Merge branch 'master' into fix-gh298-cla-records

NEWS

@@ -20,16 +20,21 @@ New Features
 
 
 Jython 2.7.4a1 Bugs fixed
+    - [ GH-316 ] PR313 cause regression
+    - [ GH-310 ] CVE-2024-25710 and CVE-2024-26308 (commons-compress)
     - [ GH-304 ] from java import * not working in Java 21
     - [ GH-302 ] Interactive interpreter awaits input instead of raising syntax error
-    - [ GH-288 ] Build fails when using java module
+    - [ GH-288 ] Build fails when using modules (duplicate org.w3c from JARs)
+    - [ GH-281 ] Invoking the wrong overloaded Java constructor
     - [ GH-280 ] LineNumberTable deprecated for removal in 2.6 still there
     - [ GH-277 ] Argument coercion fails for Java interface with default methods
+    - [ GH-272 ] GlobalRef.createReaperThreadIfAbsent produces IllegalMonitorStateException
     - [ GH-269 ] Upgrade Google Guava to 32.0.1 (CVE-2023-2976)
-    - [ GH-264 ] Create a security policy
+    - [ GH-264 ] Create a security policy (changes on GitHub only)
     - [ GH-254 ] Regression in socket.socket.sendall for sending Unicode
     - [ GH-247 ] PySystemStateTest fails on Mac
     - [ GH-245 ] Document download/binaries location
+    - [ GH-238 ] Using == to compare strings in sys
     - [ GH-223 ] JPasswordField no longer works due to 'bullet' echo char
     - [ GH-221 ] Incorrect method precedence with overloading and variable arity
     - [ GH-204 ] IllegalArgumentException: where char method returns non-byte value

README.txt

@@ -30,8 +30,9 @@ help and support of the project.
 Downloads
 ---------
 
-Binary downloads are available from https://www.jython.org/download
-along with Maven and Gradle dependency information.
+Downloads (JAR, source and dependency metadata) are available from Maven
+Central (Sonatype) at https://central.sonatype.com/search?q=g:org.python
+and linked from https://www.jython.org/download.
 
 
 Bug Reports

build.gradle

@@ -155,10 +155,11 @@ dependencies {
     antlr 'org.antlr:antlr:3.5.2'
     implementation 'org.antlr:antlr-runtime:3.5.2'
 
-    implementation 'org.apache.commons:commons-compress:1.21'
+    implementation 'org.apache.commons:commons-compress:1.26.0'
+    implementation 'commons-io:commons-io:2.15.1'
 
-    implementation 'org.bouncycastle:bcpkix-jdk18on:1.71'
-    implementation 'org.bouncycastle:bcprov-jdk18on:1.71'
+    implementation 'org.bouncycastle:bcpkix-jdk18on:1.77'
+    implementation 'org.bouncycastle:bcprov-jdk18on:1.77'
 
     implementation 'org.ow2.asm:asm:9.6'
     implementation 'org.ow2.asm:asm-commons:9.6'

build.xml

@@ -254,7 +254,8 @@ informix.jar = ../support/jdbc-4.10.12.jar
                 <file name="asm-9.6.jar" />
                 <file name="asm-commons-9.6.jar" />
                 <file name="asm-util-9.6.jar" />
-                <file name="commons-compress-1.21.jar"/>
+                <file name="commons-compress-1.26.0.jar"/>
+                <file name="commons-io-2.15.1.jar"/>
                 <file name="failureaccess-1.0.1.jar" />
                 <file name="guava-32.1.2-jre.jar" />
                 <file name="icu4j-71.1.jar" />
@@ -850,11 +851,13 @@ The text for an official release would continue like ...
             <zipfileset src="extlibs/asm-commons-9.6.jar" excludes="module-info.class"/>
             <zipfileset src="extlibs/asm-util-9.6.jar" excludes="module-info.class"/>
             <rule pattern="org.objectweb.asm.**" result="org.python.objectweb.asm.@1"/>
-            <zipfileset src="extlibs/bcpkix-jdk18on-1.71.jar" excludes="META-INF/**"/>
-            <zipfileset src="extlibs/bcprov-jdk18on-1.71.jar" excludes="META-INF/**"/>
+            <zipfileset src="extlibs/bcpkix-jdk18on-1.77.jar" excludes="META-INF/**"/>
+            <zipfileset src="extlibs/bcprov-jdk18on-1.77.jar" excludes="META-INF/**"/>
             <rule pattern="org.bouncycastle.**" result="org.python.bouncycastle.@1"/>
-            <zipfileset src="extlibs/commons-compress-1.21.jar"/>
+            <zipfileset src="extlibs/commons-compress-1.26.0.jar" excludes="META-INF/versions/9/module-info.class"/>
             <rule pattern="org.apache.commons.compress.**" result="org.python.apache.commons.compress.@1"/>
+            <zipfileset src="extlibs/commons-io-2.15.1.jar" excludes="META-INF/versions/9/module-info.class"/>
+            <rule pattern="org.apache.commons.io.**" result="org.python.apache.commons.io.@1"/>
             <zipfileset src="extlibs/failureaccess-1.0.1.jar"/>
             <zipfileset src="extlibs/guava-32.1.2-jre.jar"/>
             <rule pattern="com.google.**" result="org.python.google.@1"/>