.4 include:
+
+New features:
+o Site: added security report
+
+Fixed Bugs:
+o FILEUPLOAD-252: DiskFileItem#write() could lose original IO exception
+o FILEUPLOAD-258: DiskFileItem#getStoreLocation() wrongly returned a File
object for items stored in memory
+o FILEUPLOAD-242: FileUploadBase - should not silently catch and ignore all
Throwables
+o FILEUPLOAD-257: Fix Javadoc 1.8.0 errors
+o FILEUPLOAD-234: Fix section "Resource cleanup" of the user guide
+o FILEUPLOAD-237: Fix streaming example: use FileItem.getInputStream()
instead of openStream()
+o FILEUPLOAD-248: DiskFileItem might suppress critical IOExceptions on rename
- use FileUtil.move instead
+o FILEUPLOAD-251: DiskFileItem#getTempFile() is broken
+o FILEUPLOAD-250: FileUploadBase - potential resource leak - InputStream not
closed on exception
+o FILEUPLOAD-244: DiskFileItem.readObject fails to close FileInputStream
+o FILEUPLOAD-245: DiskFileItem.get() may not fully read the data
+
+Changes:
+o FILEUPLOAD-292: Don't create un-needed resources in FileUploadBase.java
+o FILEUPLOAD-282: Upversion complier.source, compiler.target to 1.6
+o FILEUPLOAD-246: FileUpload should use IOUtils.closeQuietly where relevant
+o FILEUPLOAD-243: Make some MultipartStream private fields final Thanks to
Ville Skytt�.
+
+
+For complete information on Apache Commons FileUpload, including instructions
on how to submit bug reports,
+patches, or suggestions for improvement, see the Apache Commons FileUpload
website:
+
+https://commons.apache.org/proper/commons-fileupload/
+
+------------------------------------------------------------------------------
+
+ Apache Commons FileUpload 1.3.3 RELEASE NOTES
+
+The Apache Commons FileUpload team is pleased to announce the release of
Apache Commons FileUpload 1.3.3.
+
+The Apache Commons FileUpload component provides a simple yet flexible means of
+adding support for multipart file upload functionality to servlets and web
+applications. Version 1.3 onwards requires Java 5 or later.
+
+No client code changes are required to migrate from version 1.3.0, 1.3.1, or
1.3.2, to 1.3.3
+
+Changes in version 1.3.3 include:
+
+o FILEUPLOAD-279: DiskFileItem can no longer be deserialized, unless a
particular system property is set.
+
+
+For complete information on Apache Commons FileUpload, including instructions
on how to submit bug reports,
+patches, or suggestions for improvement, see the Apache Commons FileUpload
website:
+
+https://commons.apache.org/proper/commons-fileupload/
+
+------------------------------------------------------------------------------
+
+No client code changes are required to migrate from version 1.3.1 to 1.3.2.
+
+Changes in version 1.3.2 include:
+
+o FILEUPLOAD-272: Performance Improvement in MultipartStream. Prevents a DoS
(CVE-2016-3092)
+
+
+For complete information on Apache Commons FileUpload, including instructions
on how to submit bug reports,
+patches, or suggestions for improvement, see the Apache Commons FileUpload
website:
+
+https://commons.apache.org/proper/commons-fileupload/
+
+------------------------------------------------------------------------------
+
+ Apache Commons FileUpload 1.3.1 RELEASE NOTES
+
+The Apache Commons FileUpload team is pleased to announce the release of
Apache Commons FileUpload 1.3.1.
+
+The Apache Commons FileUpload component provides a simple yet flexible means of
+adding support for multipart file upload functionality to servlets and web
+applications. Version 1.3 onwards requires Java 5 or later.
+
+No client code changes are required to migrate from version 1.3.0 to 1.3.1.
+
+
+This is a security and maintenance release that includes an important security
+fix as well as a small number of bugfixes.
+
+Changes in version 1.3.1 include:
+
+
+Fixed Bugs:
+o SECURITY - CVE-2014-0050. Specially crafted input can
trigger a DoS if the
+ buffer used by the MultipartStream is not big enough. When
constructing
+ MultipartStream enforce the requirements for buffer size by
throwing an
+ IllegalArgumentException if the requested buffer size is
too small. This
+ prevents the DoS.
+o When deserializing DiskFileItems ensure that the repository
location, if
+ any, is a valid one. Thanks to Arun Babu Neelicattu.
+o Correct example in usage documentation so it compiles.
