Did you look at it? Half of it is test and license headers plus the fix involves adding a whitelisting and filtering code.
Yes, that is exactly the part that concerns me. This doesn't need more code, it needs desperately less.
I’m with you, but if you’re maintaining a massively popular open source library, where backwards compatibility is expected, you’re not going to remove features without careful consideration. For an important bug fix, it probably does make more sense to just fix it without breaking anything first, then talk about a more careful deprecation/removal plan.
"Filtering code"? This sounds like trying to plug hole in dam with one's finger. And the the hole is several meters wide.
This is Java.
(I'm not surprised. I worked with Enterprise Java briefly, many years ago. Verbosity and redundancy is a deeply ingrained cultural thing.)
It's not. Backwards compatibility however is which is why the fix maintains the functionality but makes it as safe as possible rather than ripping it out.