Apache Commons FileUpload 2.0.0-M5 Release Notes
------------------------------------------------

The Apache Commons FileUpload team is pleased to announce the release of Apache Commons FileUpload 2.0.0-M5.

The Apache Commons FileUpload component provides a simple yet flexible means of
adding support for multipart file upload functionality to Servlets and web
applications. This version requires Java 11 or above.


This release requires Java 11.

Changes in version 2.0.0-M5 include:

New features:
o                  Add AbstractFileUpload support for a maximum part header size #429. Thanks to Ryan J Murphy.
o FILEUPLOAD-367:  Jakarta and Javax ServletFileUpload.isMultipartContent(HttpServletRequest) should allow PUT and PATCH request methods in addition to POST. Thanks to Gary Gregory.
o FILEUPLOAD-367:  Add AbstractFileUpload.isMultipartRequestMethod(String). Thanks to Gary Gregory.

Fixed Bugs:
o                  Better exception message in org.apache.commons.fileupload2.core.AbstractFileUpload.parseRequest(RequestContext). Thanks to Chenjp, Gary Gregory.
o FILEUPLOAD-295:  Clarified the precise meaning of isInMemory(), get(), getPath(), etc. in DiskFileItem
o                  Better exception type and message if a multipart/mixed part is presented without a boundary defined Thanks to Coverity Scan.
o                  Rename MultipartInput.Builder.[get|set]PartHeaderSizeMax() to [get|set]MaxPartHeaderSize(). Thanks to Gary Gregory.
o                  Rename MultipartInput.getPartHeaderSizeMax() to getMaxPartHeaderSize(). Thanks to Gary Gregory.
o                  Rename AbstractFileUpload.[get|set]SizeMax() to AbstractFileUpload.[get|set]MaxSize(). Thanks to Gary Gregory.
o                  Rename AbstractFileUpload.[get|set]FileSizeMax() to AbstractFileUpload.[get|set]MaxFileSize(). Thanks to Gary Gregory.
o                  Rename AbstractFileUpload.[get|set]FileCountMax() to AbstractFileUpload.[get|set]MaxFileCount(). Thanks to Gary Gregory.
o                  Minor readability and cleanup improvements in DiskFileItem #458. Thanks to tPionTech.
o                  Fix Apache RAT plugin console warnings. Thanks to Gary Gregory.

Changes:
o                  Bump org.apache.commons:commons-parent from 84 to 96 #444, #459, #463. Thanks to Gary Gregory, Dependabot.
o                  Bump org.apache.commons:commons-lang3 from 3.17.0 to 3.20.0 #427. Thanks to Gary Gregory.
o                  Bump commons-io:commons-io from 2.19.0 to 2.21.0. Thanks to Gary Gregory.


For complete information on Apache Commons FileUpload, including instructions on how to submit bug reports,
patches, or suggestions for improvement, see the Apache Commons FileUpload website:

https://commons.apache.org/proper/commons-fileupload/

Download it from https://commons.apache.org/proper/commons-fileupload/download_fileupload.cgi

------------------------------------------------------------------------------
Apache Commons FileUpload 2.0.0-M4 Release Notes
------------------------------------------------

The Apache Commons FileUpload team is pleased to announce the release of Apache Commons FileUpload 2.0.0-M4.

The Apache Commons FileUpload component provides a simple yet flexible means of
adding support for multipart file upload functionality to Servlets and web
applications. This version requires Java 11 or above.


This release requires Java 11.

Changes in version 2.0.0-M4 include:

New features:
o                  SECURITY - CVE-2025-48976. Add partHeaderSizeMax, a new limit that sets a maximum number of bytes for each individual multipart header. The default is 512 bytes. Thanks to Mark Thomas.

Fixed Bugs:
o                  Simplify exception handling in FileItem API #309. Thanks to Basil Crow.



