v0.25.0

What's Changed

• feat: add Unsafe array access sanitizer by @Marcono1234 in #932
• feat: add a path traversal sanitizer by @tballison in #915
• feat: add path traversal configuration using BugDetectors API by @oetr in #943
• breaking fix: make sure ConsumeIntegralInRange is always in range [min; max] by @oetr in #945. This change might invalidate some existing crash and corpus files.
• fix: clear last finding before starting a fuzzing run by @oetr in #944
• docs: fix incorrect annotation names by @Marcono1234 in #937
• docs: improve documentation by @Marcono1234 in #929
• chore: update pom.xml examples with correct version by @marklemay in #927
• chore: remove outdated CI workflow badge from README by @Marcono1234 in #946

New Contributors

• @tballison made their first contribution in #915
• @Marcono1234 made their first contribution in #929
• @marklemay made their first contribution in #927

Full Changelog: v0.24.0...v0.25.0

v0.24.0

What's Changed

• chore(deps): bump com.google.protobuf:protobuf-java from 3.25.2 to 3.25.5 in /selffuzz by @dependabot in #910
• readme: remove obsolete note regarding the old license by @kyakdan in #923
• mutation: Add support for sealed classes by @fmeum in #922
• Fix Maven releases by @fmeum in #921
• Update rules_jvm_external to fix POM by @fmeum in #924

New Contributors

• @dependabot made their first contribution in #910

Full Changelog: v0.23.0...v0.24.0

v0.23.0

What's Changed

• tests: Restore live output of java_fuzz_target_test by @fmeum in #875
• driver: Fix startup crash when fuzzing native libraries by @fmeum in #883
• Remove cifuzz references by @bertschneider in #892
• build: update toolchains_llvm dependency by @bertschneider in #897
• docs: update readme to inform about commercial offering by @jochil in #898
• doc: Add updated links to README by @HenrichN in #900
• Jazzer Pro by @kyakdan in #906
• Adjust license to clarify the usage within OSS-Fuzz by @serj in #909
• Change license back to Apache2 by @serj in #913
• Update macOS to 14 in the CI by @kyakdan in #914
• ci: Update softprops/action-gh-release to v2.2.0 in prerelease workflow by @zgtm in #916
• Fix prerelease pipeline by @zgtm in #917
• Fix maven deployment by @zgtm in #918

New Contributors

• @jochil made their first contribution in #898
• @HenrichN made their first contribution in #900
• @serj made their first contribution in #909

Full Changelog: v0.22.1...v0.23.0

v0.22.1

What's Changed

• Feature: junit: The API of @DirectoryEntries and @DictionaryFile has changed compared to v0.22.0.

Full Changelog: v0.22.0...v0.22.1

v0.22.0

What's Changed

• Breaking change: junit: The Lifecycle.PER_EXECUTION mode of @FuzzTest now provides a new test instance for each fuzz test, with support for TestInstancePostProcessor's (#867)
• Experimental feature (subject to change in a future version): junit: Dictionaries can be added to fuzz tests via @DirectoryEntries and @DictionaryFile (#862)
• Bugfix: Hooks can now also instrument classes on the extension classpath (#869)

Full Changelog: v0.21.1...v0.22.0

v0.21.1

What's Changed

No functional changes to the Maven artifacts.

• Bugfix: jazzer_standalone.jar in the release archives can be executed with java -jar (#858)

See v0.21.0 for the full release notes.

Full Changelog: v0.21.0...v0.21.1

v0.21.0

What's Changed

• Breaking change: Bugfixes for edge cases in FuzzedDataProvider can result in altered behavior when reproducing old findings (ed7e7b2)
• Feature: junit: The new lifecycle parameter of @FuzzTest can be set to PER_EXECUTION to run "before each" and "after each" lifecycle methods and extension callbacks for each individual execution of a fuzz test rather than just once per test (#833, #851)
• Feature: junit: @FuzzTest can now be applied to other annotations as a meta-annotation, allowing for the creation of custom reusable fuzz test annotations (#849)
• Feature: Improved Map instrumentation (#845)
• Bugfix: junit: Only create .cifuzz-corpus if it is the generated corpus (#855)

Full Changelog: v0.20.1...v0.21.0

v0.20.1

What's Changed

• Bugfix: Fixed a release process issue that corrupted the jazzer Maven artifact (#838)

See v0.20.0 for the full release notes.

Full Changelog: v0.20.0...v0.20.1

v0.20.0

What's Changed

• Breaking change: Boolean-valued JAZZER_* environment variables are parsed more strictly and fail on values that aren't obviously truthy or falsy (#815)
• Feature: Compatibility with JDK 21 (#785 by @cushon, #820)
• Feature: Comparison instrumentation for Clojure standard library functions (#805, #827)
• Feature: junit: @Timeout can now be used to configure per-class and per-test timeouts for individual fuzz test executions (#825)
• Feature: junit: @FuzzTest#maxExecutions can be used to limit the number of executions of a fuzz test during fuzzing
• Feature: junit: Jazzer command-line options can be set via JUnit configuration parameters
• Bugfix: LibFuzzer options that use subprocesses are supported more reliably and in the docker container (#748 by @svenkeidel, #793, #824)
• Bugfix: Instrumented Byte#compare and Short#compare calls no longer throw an exception (#792, reported by @jarnokie)
• Bugfix: junit: Fixed running on individual files from the command line (#819)
• Error messages for JUnit 5 fuzz test setup issues have been improved

New Contributors

• @WillRoque made their first contribution in #782
• @cushon made their first contribution in #785
• @svenkeidel made their first contribution in #784

Full Changelog: v0.19.0...v0.20.0

v0.19.0

What's Changed

• Feature: Rework Opt value handling (#767)
• Feature: Generate temporary seeds with deterministic names (#744)

Full Changelog: v0.18.0...v0.19.0