xstream-benchmark-1.4.21-150200.3.28.1<>,Yg-{p9|ZA/5UaLÜځ+_ٴH;D-f,X`J?yVwW5O|kxq5/\$,QPa_ xO{E&^4׻&tO`\a+H*Q_e0|GX d%Or_Ov@ 5OI7'.[oM M*b{vdV8h,t2/ԋYG玓CS!F\4Ã׵|?zz>>34?3$d ) J ,2<X f t  W  <(89<:F.G.H.I.X.Y.\/(]/D^/b0Ec0d1pe1uf1xl1zu1v1w2tx2y2z22223 Cxstream-benchmark1.4.21150200.3.28.1The benchmark module for xstreamThis package contains the benchmark module for xstream.g-{h01-ch4c~@SUSE Linux Enterprise 15SUSE LLC BSD-3-Clausehttps://www.suse.com/Development/Libraries/Javahttps://x-stream.github.io/linuxnoarchfAAg-wg-wg-wg-wg-wg-wg-w2d453614f579cbbce9f6604df4dbfffaa4fed82deb59af7d6c1e69b10d3dc521b3c6311103ac361a2f352417a7c582b43788cf7baaaf408b684d855ffc3204b9920ab63acd2a51aa15bfdd942af7913d424a9dab14ea46f6c3fb0c5167d0c8c4xstream/xstream-benchmark.jarxstream/xstream-benchmark.pomrootrootrootrootrootrootrootrootrootrootrootrootrootrootxstream-1.4.21-150200.3.28.1.src.rpmmvn(com.thoughtworks.xstream:xstream-benchmark)mvn(com.thoughtworks.xstream:xstream-benchmark:pom:)osgi(xstream-benchmark)xstream-benchmark@ @@    java-headlessjavapackages-filesystemmvn(com.thoughtworks.xstream:xstream)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)xstream1.81.4.213.0.4-14.6.0-14.0-15.2-11.4.21-150200.3.28.14.14.1g-@eԔ@e9@d^@ddV@bDF@b4t@a@aS``x*`Gc@\~d\Yz\Z!D@Z@WVn@VA@fstrba@suse.comfstrba@suse.comfstrba@suse.comfstrba@suse.comfstrba@suse.comfstrba@suse.comfstrba@suse.comfstrba@suse.comfstrba@suse.comfstrba@suse.comfstrba@suse.comfstrba@suse.comjrenner@suse.comfkobzik@suse.commichele.bologna@suse.commoio@suse.commc@suse.comjgonzalez@suse.commoio@suse.commoio@suse.commoio@suse.com- Upgrade to 1.4.21 * Security fixes + This maintenance release addresses the security vulnerability CVE-2024-47072 (bsc#1233085), when using the BinaryDriver to unmarshal a manipulated input stream causing a Denial of Service due to a stack overflow. * Major changes + #350: Optimize memory allocation + Add a converter for the WeakHashMap which does not write any elements of the map. Avoids also access to the ReentrantLock contained in the WeakHashMap since Java 19. * Minor changes + #335: Allow PrettyPrintWriter to replace invalid XML characters when not running in quirks mode + #331, #326: Fix handling of empty java.util.concurrent.atomic.AtomicReference + #334: Fix remaining buffer size calculation in QuickWriter + #342: Optimize internal handling of children in DomReader avoiding O(n^2) access times for siblings + #349: Fix support of lambda objects for Java 21 and above + #359: Add KEYS file with public keys to verify signed artifacts. + Detect input manipulation in c.t.x.io.binary.BinaryStreamReader. + Use Jettison 1.5.4 by default for Java Runtimes version 8 or higher. * API changes + Added constant c.t.x.io.xml.PrettyPrintWriter.XML_1_0_REPLACEMENT. + Added constant c.t.x.io.xml.PrettyPrintWriter.XML_1_1_REPLACEMENT. + Added