openjdk-21-crac (21.0.13.0.3+1-0ubuntu1) tenacious; urgency=medium

  * New release based on OpenJDK 21.0.13.0.3 release, build 1.
    - CVEs:
      + CVE-2026-114820
      + CVE-2026-91403
      + CVE-2026-83374
      + CVE-2026-83376
      + CVE-2026-83380
      + CVE-2026-83381
      + CVE-2026-83387
      + CVE-2026-83395
      + CVE-2026-83400
      + CVE-2026-87290
      + CVE-2026-87292
      + CVE-2026-87294
      + CVE-2026-87367
      + CVE-2026-91332
      + CVE-2026-91334
      + CVE-2026-91335
      + CVE-2026-91373
      + CVE-2026-91374
      + CVE-2026-91375
      + CVE-2026-91379
      + CVE-2026-91379
      + CVE-2026-91380
      + CVE-2026-91382
      + CVE-2026-91394
      + CVE-2026-91397
      + CVE-2026-91398
      + CVE-2026-91400
      + CVE-2026-91410
      + CVE-2026-91415
      + CVE-2026-91418
      + CVE-2026-91451
      + CVE-2026-91452
      + CVE-2026-91453
      + CVE-2026-91461
      + CVE-2026-91462
      + CVE-2026-91463
      + CVE-2026-91464
      + CVE-2026-91487
      + CVE-2026-101516

  [ Reuben Roessler ]
  * d/u/signing-key.asc: Merge new signing key.
  * d/s/lintian-overrides: Fix mangled override.
  * d/p/jdk-8384505.diff: Account for all jtreg-based frames in stack
    walk test (JDK-8384505).

  [ Vladimir Petko ]
  * d/p/{jdk-8334502-proposed.patch,debian/patches/jdk-8359735.patch}:
    Drop patches applied upstream.
  * d/rules: Require jtreg8 package (Closes: #1096195).
  * Regenerate control files.
  * To simplify future merges we include the following patches:
    - d/t: Add loong64 specific problemlists.
    - d/rules: Fix compilation flags for Ubuntu backports: do not override
      C and C++ maintainer append flags on jammy and noble S390x with the
      workaround.
    - d/rules: Link with -latomic for jammy and focal on riscv64
      to resolve ftbfs.
    - d/JB-{jre-headless,jre-zero,testsuport}.overrides.in: suppress
      specific-address-in-shared-library for i386 (JDK-6454213).
    - d/rules: disable tree-slp-vectorize for Ubuntu S390x builds (LP:
      #2095441). Add workaround for Launchpad C2 crash.

  [ Matthias Klose ]
  * Build using GCC 16 on development releases.

 -- Reuben Roessler <reuben.roessler@canonical.com>  Thu, 05 Nov 2026 09:55:19 +1100

openjdk-21-crac (21.0.12+8-0ubuntu1) stonking; urgency=medium

  * New release based on OpenJDK 21.0.12 release, build 8.
    - CVEs:
      + CVE-2026-46968
      + CVE-2026-46917
      + CVE-2026-47010
      + CVE-2026-47021
      + CVE-2026-47027
      + CVE-2026-60147
      + CVE-2026-47059
      + CVE-2026-47063
      + CVE-2026-41254
    - Release notes: https://bit.ly/openjdk2112
  * d/rules: Do not perform copyright validation for old releases.
  * d/rules: Check DEB_BUILD_PROFILES in addition to DEB_BUILD_OPTIONS
    to set up with_check variable. Do not check control files if
    with_check is disabled (Closes: #1137499).
  * d/JB-jre-{headless,zero}.overrides.in: Drop exit-in-shared-library
    override.

 -- Pushkar Kulkarni <pushkar.kulkarni@canonical.com>  Tue, 28 Jul 2026 21:50:18 +0530

openjdk-21-crac (21.0.11+10-0ubuntu1) stonking; urgency=medium

  * New release based on OpenJDK 21.0.11 release, build 10.
    - CVEs:
      + CVE-2026-22016: 8370529: Enhance Path Factories Redux
      + CVE-2026-34282: 8374557: Enhance TLS connection handling
      + CVE-2026-22021: 8371830: Enhance certificate chain validation
      + CVE-2026-22013: 8370615: Improve Kerberos credentialing
      + CVE-2026-23865: 8379158: Update FreeType to 2.14.2
      + CVE-2026-22018: 8370986: Enhance Zip file reading
      + CVE-2026-22007: 8369575: Enhance crypto algorithm support
      + CVE-2026-34268: 8371935: Enhance key generation
  * d/dbg.py: Fix syntax errors in gdb unwinder, do not install unwinder
    for zero, install hotspot unwinder in the correct directory.
    Disable debug traces. Load unwinder in the disabled state.
    Return iterator rather than list from OpenJDKFrameFilter.flatten().
    Remove unused code from NativeMethodInfo.
  * d/t/jtreg-autopkgtest.in: Increase the timeout from 10 to 30 seconds
    on loong64 (zero VM).
  * Ensure that all generated files are up to date:
    - The copyright generator now checks if the current directory contains
      an unpacked OpenJDK tree by verifying the presence of the
      ASSEMBLY_EXCEPTION file.
    - The copyright generator now drops common license text in-memory,
      without running a shell script that modifies the source tree.
    - d/rules: Add targets to generate all files and check that they match
      the ones provided in the source package.
    - d/rules: Add nogen DEB_BUILD_OPTION to disable file regeneration.
  * d/rules: Use '-' instead of '~' in opt version string, swap package
    version and distribution.
  * d/t/jtreg-autopkgtest.in: Increase the timeout from 10 to 30 seconds
    on loong64 (zero VM).
  * Regenerate license and control files.
  * d/rules: Synchornize with_check and any_arches variables with
    openjdk-21.
  * d/p: Synchronize patches with openjdk-21.

