This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-bcel.git
The following commit(s) were added to refs/heads/master by this push:
new 13fe5d91 Prepare for the release candidate
13fe5d91 is described below
commit 13fe5d9142a43250f33e7f636cb44e3e18f974e6
Author: Gary Gregory <[email protected]>
AuthorDate: Sun Sep 6 18:25:51 2026 +0000
Prepare for the release candidate
---
README.md | 7 +--
RELEASE-NOTES.txt | 114 ++++++++++++++++++++++++++++++++++++++++
src/changes/changes.xml | 2 +-
src/site/xdoc/download_bcel.xml | 26 ++++-----
4 files changed, 132 insertions(+), 17 deletions(-)
diff --git a/README.md b/README.md
index 33798d63..5d09fe0a 100644
--- a/README.md
+++ b/README.md
@@ -45,7 +45,7 @@ Apache Commons BCEL
[](https://github.com/apache/commons-bcel/actions/workflows/maven.yml)
[](https://search.maven.org/artifact/org.apache.bcel/bcel)
-[](https://javadoc.io/doc/org.apache.bcel/bcel/6.12.0)
+[](https://javadoc.io/doc/org.apache.bcel/bcel/6.13.0)
[](https://github.com/apache/commons-bcel/actions/workflows/codeql-analysis.yml)
[](https://api.securityscorecards.dev/projects/github.com/apache/commons-bcel)
@@ -68,7 +68,7 @@ Alternatively, you can pull it from the central Maven
repositories:
<dependency>
<groupId>org.apache.bcel</groupId>
<artifactId>bcel</artifactId>
- <version>6.12.0</version>
+ <version>6.13.0</version>
</dependency>
```
@@ -115,4 +115,5 @@ Additional Resources
Apache Commons Components
-------------------------
-Please see the [list of components](https://commons.apache.org/components.html)
++ [List of Apache Commons
components](https://commons.apache.org/components.html): homepages and
documentation for all components.
++
[`REPOSITORIES.md`](https://github.com/apache/commons-parent/blob/master/REPOSITORIES.md):
overview of the code repositories and their build status.
diff --git a/RELEASE-NOTES.txt b/RELEASE-NOTES.txt
index 62c76942..d349bcaf 100644
--- a/RELEASE-NOTES.txt
+++ b/RELEASE-NOTES.txt
@@ -1,3 +1,117 @@
+Apache Commons BCEL Version 6.13.0
+RELEASE NOTES
+
+
+Introduction
+------------
+The Apache Commons BCEL team is pleased to announce the release of
+Apache Commons BCEL 6.13.0.
+
+The Commons Byte Code Engineering Library (BCEL) is designed to provide users
with a convenient way to analyze, create, and manipulate compiled .class files.
+
+This is a feature and maintenance release. Java 8 or later is required.
+
+New Features
+------------
+* Add support for permitted subclasses #493. Thanks to nbauma109,
Gary Gregory.
+* Add RecordComponentInfo.getAttribute(byte tag)#494. Thanks to
nbauma109, Gary Gregory.
+* Add Const.MAJOR_27. Thanks to Gary Gregory.
+* Add Const.MINOR_27. Thanks to Gary Gregory.
+* Add and use ArrayType.isElementType(Type). Thanks to Gary Gregory.
+* Add Const.MAJOR_28. Thanks to Gary Gregory.
+* Add Const.MINOR_28. Thanks to Gary Gregory.
+
+Fixed Bugs
+----------
+* Fix constant pool module access test on Java 26 and above #492.
Thanks to nbauma109.
+* Deprecate org.apache.bcel.classfile.Utility.Utility(). Thanks to
Gary Gregory.
+* Deprecate
org.apache.bcel.verifier.exc.Utility.getStackTrace(Throwable). Thanks to Gary
Gregory.
+* Fix all Javadoc warnings and enforce checks by default. Thanks to
Gary Gregory.
+* Escape constant pool names in generated HTML (#500). Thanks to
Dexter.k.
+* Escape referenced names in BCELFactory Java output (#501). Thanks
to Dexter.k, Gary Gregory.
+* Make wide flag thread-local in Utility.codeToString (#502). Thanks
to Dexter.k, Gary Gregory.