c.t.x.converters.collections.WeakHashMapConverter. + Protected field fieldsToOmit of c.t.x.mapper.ElementIgnoringMapper set to private. + Protected field unknownElementsToIgnore of c.t.x.mapper.ElementIgnoringMapper set to private. * Stream compatibility + The WeakHashMaps, that have been written with previous versions of XStream, can still be deserialized. - Build against the stax:stax and stax:stax-api artifact and without hibernate unconditionally - Modified patch: * Revert-MXParser-changes.patch + rediff- Use %patch -P N instead of deprecated %patchN.- Build with source/target 8 with java 18+- Reproducible builds: use SOURCE_DATE_EPOCH for timestamp- Make dependency on bea-stax optional and disable it by default- Upgrade to 1.4.20 * Security fixes + This maintenance release addresses the security vulnerabilities CVE-2022-40151 (bsc#1203520) and CVE-2022-41966 (bsc#1206729), causing a Denial of Service by raising a stack overflow. It also provides new converters for Optional and Atomic types. * Major changes + #308: Add converter for AtomicBoolean, AtomicInteger, AtomicLong, and AtomicReference of package java.util.concurrent.atomic. + #293: Add converter for Optional, OptionalDouble, OptionalInt, and OptionalLong of package java.util. * Minor changes + #287: Close stream opened from provided URL. + #284: Fix disabling check against hash code attack with XStream.setCollectionUpdateLimit(0). * Stream compatibility + The atomic types with new converters of package java.util.concurrent.atomic, that have been written with previous versions of XStream, can still be deserialized. + The Optional types with new converters of package java.util, that have been written with previous versions of XStream, can still be deserialized. + The WildcardTypePermission allows by default no longer anonymous class types. * API changes + Added c.t.x.converters.extended.AtomicBooleanConverter. + Added c.t.x.converters.extended.AtomicIntegerConverter. + Added c.t.x.converters.extended.AtomicLongConverter. + Added c.t.x.converters.extended.AtomicReferenceConverter. + Added c.t.x.converters.extended.OptionalConverter. + Added c.t.x.converters.extended.OptionalDoubleConverter. + Added c.t.x.converters.extended.OptionalIntConverter. + Added c.t.x.converters.extended.OptionalLongConverter. + Added c.t.x.security.WildcardTypePermission .WildcardTypePermission(boolean,String[]).- Build against the standalone JavaEE modules unconditionally- Build against standalone activation-api and jaxb-api on systems where the JavaEE modules are not part of JDK- Upgrade to 1.4.19 * Security fixes + This maintenance release addresses the security vulnerability CVE-2021-43859, bsc#1195458, when unmarshalling highly recursive collections or maps causing a Denial of Service. * API changes + Added c.t.x.XStream.COLLECTION_UPDATE_LIMIT and c.t.x.XStream.COLLECTION_UPDATE_SECONDS. + Added c.t.x.XStream.setCollectionUpdateLimit(int). + Added c.t.x.core.SecurityUtils. + Added c.t.x.security.AbstractSecurityException and c.t.x.security.InputManipulationException. + c.t.x.security.InputManipulationException derives now from c.t.x.security.AbstractSecurityException.