You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@freemarker.apache.org by Daniel Dekany <dd...@apache.org> on 2026/06/12 09:44:40 UTC

Removal of freemarker.debug package

We plan to remove the freemarker.debug package in the next release
(2.3.35), because it uses RMI (a legacy Java remote method call protocol),
which is for a while seen as a security concern. While this feature is not
active by default (you had to start a debugger client, and a debugger
server explicitly), the mere presence of these classes is flagged at some
places.

I believe practically nobody uses the debugger feature, that's why even
though it breaks backward compatibility, I guess it's an OK compromise to
do this now. But I wanted to communicate this, just in case someone has
problems with this, or needs to prepare for this.