+* Read multianewarray dimensions as unsigned byte (#504). Thanks to
Dexter.k, Gary Gregory.
+* Site docs: clarify security model (#503). Thanks to Arnout Engelen.
+* Read ConstantDynamic indices as unsigned shorts (#505). Thanks to
Dexter.k, Gary Gregory.
+* Validate index upper bound in CPInstruction, IINC and RET setIndex
(#506). Thanks to Dexter.k, Gary Gregory.
+* Use correct attribute tag in NestHost and ModuleMainClass (#507).
Thanks to Dexter.k, Gary Gregory.
+* Propagate runtime-visible flag when parsing parameter annotations
(#509). Thanks to Dexter.k, Gary Gregory.
+* Use fixedLength for parsed LOOKUPSWITCH length (#499). Thanks to
Digiscrypt Technologies, Gary Gregory.
+* Fix ConstantPoolGen dedup key collisions for names with delimiters
(#510). Thanks to Dexter.k, Gary Gregory.
+* Read unsigned bytecode operands in CodeHTML disassembler (#511).
Thanks to Dexter.k, Gary Gregory.
+* Deep-copy bootstrap arguments array in BootstrapMethod.copy()
(#516). Thanks to Dexter.k, Gary Gregory.
+* Use exclusive live-range end in
LocalVariableTable.getLocalVariable (#517). Thanks to Dexter.k, Gary Gregory.
+* Build TABLESWITCH from sorted arrays in SWITCH (#518). Thanks to
Naveed Khan, Gary Gregory.
+* Use array element type not basic type for primitive array access
(#520). Thanks to Naveed Khan, Gary Gregory.
+* Set length in INVOKEDYNAMIC constructor (#521). Thanks to Naveed
Khan, Gary Gregory.
+* Reject CALOAD on non-char arrays in structural verification
(#522). Thanks to Naveed Khan, Gary Gregory.
+* Add negative verifier tests for remaining array load/store
component type checks (#524). Thanks to Naveed Khan, Gary Gregory.
+* Validate u1 count bound in INVOKEINTERFACE and MULTIANEWARRAY
(#523). Thanks to Naveed Khan, Gary Gregory.
+* Match wide local variable instruction length to dumped bytes
(#525). Thanks to Naveed Khan, Gary Gregory.
+* Bound IINC increment to signed short (#526). Thanks to Naveed
Khan, Gary Gregory.
+* Fix SpotBugs USO_UNSAFE_METHOD_SYNCHRONIZATION in ConstantUtf8.
Thanks to Gary Gregory.
+* Nested Code/Record attributes drive unbounded parse-time recursion
in ClassParser (f001). Thanks to Gary Gregory.
+* Nested annotation element values recurse unboundedly;
MAX_ARRAY_DIMENSIONS cap bypassed (f002). Thanks to Gary Gregory.
+* Opcodes tableswitch and lookupswitch add boundary checks (f003).
Thanks to Gary Gregory.
+* JustIce Pass 2 hangs on cyclic superclass chain of a referenced
exception class (f004). Thanks to Gary Gregory.
+* JustIce Pass 2 LVT check amplifies each 10-byte entry into ~131k
hashtable operations (f005). Thanks to Gary Gregory.
+* Pass 3b dataflow stores frames per instruction and clones
ever-growing execution chains (f006). Thanks to Gary Gregory.
+* Cubic handlers × range × subroutines scan in Subroutines
constructor hangs JustIce Pass 3b (f007). Thanks to Gary Gregory.
+* Subroutines.noRecursiveCalls enumerates exponentially many JSR
call paths (f008). Thanks to Gary Gregory.
+* Disassembler and Class2HTML re-implement the unchecked
switch-table allocation (f009). Thanks to Gary Gregory.
+* ConstantPool.constantToString recurses forever on self-referencing
CONSTANT_MethodHandle (f010). Thanks to Gary Gregory.
+* Utility.typeSignatureToString recurses per generic-nesting level,
unbounded, with quadratic substring copies. (f011). Thanks to Gary Gregory.
+* Repositories cache classes under the input-defined this_class
name; global static Repository/VerifierFactory make the poisoning
ClassLoader-wide. (f012). Thanks to Gary Gregory.