- Upgrade to 1.4.18 * Security fixes + This maintenance release addresses following security vulnerabilities, when unmarshalling with an XStream instance using the default blacklist of an uninitialized security framework. XStream is therefore now using a whitelist by default. (CVE-2021-39139, CVE-2021-39140, CVE-2021-39141, CVE-2021-39144, CVE-2021-39145, CVE-2021-39146, CVE-2021-39147, CVE-2021-39148, CVE-2021-39149, CVE-2021-39150, CVE-2021-39151, CVE-2021-39152, CVE-2021-39153, CVE-2021-39154, bsc#1189798) * Minor changes + Support serializable types with non-serializable parent with PureJavaReflectionConverter. * Stream compatibility + Starting with version 1.14.12 nine years ago, XStream contains a Security Framework to implement a black- or whitelist for the allowed types at deserialization time. Until version 1.4.17, XStream kept a default blacklist in order to deny all types of the Java runtime, which are used for all kinds of security attacks, in order to guarantee optimal runtime compatibility for existing users. However, this approach has failed. The last months have shown, that the Java runtime alone contains dozens of types that can be used for an attack, not even looking at the 3rd party libraries on a classpath. The new version of XStream uses therefore now by default a whitelist, which is recommended since nine years. It also has been complaining on the console for a long time about an uninitialized security framework the first time it was run. Anyone who has followed the advice and initialized the security framework for their own scenario can easily update to the new version without any problem. Everyone else will have to do a proper initialization now, otherwise the new version will fail with certainty at deserialization time. - Modified patch: * Revert-MXParser-changes.patch + rediff to changed context- Upgrade to 1.4.17 * Security fix: * bsc#1186651, CVE-2021-29505: potential code execution when unmarshalling with XStream instances using an uninitialized security framework- Upgrade to 1.4.16 * Security fixes: + bsc#1184796, CVE-2021-21351: remote attacker to load and execute arbitrary code + bsc#1184797, CVE-2021-21349: SSRF can lead to a remote attacker to request data from internal resources + bsc#1184380, CVE-2021-21350: arbitrary code execution + bsc#1184374, CVE-2021-21348: remote attacker could cause denial of service by consuming maximum CPU time + bsc#1184378, CVE-2021-21347: remote attacker to load and execute arbitrary code from a remote host + bsc#1184375, CVE-2021-21344: remote attacker could load and execute arbitrary code from a remote host + bsc#1184379, CVE-2021-21342: server-side forgery + bsc#1184377, CVE-2021-21341: remote attacker could cause a denial of service by allocating 100% CPU time + bsc#1184373, CVE-2021-21346: remote attacker could load and execute arbitrary code + bsc#1184372, CVE-2021-21345: remote attacker with sufficient rights could execute commands + bsc#1184376, CVE-2021-21343: replace or inject objects, that result in the deletion of files on the local host - Add patch: * Revert-MXParser-changes.patch + revert changes that would force us to add new dependency- Upgrade to 1.4.15 * fixes bsc#1180146, CVE-2020-26258 and bsc#1180145, CVE-2020-26259 - Upgrade to 1.4.14 * fixes bsc#1180994, CVE-2020-26217 - Update xstream to 1.4.15~susemanager Removed: * xstream_1_4_10-jdk11.patch * xstream_1_4_10-buildsh-sle12.patch * build.sh- Update xstream to 1.4.10 Added: * xstream_1_4_10-jdk11.patch * xstream_1_4_10-buildsh-sle12.patch * xstream-XSTREAM_1_4_10.tar.gz Removed: * 0001-Prevent-deserialization-of-void.patch * xstream-XSTREAM_1_4_9.tar.gz * xstream-XSTREAM_1_4_9-jdk11.patch - Major changes: - New XStream artifact with -java7 appended as version suffix for a library explicitly without the Java 8 stuff (lambda expression support, converters for java.time.* package). - Fix PrimitiveTypePermission to reject type void to prevent CVE-2017-7957 with an initialized security framework. - Improve performance by minimizing call stack of mapper chain. - XSTR-774: Add converters for types of java.time, java.time.chrono, and java.time.temporal packages (converters for LocalDate, LocalDateTime, LocalTime, OffsetDateTime, and ZonedDateTime by Matej Cimbora). - JavaBeanConverter does not respect ignored unknown elements. - Add XStream.setupDefaultSecurity to initialize security framework with defaults of XStream 1.5.x. - Emit error warning if security framework has not been initialized and the XStream instance is vulnerable to known exploits.- Feat: modify patch to be compatible with JDK 11 building Added: * xstream-XSTREAM_1_4_9-jdk11.patch Removed: * xstream-XSTREAM_1_4_9-jdk9.patch- fixes for SLE 15 compatibility- fix possible Denial of Service when unmarshalling void. (CVE-2017-7957, bsc#1070731) Added: * 0001-Prevent-deserialization-of-void.patch- Fix build for JDK9 - Disable javadoc generation (broken for SLE15 and Tumbleweed) - Add: * xstream-XSTREAM_1_4_9-jdk9.patch - Changed: * build.sh- Require building on Java 8, otherwise the LambdaMapper class is skipped (issue 30)- Upgrade to version 1.4.9, which fixes CVE-2016-3674 (bsc#972950)- Initial versionh01-ch4c 