Java JRE 8 Update 461

What's new in this version:

- New zone for Aysén Region in Chile which moves from -04/-03 to -03

Other Notes:
- security-libs/java.security
- Added 4 New Root Certificates from Sectigo Limited (JDK-8359170)
- The following root certificates have been added to the cacerts truststore:

Sectigo Limited:
- sectigocodesignroote46
- DN: CN=Sectigo Public Code Signing Root E46, O=Sectigo Limited, C=GB

Sectigo Limited:
- sectigocodesignrootr46
- DN: CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB

Sectigo Limited:
- sectigotlsroote46
- DN: CN=Sectigo Public Server Authentication Root E46, O=Sectigo Limited, C=GB

Sectigo Limited:
- sectigotlsrootr46
- DN: CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB

install/install:
- Sign oracle.com JDK RPM Packages with OL9 Signing Key (JDK-8351906 (not public))
- The oracle.com JDK RPM packages meant to be downloaded directly to the target system, now are signed with the OL9 signing key instead of the OL8 signing key. The RPM packages hosted on YUM repositories remain signed with the appropriate key for the target repository.

install/uninstall:
- The Java Uninstall Tool Will Repair the Windows Registry (JDK-8343761 (not public))
- There are some scenarios where upgrading from a JRE version 8u361 or below to a newer JRE version of Java 8 may break some of the Windows registry keys for the Java Runtime Environment. The Java Uninstall Tool will repair such situations, regardless if a JRE is selected for uninstall or not.

client-libs/2d:
- Usage of FreeType Library on Linux and Solaris Platforms (JDK-8350323 (not public))
- The latest Gnome update installs the Cantarell font, an OpenType font with CFF2 table, as the default in the latest Red Hat, SLES, and Solaris platforms. However, the T2K rendering engine used in JDK 8 does not support OpenType CFF2 fonts. As a result, when using the GTK look and feel, none of the text renders with the Cantarell font.
- Starting from JDK 8u461, the Java runtime utilizes the FreeType library installed on the end-user’s system to render certain fonts, such as Cantarell. Due to this modification, installing libfreetype.so.6 may be necessary.

core-libs/javax.naming:
- Update Default Value of com.sun.jndi.ldap.object.trustSerialData System Property (JDK-8290367)

In this release, the JDK implementation of the LDAP provider no longer supports deserialization of Java objects by default:
- The default value of the com.sun.jndi.ldap.object.trustSerialData system property has been updated to false.
- The transparent deserialization of Java objects from an LDAP context will now require an explicit opt-in. Applications that rely on reconstruction of Java objects or RMI stubs from the LDAP attributes would need to set the com.sun.jndi.ldap.object.trustSerialData system property to true.

security-libs/jdk.security:
- Jarsigner Should Print a Warning If an Entry Is Removed (JDK-8309841)
- If an entry is removed from a signed JAR file, there is no mechanism to detect that it has been removed using the JarFile API, since the getJarEntry method returns null as if the entry had never existed. With this change, the jarsigner -verify command analyzes the signature files and if some sections do not have matching file entries, it prints out the following warning: "This JAR contains signed entries for files that do not exist". Users can further find out the names of these entries by adding the -verbose option to the command.

xml/javax.xml.parsers:
- Change DOM Parser to Not Resolve EntityReference and Add Text Node with DocumentBuilderFactory.setExpandEntityReferences(false) (JDK-8206132)
- The implementation of the ExpandEntityReferences feature was changed to comply with the specification of the DocumentBuilderFactory.setExpandEntityReferences method. Now, when the method is set to false and encounters an entity reference, a DOM parser created by the DocumentBuilderFactory adds the EntityReference node to the DOM tree without the expanded Text node. Before the change, the implementation incorrectly added both nodes.
- With the change, the DOM parser no longer reads and resolves entity references when the feature ExpandEntityReferences is set to false. For applications that intend to avoid resolving entity references, it will work as expected.

This change also affects the DOM Load and Save parser. The entities parameter is aligned with the ExpandEntityReferences feature, so that setting the entities parameter to true is equivalent to setting ExpandEntityReferences to false. In the following code snippet, the document will contain EntityReference nodes but not expanded Text nodes:
- LSParser domParser = domImplementationLS.createLSParser(MODE_SYNCHRONOUS, null);
- domParser.getDomConfig().setParameter("entities", true);
- LSInput src = domImplementationLS.createLSInput();
- src.setStringData(source);
- Document document = domParser.parse(src);
- Because the references are not resolved, the resulting string will contain entity references without the text when the document is serialized:
- LSSerializer lsSerializer = domImplementationLS.createLSSerializer();
- lsSerializer.getDomConfig().setParameter("format-pretty-print", true);
- String result = lsSerializer.writeToString(document);

Fixed:
- Update PipeWire to 1.3.81
- Update Libpng to 1.6.47
- [Accessibility,macOS,VoiceOver] VoiceOver reads the spinner value 10 as 1 when user iterates to 10 for the first time on macOS
- Limit the length of inflated text chunks
- JOptionPane message string with 5000+ newlines produces StackOverflowError
- Enhance checks in BigDecimal.toPlainString()
- Update IANA Language Subtag Registry to Version 2024-11-19
- currency.properties supercede not working correctly
- ISO 4217 Amendment 179 Update
- [Metrics] Swap memory limit reported incorrectly when too large
- Refactor TestMemoryAwareness to use WhiteBox api for host values
- usageTicks and totalTicks should be volatile to ensure that different threads get the latest ticks
- Java 8 About Dialog in JCP shows http://www.java.com instead of https://www.java.com
- StubCodeDesc constructor publishes partially-constructed objects on StubCodeDesc::_list
- CPUIDBrandString stub is generated on demand
- ArrayAllocator should take MEMFLAGS as regular parameter
- Fine bitmaps should be allocated as belonging to mtGC, not mtInternal
- Remove PRAGMA_FORMAT_MUTE_WARNINGS_FOR_GCC from g1BlockOffsetTable.cpp
- [cgroups] Consistently use stringStream throughout parsing code
- stringStream should not use Resource Area
- Failing to allocate MethodCounters and MDO causes a serious performance drop
- share/vm/runtime/mutex.cpp:1161 assert(((uintptr_t(_owner))|(uintptr_t(_LockWord.FullWord))|(uintptr_t(_EntryList))|(uintptr_t(_WaitSet))|(uintptr_t(_OnDeck))) == 0) failed
- Make os::Linux::active_processor_count() public
- Handle julong values in logging of GET_CONTAINER_INFO macros