For complete information on Apache Commons FileUpload, including instructions on how to submit bug reports,
patches, or suggestions for improvement, see the Apache Commons FileUpload website:

https://commons.apache.org/proper/commons-fileupload/

Download it from https://commons.apache.org/proper/commons-fileupload/download_fileupload.cgi

------------------------------------------------------------------------------
Apache Commons FileUpload 2.0.0-M3 Release Notes
------------------------------------------------

The Apache Commons FileUpload team is pleased to announce the release of Apache Commons FileUpload 2.0.0-M3.

The Apache Commons FileUpload component provides a simple yet flexible means of
adding support for multipart file upload functionality to Servlets and web
applications. This version requires Java 11 or above.


This release requires Java 11.

Changes in version 2.0.0-M3 include:

New features:
o                  Handle multipart/related Requests without content-disposition header. Thanks to mufasa1976, Gary Gregory.

Fixed Bugs:
o                  [site] Fix instantiation of DiskFileItemFactory in migration guide #273. Thanks to Gregor Dschung.
o FILEUPLOAD-355:  [site] Update code example: Use IOUtils instead of Streams utils class. Thanks to Ana, Gary Gregory.
o                  Replace internal use of Locale.ENGLISH with Locale.ROOT. Thanks to Gary Gregory.
o                  Pick up JUnit version from parent POM. Thanks to Gary Gregory.
o FILEUPLOAD-356:  [site] Fix incorrect link to changes report in Commons FileUpload #357. Thanks to Mattias Reichel, GirirajSinghRathore, Gary Gregory.
o                  Fix changes report link for new version of Maven Changes plugin from commons-parent 79 #388. Thanks to Filipe Roque.
o                  Fix SpotBugs multithreading issues in DiskFileItem. Thanks to Gary Gregory.

Changes:
o                  Bump org.apache.commons:commons-parent from 66 to 83 #283, #294, #335, #343, #345, #351, #356, #360, #368. Thanks to Gary Gregory.
o                  Bump commons-io:commons-io from 2.16.0 to 2.19.0 #297, #352, #377. Thanks to Gary Gregory.
o                  Bump org.apache.maven.plugins:maven-javadoc-plugin from 3.6.3 to 3.7.0 #319. Thanks to Gary Gregory.
o                  Bump org.codehaus.mojo:taglist-maven-plugin from 3.0.0 to 3.1.0 #327. Thanks to Gary Gregory.
o                  Bump org.apache.commons:commons-lang3 from 3.14.0 to 3.17.0 #331, #338, #346. Thanks to Gary Gregory.


For complete information on Apache Commons FileUpload, including instructions on how to submit bug reports,
patches, or suggestions for improvement, see the Apache Commons FileUpload website:

https://commons.apache.org/proper/commons-fileupload/

Download it from https://commons.apache.org/proper/commons-fileupload/download_fileupload.cgi

------------------------------------------------------------------------------

Apache Commons FileUpload 2.0.0-M2 Release Notes
------------------------------------------------

The Apache Commons FileUpload team is pleased to announce the release of Apache Commons FileUpload 2.0.0-M2.

The Apache Commons FileUpload component provides a simple yet flexible means of
adding support for multipart file upload functionality to Servlets and web
applications. This version requires Java 11 or above.


2.0.0-M2 Release

Changes in version 2.0.0-M2 include:

New features:
o                  Fix off-by-one error when checking fileSizeMax in FileItemInputImpl #235. Thanks to James Reeves.
o FILEUPLOAD-352:  NullPointerException in DiskFileItem#toString. Thanks to Bj�rn Kautler, Gary Gregory.
o                  Fail fast on null inputs to org.apache.commons.fileupload2.core.AbstractRequestContext.AbstractRequestContext(Function, LongSupplier, T). Thanks to Gary Gregory.
o                  Complete refactoring in JakartaServletRequestContext. Thanks to Gary Gregory.
o                  Fix "Implicit narrowing conversion in compound assignment" from https://github.com/apache/commons-fileupload/security/code-scanning/118. Thanks to Gary Gregory.
o                  Refactor to support Jakarta Servlet 5 and 6. Thanks to Gary Gregory.
o                  Generate some OSGi metadata. Thanks to Michal H Siemaszko, Gary Gregory.