+
+
+
+For complete information on Apache Commons FileUpload, including instructions
on how to submit bug reports,
+patches, or suggestions for improvement, see the Apache Commons FileUpload
website:
+
+https://commons.apache.org/proper/commons-fileupload/
+
Copied:
release/commons/fileupload/binaries/commons-fileupload2-2.0.0-M5-bin.tar.gz
(from r82574,
dev/commons/fileupload/2.0.0-M5-RC1/binaries/commons-fileupload2-2.0.0-M5-bin.tar.gz)
==============================================================================
Binary file (source and/or target). No diff available.
Copied:
release/commons/fileupload/binaries/commons-fileupload2-2.0.0-M5-bin.tar.gz.asc
(from r82574,
dev/commons/fileupload/2.0.0-M5-RC1/binaries/commons-fileupload2-2.0.0-M5-bin.tar.gz.asc)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++
release/commons/fileupload/binaries/commons-fileupload2-2.0.0-M5-bin.tar.gz.asc
Tue Feb 17 15:44:38 2026 (r82575, copy of r82574,
dev/commons/fileupload/2.0.0-M5-RC1/binaries/commons-fileupload2-2.0.0-M5-bin.tar.gz.asc)
@@ -0,0 +1,7 @@
+-----BEGIN PGP SIGNATURE-----
+
+iHUEABYKAB0WIQT03VnJAUi9xSvrkKRTCqXyXCUBHwUCaYjWTwAKCRBTCqXyXCUB
+H5kSAP9QG2Z9jF+1z/iJsdtQ+F58iDLF/O5wlafs3tNViNH1TAD9Gv0IeCD3r3Kl
+5YfImNsfzYBfD4xqTjrDvi0bJDtRSAI=
+=megV
+-----END PGP SIGNATURE-----
Copied:
release/commons/fileupload/binaries/commons-fileupload2-2.0.0-M5-bin.tar.gz.sha512
(from r82574,
dev/commons/fileupload/2.0.0-M5-RC1/binaries/commons-fileupload2-2.0.0-M5-bin.tar.gz.sha512)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++
release/commons/fileupload/binaries/commons-fileupload2-2.0.0-M5-bin.tar.gz.sha512
Tue Feb 17 15:44:38 2026 (r82575, copy of r82574,
dev/commons/fileupload/2.0.0-M5-RC1/binaries/commons-fileupload2-2.0.0-M5-bin.tar.gz.sha512)
@@ -0,0 +1 @@
+7e050be0187813dfa6fac3e9679a9be71a7956a97ff3e8e762ad2fd5552f3883ecfbe92c013c2f66409a998600c7167d8749eecbdf61ba50f69472af8a9ec533
Copied:
release/commons/fileupload/binaries/commons-fileupload2-2.0.0-M5-bin.zip (from
r82574,
dev/commons/fileupload/2.0.0-M5-RC1/binaries/commons-fileupload2-2.0.0-M5-bin.zip)
==============================================================================
Binary file (source and/or target). No diff available.
Copied:
release/commons/fileupload/binaries/commons-fileupload2-2.0.0-M5-bin.zip.asc
(from r82574,
dev/commons/fileupload/2.0.0-M5-RC1/binaries/commons-fileupload2-2.0.0-M5-bin.zip.asc)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++
release/commons/fileupload/binaries/commons-fileupload2-2.0.0-M5-bin.zip.asc
Tue Feb 17 15:44:38 2026 (r82575, copy of r82574,
dev/commons/fileupload/2.0.0-M5-RC1/binaries/commons-fileupload2-2.0.0-M5-bin.zip.asc)
@@ -0,0 +1,7 @@
+-----BEGIN PGP SIGNATURE-----
+
+iHUEABYKAB0WIQT03VnJAUi9xSvrkKRTCqXyXCUBHwUCaYjWTwAKCRBTCqXyXCUB
+HySbAQD8V6OnU5N4lZLrA/shGdZMfI1syS0HqyK7CFM3UHFnoQEA2fXx80hNZny8
+p2fgfuBWI8UlDXQ7izq52Avzyd2BHgQ=
+=d2/A
+-----END PGP SIGNATURE-----
Copied:
release/commons/fileupload/binaries/commons-fileupload2-2.0.0-M5-bin.zip.sha512
(from r82574,
dev/commons/fileupload/2.0.0-M5-RC1/binaries/commons-fileupload2-2.0.0-M5-bin.zip.sha512)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++
release/commons/fileupload/binaries/commons-fileupload2-2.0.0-M5-bin.zip.sha512
Tue Feb 17 15:44:38 2026 (r82575, copy of r82574,
dev/commons/fileupload/2.0.0-M5-RC1/binaries/commons-fileupload2-2.0.0-M5-bin.zip.sha512)
@@ -0,0 +1 @@
+1b5230e74fe551c756badce15e586ab9dde9bda93320270ad3865dc0a657f687b7a7050ee02b1670d0cd7f38e424cf41736ebfec8e6f41b77e43fab8cb037786
Copied:
release/commons/fileupload/source/commons-fileupload2-2.0.0-M5-src.tar.gz (from
r82574,
dev/commons/fileupload/2.0.0-M5-RC1/source/commons-fileupload2-2.0.0-M5-src.tar.gz)
==============================================================================
Binary file (source and/or target). No diff available.
