RELEASE NOTES: JDK 11.0.16

Vector Should Throw ClassNotFoundException for a Missing Class of an Element

java.util.Vector is updated to correctly report ClassNotFoundException that occurs during deserialization usingjava.io.ObjectInputStream.GetField.get(name, object)when the class of an element of the Vector is not found. Without this fix, aStreamCorruptedException` is thrown that does not provide information about the missing class.

`java.net.FileNameMap.getContentTypeFor(fileName)` May Return a Different MIME Type for Certain Filenames

The default, built-in filename map in the JDK has been updated to include additional filename to MIME type mappings. Along with the additions, existing mappings of .gz and .zip have also been updated. This can result in the default, built-in java.net.FileNameMap instance returning a different MIME type from the getContentTypeFor(String fileName) method than what it returned in previous JDK releases.

java.net.URLConnection.guessContentTypeFromName(String fname), which may use this default, built-in FileNameMap instance, thus may return a different value than previously.

HTTPS Channel Binding Support for Java GSS/Kerberos

Support has been added for TLS channel binding tokens for Negotiate/Kerberos authentication over HTTPS through javax.net.HttpsURLConnection.

Channel binding tokens are increasingly required as an enhanced form of security. They work by communicating from a client to a server the client's understanding of the binding between connection security, as represented by a TLS server cert, and higher level authentication credentials, such as a username and password. The server can then detect if the client has been fooled by a MITM and shutdown the session or connection.

The feature is controlled through a new system property jdk.https.negotiate.cbt which is described fully in Networking Properties.

Incorrect Handling of Quoted Arguments in ProcessBuilder

ProcessBuilder on Windows is restored to its previous functionality to address a regression caused by JDK-8250568. Previously, an argument to ProcessBuilder that started with a double-quote and ended with a backslash followed by a double-quote was passed as a command incorrectly and may have caused the command to fail. For example the argument "C:\\Program Files\", would be seen as a command with extra double-quotes. This update restores the long standing behavior that does not treat the backslash before the final double-quote specially.

Default JDK Compressor Will Be Closed when IOException Is Encountered

DeflaterOutputStream.close() and GZIPOutputStream.finish() methods have been modified to close out the associated default JDK compressor before propagating a Throwable up the stack. ZIPOutputStream.closeEntry() method has been modified to close out the associated default JDK compressor before propagating an IOException, not of type ZipException, up the stack.

Cgroups v2: Container awareness

The HotSpot runtime code as well as the core libraries code in the JDK has been updated in order to detect a cgroup v2 host system when running OpenJDK within a Linux container.

Since the 8u202 release of OpenJDK, the container detection code recognized cgroup v1 (legacy) host Linux systems. With 8u372 and later releases, both versions of the underlying cgroups pseudo filesystem will be detected and corresponding container limits applied to the OpenJDK runtime.

Without this enhancement, OpenJDK would not apply container resource limits when running on a cgroup v2 Linux host system, but would use the underlying hosts' resource limits instead.

The hash recorded by the jar and jmod --hash-modules option is changed

The jar and jmod tools support the command line option --hash-modules to compute and record the hashes of modules that depend upon directly or indirectly on a module in a modular JAR or JMOD file. The generation of this hash is changed in this release so that it is reproducible, and more specifically, it is no longer dependent on the ordering of entries in the JAR or JMOD file or the timestamps of entries.

Modular JAR or JMOD files that have recorded hashes computed with JDK 14 or older will now be rejected by the jlink tool. The jar and jmod tools must be re-run to compute and record new hashes.

New System Property to Disable Windows Alternate Data Stream Support in java.io.File

The Windows implementation of java.io.File allows access to NTFS Alternate Data Streams (ADS) by default. Such streams have a structure like “filename:streamname”. A system property jdk.io.File.enableADS has been added to control this behavior. To disable ADS support in java.io.File, the system property jdk.io.File.enableADS should be set to false (case ignored). Stricter path checking however prevents the use of special devices such as NUL: