Apache Commons logo Commons Collections

Release notes for v4.1


Apache Commons Collections is a project to develop and maintain collection classes based on and inspired by the JDK collection framework.

This v4.1 release is a minor and security release, fixing several bugs present in previous releases of the 4.X branch. Additionally, this release provides a mitigation for a known remote code exploitation via the standard java object serialization mechanism. Serialization support for unsafe classes in the functor package has been completely removed (classes do not implement the Serializable interface anymore). For more details, please refer to COLLECTIONS-580.

All users are strongly encouraged to updated to this release.

Compatibility

  • Java 6 or later is now required (previous version 4.0 required Java 5)
  • This release is source and binary compatible with the previous 4.0 release of Commons Collections with the exception that some classes in the functor package do not implement the Serializable interface anymore (see COLLECTIONS-580)

Major changes since 4.0

  • Added interface MultiSet (package multiset)
  • Added interfaces MultiValuedMap, ListValuedMap and SetValuedMap (package multimap)
  • Added fluent API for Iterable instances (class FluentIterable)

Security Changes

COLLECTIONS-580 Serialization support for unsafe classes in the functor package has been removed completely as this can be exploited for remote code execution attacks. Classes considered to be unsafe are: CloneTransformer, ForClosure, InstantiateFactory, InstantiateTransformer, InvokerTransformer, PrototypeCloneFactory, PrototypeSerializationFactory, WhileClosure.

For a full list of changes in this release, refer to the Change report.