Update dependency com.github.junrar:junrar to v8

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
com.github.junrar:junrar	7.6.1 → 8.1.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

junrar/junrar (com.github.junrar:junrar)

v8.1.1

Compare Source

🐛 Fixes

io

• readLongBigEndian returned only the low 32 bits (efdbd79)

rar3

• read the Unix owners sub-block names within its bounds (27d7755)
• bound the remaining header reads and keep reading past a broken header (8301bcb), closes #​12
• bound the extended-time reads left unguarded by v7.5.1 (da5ef82), closes #​12 #​86 #​87

unscoped

• keep extracting when an entry name has no Path on this JVM (510b792)

🔄️ Changes

• satisfy spotless in the changed method (6557837)

🧪 Tests

• reproduce the unrepresentable name without a locale (06aefef)

🛠 Build

deps

• bump gradle from 9.6.1 to 9.7.1 (1de660e)
• bump com.fasterxml.jackson.datatype:jackson-datatype-jsr310 (d79e3a5)
• bump com.diffplug.spotless from 8.9.0 to 8.10.0 (8787a21)
• bump com.fasterxml.jackson.core:jackson-databind (facf4d5)
• bump io.github.ben-manes.versions.settings (a17162c)
• bump EndBug/add-and-commit from 10 to 11 (c866a6f)
• bump org.bouncycastle:bcprov-jdk18on from 1.85 to 1.85.2 (8017539)
• bump gradle/actions from 6.2.0 to 6.3.0 (1397fab)
• bump com.github.ben-manes.versions from 0.58.0 to 0.59.0 (a16c9f4)
• bump com.github.ben-manes.versions from 0.54.0 to 0.58.0 (dcb0afb)
• bump com.diffplug.spotless from 8.8.0 to 8.9.0 (5829d84)
• bump gradle/actions from 6 to 6.2.0 (0b3f663)

unscoped

• update svu install (09ad661)

v8.1.0

Compare Source

🚀 Features

crypt

• decrypt legacy RAR 1.3/1.5/2.0 encrypted entries (5da2cb6)

rar14

• extract entries spanning multiple RAR 1.4 volumes (a4b9591)
• extract RAR 1.4 entries with Checksum14 verification (11f1d23)
• parse RAR 1.4 headers and list entries (7ac5a8c)

🐛 Fixes

rar5

• skip CRC verification when no checksum is stored (62170ff)

unscoped

• reject RAR 1.4 archives with UnsupportedRarVersionException (e0bc027), closes #​293

🏎 Perf

• buffer RAR decryption without per-byte allocation (5e66082)
• speed up and cache the RAR4 key derivation (ae6bcc5)
• backport unrar quick-decode table to the RAR4 decoder (68555aa)

🧪 Tests

rar14

• replace third-party fixtures with self-authored archives (56d43d8)

regression

• add legacy RAR era matrix to the corpus (e7392d1)

🛠 Build

deps

• bump com.fasterxml.jackson.core:jackson-databind (57091f9)
• bump com.fasterxml.jackson.datatype:jackson-datatype-jsr310 (58ea9cf)
• bump org.bouncycastle:bcprov-jdk18on from 1.84 to 1.85 (5a80ee1)

v8.0.0

Compare Source

🚀 Features

api

• 🚨 remove UnsupportedRarV5Exception: UnsupportedRarV5Exception is removed. It has not been
  thrown since RAR5 extraction landed; callers catching it should catch
  RarException, or UnsupportedRarVersionException for a version this library
  genuinely does not implement. (823b42d), closes #​289

archive

• parse RAR5 main/end/crypt + file/service headers (M3.3) (9205d23), closes #​24
• add RAR5 block-header framework (M3.2) (9a1916a), closes #​23
• add vint reader, signature dispatch + SFX scan (M3.1) (4eb0a95), closes #​22

crypt

• RAR5 Blake2s/Blake2sp + DataHash hash seam (M3.5) (938b8fa), closes #​26
• RAR5 KDF, pswcheck, header + data decryption (M3.4) (faae8cc), closes #​25

links

• RAR5 REDIR extraction + three symlink-safety layers (M3.10) (410a646), closes #​31

rar5

• segment the window lazily above 1 GB, capability 64 GB (M4.3) (85b61ad), closes #​35
• decode RAR7 extended distances and route version 70 (M4.2) (434de0e), closes #​34
• parse RAR7 compression info and gate its dictionary (M4.1) (345c291), closes #​33 #​34
• 🚨 lift the V5 extraction gate, delete the pre-gate harness (M3.11): *RAR5 archives now open and extract instead of throwing
  UnsupportedRarV5Exception; the exception class is deprecated.

Refs #​32* (dd64124), closes #​32

unpack

• RAR5 filters (DELTA/E8/E8E9/ARM) + sweep topology (M3.8) (8eaea37), closes #​29
• RAR5 Unpack5 decode loop + engine lifecycle (M3.7) (5abb2d8), closes #​28
• RAR5 Unpack5 skeleton — window, tables, block header (M3.6) (ee6386a), closes #​27

volume

• RAR5 multi-volume spanning + typed volume errors (M3.9) (3308906), closes #​30

unscoped

• verify RAR3 header CRCs, refuse extracting broken FILE headers (a0870d3), closes #​12
• add ArchiveOptions construction-time configuration API (P0.8) (a9f5af7)

🐛 Fixes

archive

• add unrar's second, unconditional FILE/SERVICE header-CRC check (9eca3ec), closes #​12 #​38
• reject backward-seeking RAR5 DataSize vint (8974da5), closes #​23

build

• pin compileTestJava release=21 so ArchUnit can parse test bytecode (4600a08), closes #​36

rar3

• decode narrow names as UTF-8 when the bytes are valid (e00b6c5), closes #​44

rar5

• widen the split-before guard to any RAR5-container entry (30d1aaf), closes #​30 #​43
• route unknown-algorithm-version entries by container, not family (57d38d8), closes #​43
• wrap window positions instead of masking them (M4.3) (c60795b), closes #​35

rarfile

• bounds-check encname decode and drop method 36 (47198c5), closes #​19

unpack

• zero-fill distance-into-void via FirstWinDone tracking (7.0.3) (4c59fe5), closes #​18
• mask RAR1.5 LongLZ distance write index (a81a5e9), closes #​17
• compare RAR filter fields unsigned (65fe437)
• reject unsigned delta sizes (d2d0f72)
• reject unsigned filter positions (146e15b)
• bound RAR3 delta channels (1cfdccd)
• guard RAR 1.5 flags index (22f95f9)
• bound RAR3 filter stacks (4f36413)

unscoped

• guard PPM state arrays (af0af77)
• latch nested PPM decode errors (146bc6b)
• mark *.bin oracle fixtures binary to survive Windows checkout (ea03470), closes #​37
• give v20-solid-negative-backref.rar real header CRCs, not 0x0000 (16a5fc8)
• decode plain-ANSI names byte-transparently, not as UTF-8 (T6 fix round) (1171d33)
• decode ANSI names with explicit UTF-8, port whole-name branch (T6) (a58a48a)
• serialize RAR3 KDF passwords as UTF-16LE, not platform charset (T4) (90e6840)
• promote unpSize sentinel to INT64MAX (T1) (1e32b05)
• honor PPM MaxMB verbatim per unrar policy (S8/P0.5) (e23273d)
• correct ProtectHeader layout to unrar SIZEOF_PROTECTHEAD 26 (T2) (266f2bb)

🔄️ Changes

vm

• delete the dead RAR3 bytecode interpreter (M2.2) (e2287ab), closes #​20 #​21
• replace RAR3 interpreter with 5.5.1 fingerprint recognition (b1ca0f2), closes #​20

unscoped

• 🚨 rename deprecated methods in FileHeader: remove deprecated FileHeader#getFileNameString and FileHeader#getFileNameW (c78e224)
• 🚨 remove deprecated BaseBlock#getHeaderSize(): remove deprecated BaseBlock#getHeaderSize() (81dd982)
• apply Spotless formatting (9ec0986)
• ci: keep the regression test in its own workflow (0f6ddaa), closes #​289

🧪 Tests

archive

• pin encrypted-header fatal-at-open to Archive construction (d86980e), closes #​38
• pin short-input rejection, refresh stale VC snapshot (8712039), closes #​42 #​288

corpus

• add M3.11 three-shape audit + all-members oracle-check scripts (b099bcc), closes #​32
• flip 345 RAR5 member expectations for the lifted V5 gate (6f76df5), closes #​32

ppm

• assert reflected unpack/ppm non-null in heap dump oracle (0e0532d)

rar5

• make two vint-guard tests earn their names (0912a82)
• pin the solid-window grow-mid-set rejection (4bc018c)
• pin file-header compat quirks and crypt-record guards (85361f3)
• pin main-header hostile-input guards (3272828)

