🚀 New features and improvements

• feat: reduce terminal startup latency with deferred build and provider short-circuit (#2430) @gnodet

🐛 Bug Fixes

• fix: halfwidth katakana voiced/semi-voiced sound marks not counted in display width (#2435) @gnodet
• fix: preserve command buffer when edit-and-execute secure temp file fails (#2434) @gnodet
• fix: remove eager native library load from JLineLibrary static initializer (#2432) @gnodet
• fix: isolate ColorPaletteTest from COLORTERM env, fix setEnv() capability reset (#2431) @gnodet

🐛 Bug Fixes

• perf: lazily initialise FFM handles to reduce cold-start cost (#2424) @gnodet
• fix: drop a lone ESC before a control character in ansiAppend (#2423) @uchiha-bug-hunter
• fix: escape % in JDK console and ssh prompts passed to readLine (#2422) @uchiha-bug-hunter
• fix: size FormatMessageW buffers in WCHARs, not bytes (#2417) @uchiha-bug-hunter

📦 Dependency updates

• chore: bump eu.maveniverse.maven.nisse:extension from 0.9.11 to 0.9.12 (#2428) @dependabot[bot]
• chore: bump org.codehaus.mojo:build-helper-maven-plugin from 3.6.2 to 3.7.0 (#2426) @dependabot[bot]
• chore: bump actions/setup-java from 6.1.0 to 6.2.0 (#2425) @dependabot[bot]
• chore: bump org.graalvm.sdk:graal-sdk from 25.4.4.1.1 to 25.5.5.0.3 (#2420) @dependabot[bot]
• chore: bump com.diffplug.spotless:spotless-maven-plugin from 3.10.4 to 3.11.0 (#2419) @dependabot[bot]

JLine 4.5.0 brings four security fixes, two new features, twenty bug fixes, and a batch of maintenance improvements.

This release addresses four moderate-severity vulnerabilities: a heap overflow in the native CLibrary.ioctl() binding, world-readable editor temp files, history expansion applied to masked (password) input, and a multi-frame bypass of the NEW-ENVIRON variable limit in the Telnet server. It also hardens WebTerminal against DNS rebinding and clickjacking, and fixes a broad set of reader/terminal correctness issues contributed by the community.

🔒 Security Fixes

• GHSA-p73x-fv3x-mvv6 — Prevent heap overflow in CLibrary.ioctl(int, long, int[]) (#2412) @gnodet
• GHSA-7whq-538g-8928 — Create editor temp files with owner-only permissions (#2343) @uchiha-bug-hunter
• GHSA-rcc3-r7r7-qvg2 — Skip history expansion for masked input (#2346) @uchiha-bug-hunter
• GHSA-7qh2-r6cc-r47w — Enforce NEW-ENVIRON variable limit across frames to prevent memory exhaustion (#2415) @gnodet

✨ New Features

• Allow disabling the JLine shutdown hook (#2325) @ItsDeadlyProgrammer
• Use detailed command description via describe() in command help (#2318) @FSeidinger

🐛 Bug Fixes

• Resolve the Nano overwrite check against the editor root (#2414) @uchiha-bug-hunter
• Add mach_absolute_time() fallback for clock_gettime on macOS and mac-x86 target (#2410) @gnodet
• Match multi-line history entries against history-ignore (#2406) @uchiha-bug-hunter
• Keep text killed at masked prompts out of the shared kill ring (#2356) @uchiha-bug-hunter
• Buffer the output of dumb system terminals (#2353) @Pankraz76
• AnsiConsole asks the terminal's own provider whether the other stream is a TTY (#2352) @knutwannheden
• Forbid framing of the WebTerminal page (#2351) @uchiha-bug-hunter
• Drop 8-bit C1 control sequences in ansiAppend (#2350) @uchiha-bug-hunter
• Skip history expansion for masked input (#2346) @uchiha-bug-hunter
• Reject DNS-rebound Host headers in WebTerminal (#2345) @uchiha-bug-hunter
• Stop treating ambiguous and neutral symbols as wide in WCWidth (#2344) @wleeaf
• Use Locale.ROOT when converting terminal flag and OS names (#2342) @vidhan843426
• NonBlockingReader.available() always returns 0 (#2339) @gnodet
• Honor buffer ranges and cached EOF in nonblocking readers (#2337) @PHJ2000
• Honor echo flags for line discipline signal characters (#2336) @PHJ2000
• Preserve incremental search prompts with autosuggestions (#2335) @PHJ2000
• Clear tail tips when setTailTip receives null (#2334) @PHJ2000
• Retain reader cursor tracking on status resize (#2326) @snowyukitty
• AnsiConsole.systemInstall() no longer redirects the non-terminal stream to the wrong fd (#2317) @gnodet

🧰 Maintenance

• Make history trimming linear instead of quadratic (#2413) @ptweezy
• Rework native library generation: Docker cross-compilation infrastructure with automated CI rebuild workflow and macOS crossbuild images (#2411) @gnodet
• Unify OSC/non-OSC string states with belTerminatesString flag (#2372) @gnodet

JLine 4.4.8 is a bugfix and enhancement release addressing an AnsiConsole stream-routing bug and improving command help output.

The AnsiConsole fix corrects a long-standing issue where ansiStream() used terminal.output() for both stdout and stderr, causing the non-terminal-backed stream to be silently redirected to the wrong file descriptor (for example, stderr output going to stdout when the terminal was selected via SysOut). The fix routes each stream to its correct fd: the terminal-backed stream goes through terminal.output(), while the other writes to the original system stream. ANSI mode for the non-terminal-backed stream is now auto-detected per-fd (preserving colors when it is a tty, stripping when redirected), with jansi.out.mode/jansi.err.mode properties still honoured as overrides. The enhancement from @FSeidinger makes detailed command help richer: it now displays every non-empty line of the main description via CommandDescription#describe(), argument descriptions appear alongside argument names, and additional description lines are indented beneath the first for easier reading.

🐛 Bug Fixes

• fix: AnsiConsole.systemInstall() no longer redirects the non-terminal stream to the wrong fd (#2317) @gnodet

✨ Enhancements

• feat: use detailed command description via describe() in command help (#2318) @FSeidinger

📦 Dependency Updates

• chore: bump release-drafter/release-drafter from 7.7.0 to 7.9.0 (#2313) @dependabot[bot]
• chore: bump com.palantir.javaformat:palantir-java-format from 2.101.0 to 2.102.0 (#2314, #2315) @dependabot[bot]

Full Changelog: 4.4.7...4.4.8

JLine 4.4.7 is a security and bug fix release addressing two security vulnerabilities and one rendering correctness bug.

The history /PATTERN search in HistoryCommands was compiling user-supplied regex patterns with a raw Pattern.compile + Matcher.find() call, with no execution-time guard — the only unprotected regex path in the project. A pathological pattern like (a+)+z would hang the session thread indefinitely via catastrophic backtracking (GHSA-vrw4-fppg-3rhf). The fix routes through SafeRegex, consistent with all other regex call sites. The telnet NEW-ENVIRON handler (TelnetIO.readNEVariables) enforced its 100-variable limit only within a single subnegotiation frame via a local counter that reset on each call. An unauthenticated client could send multiple frames to accumulate an unbounded number of environment entries and exhaust server heap (GHSA-7qh2-r6cc-r47w, bypassing the incomplete fix for CVE-2026-56740); the fix also checks the persistent connection-level map size. Finally, AttributedStringBuilder.setLength did not recompute lastLineLength after truncation, causing subsequent tab stops to be calculated against the wrong position; three regression tests covering cleared builder, newline removal, and last-line shortening were added by the contributor.

🐛 Bug Fixes

• fix: guard history /pattern regex search against ReDoS via SafeRegex (#2286) @gnodet
• fix: enforce NEW-ENVIRON variable limit across frames to prevent memory exhaustion (#2287) @gnodet
• fix: recompute tab position after truncation (#2305) @PHJ2000

📦 Dependency Updates

• chore: bump sshd.version from 2.19.0 to 2.20.0
• chore: bump com.diffplug.spotless:spotless-maven-plugin from 3.10.2 to 3.10.3
• chore: bump com.palantir.javaformat:palantir-java-format from 2.98.0 to 2.100.0
• chore: bump slf4j.version from 2.0.19 to 2.0.20 (#2289)
• chore: bump org.graalvm.sdk:graal-sdk from 25.3.4.1 to 25.4.4.1.1 (#2292)

Full Changelog: 4.4.6...4.4.7

JLine 4.4.6 is a bugfix release addressing two correctness issues and updating several dependencies.

The main fix resolves a boot layer initialization failure (InvalidModuleDescriptorException) that affected Java 17+ projects with jline-terminal-ffm on the module path: the module-info.class was compiled at Java 22 and placed at the jar root, causing the JVM to reject it. The module is now packaged as a proper Multi-Release JAR, with the module descriptor in META-INF/versions/22/, so Java 17 consumers load the jar without issues while Java 22+ still gets the full JPMS module. The second fix corrects codePointAt/codePointBefore in AttributedString to respect subsequence bounds, preventing surrogates from being combined with characters outside the logical range.

🐛 Bug Fixes

• fix: make jline-terminal-ffm a Multi-Release JAR to fix Java 17 boot layer failure (#2285) @gnodet
• fix: respect attributed sequence bounds when reading code points (#2278) @jakezwang

📦 Dependency Updates

• chore: bump groovy.version from 5.1.2 to 6.0.0 (#2281) @dependabot[bot]
• chore: bump org.graalvm.buildtools:native-maven-plugin from 1.1.12 to 1.1.14 (#2279) @dependabot[bot]
• chore: bump org.apache.felix:maven-bundle-plugin from 6.1.2 to 6.2.0 (#2277) @dependabot[bot]

Full Changelog: 4.4.5...4.4.6

JLine 4.4.5 is a bug fix release addressing terminal color palette initialization, FFM signal handling, and paginated list rendering, along with dependency updates.

🐛 Bug Fixes

• fix: palette sized before infocmp capabilities are parsed (#2260) @gnodet
• fix: ColorPalette.loadPalette() falls back to default when terminal does not answer OSC 4 (#2261) @gnodet
• fix: prevent FFM provider from overwriting JVM-reserved SIGQUIT with SIG_DFL (#2271) @gnodet
• fix: correct paginated list/checkbox layout defects (#2273) @gnodet
• fix: replace ReDoS-vulnerable regex with simple string checks in DefaultPrinter (#2247) @gnodet

📦 Dependency Updates

• chore: bump eu.maveniverse.maven.nisse:extension from 0.9.10 to 0.9.11 (#2253) @dependabot[bot]
• chore: bump com.palantir.javaformat:palantir-java-format from 2.97.0 to 2.98.0 (#2254) @dependabot[bot]
• chore: bump actions/setup-java from 6.0.0 to 6.0.1 (#2258) @dependabot[bot]
• chore: bump org.codehaus.mojo:build-helper-maven-plugin from 3.6.1 to 3.6.2 (#2266) @dependabot[bot]
• chore: bump org.apache.maven.plugins:maven-deploy-plugin from 3.1.4 to 3.2.0 (#2268) @dependabot[bot]
• chore: bump org.apache.maven.plugins:maven-install-plugin from 3.1.4 to 3.2.0 (#2269) @dependabot[bot]
• chore: bump org.codehaus.mojo:exec-maven-plugin from 3.6.3 to 3.6.4 (#2270) @dependabot[bot]

Full Changelog: 4.4.3...4.4.5

JLine 3.30.17 is a security patch release addressing multiple vulnerabilities reported by AFINE/CERT.PL, plus dependency updates.

🔒 Security Fixes

• Native Stack Buffer Overflow in Public INPUT_RECORD.memmove JNI Method (Windows) (GHSA-6r3w-6jpj-x5w6)
• Authenticated SSH Shell Channel Resource Leak via Null or Non-Numeric PTY Dimensions (GHSA-7h86-pjwh-gpqj)
• Authenticated SSH DoS via Unbounded Window-Change Terminal Geometry (GHSA-m935-wqpj-pvp3)
• TCP Socket File Descriptor Leak When Maximum Connections Reached (GHSA-c87g-867h-cqr6)

🐛 Bug Fixes

• fix: strip control characters from file names in posix builtins (3.x backport) (#2240) @gnodet
• fix: bound !# history expansion to prevent exponential blowup (3.x backport) (#2239) @gnodet
• fix: verify server host keys in the ssh client builtin (3.x backport) (#2237) @gnodet
• fix: address remaining security vulnerabilities reported by AFINE/CERT.PL (3.x backport) (#2238) @gnodet
• fix: backport security fixes from master (#2156, #2164, #2175) (#2190) @gnodet
• fix: backport security fixes to 3.x (path traversal + DSR plain text) (#2137) @gnodet
• fix: strip control characters from ssh banner and prompts (3.x backport) (#2136) @gnodet

