[ANNOUNCE] Apache Ant 1.10.14 released

The Apache Ant Team is pleased to announce the release of Apache Ant 
1.10.14.

Apache Ant is a Java library and command-line tool that helps building 
software.

The Apache Ant team currently maintains two lines of development. The 
1.9.x releases require Java 5 or higher at runtime and 1.10.x requires 
Java 8 or higher at runtime. Both lines are based off of Ant 1.9.7 and 
the 1.9.x releases are mostly bug fix releases while additional new 
features are developed for 1.10.x. We recommend using 1.10.14 unless you 
are required to use versions of Java prior to Java 8 during the build 
process.

Apart from regular bug fixes, Ant 1.10.14 is an important release in 
context of the changes that have been happening in the Java's 
SecurityManager. Java, in version 17, deprecated (for removal) the 
SecurityManager. In Java 18, setting of SecurityManager at runtime was 
disallowed by default. This had an impact on Ant because Ant internally 
at runtime sets a SecurityManager. Ant sets this SecurityManager to 
prevent calls to System.exit()/Runtime.exit() from tasks running in 
Ant's build process, from killing the JVM that Ant is running in. Ant 
also uses and sets a SecurityManager when the "<permissions>" type is 
used in build files. A previous release of Ant (i.e 1.10.13) introduced 
a few complex (and brittle) workarounds hoping that it will allow Ant to 
keep using SecurityManager for a few more releases. This was done to 
avoid any changes to end user build files or tasks when running on Java 
versions 18 and higher. Unfortunately, those workarounds that we put in 
place in Ant 1.10.13 caused several regressions. Reviewing those changes 
and the fact that Java's SecurityManager is going away, we have decided 
that these workarounds no longer add any value. So we have reverted 
those changes in this current Ant 1.10.14 release. In this release, Ant 
will no longer use or set the SecurityManager when Ant is running in 
Java 18 and higher versions. This does have implications for user 
builds. If you are using Ant 1.10.14 with Java 18 and higher versions, 
then it is important that if any of your tasks or libraries used in 
those tasks call System.exit() or Runtime.exit(), then those tasks are 
expected to be run in a forked JVM (i.e. not run in the same JVM as the 
Ant build process which launches the task). This means changing your 
build files and/or the tasks' code. Some of the tasks shipped by Ant, 
like "java", "junit" and "junitlauncher" already have the fork 
attributes to allow forking them in a new JVM, so updating those may not 
be difficult.


Continuing with the SecurityManager changes in this release, we now no 
longer support the usage of "<permissions>" type when running on Java 18 
and higher. The manual has more details about this change 
https://ant.apache.org/manual/Types/permissions.html.


The symptoms of Ant no longer setting the SecurityManager to prevent 
System.exit() calls may not be easily visible. In some cases, the JVM 
running the Ant build process might just get killed without any visible 
trace of what caused it. In some cases when running tasks like "junit", 
if some test calls System.exit() then that might mean the (forked) JVM 
running the "junit" task gets killed and only some of the tests that 
were supposed to be run will get run. This isn't easy to spot, unless 
you pay a close attention to the logs. One way to spot such issues is 
check the number of tests executed as reported in the "junitreport" 
output html file(s) or even the logs. Compare them with the number of 
tests that were expected to be run. That might give a hint that the 
junit task was abruptly killed. The upcoming Java 21 release introduces 
logging when System.exit()/Runtime.exit() gets called to try and detect 
such issues https://bugs.openjdk.org/browse/JDK-8301627.

The Ant project team would like to hear all kinds of feedback, issues 
arising from Ant 1.10.14 changes in this area so that we can evaluate 
any possible improvements. As usual please report them to our user or 
dev mailing lists or even the issue tracker. More details at 
https://ant.apache.org/mail.html.

The binary and source distributions are available for download from the 
Apache Ant download site:

https://ant.apache.org/bindownload.cgi
https://ant.apache.org/srcdownload.cgi

When downloading, please verify signatures using the KEYS file available 
at the above location.

The complete set of changes in this Ant 1.10.14 release are available at 
https://dist.apache.org/repos/dist/release/ant/RELEASE-NOTES-1.10.14.html 
and listed inline here:

Changes that could break older environments:
-------------------------------------------

  * Resource#compareTo now invokes getName rather than toString as the
    later may be costly (for example in the case of a StringResource).
    Bugzilla Report 66496

  * When using Java 18 or higher, Ant will no longer use Java 
SecurityManager
    because it has been deprecated for removal and by default is disallowed
    to be set at runtime https://openjdk.org/jeps/411.
    This will mean that the "<permissions>" type is no longer functional 
when
    using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build executes
    tasks that call "java.lang.System.exit()" and if those tasks aren't
    running in a forked VM of their own, then such tasks will now kill
    the entire Ant build process. It is recommended that such tasks be
    updated to launch in a forked JVM so that the System.exit() call
    will not impact the JVM in which Ant process runs.

Fixed bugs:
-----------

  * log only the stylesheet name in the xslt task.
    Github Pull Request #199

  * junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the outputDir
    against the current working directory instead of the project's
    basedir. This has now been fixed.
    Bugzilla Report 66504

  * regexmapper would, in some cases, incorrectly consume backslash 
characters
    from the "to" attribute, resulting in missing backslashes in the output.
    This is now fixed.
    Bugzilla Report 66468

  * <fixcrlf>, <replace> and <replaceregexp> now try to preserve the
    file permissions of the files they modify.
    Bugzilla Report 66522

  * junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false. This is now fixed.
    Bugzilla Report 66411

  * fixes a bug in org.apache.tools.zip.ZipOutputStream where, even
    when "zip64Mode" is set to "always", ZipOutputStream may not create
    a CEN extra field data for the entry.
    Bugzilla Report 66873

  * legacy-xml listener of junitlauncher task wouldn't report certain
    failures involving junit jupiter dynamic tests. This has now been
    fixed.
    Github Pull Request #122

  * allow.class which was introduced in Ant 1.10.13 release, has been
    removed from this 1.10.14 release. This class was introduced in
    context of the SecurityManager changes in Ant 1.10.13, which have
    now been reverted in Ant 1.10.14, since they caused several
    regressions.
    Bugzilla Reports 66828, 66951

Other changes:
--------------

  * <fork> element of the junitlauncher task now has a new optional "java"
    attribute which can be used to point to a different Java installation
    for runnning the forked tests.
    Bugzilla Report 66464

  * made sure <echoproperties> sorts the echoed properties on JDK9+ as well.
    Bugzilla Report 66588

  * org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    Bugzilla Report 66238

  * The <fork> element of junitlaunchertask now allows a "forkMode"
    attribute. forkMode=perTestClass can now be used to launch
    each test class in a separate forked JVM.
    Bugzilla Report 65176


Looking forward to seeing Ant being used with recent Java versions.


-Jaikiran (on behalf of Apache Ant team)