<?xml version="1.0"?>
<!--
   Licensed to the Apache Software Foundation (ASF) under one or more
   contributor license agreements.  See the NOTICE file distributed with
   this work for additional information regarding copyright ownership.
   The ASF licenses this file to You under the Apache License, Version 2.0
   (the "License"); you may not use this file except in compliance with
   the License.  You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-->
<document>
 <properties>
  <title>Release notes for version 4.1</title>
  <author email="dev@commons.apache.org">Commons Documentation Team</author>
 </properties>
<body>

<section name="Release notes for version 4.1">
<hr />
<p>
Apache Commons Collections is a project to develop and maintain collection
classes based on and inspired by the JDK collection framework.
</p>
<p>
This 4.1 release is a minor and security release, fixing several bugs present in
previous releases of the 4.X branch. Additionally, this release provides a mitigation
for a known remote code exploitation via the standard java object serialization
mechanism. Serialization support for unsafe classes in the functor package has been
completely removed (classes do not implement the Serializable interface anymore).
For more details, please refer to COLLECTIONS-580.
</p>
<p>
All users are strongly encouraged to updated to this release.
</p>

<h3>Compatibility</h3>
<ul>
 <li>Java 6 or later is now required (previous version 4.0 required Java 5)</li>
 <li>This release is source and binary compatible with the previous 4.0 release
     of Commons Collections with the exception that some classes in the functor
     package do not implement the Serializable interface anymore (see COLLECTIONS-580)</li>
</ul>

<center><h3>Major changes since 4.0</h3></center>
<ul>
<li>Added interface MultiSet (package multiset)</li>
<li>Added interfaces MultiValuedMap, ListValuedMap and SetValuedMap (package multimap)</li>
<li>Added fluent API for Iterable instances (class FluentIterable)</li>
</ul>

<h3>Security Changes</h3>
<table>
<tr>
 <td><b>COLLECTIONS-580</b></td>
 <td>Serialization support for unsafe classes in the functor package has been
     removed completely as this can be exploited for remote code execution
     attacks. Classes considered to be unsafe are: CloneTransformer, ForClosure,
     InstantiateFactory, InstantiateTransformer, InvokerTransformer,
     PrototypeCloneFactory, PrototypeSerializationFactory, WhileClosure.</td>
</tr>
</table>

<p>
For a full list of changes in this release, refer to the <a href="changes-report.html#a4.1">Change report</a>.
</p>
</section>

</body>
</document>
