Version 1.11.2 (31-Oct-2026)
Security
- GHSA-h2ch-39mm-r68h: The robot sandbox was not enforced on Java 24 and newer, where the SecurityManager has been removed. A malicious robot could execute commands, access the network, and read and write files on the host. Reported by Hongwei Li, Junmin Zhu, Zhun Wang, Jiacheng Zhong, Han Dai, Suyue Guo, Songyang Peng, and Ziyue Pan.
- Robot classes are now verified when they are loaded, on all Java versions. Robots using something that is not allowed (e.g. sockets, processes, reflection, or writing files outside their data directory) are rejected with a message explaining why.
RobocodeFileOutputStream now checks that the file is inside the robot's data directory.- Robots can only delete files and create directories in their own data directory.
- Robots can only read files and get information about files (e.g.
File.exists() and File.list()) in their own root package directory and data directory, like with the SecurityManager.
- Robots can only deserialize their own classes, Robocode classes, and common Java classes like strings, collections, and geometry.
- Robots can use reflection on their own classes, but can only use the members of other classes via reflection that they are allowed to use directly, and cannot make these accessible with
setAccessible().
- Robots can no longer read files outside their class path via
getResourceAsStream().
- Robots are punished if they create more than 5 threads, which is now checked every turn, and cannot use virtual threads, as these are not counted.
- Robots can no longer access the libraries used by Robocode.
Bugfix
- Robots in a jar file inside another jar file, e.g. in a team jar, could not be loaded with Java 9 and newer.
- Battles were not deterministic with Java 9 and newer, e.g. when using the
RANDOMSEED system property, if robots used Math.random(). Calls to Math.random() in robots now use the random number generator of Robocode.
- A robot that skipped too many turns was not stopped properly since version 1.10.1. Robocode waited several seconds for the robot thread to stop itself, reported "Unable to stop thread" and punished the robot as unstoppable, and the robot then failed with "You cannot take action in this thread!".
Changes
- Tests can be run on another Java version than the Java 8 toolchain, e.g.
./gradlew test -PtestJavaVersion=25. The CI build now runs all tests with both Java 8 and Java 25.
Download Robocode 1.11.2 from
here
