High-Performance IBAN processing:
iban-commons

Allocation-Free Validation Path

IbanValidationResult now caches one singleton per IbanValidationError constant at class-load time. Failed validations on the hot path no longer allocate. Iban.toFormattedString() caches its result in a transient volatile field

Cleaner validate() API

New allocation-free Iban.validate() and Bic.validate() methods throw on invalid input without constructing an instance — ideal for strict input guards.

Internal Refactoring & Correctness

Objects.hash() replaced with the classic Bloch prime-accumulation pattern. IbanRegistry.ALL_COUNTRIES is now a shared, alphabetically pre-sorted array. PMD upgraded to 7.24.0, pitest-maven to 1.23.1.

Invalid IBAN Generator

New utilities for generating structurally invalid IBAN strings with controlled sabotage strategies — invaliding check digits, corrupting BBAN segments, and mutating country codes. Purpose-built for negative test suites and fuzz harnesses.

Error-Prone Integration

The build now integrates Error‑Prone with error‑prone‑support, catching bug patterns at compile time that unit tests alone cannot surface. Even stronger code quality enforcement is part of every build, not just CI.

Dedicated JUnit Extensions Module

JUnit 5 extensions (enhanced IBAN and BIC assertions, parameterized test support) have been extracted into a standalone iban-commons-junit sub-module. Test infrastructure is now decoupled from the core library — include it only where needed.

Near-Zero Allocation

The entire internal validation pipeline has been migrated from CharSequence to char[] across all country validators and the NationalCheckDigitCalculator SPI. This eliminates virtual dispatch on charAt() and allows the JIT to apply scalar replacement, reducing measured heap allocation to effectively zero (< 0.001 B/op). Backward compatibility is preserved.

Expanded Public API

Bic, IbanRegistry, RandomBic, and the Formatter type are now part of the stable public API. The RandomIban factory methods have been replaced by a fluent builder for more explicit and composable generation.

• RandomIban.builder()   .country("DE").build()
• RandomIban.builder()   .sepaOnly().random(rng).build()

Immutable IbanConfig

IbanConfig has been redesigned from a mutable enum to an immutable class using the freeze pattern. Configuration is locked at startup via IbanConfig.freeze(); concurrent reads thereafter require no synchronization and mutation is permanently blocked.

Country-Agnostic Random IBANs

Two new factory methods on RandomIban generate valid IBANs without requiring a specific country:

• RandomIban.of() — any supported country
• RandomIban.ofSepa() — SEPA countries only

Iso3166Alpha2 Enum & BIC Validation

A new Iso3166Alpha2 enum provides a type-safe representation of all registered ISO 3166 Alpha-2 country codes. BIC country code validation is now backed by this enum, eliminating string-based lookups and tightening correctness guarantees at compile time.

Reduced Bic Memory Footprint

The internal Bic representation has been slimmed down by removing a redundant char[] field and eliminating eager computation of the padded BIC-11 form. Both are now derived on demand, reducing per-instance heap allocation with no change to the public API.

Serialization Security

Iban and Bic now use the Serialization Proxy Pattern (Memento). Byte-stream injection attacks are blocked: deserialization always re-validates through the full ISO 7064 Mod 97-10 pipeline. Direct deserialization of raw instances throws InvalidObjectException.

Android Compatibility

New null-returning alternatives avoid java.time.YearMonth (requires API 26+):

• IbanRegistry.getLastUpdateYear()
• IbanRegistry.getLastUpdateMonth()

Feature Parity

All remaining gaps vs. alternative libraries are now closed. iban-commons leads on country coverage (120 vs. 111), BIC support, rich metadata, random IBAN generation, and validation error detail — now also matching on serialization hardening and Android-friendly API.