17310588111.4.211.4.211.4.211.4.21-150200.3.28.1xstreamxstream-benchmark.jarxstream-benchmark.jarxstream-xstream-benchmark.xmlxstreamxstream-benchmark.pomxstream-benchmark.pom/usr/share/java//usr/share/java/xstream//usr/share/maven-metadata//usr/share/maven-poms//usr/share/maven-poms/xstream/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:36368/SUSE_SLE-15-SP2_Update/59b905fbda44c6687a8cd74a4b5dbedb-xstream.SUSE_SLE-15-SP2_Updatedrpmxz5noarch-suse-linuxdirectoryASCII text, with CRLF line terminators (Zip archive data, at least v2.0 to extract Zip archive data, at least v2.0 to extract)XML 1.0 document, ASCII textexported SGML document, ASCII textPPPRRR%^IJ~̃=>utf-85c13846b50a8f2ab9dd0f7ccf1e9784398d19db1bd9459cabff90c60a629352b? 7zXZ !t/Fu!]"k%]ס%$X;VL`’ n`-HnVѽ g"Qdwnr]l SB p?q77䡼L>蘆F{$% ww tͯJ3mfSvrof 1SfACIc703ɝJ-UȊt =[4.K!# ٯ$`~uشT1;KHSW 51w]@iC m{JP-G2C}]d|2K46ꏄaܹAՉdAH@R^l}CIYXnoI˺sYA2s?ya˥ _gykl0H#' ě=ɭ6xE$:QڨUW$:ぞՀ*kٸ1ZJ(Z2Gj>Ǚy*9 )QMl¼E1O(tC׀> CNiYf=UJN Hxw4[!jfK"Ug:rj/:;|H1*vktZ񑠯e߀[ Im|-t"{ZkTyLһ zR@ Bi#KnxIq>O^%"Kz|8:0Ѓl8R#6ɱφ*:CZ 340#48 άS׍|`? 47]U_T3*{h] %D=5&DFU?V%D>ށ&'˨7*=LI{w7Yx(fQS!}dYn|;4;u3Q(8İgNy*{Tc"F;%B$B]B5]w[b3-[[OJPwTpE` Hy^㦪Ã/l?=JRpGa)d}{t"~nmJR~o1TDi0!+R:%BaeUdŅ|ya=gV4Ma2Ih:kQW&Y{r|k]|鏡̏ymNo="JjZ:o(tأV 2a]P8shR5*<#[*Ǎ< 㸩0,f SS 4l$#FS'q  Pupb1\&.}'`3 4_[EXV)Y #xq4N{tϿRA1^vͩܰ廝_{ENjPphPVǕb_lQcXw K.58V?T ~ _'靮>(]27b%C2slۀOK.Δ~5tCFz( 2,CrݨòO/^@obucܭͨ >ϛdK֥1#>D4$?RilA^(rwd8Ia MζMkC|M>R{nAO=A>sipJ^vOSXزb9|棐^pD?Z0zhT=qQ$8Ӏ]GHGU k@aGd%1~G%۸v$8 >:u3)(hOBEjAt }z}*kʍL\id66幙UrDhفJtxĞ'Jp:霞mfdq4MŀL0Ąwv ^G胾^V?:ltӣ*k.djh BN;w@jRl5z,7D5ZyR (!%.U/fo)X#ӓ?ih2: uz2i+i4A([Vܭ-ؾP!"tSY/Jy_S oۼ Ӆnw^oYtBbptJՆ0¿&:Hp:/-|]F`1D~:D0c aAg+/|<-mB .+\je@ߣ G}Nu魳?liګ7{杖-Q آ* =7.25V22%I\}0ծ6HEiu vPYs ͤ ֕Pd9>}ӿFY.QZ+UviY" @b>uВ5V$M5FD1{$դ>ITubp<,k j׷ Ч I3p( :נֺ \|Z^?)5uLb[uDC:5FK1Ê/cKS;nmh8o`+b"Iy!yZhaf@d@#"lF;_;+unr?C}Bc*>f0;9Y$zɴ5Vt7 ߂oJ yG 5L](t%<%Xw]zW'6uX<1xHGr19ę,0IA~}.#m;/~ɨX>MYY-?yT'ŒM9i*xq}Z#6@:ųZ&pp;y.xīѫ+Uag3^=_%9GJM)r\i5 In 8Q [p"kEJA6}.t0;a97SNȐl<,K엚-lKd~RJFe$E OP)q*nD`Mrh[ =WZھ鹐ּ ƻuL3څx-!1! fs#a:$gl'֩)%0=Rqw*LB+χ1%*i[*QQ(fClʌ_[@х'G6SjMkPO6Lvctah@,uK sdjyHu߫"\nmed/jyxgb`3b0ъt-~!#ߗ~ҭ';j^[QXW\ܠvӛRY|zZ?kӺ4Fc3Wn|QX9&[~&N+{çahQTlcP_牲k> 6+]31кHPrKz~3@(p.(sI TV(Q[s-R7E\?st&Y]ݒ-41A1@'bx^xgAA09wq7b_(͂=jSoĬDr׹5Yr}dDVP7_L`MؾM 0yZ2>? :z)ɟm 9M%KX $ JQLs] 0ʃCT)vk;M$o qsOq)EQ~ hZ)'#+זhs'oD- iyxhaQ N=??A+G4MVM,6A\`Mx,%l^\)C*h;t7!]-Mzb#y/0򤂃YWbћƌk{AQ&V^1IlO g4Vcϙni ".Y{?_5 włvu@xps7`eјB=S`7jKa^l%U. =HmlxR]P5y:ʖ>Y пV \]ZODeqD,C`9qy1Ƀ_: 0ϡ@A SS=u 0뫪*οC_LL*!ap@u!x*ٕ2S/?Kխ%Nh RNR@*6on!t"Zt-/4{3~1Ȉ6y.Z4‚!E St~C-U (ԗڙVZԠ'~/*0DxB 7].~ymkK+x*Slqr_L/7 9cc"+-NhH| ^V@Drޛ; 3եXQ{yCj.FFfWRBV %sjS?ܕTbImq7qe00[ݕRL7E8 ;[ QQ̾hQ <=7Kߔ5/E F%)ZY%3(kVF@hK e區BƎ7$ uy*{{C&K0mW\k_hrp: m?UY<acڑK=/PniˀY'?  x(#8{mU=LO}q&MWbaJ- VW[c!ZFQ)&]8 IaEU+T2F^.?c$uEUx<,1_$5ƟRe[w Lc.Q=0uJv N]J7^G a2//hm4?{3AԉGiaHR/wJ 8%paH- h.9H\ܑ@&+-b۽f_ԓ8U;hiB0#zዟ;2e~`BfL3h$0"̧kWcyۏo@™N; Wmr&] ͮ6j &lqUUuq>rOj^>DJ3*0 `y}7꛴Ɯ-ӥ, ӉLg2q|.?\ c79DXshUNar+\Da͉V.u轚GOvTA&Ԫ 5> r"m/>bus%RrآآBl-ָ;{}*^\ţ3$ҔW\:*'kdp4뒧"k~ۓm랉 ]'dAGAl "a,񤑮*Ƅ4϶pfQXy(&߾ c"ЈU {T*,*4"W1zO9N5L Obc~^5ٽ$2xh``PC2 YZ