Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package tomcat11 for openSUSE:Factory checked in at 2026-07-28 18:18:04 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/tomcat11 (Old) and /work/SRC/openSUSE:Factory/.tomcat11.new.2004 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "tomcat11" Tue Jul 28 18:18:04 2026 rev:14 rq:1368164 version:11.0.24 Changes: -------- --- /work/SRC/openSUSE:Factory/tomcat11/tomcat11.changes 2026-07-06 12:36:16.435627275 +0200 +++ /work/SRC/openSUSE:Factory/.tomcat11.new.2004/tomcat11.changes 2026-07-28 18:20:17.131511432 +0200 @@ -1,0 +2,62 @@ +Thu Jul 23 15:24:08 UTC 2026 - mbussolotto <[email protected]> + +- Update to Tomcat 11.0.24 + * adapt tomcat-jdt.patch + * Fixed CVEs: + + CVE-2026-59084: The requirements to secuely configure the + EncryptInterceptor were not clearly documented. (bsc#1271398) + + CVE-2026-59083: Incorrect decoding of + in rewritten URIs to a single + space could allow security control bypass for some configurations. + (bsc#1271397) + * Catalina + + Fix: Avoid a race condition with concurrent lookups for a singleton JNDI + resource. (markt) + + Fix: Improve the performance of range validation for the default + servlet. (markt) + + Fix: Avoid NPE in RewriteValve. (markt) + + Fix: 70127: Fix use of Bootstrap through reflection by restoring the + public constructor. Use through scripts was not affected. (remm) + + Fix: Restore ability to extend many element classes from + AbstractAccessLogValve. (remm) + + Fix: Align DIGEST authentication with RFC 7616 and require clients to + provide a valid qop parameter. (markt) + + Fix: Use Files API to create temporary docBase when antiLockingDocBase + is enabled. (markt) + + Fix: Improve validation of configuration when DataSourceRealm starts. + (remm) + + Fix: JAASRealm should do a logout if login does not fail outright but + does not produce a Principal. (remm) + + Fix: Various edge cases for SSI substitutions, quoting and escaping. + (remm) + + Fix: unintentional conversion of literal + to a space during rule + processing in the RewriteValve. (markt) + * Coyote + + Fix: Avoid a potential JVM crash if a suitable version of Tomcat Native + is not available when the connector is explicitly configured to use + Tomcat Native with OpenSSL for TLS. (markt) + * Jasper + + Fix: 70120: The fix for 69399 (itself a fix for a regression in the fix + for 69333) was incomplete and tags that threw exceptions in doStartTag() + and doEndTag() were incorrectly re-used. This fix prevents tags from + being re-used if such an exception occurs. (markt) + + Add: support for specifying Java 28 (with the value 28) as the compiler + source and/or compiler target for JSP compilation. If used with an + Eclipse JDT compiler version that does not support these values, a + warning will be logged and the default will be used. (markt) + * WebSocket + + Fix: 70126: Fix WebSocket extension permessage-deflate so that it does + not drop bytes if a compressed message inflates to more than the + available buffer. Fix written by GPT-5.5. Test case written by Hironori + Ichimiya. (markt) + + Fix: Optimise WebSocket client processing of server responses during + WebSocket HTTP upgrade process. (markt) + * Other + + Update: to the Eclipse JDT compiler 4.40. (markt) + + Update: Byte Buddy to 1.18.9. (markt) + + Update: UnboundID to 7.0.5. (markt) + + Update: JaCoCo to 0.8.15. (markt) + + Update: BND to 7.3.0. (markt) + + Add: Improvements to French translations. (remm) + + Add: Improvements to Japanese translations provided by tak7iji. (markt) + +------------------------------------------------------------------- Old: ---- apache-tomcat-11.0.23-src.tar.gz apache-tomcat-11.0.23-src.tar.gz.asc New: ---- apache-tomcat-11.0.24-src.tar.gz apache-tomcat-11.0.24-src.tar.gz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ tomcat11.spec ++++++ --- /var/tmp/diff_new_pack.JefVtM/_old 2026-07-28 18:20:18.495559028 +0200 +++ /var/tmp/diff_new_pack.JefVtM/_new 2026-07-28 18:20:18.495559028 +0200 @@ -29,7 +29,7 @@ %define elspec %{elspec_major}.