Fixed Bugs:
o                  Pick up Maven Moditect plugin version from parent POM. Thanks to Gary Gregory.

Changes:
o                  Bump Java from 8 to 11. Thanks to Dependabot.
o                  Bump commons-parent from 58 to 65. Thanks to Gary Gregory.
o                  Bump commons-lang3 from 3.12.0 to 3.14.0. Thanks to Gary Gregory.
o                  Bump commons-io from 2.13.0 to 2.15.1. Thanks to Gary Gregory.


For complete information on Apache Commons FileUpload, including instructions on how to submit bug reports,
patches, or suggestions for improvement, see the Apache Commons FileUpload website:

https://commons.apache.org/proper/commons-fileupload/

Download it from https://commons.apache.org/proper/commons-fileupload/download_fileupload.cgi

------------------------------------------------------------------------------

Apache Commons FileUpload 2.0.0-M1 Release Notes
------------------------------------------------

The Apache Commons FileUpload Parent team is pleased to announce the release of Apache Commons FileUpload Parent 2.0.0-M1.

The Apache Commons FileUpload component provides a simple yet flexible means of
adding support for multipart file upload functionality to servlets and web
applications. 

This version requires Java 11 or later.

Note also that the base package name has changed to org.apache.commons.fileupload2,
so source changes will be required.

The Maven coordinates have also changed to:

  <groupId>org.apache.commons</groupId>
  <artifactId>commons-fileupload2</artifactId>

They were previously:
  <groupId>commons-fileupload</groupId>
  <artifactId>commons-fileupload</artifactId>


2.0.0-M1 Release

Changes in version 2.0.0-M1 include:

New features:
o                  Add github/codeql-action from #144. Thanks to Gary Gregory.
o                  Add the package org.apache.fileupload2.jaksrvlt, for compliance with Jakarta Servlet API 5.0.
o                  Making FileUploadException a subclass of IOException. (Mibor API simplification.)
o                  Add a configurable limit (disabled by default) for the number of files to upload per request.

Fixed Bugs:
o                  Changing Maven coordinates, and package name, due to binary incompatible changes.
o FILEUPLOAD-293:  DiskFileItem.write(File) had been changed to use FileUtils.moveFile internally, preventing an existing file as the target.
o FILEUPLOAD-296:  Performance gains by reusing an internal buffer. Thanks to David Georg Reochelt.
o FILEUPLOAD-274:  RFC 5987 compliance Thanks to Merbin J Anselm.
o                  Slight optim: resuse the index position instead of recomputing it #49. Thanks to Emmanuel L�charny.
o FILEUPLOAD-340:  Make commons-fileupload2 a JPMS module by adding module-info.class.
o FILEUPLOAD-341:  Move Exception classes out of the impl package. Thanks to Martin Grigorov.
o                  Rework exceptions to use propagated exception causes (introduced in Java 1.4). Thanks to Gary Gregory.
o                  All custom exception extend FileUploadException. Thanks to Gary Gregory.
o                  All custom exceptions serialVersionUID value is now 2. Thanks to Gary Gregory.
o FILEUPLOAD-350:  FileUploadByteCountLimitException ctor switches fileName and fieldName parameters #216. Thanks to Ernesto Reinaldo Barreiro.
o                  [StepSecurity] ci: Harden GitHub Actions #224. Thanks to step-security-bot, Gary Gregory.

