RELEASE NOTES: JDK 11.0.16

Vector Should Throw ClassNotFoundException for a Missing Class of an Element

java.util.Vector is updated to correctly report ClassNotFoundException that occurs during deserialization usingjava.io.ObjectInputStream.GetField.get(name, object)when the class of an element of the Vector is not found. Without this fix, aStreamCorruptedException` is thrown that does not provide information about the missing class.

HTTPS Channel Binding Support for Java GSS/Kerberos

Support has been added for TLS channel binding tokens for Negotiate/Kerberos authentication over HTTPS through javax.net.HttpsURLConnection.

Channel binding tokens are increasingly required as an enhanced form of security. They work by communicating from a client to a server the client's understanding of the binding between connection security, as represented by a TLS server cert, and higher level authentication credentials, such as a username and password. The server can then detect if the client has been fooled by a MITM and shutdown the session or connection.

The feature is controlled through a new system property jdk.https.negotiate.cbt which is described fully in Networking Properties.

Incorrect Handling of Quoted Arguments in ProcessBuilder

ProcessBuilder on Windows is restored to its previous functionality to address a regression caused by JDK-8250568. Previously, an argument to ProcessBuilder that started with a double-quote and ended with a backslash followed by a double-quote was passed as a command incorrectly and may have caused the command to fail. For example the argument "C:\\Program Files\", would be seen as a command with extra double-quotes. This update restores the long standing behavior that does not treat the backslash before the final double-quote specially.

Default JDK Compressor Will Be Closed when IOException Is Encountered

DeflaterOutputStream.close() and GZIPOutputStream.finish() methods have been modified to close out the associated default JDK compressor before propagating a Throwable up the stack. ZIPOutputStream.closeEntry() method has been modified to close out the associated default JDK compressor before propagating an IOException, not of type ZipException, up the stack.

Cgroups v2: Container awareness

The HotSpot runtime code as well as the core libraries code in the JDK has been updated in order to detect a cgroup v2 host system when running OpenJDK within a Linux container.

Since the 8u202 release of OpenJDK, the container detection code recognized cgroup v1 (legacy) host Linux systems. With 8u372 and later releases, both versions of the underlying cgroups pseudo filesystem will be detected and corresponding container limits applied to the OpenJDK runtime.

Without this enhancement, OpenJDK would not apply container resource limits when running on a cgroup v2 Linux host system, but would use the underlying hosts' resource limits instead.

New System Property to Disable Windows Alternate Data Stream Support in java.io.File

The Windows implementation of java.io.File allows access to NTFS Alternate Data Streams (ADS) by default. Such streams have a structure like “filename:streamname”. A system property jdk.io.File.enableADS has been added to control this behavior. To disable ADS support in java.io.File, the system property jdk.io.File.enableADS should be set to false (case ignored). Stricter path checking however prevents the use of special devices such as NUL: