The new KMS-based approach can use a key derivation function that is orders of magnitudes
   cheaper w.r.t. memory and CPU.
- Root credentials can now be changed easily. Before, a two-step process was required to
   change the cluster root credentials since they were used to en/decrypt the IAM data.
   So, both - the old and new credentials - had to be present at the same time during a rotation

   * safe range. If {@code safeMax < safeMin} then no code points are considered safe.
   *
   * <p>If a code point has no mapped replacement then it is checked against the safe range. If it
   * lies outside that, then {@link #escapeUnsafe} is called, otherwise no escaping is performed.
   *
   * @param replacementMap a map of characters to their escaped representations

sftp>
```

## Advanced options

### Change default FTP port

Default port '8021' can be changed via

```
--ftp="address=:3021"
```

### Change FTP passive port range

By default FTP requests OS to give a free port automatically, however you may want to restrict

    /**
     * Function code to transceive data on a named pipe
     */
    public static final int FSCTL_PIPE_TRANSCEIVE = 0x0011C017;
    /**
     * Function code for server-side copy chunk operation
     */
    public static final int FSCTL_SRV_COPYCHUNK = 0x001440F2;
    /**
     * Function code to enumerate volume shadow copy snapshots
     */

  private volatile @Nullable Logger logger;

  LazyLogger(Class<?> ownerOfLogger) {
    this.loggerName = ownerOfLogger.getName();
  }

  Logger get() {
    /*
     * We use double-checked locking. We could the try racy single-check idiom, but that would
     * depend on Logger to not contain mutable state.
     *
     * We could use Suppliers.memoizingSupplier here, but I micro-optimized to this implementation

}
```

### 3.2 Witness Event Types
```java
public enum WitnessEventType {
    RESOURCE_CHANGE(1),        // Resource state changed
    CLIENT_MOVE(2),           // Client should move to different node
    SHARE_MOVE(3),            // Share moved to different node
    IP_CHANGE(4),             // IP address changed
    SHARE_DELETE(5),          // Share deleted
    NODE_UNAVAILABLE(6),      // Cluster node unavailable

      } catch (Exception e) { // sneaky checked exception
        if (exception == null) {
          exception = e;
        } else {
          exception.addSuppressed(e);
        }
      }
    }
    if (exception != null) {
      // Normally this is a RuntimeException that doesn't need sneakyThrow.
      // But theoretically we could see sneaky checked exception
      sneakyThrow(exception);
    }
  }

            .log(
                SEVERE,
                String.format(Locale.ROOT, "Caught an exception in %s.  Shutting down.", t),
                e);
      } catch (Throwable errorInLogging) { // sneaky checked exception
        // If logging fails, e.g. due to missing memory, at least try to log the
        // message and the cause for the failed logging.
        System.err.println(e.getMessage());

  static {
    AtomicHelper helper;
    Throwable thrownReflectionFailure = null;
    try {
      helper = new SafeAtomicHelper();
    } catch (Throwable reflectionFailure) { // sneaky checked exception
      // Some Android 5.0.x Samsung devices have bugs in JDK reflection APIs that cause
      // getDeclaredField to throw a NoSuchFieldException when the field is definitely there.

   * Returns the node that is adjacent to {@code node} along the origin edge.
   *
   * @throws IllegalArgumentException if this {@link EndpointPair} does not contain {@code node}
   * @since 20.0 (but the argument type was changed from {@code Object} to {@code N} in 31.0)
   */
  public final N adjacentNode(N node) {
    if (node.equals(nodeU)) {
      return nodeV;
    } else if (node.equals(nodeV)) {
      return nodeU;
    } else {