Released on 2026-08-12. The complete release notes are available in the changelog.

• Fixed the reading of LinkedHashMap (issue #30). Its entries are written
  in the block data of the HashMap it extends, and its own accessOrder
  field right after them. v1 read that block data a second time, which
  desynchronized the stream and broke every field read afterwards; v3
  looked for the entries under the LinkedHashMap level instead of the
  HashMap one, and silently returned an empty map.
• Fixed the reading of arrays referenced more than once in v2
  (issue #62). Arrays were given a reference handle but were never stored,
  so a reference to an array could not be resolved, and a reference found
  in an array field was read as a class description. Class descriptions are
  also stored before their annotations now, as v3 already does, so that
  what is read in between can refer to them.
• Giving a transformer class instead of an instance to load() or
  loads() now raises a TypeError naming the transformer, instead of
  failing later inside the parser with a missing argument (issue #54).
• The package declares itself as typed: it ships the PEP 561 py.typed
  marker, so type checkers use its hints once it is installed.
• Fixed wrong type hints, and the problems they were hiding (issue #39):
  _do_classdesc() and _read_content() are declared as optional, which
  is what they return on TC_NULL; reading an object, a class or an array
  without a class description now reports a ValueError instead of
  crashing on a missing attribute; and the _read_content() method of the
  IJavaStreamParser interface raises NotImplementedError, like the
  other ones, instead of returning None. mypy runs in the CI, with its
  configuration in pyproject.toml. Describing the functions which have no
  hints yet, mostly in the beans and transformers of v1 and v2, is left
  for a next release.
• Added tests for the java.time handlers of v1, which had none.

Verifying this release

Each artifact published on PyPI carries a
PEP 740 attestation, generated by the
publish.yml workflow through PyPI Trusted Publishing: no long-lived token is
involved, and the attestation is visible on the PyPI page of each file.

The same artifacts are attached below, together with their CycloneDX Software
Bill of Materials, and are covered by a SLSA build provenance attestation:

gh attestation verify <downloaded file> --repo tcalmant/python-javaobj
git tag -v 0.6.1

Released on 2026-08-12. The complete release notes are available in the changelog.

• Fixed the version number, which was declared inconsistently across the
  tree (pyproject.toml said 0.5.0 while most modules still said
  0.4.4): every module tuple, docstring field, pyproject.toml and
  setup.py now agree.
• Documented javaobj.v3 more thoroughly in the README: automatic
  conversion of Java collections to Python types, how to catch
  javaobj.v3.exceptions, and the parser/writer logger names.
• Added a containerized test matrix (run_tests.sh /
  run_tests_containers.sh, podman by default, Docker in CI) so ci-build.yml
  covers every Python version this project declares as supported, including
  2.7 and 3.4-3.7, which actions/setup-python cannot install on a current
  runner.
• Fixed two Java test sources that failed to compile or run once
  tests/java's Maven build became an actual CI gate instead of a
  best-effort, silently-ignored step: a misnamed public class and a
  duplicate class name in SerializationExample.java, and a Swing-based
  test that now skips itself when there is no display instead of failing.
• Switched the build backend from hatchling to setuptools, so releases
  ship a single universal py2.py3-none-any wheel: Python 2.7 users get a
  wheel install instead of always building from source.
• Added this changelog and a publish.yml release workflow (build, SLSA
  provenance attestation, CycloneDX SBOM, PyPI Trusted Publishing, GitHub
  release), modeled on the jsonrpclib/ipopo projects.

Verifying this release

Each artifact published on PyPI carries a
PEP 740 attestation, generated by the
publish.yml workflow through PyPI Trusted Publishing: no long-lived token is
involved, and the attestation is visible on the PyPI page of each file.

The same artifacts are attached below, together with their CycloneDX Software
Bill of Materials, and are covered by a SLSA build provenance attestation:

gh attestation verify <downloaded file> --repo tcalmant/python-javaobj
git tag -v 0.6.0

What's Changed

• fix path to tests by @eighthave in #57
• Project overhaul by @tcalmant in #58 and #59
• fix: Custom reader should read till endblock by @svaningelgem in #61
• Addition of new v3 implementation (read+write) by @tcalmant in #63 and #64
• Bug fixes by @tcalmant in #65

New Contributors

• @eighthave made their first contribution in #57
• @svaningelgem made their first contribution in #61

Full Changelog: 0.4.4...0.5.0

• @madaaraisok : Added support for java.lang.Class arrays (#48)
• @ElDavoo : Fixed marshalling of JavaByteArrays (#53)
• Tests ran with pytest manually on Python 2.7, 3.6-3.12

Full Changelog: 0.4.3...0.4.4

• Added support for TC_NULL as array sub-type in _read_field_value (see #46, thanks to @photoniker)
• javaobj can now read GZipped files directly (trick done in load(), which is also the underlying method used by loads())
• Fixed a type issue in BlockData/str content comparison

• NumPy is now loaded lately, only if the use of numpy arrays is expected.
  This allows the calling modules to load and configure numpy beforehand.
  Contribution from @sarimak

• Added the custom transformer contributed by @UruDev, allowing a finer loading of custom Java streams

Small fix on metadata:

• setup.py has been fixed, to include the requirements for Python < 3.4
• Added a manifest.in to include README, LICENSE and AUTHORS in distribution.

• Added a new implementation of the parser, based on the code of jdeserialize.
  It is provided by the javaobj.v2 package.
  It can parse more cases than the previous implementation and provides a new API for the object transformers.
  This implementation doesn't support writing serialized objects.
• Moved the old implementation to the javaobj.v1 package.
  The import from javaobj redirect to the v1 package.

• Added support for custom post-loading operations on JavaObject returned by the DefaultObjectTransformer
  (if the returned object implements an __extra_loading__(self, unmarshaller, ident=0) method)
• Added support for primitive classes (Boolean, Integer, Long), thanks to @qistoph (#27)
• Added support for HashSet, LinkedHashSet and TreeSet (#25)
• Added support for java.time types (#15)
• Better handling of unicode strings (#26): all loaded java.lang.String objects are now unicode
• Added support for Java's modified UTFG-8, thanks to @guywithface (#24)
• Fixed handling of char arrays (see #16 and PR #21 by @moriyoshi)