Changes:
o                  Bump actions/cache from 2.1.6 to 3.0.8 #128, #140. Thanks to Dependabot, Gary Gregory.
o                  Bump actions/checkout from 2.3.4 to 3.0.2 #125. Thanks to Dependabot, Gary Gregory.
o                  Bump build actions/setup-java from 1.4.3 to 3.8.0 #142, #175, #180, #182. Thanks to Gary Gregory.
o                  Bump Java compiler level to 1.8.
o                  Bump commons-io:commons-io 2.6 to 2.13.0, #104, #221. Thanks to Gary Gregory, Dependabot.
o                  Bump junit-jupiter from 5.5.2 to 5.9.1 #31, #130, #156, #166. Thanks to Dependabot.
o                  Bump maven-pmd-plugin from 3.13.0 to 3.19.0 #48, #162. Thanks to Dependabot.
o                  Bump commons.japicmp.version from 0.13.0 to 0.16.0. Thanks to Gary Gregory.
o                  Bump spotbugs-maven-plugin from 4.2.3 to 4.7.3.0 #103, #133, #141, #146, #155, #163, #179. Thanks to Dependabot.
o                  Bump spotbugs from 4.2.3 to 4.7.3, ignore EI_EXPOSE_REP, and EI_EXPOSE_REP2, #152, #161, #174. Thanks to Dependabot.
o                  Bump biz.aQute.bndlib from 6.0.0 to 6.4.0 #129, #181. Thanks to Dependabot.
o                  Bump commons-parent from 52 to 58, #167, #183, #194. Thanks to Gary Gregory, Dependabot.
o                  Bump maven-checkstyle-plugin from 3.1.2 to 3.2.0 #160. Thanks to Dependabot.

Removed:
o                  Remove deprecated constructors in MultipartStream. Thanks to Gary Gregory.
o                  Remove deprecated RequestContext.getContentLength(). Thanks to Gary Gregory.
o                  Remove deprecated JakSrvltRequestContext.getContentLength(). Thanks to Gary Gregory.
o                  Remove deprecated PortletRequestContext.getContentLength(). Thanks to Gary Gregory.
o                  Remove deprecated ServletRequestContext.getContentLength(). Thanks to Gary Gregory.
o                  Remove deprecated FileUploadBase.MAX_HEADER_SIZE. Thanks to Gary Gregory.
o                  Remove deprecated FileUploadBase.createItem(Map, boolean). Thanks to Gary Gregory.
o                  Remove deprecated FileUploadBase.getFieldName(Map). Thanks to Gary Gregory.
o                  Remove deprecated FileUploadBase.getFileName(Map). Thanks to Gary Gregory.
o                  Remove deprecated FileUploadBase.getHeader(Map, String). Thanks to Gary Gregory.
o                  Remove deprecated FileUploadBase.parseHeaders(String). Thanks to Gary Gregory.
o                  Replace org.apache.commons.fileupload2.util.mime.Base64Decoder with java.util.Base64. Thanks to Gary Gregory.
o                  Replace LimitedInputStream with BoundedInputStream. Thanks to Gary Gregory.
o                  FileItemHeadersImpl is no longer Serializable. Thanks to Gary Gregory.
o                  Reuse Java's InvalidPathException instead of the custom InvalidFileNameException. Thanks to Gary Gregory.

For complete information on Apache Commons FileUpload Parent, including instructions on how to submit bug reports,
patches, or suggestions for improvement, see the Apache Commons FileUpload Parent website:

https://commons.apache.org/proper/commons-fileupload/

------------------------------------------------------------------------------

Apache Commons FileUpload 1.6.0 Release Notes
---------------------------------------------

The Apache Commons FileUpload team is pleased to announce the release of Apache Commons FileUpload 1.6.0.

The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart
file upload functionality to servlets and web applications.

This release requires Java 8.

Changes in this version include:

New features:
o                  [1.x] Enable multipart/related on FileUpload #314. Thanks to mufasa1976, Jochen Wiedmann, Gary Gregory.
o                  Add JApiCmp to the default Maven goal. Thanks to Gary Gregory.
o                  Add partHeaderSizeMax, a new limit that sets a maximum number of bytes for each individual multipart header. The default is 512 bytes. Thanks to Mark Thomas.

Fixed Bugs:
o                  Replace use of Locale.ENGLISH with Locale.ROOT. Thanks to Gary Gregory.
o                  Remove unused exception from FileUploadBase.createItem(Map, boolean). Thanks to Gary Gregory.
o                  Migrate from deprecated API in DiskFileItem.getOutputStream(). Thanks to Gary Gregory.
o                  Use try-with-resources. Thanks to Gary Gregory.
o                  Port to Java 1.4 Throwable APIs (!). Thanks to Gary Gregory.
o                  Remove -nouses directive from maven-bundle-plugin. OSGi package imports now state 'uses' definitions for package imports, this doesn't affect JPMS (from org.apache.commons:commons-parent:80). Thanks to Gary Gregory.
o                  DiskFileItem.getInputStream() now uses NIO. Thanks to Gary Gregory.
o                  Last statement in DiskFileItem.finalize() method should be a call to super.finalize(). Thanks to Gary Gregory.
o                  org.apache.commons.fileupload.FileUploadBase.FileUploadIOException is now a proper Java 1.4-style exception (propagates its cause to super). Thanks to Gary Gregory.
o                  Use java.util.Base64 instead of custom code. Thanks to Gary Gregory.

Changes:
o                  Bump Java from 6 to 8. Thanks to Gary Gregory.
o                  Bump org.apache.commons:commons-parent from 62 to 84, upgrades Doxia from 1 to 2. Thanks to Gary Gregory.
o                  Bump commons-io from 2.11.0 to 2.19.0. Thanks to Gary Gregory.
o                  Bump javax.servlet:servlet-api from 2.4 to 2.5. Thanks to Gary Gregory.
o                  Bump JUnit from junit:junit:4.13.2 org.junit.vintage:junit-vintage-engine from parent POM. Thanks to Gary Gregory.


Historical list of changes: https://commons.apache.org/proper/commons-fileupload/changes.html

For complete information on Apache Commons FileUpload, including instructions on how to submit bug reports,
patches, or suggestions for improvement, see the Apache Commons FileUpload website:

https://commons.apache.org/proper/commons-fileupload/

Download page: https://commons.apache.org/proper/commons-fileupload/download_fileupload.cgi

Apache Commons Team

------------------------------------------------------------------------------

              Apache Commons FileUpload 1.5 RELEASE NOTES

The Apache Commons FileUpload team is pleased to announce the release of Apache Commons FileUpload 1.5.

The Apache Commons FileUpload component provides a simple yet flexible means of
adding support for multipart file upload functionality to servlets and web
applications. Version 1.3 onwards requires Java 6 or later.

No client code changes are required to migrate from version 1.4 to 1.5.

Changes in version 1.5 include:

New features:
o                  Add a configurable limit (disabled by default) for the number of files to upload per request. 

Fixed Bugs:
o FILEUPLOAD-293:  DiskFileItem.write(File) had been changed to use FileUtils.moveFile internally, preventing an existing file as the target. 
o                  Improve parsing speed. Thanks to David Georg Reichelt.

Changes:
o                  Bump Commons IO to 2.11.0 
o FILEUPLOAD-328   Switch from Cobertura code coverage to Jacoco code coverage. Thanks to Arturo Bernal. 
o                  Bump JUnit to 4.13.2 


For complete information on Apache Commons FileUpload, including instructions on how to submit bug reports,
patches, or suggestions for improvement, see the Apache Commons FileUpload website:

https://commons.apache.org/proper/commons-fileupload/

------------------------------------------------------------------------------

              Apache Commons FileUpload 1.4 RELEASE NOTES

The Apache Commons FileUpload team is pleased to announce the release of Apache Commons FileUpload 1.4.

The Apache Commons FileUpload component provides a simple yet flexible means of
adding support for multipart file upload functionality to servlets and web
applications. Version 1.3 onwards requires Java 6 or later.


