This is an automated email from the ASF dual-hosted git repository.
jamesbognar pushed a commit to branch docs
in repository https://gitbox.apache.org/repos/asf/juneau.git
The following commit(s) were added to refs/heads/docs by this push:
new f13743b6f2 docs(release-notes): add 9.5.0 entries for TODO-125
(LocalDir path-traversal) and TODO-138 (ClassFormatSwap session classloader)
f13743b6f2 is described below
commit f13743b6f2c3c5f5a483fba0172c01026da3f51e
Author: James Bognar <[email protected]>
AuthorDate: Thu May 28 15:25:40 2026 -0400
docs(release-notes): add 9.5.0 entries for TODO-125 (LocalDir
path-traversal) and TODO-138 (ClassFormatSwap session classloader)
Co-authored-by: Cursor <[email protected]>
---
pages/release-notes/9.5.0.md | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/pages/release-notes/9.5.0.md b/pages/release-notes/9.5.0.md
index 674b95130f..8a55bbdce0 100644
--- a/pages/release-notes/9.5.0.md
+++ b/pages/release-notes/9.5.0.md
@@ -385,6 +385,16 @@ land, parser sessions other than `JsonParserSession` /
`Json5ParserSession` prod
- Updated the `RestClient.msgPack()` / `RestRequest.msgPack()` Javadoc to
document the new media-type
value sent on the `Accept` and `Content-Type` request headers.
+#### Bugs
+
+- **`ClassFormatSwap.unswap(...)` now consults the session classloader**
before falling back to the
+ thread-context classloader (TODO-138). Sessions that explicitly set a
classloader via
+ `MarshallingContext.Builder.classLoader(ClassLoader)` — such as OSGi bundle
classloaders, webapp
+ classloaders, and plugin systems — now correctly resolve `Class<?>` values
from that classloader
+ during parsing. The same fix was applied to the inline per-property swap
installed by
+ `MarshalledPropertyPostProcessor`. The thread-context classloader is still
used as a fallback when
+ no session classloader is configured, preserving historical behavior for
existing callers.
+
### juneau-commons
#### `@Value` annotation + `${xxx}` shortcut (TODO-79)
@@ -576,6 +586,10 @@ var keep their existing syntax — no migration required for
those.
- **`XValue` primitive-holder companions renamed to `XHolder`.** The nine
typed primitive-holder subclasses have been renamed for consistency with the
`Value` → `Holder` rename: `BooleanValue` → `BooleanHolder`, `ByteValue` →
`ByteHolder`, `CharValue` → `CharHolder`, `DoubleValue` → `DoubleHolder`,
`FloatValue` → `FloatHolder`, `IntegerValue` → `IntegerHolder`, `LongValue` →
`LongHolder`, `ShortValue` → `ShortHolder`, `StringValue` → `StringHolder`.
Update import statements and type refe [...]
+#### Security
+
+- **`LocalDir.resolve(...)` now enforces path-traversal boundary defensively
(consistent with `FileUtils.resolveSafely(...)`).** On the filesystem-root
branch, resolution is delegated to `FileUtils.resolveSafely(...)` which rejects
any path that escapes the configured root (via `../`, absolute-path injection,
or symlinks pointing outside the root) with `IllegalArgumentException`. On the
classpath-resource branch, paths containing `..` segments are likewise
rejected. This makes `LocalDir` [...]
+
### juneau-config
#### Classpath-default `Config` bridge to `Settings` (TODO-79)