Copied:
release/commons/fileupload/source/commons-fileupload2-2.0.0-M5-src.tar.gz.asc
(from r82574,
dev/commons/fileupload/2.0.0-M5-RC1/source/commons-fileupload2-2.0.0-M5-src.tar.gz.asc)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++
release/commons/fileupload/source/commons-fileupload2-2.0.0-M5-src.tar.gz.asc
Tue Feb 17 15:44:38 2026 (r82575, copy of r82574,
dev/commons/fileupload/2.0.0-M5-RC1/source/commons-fileupload2-2.0.0-M5-src.tar.gz.asc)
@@ -0,0 +1,7 @@
+-----BEGIN PGP SIGNATURE-----
+
+iHUEABYKAB0WIQT03VnJAUi9xSvrkKRTCqXyXCUBHwUCaYjWTgAKCRBTCqXyXCUB
+H3t1AQDgKbqwPkDSirEXUHG0sisH4L5dAMRfYjuGAgXaU4tjigEA56KibQlhW88v
+KhZyBZOgRucV6zBOCJGoTk+l1bgN2Q8=
+=Cx62
+-----END PGP SIGNATURE-----
Copied:
release/commons/fileupload/source/commons-fileupload2-2.0.0-M5-src.tar.gz.sha512
(from r82574,
dev/commons/fileupload/2.0.0-M5-RC1/source/commons-fileupload2-2.0.0-M5-src.tar.gz.sha512)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++
release/commons/fileupload/source/commons-fileupload2-2.0.0-M5-src.tar.gz.sha512
Tue Feb 17 15:44:38 2026 (r82575, copy of r82574,
dev/commons/fileupload/2.0.0-M5-RC1/source/commons-fileupload2-2.0.0-M5-src.tar.gz.sha512)
@@ -0,0 +1 @@
+da7c3cd5d744149d1abdf8700385530659898934c5081fc5844ce72f5884ca263ced50d4026b21e576c93e126eb405a26ee751cfc524c856df91c91dba8f7ef2
Copied: release/commons/fileupload/source/commons-fileupload2-2.0.0-M5-src.zip
(from r82574,
dev/commons/fileupload/2.0.0-M5-RC1/source/commons-fileupload2-2.0.0-M5-src.zip)
==============================================================================
Binary file (source and/or target). No diff available.
Copied:
release/commons/fileupload/source/commons-fileupload2-2.0.0-M5-src.zip.asc
(from r82574,
dev/commons/fileupload/2.0.0-M5-RC1/source/commons-fileupload2-2.0.0-M5-src.zip.asc)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ release/commons/fileupload/source/commons-fileupload2-2.0.0-M5-src.zip.asc
Tue Feb 17 15:44:38 2026 (r82575, copy of r82574,
dev/commons/fileupload/2.0.0-M5-RC1/source/commons-fileupload2-2.0.0-M5-src.zip.asc)
@@ -0,0 +1,7 @@
+-----BEGIN PGP SIGNATURE-----
+
+iHUEABYKAB0WIQT03VnJAUi9xSvrkKRTCqXyXCUBHwUCaYjWTgAKCRBTCqXyXCUB
+H3jxAPsGDgY4LBjKf6gSgg1o7bPvQ51mff4YaTbOc2uBKKhPGQD+PVNOVQjvsbPw
+aaoDZ8en7/8E4nYZe6XUnASr/oLeKA0=
+=sDJ8
+-----END PGP SIGNATURE-----
Copied:
release/commons/fileupload/source/commons-fileupload2-2.0.0-M5-src.zip.sha512
(from r82574,
dev/commons/fileupload/2.0.0-M5-RC1/source/commons-fileupload2-2.0.0-M5-src.zip.sha512)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++
release/commons/fileupload/source/commons-fileupload2-2.0.0-M5-src.zip.sha512
Tue Feb 17 15:44:38 2026 (r82575, copy of r82574,
dev/commons/fileupload/2.0.0-M5-RC1/source/commons-fileupload2-2.0.0-M5-src.zip.sha512)
@@ -0,0 +1 @@
+16862effd545665ab00f37838ca31d811077a9efa68fbc91141cc155aaceb3e74072c075629de477e9d30938b9c4e0ba1a39cd508b9663a57fefe22716112d27