 -- Vladimir Petko <vladimir.petko@canonical.com>  Mon, 04 May 2026 15:26:52 +1200

openjdk-21-crac (21.0.10+7-0ubuntu1) resolute; urgency=medium

  * New release based on OpenJDK 21.0.10 release, build 7.
    - CVEs:
      + CVE-2026-21945: 8368032: Enhance Certificate Checking.
      + CVE-2026-21932: 8359501: Enhance Handling of URIs.
      + CVE-2026-21933: 8362632: Improve HttpServer Request handling.
      + CVE-2026-21925: 8341496: Improve JMX connections.
  * Update override comments for unstripped-binary-or-object.
    We need to keep symbols for Native Memory Tracking to work.
  * d/{JB-doc.overrides.in, JB-jre-headless.overrides.in}: Add override
    for old FSF copyright address.
  * d/s/lintian-overrides: Override false positive debian-rules-calls-
    nproc. The utility is used to log the number of processors.
  * d/p/jdk-8369450-proposed.patch: drop patch applied upstream.

 -- Vladimir Petko <vladimir.petko@canonical.com>  Mon, 26 Jan 2026 19:19:31 +1300

openjdk-21-crac (21.0.9+10-0ubuntu1) resolute; urgency=medium

  * New release based on OpenJDK 21.0.9 release, build 10.
    - CVEs:
      + CVE-2025-53057, 8360937: Enhance certificate handling.
      + CVE-2025-53066, 8356294: Enhance Path Factories.
      + CVE-2025-61748, 8359454: Enhance String handling.
  * d/patches: sync patches from openjdk-21.
  * d/tests/*: sync changes to skip large autopkgtests.
  * d/t/dependencies.sh: Relax test assertion for PC/SC library.
  * d/t/control.*: correct Depends, update Architecture.
  * d/control: build with gcc-15.
  * d/rules: sync with d/rules from openjdk-21.
  * d/{control.*,watch.in}: support to regenerate d/control for
    older lts releases.

 -- Pushkar Kulkarni <pushkar.kulkarni@canonical.com>  Mon, 17 Nov 2025 20:46:46 +0530

openjdk-21-crac (21.0.8+9-0ubuntu1) questing; urgency=medium

  * New release based on OpenJDK 21.0.8 release, build 9.
    - Addresses CVE-2025-50059, CVE-2025-30749, CVE-2025-50106,
      CVE-2025-30754. See
      https://openjdk.org/groups/vulnerability/advisories/2025-07-15
    - Release notes:
      https://mail.openjdk.org/pipermail/jdk-updates-dev/2025-July/045617.html
  * d/copyright: regenerate.
  * d/copyright-generator/copyright-gen.py: bump copyright year.
  * d/patches, d/watch: update/refresh, mirror openjdk-21 packaging.

 -- Pushkar Kulkarni <pushkar.kulkarni@canonical.com>  Mon, 21 Jul 2025 18:58:17 +0530

openjdk-21-crac (21.0.7+6.1-0ubuntu1) questing; urgency=medium

  * New release based on jdk-21.0.7+6. Release notes:
    https://mail.openjdk.org/pipermail/jdk-updates-dev/2025-April/043308.html

    - CVEs:
      + CVE-2025-21587
      + CVE-2025-30691
      + CVE-2025-30698

  * d/u/signing-key.asc: update signing key
  * d/t/jtreg-autopkgtest{.sh,.in}: Honour DEB_BUILD_OPTIONS=parallel=N
    while running jtreg tests
  * d/t/problems.csv: merge with exclusions from openjdk-21

 -- Pushkar Kulkarni <pushkar.kulkarni@canonical.com>  Tue, 29 Apr 2025 02:27:41 +0530

openjdk-21-crac (21.0.6+7-0ubuntu1) plucky; urgency=medium

  * New upstream release based on openjdk 21.0.6+7
  * d/t/problems.csv, d/{rules, patches, copyright}: Merge with
    updates from debian/openjdk-21

 -- Pushkar Kulkarni <pushkar.kulkarni@canonical.com>  Wed, 05 Feb 2025 11:24:37 +0530

openjdk-21-crac (21.0.5+11-0ubuntu1) plucky; urgency=medium

  * New upstream release based on openjdk 21.0.5+11
  * d/t/problems.csv: Merge with updates from debian/openjdk-21,
    skip serviceability/dcmd/compiler/CodeHeapAnalyticsMethodNames
  * d/control: merge with debian/openjdk-21, b-d for dtrace
  * d/rules: Merge with updates from debian/openjdk-21
  * d/patches: Purge unnecessary patches
  * d/tests/*.sh: Update scripts to point to the -crac install

 -- Pushkar Kulkarni <pushkar.kulkarni@canonical.com>  Tue, 19 Nov 2024 21:03:23 +0530

openjdk-21-crac (21.0.5+0-0ubuntu2) oracular; urgency=medium

  * d/t/problems.csv: Skip runtime/NMT tests in the right way
    (LP: #2078950)
  * d/rules: modify update-alternatives priority to a unique
    number
  * d/u/signing-key.asc: update public key for upstream
    source verification

 -- Pushkar Kulkarni <pushkar.kulkarni@canonical.com>  Wed, 04 Sep 2024 20:32:12 +0530

openjdk-21-crac (21.0.5+0-0ubuntu1) oracular; urgency=medium

  * Initial release (LP: #2073612).

 -- Pushkar Kulkarni <pushkar.kulkarni@canonical.com>  Tue, 09 Jul 2024 18:18:29 +0530
