From b97a550253a0e6eec21f45cf91a5ea0584af5f14 Mon Sep 17 00:00:00 2001 From: Gregory Brail Date: Fri, 22 Dec 2017 11:04:32 -0800 Subject: [PATCH] Update release to 1.7.8-RC1 including release notes. --- README.md | 2 +- RELEASE-NOTES.md | 52 +++++++++++++++++++++++++++++++++++++++++++++ gradle.properties | 2 +- maven/maven-pom.xml | 2 +- release-steps.txt | 2 -- src/manifest | 4 ++-- 6 files changed, 57 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index 2594ef39cf..6e48212818 100644 --- a/README.md +++ b/README.md @@ -45,7 +45,7 @@ Rhino builds with `Gradle`. Here are some useful tasks: ``` ./gradlew jar ``` -Build and create `Rhino` jar in the `build/libs` directory. +Build and create `Rhino` jar in the `buildGradle/libs` directory. ``` ./gradlew test ``` diff --git a/RELEASE-NOTES.md b/RELEASE-NOTES.md index 93564ceed3..e34e9ae612 100644 --- a/RELEASE-NOTES.md +++ b/RELEASE-NOTES.md @@ -1,3 +1,55 @@ +# Rhino 1.7.8-RC1 +## December 22, 2017 + +Most important changes in this release: + +* JavaScript objects are no longer (somewhat) thread-safe by default +* Rhino is resistant to "hash flooding" attacks +* Rhino is only supported for Java 8 and up +* Rhino only builds with Gradle. + +The primary change in this release is that the object storage format has changed +for objects derived from ScriptableObject (which is nearly all objects). + +First, objects are no longer thread-safe by default. (They were thread-safe previously, but +not in a way that we could prove was 100 percent correct in all cases.) We do not believe +that the vast majority of Rhino code depended on this capability. + +The feature flag Context.FEATURE_THREAD_SAFE_OBJECTS may be used to enable locking on all +objects by default in case it is needed. Furthermore, the built-in "sync" function is still +supported, which can be used to wrap a function in a similar way to the "synchronized" keyword +in Java. + +Second, when an object grows to a large number of properties, the native hash table implementation +is replaced with java.util.HashMap. This more complex (but slightly slower) hash implementation +is resistant to hash collisions. This makes Rhino in general resistant to "hash flooding" attacks. + +Rhino now depends on Java 8. It also works on Java 9, although a few tests are currently breaking +around Date parsing and UTF-8 encoding. + +Additional changes: + +[Issue 290](https://github.com/mozilla/rhino/issues/290) Resist hash flooding attacks +[Issue 303](https://github.com/mozilla/rhino/issues/303) Arrow function position set error +[Issue 323](https://github.com/mozilla/rhino/issues/323) Possible OutOfMemory due to +infinite loop on parsing +[Issue 341](https://github.com/mozilla/rhino/issues/341) Objects are only thread-safe when +feature is enabled +[Issue 351](https://github.com/mozilla/rhino/issues/351) Function-level use-strict breaks +backward compatibility +[Issue 357](https://github.com/mozilla/rhino/issues/357) Array.sort() can throw +ArrayIndexOutOfBoundsException +[Issue 295](https://github.com/mozilla/rhino/issues/295) Change WrapFactory to only wrap +"true" primitive types and not subclasses. +[PR102](https://github.com/mozilla/rhino/pull/102) Fix regexp parsing for "/0{0/" +[PR108](https://github.com/mozilla/rhino/pull/108) Attach jsdoc nodes to function params. +[PR 169](https://github.com/mozilla/rhino/pull/169) Enable calling default method +on Java 8. +[PR322](https://github.com/mozilla/rhino/pull/322) Fix static array functions +[PR353](https://github.com/mozilla/rhino/pull/353) Member box call error. +[PR355](https://github.com/mozilla/rhino/pull/358) Support array-like parameters to +Function.prototype.apply(). + # Rhino 1.7.7.2 ## August 24, 2017 diff --git a/gradle.properties b/gradle.properties index 20f97318ad..7a1ef8d018 100644 --- a/gradle.properties +++ b/gradle.properties @@ -1,7 +1,7 @@ #Sun, 26 Apr 2015 10:43:55 +0300 rootProject.name=rhino group=org.mozilla -version=1.7.8-SNAPSHOT +version=1.7.8-RC1 buildDir=buildGradle mavenSnapshotRepo=https://oss.sonatype.org/content/repositories/snapshots mavenReleaseRepo=https://oss.sonatype.org/service/local/staging/deploy/maven diff --git a/maven/maven-pom.xml b/maven/maven-pom.xml index effb89d458..c1742b6ec9 100644 --- a/maven/maven-pom.xml +++ b/maven/maven-pom.xml @@ -12,7 +12,7 @@ org.mozilla rhino Mozilla Rhino - 1.7.8-SNAPSHOT + 1.7.8-RC1 jar diff --git a/release-steps.txt b/release-steps.txt index bc07ac3acb..2188c8ffab 100644 --- a/release-steps.txt +++ b/release-steps.txt @@ -1,6 +1,5 @@ Update version in: src/manifest - build.properties gradle.properties maven/maven-pom.xml @@ -28,7 +27,6 @@ Update release in GitHub Update to new snapshot version in: src/manifest - build.properties gradle.properties maven/maven-pom.xml diff --git a/src/manifest b/src/manifest index badaac6827..fae932378b 100644 --- a/src/manifest +++ b/src/manifest @@ -1,6 +1,6 @@ Manifest-Version: 1.0 Main-Class: org.mozilla.javascript.tools.shell.Main -Implementation-Version: 1.7.8-SNAPSHOT -Implementation-Title: Mozilla Rhino 1.7.8 SNAPSHOT +Implementation-Version: 1.7.8-RC1 +Implementation-Title: Mozilla Rhino 1.7.8 RC1 Implementation-Vendor: Mozilla Foundation Implementation-URL: http://www.mozilla.org/rhino