1.4 Release

Changes in version 1.4 include:

New features:
o                  Site: added security report

Fixed Bugs:
o FILEUPLOAD-252:  DiskFileItem#write() could lose original IO exception
o FILEUPLOAD-258:  DiskFileItem#getStoreLocation() wrongly returned a File object for items stored in memory
o FILEUPLOAD-242:  FileUploadBase - should not silently catch and ignore all Throwables
o FILEUPLOAD-257:  Fix Javadoc 1.8.0 errors
o FILEUPLOAD-234:  Fix section "Resource cleanup" of the user guide
o FILEUPLOAD-237:  Fix streaming example: use FileItem.getInputStream() instead of openStream()
o FILEUPLOAD-248:  DiskFileItem might suppress critical IOExceptions on rename - use FileUtil.move instead
o FILEUPLOAD-251:  DiskFileItem#getTempFile() is broken
o FILEUPLOAD-250:  FileUploadBase - potential resource leak - InputStream not closed on exception
o FILEUPLOAD-244:  DiskFileItem.readObject fails to close FileInputStream
o FILEUPLOAD-245:  DiskFileItem.get() may not fully read the data

Changes:
o FILEUPLOAD-292:  Don't create un-needed resources in FileUploadBase.java
o FILEUPLOAD-282:  Upversion complier.source, compiler.target to 1.6
o FILEUPLOAD-246:  FileUpload should use IOUtils.closeQuietly where relevant
o FILEUPLOAD-243:  Make some MultipartStream private fields final Thanks to Ville Skytt�.


For complete information on Apache Commons FileUpload, including instructions on how to submit bug reports,
patches, or suggestions for improvement, see the Apache Commons FileUpload website:

https://commons.apache.org/proper/commons-fileupload/

------------------------------------------------------------------------------

              Apache Commons FileUpload 1.3.3 RELEASE NOTES

The Apache Commons FileUpload team is pleased to announce the release of Apache Commons FileUpload 1.3.3.

The Apache Commons FileUpload component provides a simple yet flexible means of
adding support for multipart file upload functionality to servlets and web
applications. Version 1.3 onwards requires Java 5 or later.

No client code changes are required to migrate from version 1.3.0, 1.3.1, or 1.3.2, to 1.3.3

Changes in version 1.3.3 include:

o FILEUPLOAD-279:  DiskFileItem can no longer be deserialized, unless a particular system property is set.


For complete information on Apache Commons FileUpload, including instructions on how to submit bug reports,
patches, or suggestions for improvement, see the Apache Commons FileUpload website:

https://commons.apache.org/proper/commons-fileupload/

------------------------------------------------------------------------------

No client code changes are required to migrate from version 1.3.1 to 1.3.2.

Changes in version 1.3.2 include:

o FILEUPLOAD-272:  Performance Improvement in MultipartStream. Prevents a DoS (CVE-2016-3092)


For complete information on Apache Commons FileUpload, including instructions on how to submit bug reports,
patches, or suggestions for improvement, see the Apache Commons FileUpload website:

https://commons.apache.org/proper/commons-fileupload/

------------------------------------------------------------------------------

              Apache Commons FileUpload 1.3.1 RELEASE NOTES

The Apache Commons FileUpload team is pleased to announce the release of Apache Commons FileUpload 1.3.1.

The Apache Commons FileUpload component provides a simple yet flexible means of
adding support for multipart file upload functionality to servlets and web
applications. Version 1.3 onwards requires Java 5 or later.

No client code changes are required to migrate from version 1.3.0 to 1.3.1.


This is a security and maintenance release that includes an important security
fix as well as a small number of bugfixes.

Changes in version 1.3.1 include:


Fixed Bugs:
o                  SECURITY - CVE-2014-0050. Specially crafted input can trigger a DoS if the
                   buffer used by the MultipartStream is not big enough. When constructing
                   MultipartStream enforce the requirements for buffer size by throwing an
                   IllegalArgumentException if the requested buffer size is too small. This
                   prevents the DoS.
o                  When deserializing DiskFileItems ensure that the repository location, if
                   any, is a valid one. Thanks to Arun Babu Neelicattu.
o                  Correct example in usage documentation so it compiles.



For complete information on Apache Commons FileUpload, including instructions on how to submit bug reports,
patches, or suggestions for improvement, see the Apache Commons FileUpload website:

https://commons.apache.org/proper/commons-fileupload/

