Can you provide some log files that show how it breaks?
> On Nov 10, 2026, at 7:44 PM, Don Lewis via commits
> <[email protected]> wrote:
>
> On 3 Nov, pfg.apache.org via commits wrote:
>> This is an automated email from the ASF dual-hosted git repository.
>>
>> asf-gitbox-commits pushed a commit to branch trunk
>> in repository https://gitbox.apache.org/repos/asf/openoffice.git
>>
>>
>> The following commit(s) were added to refs/heads/trunk by this push:
>> new a0d841013a Rhino 1.7.7.2 integration: security hardening, patch
>> fixes, ES6 default mode
>> a0d841013a is described below
>>
>> commit a0d841013a7b93e3bcedcaed86403bb1797490bd
>> Author: Pedro Giffuni <[email protected]>
>> AuthorDate: Tue Nov 3 03:37:55 2026 -0500
>>
>> Rhino 1.7.7.2 integration: security hardening, patch fixes, ES6 default
>> mode
>>
>> Security hardening:
>> - E4X/XML: harden XmlProcessor against XXE (external entities, parameter
>> entities, external DTD, XInclude, external stylesheet).
>> TransformerFactory
>> configured with FEATURE_SECURE_PROCESSING and ACCESS_EXTERNAL_*;
>> explicit
>> empty entity resolver as defense-in-depth.
>> - toFixed(): bound computational cost for tiny/subnormal values using
>> 0.5 * 10^(-precision) comparison (no overflow, numerically stable),
>> preventing DoS on inputs like (4.47118444E-314).toFixed(2).
>> - DefiningClassLoader: call Thread.getContextClassLoader() directly
>> instead
>> of reflection (available since Java 2, no Java2 concern on Java 8).
>>
>> Patch fixes:
>> - java-version.patch: target-jvm/source-level 1.6 -> 1.8 (Java 8 minimum).
>> - Main: getIn()/getOut()/getErr() fall back to System.in/out/err instead
>> of
>> returning null when debugger console unavailable.
>> - build.xml: inline manifest (Implementation-Version: 1.7.7.2), ships
>> Messages.properties in JAR; full js.jar with debugger+tools preserved.
>>
>> Language mode:
>> - Default Context.VERSION_ES6 in ScriptProviderForJavaScript and
>> ScriptEditorForJavaScript.
>>
>> Build note:
>> - Rhino 1.7.7.2 is the last Rhino version supporting the Ant build;
>> upstream migrated to Gradle thereafter.
>>
>> Regression tests (not committed): TestXXEResgression (11 pass),
>> TestToFixedRegression (32 pass), TestES6Smoke (5 pass).
>> ---
>> main/LICENSE_category_b | 4 +-
>> main/external_deps.lst | 6 +-
>> main/rhino/README | 23 +-
>> main/rhino/makefile.mk | 11 +-
>> main/rhino/prj/d.lst | 2 +-
>> main/rhino/rhino-1.7.7.2-definingclassloader.patch | 66 ++
>> main/rhino/rhino-1.7.7.2-main.patch | 38 +
>> main/rhino/rhino-1.7.7.2-tofixed-fix.patch | 43 +
>> main/rhino/rhino-1.7.7.2-xxe-fix.patch | 61 +
>> main/rhino/rhino1_7R3-java-version.patch | 13 -
>> main/rhino/rhino1_7_7_2-java-version.patch | 14 +
>> .../rhino/{rhino1_7R3.patch => rhino1_7_7_2.patch} | 1228
>> +++++++++-----------
>> .../script/framework/provider/ScriptContext.java | 11 +-
>> .../script/framework/provider/ScriptProvider.java | 2 +-
>> .../javascript/ScriptEditorForJavaScript.java | 21 +-
>> .../javascript/ScriptProviderForJavaScript.java | 24 +-
>> 16 files changed, 825 insertions(+), 742 deletions(-)
>>
>> diff --git a/main/LICENSE_category_b b/main/LICENSE_category_b
>> index 5603eeb568..f512564201 100644
>> --- a/main/LICENSE_category_b
>> +++ b/main/LICENSE_category_b
>> @@ -20,8 +20,8 @@ ____
>> -- GPL 2.0/LGPL 2.1/MPL 1.1 tri-license
>> MPL 1.1 is chosen for Apache OpenOffice
>> - For Rhino
>> --- MPL 1.1 / GPL 2.0 dual licensed
>> - MPL 1.1 is chosen for Apache OpenOffice
>> +-- MPL 2.0
>> + MPL 2.0 is chosen for Apache OpenOffice
>>
>>
>> MOZILLA PUBLIC LICENSE
>> diff --git a/main/external_deps.lst b/main/external_deps.lst
>> index b7ddf2a260..95db5cb62f 100644
>> --- a/main/external_deps.lst
>> +++ b/main/external_deps.lst
>> @@ -292,9 +292,9 @@ if (ENABLE_CATEGORY_B==YES && SYSTEM_HUNSPELL!=YES)
>> URL2 = $(OOO_EXTRAS)$(MD5)-$(name)
>>
>> if (ENABLE_CATEGORY_B==YES && SOLAR_JAVA==TRUE && ENABLE_JAVASCRIPT==YES)
>> - MD5 = 99d94103662a8d0b571e247a77432ac5
>> - name = rhino1_7R3.zip
>> - URL1 = https://ftp.mozilla.org/pub/js/$(name)
>> + MD5 = afcf570784ebd919c1d484a6d0d3fcd6
>> + name = rhino-1.7.7.2.zip
>> + URL1 =
>> https://github.com/mozilla/rhino/releases/download/Rhino1_7_7_2_Release/$(name)
>> URL2 = $(OOO_EXTRAS)$(MD5)-$(name)
>>
>> if (ENABLE_CATEGORY_B==YES && ENABLE_NSS_MODULE==YES)
>
>
> To get the FreeBSD port to build, I need something like the following
> patch. Both 1.7.7.2 and 1.7.15.1 are broken. I don't see anything that
> create the version of the filename with underscores, which causes the
> rhino source to fail to unpack.
>
> <rhino.patch>
--
Jim
"This is an outrage!"
Tony Harrison