📦 Dependency updates

• chore: bump com.diffplug.spotless:spotless-maven-plugin from 3.10.1 to 3.10.2 (#2243)
• chore: bump slf4j.version from 2.0.18 to 2.0.19 (#2241)
• chore: bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.6 to 3.6.0 (#2233)
• chore: bump org.apache.maven.plugins:maven-compiler-plugin from 3.15.0 to 3.16.0 (#2226)
• chore: bump org.apache.felix:maven-bundle-plugin from 6.1.0 to 6.1.2 (#2224)
• chore: bump com.diffplug.spotless:spotless-maven-plugin from 3.10.0 to 3.10.1 (#2216)
• chore: bump actions/setup-java from 5.7.0 to 6.0.0 (#2205)
• chore: bump org.graalvm.sdk:graal-sdk from 25.2.4 to 25.3.4.1 (#2202)
• chore: bump com.mycila:license-maven-plugin from 5.1.1 to 5.1.2 (#2187)
• chore: bump org.easymock:easymock from 5.6.0 to 5.7.0 (#2188)
• chore: bump com.diffplug.spotless:spotless-maven-plugin from 3.9.0 to 3.10.0 (#2182)
• chore: bump com.google.jimfs:jimfs from 1.3.1 to 1.3.2 (#2184)
• chore: bump org.apache.maven.wrapper:maven-wrapper from 3.3.2 to 3.3.4 (#2166)
• chore: bump org.apache.maven:apache-maven from 4.0.0-rc-3 to 4.0.0-rc-6 (#2165)
• chore: bump eu.maveniverse.maven.njord:extension3 from 0.9.9 to 0.9.10 (#2161)
• chore: bump com.palantir.javaformat:palantir-java-format from 2.96.0 to 2.97.0 (#2159)
• chore: bump actions/setup-java from 5.6.0 to 5.7.0 (#2147)
• chore: bump release-drafter/release-drafter from 7.6.0 to 7.7.0 (#2146)
• chore: bump groovy.version from 4.0.32 to 4.0.33 (#2143)
• chore: bump actions/setup-java from 5 to 5.6.0 (#2134)
• chore: bump release-drafter/release-drafter from 7 to 7.6.0 (#2133)
• chore: bump org.apache.felix:maven-bundle-plugin from 6.0.2 to 6.1.0 (#2132)
• chore: bump com.diffplug.spotless:spotless-maven-plugin from 3.8.0 to 3.9.0 (#2125)
• chore: bump org.graalvm.sdk:graal-sdk from 25.1.3 to 25.2.4 (#2123)
• chore: bump com.mycila:license-maven-plugin from 5.0.0 to 5.1.1 (#2115)
• chore: bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 (#2113)

JLine 4.4.3 is a security patch release addressing multiple vulnerabilities reported by AFINE/CERT.PL, plus bug fixes and dependency updates.

🔒 Security Fixes

• Native Stack Buffer Overflow in Public INPUT_RECORD.memmove JNI Method (Windows) (GHSA-6r3w-6jpj-x5w6)
• Authenticated SSH Shell Channel Resource Leak via Null or Non-Numeric PTY Dimensions (GHSA-7h86-pjwh-gpqj)
• Authenticated SSH DoS via Unbounded Window-Change Terminal Geometry (GHSA-m935-wqpj-pvp3)
• TCP Socket File Descriptor Leak When Maximum Connections Reached (GHSA-c87g-867h-cqr6)

🐛 Bug Fixes

• fix: verify server host keys in the ssh client builtin (#2236) @uchiha-bug-hunter
• fix: address remaining security vulnerabilities reported by AFINE/CERT.PL (#2235) @gnodet
• fix: use Release Drafter draft for GitHub release and fail closed on lookup errors (#2232) @gnodet

📦 Dependency updates

• chore: bump org.graalvm.buildtools:native-maven-plugin from 1.1.11 to 1.1.12 (#2242) @dependabot[bot]
• chore: bump com.diffplug.spotless:spotless-maven-plugin from 3.10.1 to 3.10.2 (#2246) @dependabot[bot]
• chore: bump groovy.version from 5.1.1 to 5.1.2 (#2245) @dependabot[bot]
• chore: bump slf4j.version from 2.0.18 to 2.0.19 (#2244) @dependabot[bot]
• chore: bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.6 to 3.6.0 (#2234) @dependabot[bot]

JLine 4.4.2 is a bugfix release focused on terminal I/O reliability. It eliminates a race condition where the pump thread could steal keystrokes from subprocesses (e.g. less), fixes mouse event corruption on Windows at large column positions, and replaces wall-clock deadlines with monotonic timing to prevent misbehavior under NTP adjustments.

🐛 Bug Fixes

• fix: use poll(2) in pump thread to prevent tty keystroke theft (fixes #2219) (#2222) @gnodet
• fix: use poll(2) for probe and PTY reads (fixes #2223) (#2229) @gnodet
• fix: use System.nanoTime() for monotonic deadline accounting (fixes #2230) (#2231) @gnodet
• fix: use SGR mouse encoding on Windows to avoid corruption at column >= 96 (#2221) @gnodet
• fix: add mouse support capability to Windows terminal types (fixes #2217) (#2218) @gnodet

📦 Dependency updates

• chore: bump org.apache.maven.plugins:maven-compiler-plugin from 3.15.0 to 3.16.0 (#2225) @dependabot
• chore: bump org.apache.felix:maven-bundle-plugin from 6.1.0 to 6.1.2 (#2227) @dependabot
• chore: bump org.graalvm.buildtools:native-maven-plugin from 1.1.10 to 1.1.11 (#2215) @dependabot
• chore: bump com.diffplug.spotless:spotless-maven-plugin from 3.10.0 to 3.10.1 (#2214) @dependabot
• chore: bump eu.maveniverse.maven.nisse:extension from 0.9.8 to 0.9.10 (#2213) @dependabot

Full Changelog: 4.4.1...4.4.2