Release Note: URL Constructors Called with Malformed Input May Throw MalformedURLException for Cases where It Was Not Thrown Previously

The parsing of input provided to the `java.net.URL` constructors has changed in this release to be more strict. If the URL constructors are called with malformed input, then `MalformedURLException` may be thrown for cases where it wasn’t thrown previously.

In previous releases, some of the parsing and validation performed by the JDK built-in `URLStreamHander` implementations was delayed until `URL::openConnection` or `URLConnection::connect` was called. Some of these parsing and validation actions are now performed early, within URL constructors. An exception caused by a malformed URL that would have been delayed until the connection was opened or connected might now cause a `MalformedURLException` to be thrown at URL construction time.

This change only affects URL instances that delegate to JDK built-in stream handler implementations. Applications relying on custom, third party `URLStreamHandler` implementations should remain unaffected.

A new JDK specific system property `-Djdk.net.url.delayParsing` or `-Djdk.net.url.delayParsing=true` can be specified on the command line to revert to the previous behavior. By default, the property is not set, and the new behavior is in place.

This new property is provided for backward compatibility and may be removed in a future release.