+* Silent u2/u1 count truncation across dump paths corrupts emitted
bytecode. (f013). Thanks to Gary Gregory.
+* Class2HTML emitters write attacker class-file strings into HTML
unescaped (stored XSS in reports) (f014). Thanks to Gary Gregory.
+* Class2HTML builds output file paths from the unvalidated class
name (f015). Thanks to Gary Gregory.
+* ClassPath.getBytes() sizes its buffer from the forged ZIP
uncompressed-size field (f016). Thanks to Gary Gregory.
+* PMG attribute ignores declared length, enabling BCEL-vs-JVM parse
divergence (f019). Thanks to Gary Gregory.
+* Signature.matchGJIdent recurses unboundedly on nested generic
signatures (Signature.translate) (f020). Thanks to Gary Gregory.
+* Utility.decode fixed 3x buffer breaks the encode/decode round trip
and throws unchecked AIOOBE (f021). Thanks to Gary Gregory.
+* BCELifier interpolates attacker class/package names into generated
Java source unescaped (f022). Thanks to Gary Gregory.
+* Verifier pass 3a delayed checks are quadratic in attribute and
code size (f023). Thanks to Gary Gregory.
+* Verifier cache grows unboundedly with attacker-chosen class names
(f024). Thanks to Gary Gregory.
+* Static WIDE ThreadLocal survives exceptions, corrupting the next
class's disassembly on the same thread (f025). Thanks to Gary Gregory.
+* Utility.JavaReader escape decoding: OOB table index, bad-hex
crash, silent non-canonical aliasing (f026). Thanks to Gary Gregory.
+
+Changes
+-------
+* Bump org.apache.commons:commons-parent from 95 to 104. Thanks to
Gary Gregory.
+* Bump org.jetbrains.kotlin:kotlin-stdlib from 2.3.0 to 2.4.20
(#497, #519). Thanks to Gary Gregory, Dependabot.
+* Bump commons-io:commons-io from 2.21.0 to 2.22.0. Thanks to Gary
Gregory.
+* Bump jna.version from 5.18.1 to 5.19.1 (#514). Thanks to Gary
Gregory, Dependabot.
+* [test] Bump org.apache.commons:commons-collections4 from 4.5.0 to
4.6.0. Thanks to Gary Gregory.
+
+
+Historical list of changes:
https://commons.apache.org/proper/commons-bcel/changes.html
+
+For complete information on Apache Commons BCEL, including instructions on how
to submit bug reports,
+patches, or suggestions for improvement, see the Apache Commons BCEL website:
+
+https://commons.apache.org/proper/commons-bcel
+
+Download it from
https://commons.apache.org/proper/commons-bcel/download_bcel.cgi
+
+Have fun!
+-Apache Commons BCEL team
+
+Feedback
+--------
+Open source works best when you give feedback:
+
+ https://commons.apache.org/bcel
+
+Please direct all bug reports to JIRA:
+
+ https://issues.apache.org/jira/browse/BCEL
+
+Or subscribe to the commons-user mailing list
+
+The Apache Commons Team
+
+-----------------------------------------------------------------------------
+
Apache Commons BCEL Version 6.12.0
RELEASE NOTES
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index 4eab68ca..a1629373 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -59,7 +59,7 @@ The <action> type attribute can be add,update,fix,remove.
Defining changes.version allows one to create the RN without first removing
the SNAPSHOT suffix.
-->
<body>
- <release version="6.13.0" date="YYYY-MM-DD" description="This is a feature
and maintenance release. Java 8 or later is required.">
+ <release version="6.13.0" date="2026-09-06" description="This is a feature
and maintenance release. Java 8 or later is required.">
<!-- FIX -->
<action type="fix" dev="ggregory"
due-to="nbauma109">Fix constant pool module access test on Java 26 and above
#492.</action>
<action type="fix" dev="ggregory" due-to="Gary
Gregory">Deprecate org.apache.bcel.classfile.Utility.Utility().</action>
diff --git a/src/site/xdoc/download_bcel.xml b/src/site/xdoc/download_bcel.xml
index 5c49f42c..75ccc219 100644
--- a/src/site/xdoc/download_bcel.xml
+++ b/src/site/xdoc/download_bcel.xml
@@ -115,32 +115,32 @@ limitations under the License.
</p>
</subsection>
</section>
- <section name="Apache Commons BCEL 6.12.0 (Java 8 or above)">
+ <section name="Apache Commons BCEL 6.13.0 (Java 8 or above)">
<subsection name="Binaries">
<table>
<tr>
- <td><a
href="[preferred]/commons/bcel/binaries/bcel-6.12.0-bin.tar.gz">bcel-6.12.0-bin.tar.gz</a></td>
- <td><a
href="https://downloads.apache.org/commons/bcel/binaries/bcel-6.12.0-bin.tar.gz.sha512";>sha512</a></td>
- <td><a
href="https://downloads.apache.org/commons/bcel/binaries/bcel-6.12.0-bin.tar.gz.asc";>pgp</a></td>
+ <td><a
href="[preferred]/commons/bcel/binaries/bcel-6.13.0-bin.tar.gz">bcel-6.13.0-bin.tar.gz</a></td>
+ <td><a
href="https://downloads.apache.org/commons/bcel/binaries/bcel-6.13.0-bin.tar.gz.sha512";>sha512</a></td>
+ <td><a
href="https://downloads.apache.org/commons/bcel/binaries/bcel-6.13.0-bin.tar.gz.asc";>pgp</a></td>
</tr>
<tr>
- <td><a
href="[preferred]/commons/bcel/binaries/bcel-6.12.0-bin.zip">bcel-6.12.0-bin.zip</a></td>
- <td><a
href="https://downloads.apache.org/commons/bcel/binaries/bcel-6.12.0-bin.zip.sha512";>sha512</a></td>
- <td><a
href="https://downloads.apache.org/commons/bcel/binaries/bcel-6.12.0-bin.zip.asc";>pgp</a></td>
+ <td><a
href="[preferred]/commons/bcel/binaries/bcel-6.13.0-bin.zip">bcel-6.13.0-bin.zip</a></td>
+ <td><a
href="https://downloads.apache.org/commons/bcel/binaries/bcel-6.13.0-bin.zip.sha512";>sha512</a></td>
+ <td><a
href="https://downloads.apache.org/commons/bcel/binaries/bcel-6.13.0-bin.zip.asc";>pgp</a></td>
</tr>
</table>
</subsection>
<subsection name="Source">
<table>
<tr>
- <td><a
href="[preferred]/commons/bcel/source/bcel-6.12.0-src.tar.gz">bcel-6.12.0-src.tar.gz</a></td>
- <td><a
href="https://downloads.apache.org/commons/bcel/source/bcel-6.12.0-src.tar.gz.sha512";>sha512</a></td>
- <td><a
href="https://downloads.apache.org/commons/bcel/source/bcel-6.12.0-src.tar.gz.asc";>pgp</a></td>
+ <td><a
href="[preferred]/commons/bcel/source/bcel-6.13.0-src.tar.gz">bcel-6.13.0-src.tar.gz</a></td>
+ <td><a
href="https://downloads.apache.org/commons/bcel/source/bcel-6.13.0-src.tar.gz.sha512";>sha512</a></td>
+ <td><a
href="https://downloads.apache.org/commons/bcel/source/bcel-6.13.0-src.tar.gz.asc";>pgp</a></td>
</tr>
<tr>
- <td><a
href="[preferred]/commons/bcel/source/bcel-6.12.0-src.zip">bcel-6.12.0-src.zip</a></td>
- <td><a
href="https://downloads.apache.org/commons/bcel/source/bcel-6.12.0-src.zip.sha512";>sha512</a></td>
- <td><a
href="https://downloads.apache.org/commons/bcel/source/bcel-6.12.0-src.zip.asc";>pgp</a></td>
+ <td><a
href="[preferred]/commons/bcel/source/bcel-6.13.0-src.zip">bcel-6.13.0-src.zip</a></td>
+ <td><a
href="https://downloads.apache.org/commons/bcel/source/bcel-6.13.0-src.zip.sha512";>sha512</a></td>
+ <td><a
href="https://downloads.apache.org/commons/bcel/source/bcel-6.13.0-src.zip.asc";>pgp</a></td>
</tr>
</table>
</subsection>