%{elspec_minor} %define major_version 11 %define minor_version 0 -%define micro_version 23 +%define micro_version 24 %define java_major 1 %define java_minor 17 %define java_version %{java_major}.%{java_minor} ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.JefVtM/_old 2026-07-28 18:20:18.559561262 +0200 +++ /var/tmp/diff_new_pack.JefVtM/_new 2026-07-28 18:20:18.563561402 +0200 @@ -1,6 +1,6 @@ -mtime: 1783077737 -commit: bbd15387b04146f3ee0763d72af7fe292e066b50a001b71753373c5da1d55f3e +mtime: 1785225302 +commit: 1876b45e7cc14e3ac043c9fba69d6bbb610c581515b5fbb2b09590559f9c434f url: https://src.opensuse.org/java-packages/tomcat11 -revision: bbd15387b04146f3ee0763d72af7fe292e066b50a001b71753373c5da1d55f3e +revision: 1876b45e7cc14e3ac043c9fba69d6bbb610c581515b5fbb2b09590559f9c434f projectscmsync: https://src.opensuse.org/java-packages/_ObsPrj ++++++ apache-tomcat-11.0.23-src.tar.gz -> apache-tomcat-11.0.24-src.tar.gz ++++++ /work/SRC/openSUSE:Factory/tomcat11/apache-tomcat-11.0.23-src.tar.gz /work/SRC/openSUSE:Factory/.tomcat11.new.2004/apache-tomcat-11.0.24-src.tar.gz differ: char 98, line 1 ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-07-28 09:55:02.000000000 +0200 @@ -0,0 +1 @@ +.osc ++++++ tomcat-jdt.patch ++++++ --- /var/tmp/diff_new_pack.JefVtM/_old 2026-07-28 18:20:18.875572288 +0200 +++ /var/tmp/diff_new_pack.JefVtM/_new 2026-07-28 18:20:18.887572707 +0200 @@ -1,6 +1,6 @@ ---- apache-tomcat-11.0.18-src.orig/java/org/apache/jasper/compiler/JDTCompiler.java 2026-03-06 20:07:11.876514348 +0100 -+++ apache-tomcat-11.0.18-src/java/org/apache/jasper/compiler/JDTCompiler.java 2026-03-06 20:12:04.110579179 +0100 -@@ -316,25 +316,25 @@ +--- apache-tomcat-11.0.24-src.orig/java/org/apache/jasper/compiler/JDTCompiler.java 2026-07-03 09:01:34.000000000 +0200 ++++ apache-tomcat-11.0.24-src/java/org/apache/jasper/compiler/JDTCompiler.java 2026-07-27 15:58:33.000000000 +0200 +@@ -323,27 +323,27 @@ } else if (opt.equals("15")) { settings.put(CompilerOptions.OPTION_Source, CompilerOptions.VERSION_15); } else if (opt.equals("16")) { @@ -34,10 +34,13 @@ - settings.put(CompilerOptions.OPTION_Source, CompilerOptions.VERSION_25); + settings.put(CompilerOptions.OPTION_Source, "25"); } else if (opt.equals("26")) { +- settings.put(CompilerOptions.OPTION_Source, CompilerOptions.VERSION_26); ++ settings.put(CompilerOptions.OPTION_Source, "26"); + } else if (opt.equals("27")) { // Constant not available in latest ECJ version shipped with // Tomcat. May be supported in a snapshot build. -@@ -347,11 +347,11 @@ - settings.put(CompilerOptions.OPTION_Source, "27"); +@@ -356,11 +356,11 @@ + settings.put(CompilerOptions.OPTION_Source, "28"); } else { log.warn(Localizer.getMessage("jsp.warning.unknown.sourceVM", opt)); - settings.put(CompilerOptions.OPTION_Source, CompilerOptions.VERSION_17); @@ -50,7 +53,7 @@ } // Target JVM -@@ -401,35 +401,35 @@ +@@ -410,38 +410,38 @@ settings.put(CompilerOptions.OPTION_TargetPlatform, CompilerOptions.VERSION_15); settings.put(CompilerOptions.OPTION_Compliance, CompilerOptions.VERSION_15); } else if (opt.equals("16")) { @@ -104,10 +107,15 @@ + settings.put(CompilerOptions.OPTION_TargetPlatform, "25"); + settings.put(CompilerOptions.OPTION_Compliance, "25"); } else if (opt.equals("26")) { +- settings.put(CompilerOptions.OPTION_TargetPlatform, CompilerOptions.VERSION_26); +- settings.put(CompilerOptions.OPTION_Compliance, CompilerOptions.VERSION_26); ++ settings.put(CompilerOptions.OPTION_TargetPlatform, "26"); ++ settings.put(CompilerOptions.OPTION_Compliance, "26"); + } else if (opt.equals("27")) { // Constant not available in latest ECJ version shipped with // Tomcat. May be supported in a snapshot build. -@@ -444,12 +444,12 @@ - settings.put(CompilerOptions.OPTION_Compliance, "27"); +@@ -456,12 +456,12 @@ + settings.put(CompilerOptions.OPTION_Compliance, "28"); } else { log.warn(Localizer.getMessage("jsp.warning.unknown.targetVM", opt)); - settings.put(CompilerOptions.OPTION_TargetPlatform, CompilerOptions.VERSION_17);
