Java JDK 8 Update 491

What's new in this version:

JDK 8u491 contains IANA time zone data 2026a which contains the following changes since the previous update:
- Several code changes for compatibility with FreeBSD
- The only changed data are leap second table expiration and pre-1976 time in Baja California
- Moldova has used EU transition times since 2022
- The "right" TZif files are no longer installed by default
- -DTZ_RUNTIME_LEAPS=0 disables runtime support for leap seconds
- TZif files are no longer limited to 50 bytes of abbreviations
- zic is no longer limited to 50 leap seconds
- Several integer overflow bugs have been fixed

New Features:
security-libs/java.security ➜ Enhanced keytool Password Handling When Output Is Redirected (JDK-8354469):
- The keytool command reads passwords from the system console to prevent them from being displayed on the screen. However, the console is usually available only when both the standard input and output streams are not redirected. Previously, if the standard output stream was redirected into a file or another command, the console was unavailable and the input password was echoed on the screen. This enhancement improves password handling to ensure that the password is not displayed on the screen even if the standard output stream is redirected. This enhancement has also been made to the jarsigner command and the JAAS TextCallbackHandler API.

security-libs/java.security ➜ Oracle JDK src.zip File Now Includes Source Code for the JSSE/JCE/JGSS Components (JDK-8369608):
- The <java-home>/lib/src.zip file distributed with the Oracle JDK now contains sources for JCE, JGSS, and JSSE. Debugging tools can now examine or display most of the security source files.

security-libs/java.security➜ New Security Property jdk.crypto.disabledAlgorithms for Restricting Algorithms at the JCE layer (JDK-8244336):
- A new security property named jdk.crypto.disabledAlgorithms has been introduced to disable algorithms for JCE/JCA cryptographic services. Initially, this property only supports the Cipher, KeyStore, MessageDigest, and Signature services. This property is defined in the java.security file and initially no algorithms are disabled by default. However, this may change in the future. This security property can be overridden by a system property of the same name if applications need to re-enable algorithms.

Other Notes:
javafx/other ➜ Oracle JDK 8 Includes JavaFX for a Limited Time (JDK-8371301 (not public)):
- JavaFX is again included with JDK 8, although it has a shorter support timeline than JDK 8. Update releases of JDK 8 after March 2028 will not include JavaFX. Visit www.oracle.com/javase/javafx for details.

core-libs/java.net➜ Implementation of java.net.CookieStore.getURIs() and get(URI) Methods Now Return an Immutable List (JDK-8365086):
- The JDK's implementation of the java.net.CookieStore interface has been updated to return an immutable java.util.List from the getURIs() and get(URI) methods. The updated implementation now matches the specification of these two methods.

security-libs/java.security➜ Distrust TLS Server Certificates Anchored by Chunghwa Root Certificates and Issued After March 17, 2026 (JDK-8369282):
- The JDK will stop trusting TLS server certificates issued after March 17, 2026 and anchored by Chunghwa root certificates, in line with similar plans announced by Google and Mozilla.
- TLS server certificates issued on or before March 17, 2026 will continue to be trusted until they expire. Certificates issued after that date, and anchored by the Certificate Authority listed in the table below, will be rejected.
- The restrictions are enforced in the JDK implementation (the SunJSSE Provider) of the Java Secure Socket Extension (JSSE) API. A TLS session will not be negotiated if the server's certificate chain is anchored by any of the Certificate Authorities in the table below and the certificate has been issued after March 17, 2026.

An application will receive an exception with a message indicating the trust anchor is not trusted, for example:
- "TLS Server certificate issued after 2026-03-17 and anchored by a distrusted legacy Chunghwa root CA: OU=ePKI Root Certification Authority, O="Chunghwa Telecom Co., Ltd." C=TW"
- The JDK can be configured to trust these certificates again by removing "CHUNGHWA_TLS" from the jdk.security.caDistrustPolicies security property in the java.security configuration file.

Fixed:
- JDK-8162545 client-libs/2d Mac build failure
- JDK-8223045 client-libs/2d GraphicsEnvironment does not detect resolution changes in multiscreen systems
- JDK-8373727 client-libs/2d New XBM images parser regression: only the first line of the bitmap array is parsed
- JDK-6899304 client-libs/java.awt java.awt.Toolkit.getScreenInsets(GraphicsConfiguration) returns incorrect values
- JDK-8372756 client-libs/java.awt Mouse additional buttons and horizontal scrolling are broken on XWayland GNOME >= 47 after JDK-8351907
- JDK-8372534 client-libs/java.awt Update Libpng to 1.6.51
- JDK-8372048 client-libs/java.awt Performance improvement on Linux remote desktop
- JDK-8375063 client-libs/java.awt Update Libpng to 1.6.54
- JDK-8372977 client-libs/java.awt Unnecessary gthread-2.0 loading
- JDK-8366261 core-libs/java.io Provide utility methods for sun.security.util.Password
- JDK-8048192 core-libs/java.nio (bf) Out of direct buffer memory message should include the limits
- JDK-8228343 core-svc/tools JCMD and attach fail to work across Linux Container boundary
- JDK-8371052 javafx/media Update libFFI to 3.5.2
- JDK-8377099 javafx/web Additional WebKit 623.1 fixes from WebKitGTK 2.50.4
- JDK-8377930 javafx/web Additional WebKit 623.1 fixes from WebKitGTK 2.50.5
- JDK-8368572 javafx/web Update WebKit to 623.1
- JDK-8380557 javafx/web Additional WebKit 623.1 fixes from WebKitGTK 2.50.6
- JDK-8375549 security-libs/java.security ConcurrentModificationException if jdk.crypto.disabledAlgorithms has multiple entries with known oid
- JDK-8374555 security-libs/java.security No need for visible input warning in s.s.u.Password when not reading from System.in
- JDK-8186831 security-libs/org.ietf.jgss:krb5 Kerberos ignores PA-DATA with a non-null s2kparams
- JDK-8336695 xml/jaxp Update Commons BCEL to Version 6.10.0