regression

• ship a payload-stripped corpus, drop the 7 GB download (82f54fa), closes #​41

unpack

• drive M1.4 first-window distance-into-void from hostile fixtures (7ed0a2d), closes #​18
• drive M1.3 filter/channel/flags limits from hostile archives (39d5b8e), closes #​17
• pin RAR 1.5 flags boundary (d2cf4eb)
• pin RAR3 filter upper bound (f67e7ae)

unscoped

• make every suite runnable on a real JVM 8 toolchain (6ca1348), closes #​289
• reconcile upstream regression tests with this branch (R6 sync) (fb62ab3), closes #​5 #​12
• document PPM fixture provenance (3cff6b6)
• add PPMd heap dump oracle (5a540ce)
• refresh 7 corpus reference JSONs for T6 byte-transparent decode (3efb1bc), closes #​11 #​38
• discriminate builder password copy; document null-literal ambiguity (P0.8 fix round) (7a5f90f), closes #​13
• pin C15 signedness class rule + audit ledger (P0.4) (2eae244)
• pin C13 long-clean lengths and D1 byte[] refusal (P0.3) (9f768e6)
• pin C7 protect-header seek-past-data (2fee927)
• pin C1 solid-v20 negative back-ref (P0.1) (ff86dda)

🛠 Build

regression

• retry transient corpus download failures (1d39cc3)
• fetch corpus by id via gdown with caching (5b6ec04)

unscoped

• drop dead JGit dependency constraint (258a0b0)
• enable Spotless with JGit-free parameters (0ccc14c)
• gate release on JRE smoke (ec5a10a)
• run the unit and regression suites on a Java 8/25 matrix (3023d06), closes #​289
• build and test on JDK 25, pin the regression harness bytecode (c168901)
• compile the smoke runner through a Gradle source set (904f2a4)
• build the smoke jar with Gradle on JDK 25, keep the JRE 8/25 matrix (4c8f1c7), closes #​36
• build the smoke jar with a real JDK 8 and run it on JRE 8 and 25 (f7b1704), closes #​289
• keep the regression test in its own workflow (544b18d)
• fold the regression test into the main CI workflow (560f07d), closes #​289
• compile the jre8 smoke runner with explicit -encoding UTF-8 (43c0afe)
• add JRE 8 runtime extraction smoke job (P0.9) (d503bff)

📝 Documentation

api

• explain why getFileCRC() stays a signed int, and pin it (3b63fa3), closes #​260 #​289

contributing

• keep the original corpus URL for regeneration (7515dfc), closes #​289

porting

• cite port-tracker issues by PT-NN appendix keys (cd6323d), closes #​289
• make issue citations survive the port tracker (d6d3aff), closes #​31 #​40 #​289
• stop claiming checkstyle enforces the house rules (d9515ab), closes #​289

rar5

• close #​40 FHEXTRA_REDIR link-path divergences as keep (6c40209), closes #​40

unscoped

• update supported RAR version in README (6c5ca7d)
• remap two commit citations the markdown-only sweep missed (ad35e1b)
• remap commit citations orphaned by the upstream rebase (576dbc0)
• correct the M3.10 commit citation in no-go row D3 (fca2a6c), closes #​40
• add missing javadoc summary on BaseBlock#setBrokenHeader (c66cd00)
• record T6 ISO-8859-1 decision and T4 non-BMP divergence (manual §6) (6ffc2a0)
• qualify P0.8 additive claim in plan §5.4 (source-level null-literal caveat) (656f501), closes #​13
• reconcile S8 resolution and clear residual UNPINNED markers after P0.5 (60b1ecc)
• reconcile C15 pin state and d276f93 attribution after P0.4 (e47d8d6)
• precise post-sweep shift-history claim for RarVM (36a5883) (a3b88de)
• correct signedness-audit claims per verification (d1c534d), closes #​9
• reconcile pin state after P0.3; snapshot-note the divergences report (2f0a493)
• reconcile manual UNPINNED/T2 state after P0.1-P0.2 (34e9fa7)
• revise parity plan per external review (GPT-5.6 Sol) (c0abbd9)
• correct RAR5 KDF snapshot offsets and header-CRC semantics (72c2d49)
• revise parity plan per independent adversarial review (3e0022b)
• correct Blake2sp/Bouncy Castle claim in migration manual (25c4db2)
• add RAR5/RAR7 extraction parity plan (7a0f936)
• add C++→Java migration manual and porting analysis reports (55e165e)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud