dev  

Messages by Date

• 2026/09/30 (tomcat) 01/02: Update to the Eclipse JDT compiler 4.41 markt
• 2026/09/30 (tomcat) branch 11.0.x updated (f386b930f1 -> 04acaa8e32) markt
• 2026/09/30 (tomcat) branch main updated: Update NSIS to 3.13 markt
• 2026/09/30 (tomcat) branch main updated: Update to the Eclipse JDT compiler 4.41 markt
• 2026/09/30 [Bug 70251] New: CloseableURLConnection closes shared Jar file bugzilla
• 2026/09/30 (tomcat) branch 11.0.x updated: Treat close() the same was as shutdown() markt
• 2026/09/30 (tomcat) branch main updated: Treat close() the same was as shutdown() markt
• 2026/09/30 (tomcat) branch 9.0.x updated: Rename tests to match standard naming convention. markt
• 2026/09/30 (tomcat) branch 11.0.x updated: Rename tests to match standard naming convention. markt
• 2026/09/30 (tomcat) branch main updated: Rename tests to match standard naming convention. markt
• 2026/09/30 (tomcat) branch 10.1.x updated: Rename tests to match standard naming convention. markt
• 2026/09/30 (tomcat) branch 9.0.x updated: Explicitly state virtual host and SNI matching are separate markt
• 2026/09/30 (tomcat) 01/10: Add the missing standardService.connector.startFailed and standardService.connector.stopFailed localization keys so connector start and stop failures produce readable messages rather than the raw key remm
• 2026/09/30 (tomcat) branch 11.0.x updated: Explicitly state virtual host and SNI matching are separate markt
• 2026/09/30 (tomcat) branch main updated: Follow-up to 87ed9d47 markt
• 2026/09/30 (tomcat) branch 9.0.x updated (2fb3864f0e -> 006099e16a) markt
• 2026/09/30 (tomcat) 07/08: Make FrameworkListener registration idempotent so repeated Server start events do not add duplicate container listeners or orphan previous per-context lifecycle listeners that can no longer be removed remm
• 2026/09/30 (tomcat) 07/10: Walk the class hierarchy in NamingResourcesImpl getSetterType() and getFieldType() so that injection targets resolving to inherited fields or setters are no longer rejected at deployment, matching the behaviour of the runtime injection engine remm
• 2026/09/30 (tomcat) 10/10: Merge branch 'main' of [email protected]:apache/tomcat.git into main remm
• 2026/09/30 (tomcat) 06/10: Retain an existing resource link in NamingResourcesImpl.addEnvironment() when the link's global target is not an overridable global environment rather than adding an environment entry with the same name which would create a duplicate JNDI binding remm
• 2026/09/30 Re: (tomcat) branch main updated: Follow-up to 09c0caced9 Rémy Maucherat
• 2026/09/30 (tomcat) 05/07: Initialize the ServerAuthModule before caching the SingleModuleServerAuthContext so a failed initialization is not cached permanently and can be re-attempted on next use remm
• 2026/09/30 (tomcat) 04/04: Merge branch '10.1.x' of [email protected]:apache/tomcat.git into 10.1.x remm
• 2026/09/30 (tomcat) branch 9.0.x updated: Follow-up to 87ed9d47 markt
• 2026/09/30 (tomcat) branch main updated: Follow-up to 34315ac0 markt
• 2026/09/30 (tomcat) 07/08: Use the atomic add() of the shared entries set as the name claim in all NamingResourcesImpl add*() methods to close the check-then-act race which could allow two descriptors with the same JNDI name to both be registered remm
• 2026/09/30 (tomcat) 05/07: Initialize the ServerAuthModule before caching the SingleModuleServerAuthContext so a failed initialization is not cached permanently and can be re-attempted on next use remm
• 2026/09/30 (tomcat) branch 9.0.x updated: Partial revert of 6fd26942 markt
• 2026/09/30 (tomcat) branch 10.1.x updated: Fix CharChunk.indexOf(char) for chunks with a non-zero start markt
• 2026/09/30 (tomcat) 07/08: Use the atomic add() of the shared entries set as the name claim in all NamingResourcesImpl add*() methods to close the check-then-act race which could allow two descriptors with the same JNDI name to both be registered remm
• 2026/09/30 (tomcat) branch 10.1.x updated (792859bdb8 -> bd356f1714) remm
• 2026/09/30 (tomcat) branch 10.1.x updated: Partial revert of 99d1d567 markt
• 2026/09/30 (tomcat) 05/06: Update the JASPIC client Subject only when password validation succeeded (or was not requested), failing closed rather than adding a principal derived from untrusted caller-supplied data when validation failed remm
• 2026/09/30 (tomcat) branch 10.1.x updated: Fix IDE resource leak warnings markt
• 2026/09/30 (tomcat) 03/04: Merge branch '10.1.x' of [email protected]:apache/tomcat.git into 10.1.x remm
• 2026/09/30 (tomcat) branch 9.0.x updated: Fix IDE resource leak warnings markt
• 2026/09/30 (tomcat) branch 11.0.x updated: Fix IDE resource leak warnings markt
• 2026/09/30 (tomcat) branch main updated: Fix IDE resource leak warnings markt
• 2026/09/30 (tomcat) 10/10: Merge branch '11.0.x' of [email protected]:apache/tomcat.git into 11.0.x remm
• 2026/09/30 Re: [PR] Fix CharChunk.indexOf(char) for chunks with a non-zero start [tomcat] via GitHub
• 2026/09/30 (tomcat) 03/07: Return 0 rather than -1 for zero-length reads from InputBuffer at end of stream, as required by the InputStream/Reader contract, and avoid the unnecessary blocking fill these requests previously triggered remm
• 2026/09/30 (tomcat) branch 10.1.x updated: Route JspC context logging through Ant markt
• 2026/09/30 (tomcat) branch 9.0.x updated: Route JspC context logging through Ant markt
• 2026/09/30 (tomcat) branch 11.0.x updated: Route JspC context logging through Ant markt
• 2026/09/30 (tomcat) branch 10.1.x updated (ce5f2588a8 -> ae6ad90929) remm
• 2026/09/30 Re: [PR] Route JspC context logging through Ant [tomcat] via GitHub
• 2026/09/30 (tomcat) branch main updated: Route JspC context logging through Ant markt
• 2026/09/30 Re: [PR] Fix Map.Entry contract for CaseInsensitiveKeyMap entries [tomcat] via GitHub
• 2026/09/30 (tomcat) branch 9.0.x updated: Fix CharChunk.indexOf(char) for chunks with a non-zero start markt
• 2026/09/30 (tomcat) branch 11.0.x updated: Fix CharChunk.indexOf(char) for chunks with a non-zero start markt
• 2026/09/30 (tomcat) branch main updated: Fix CharChunk.indexOf(char) for chunks with a non-zero start markt
• 2026/09/30 (tomcat) branch 9.0.x updated: Partial revert of 99d1d567 markt
• 2026/09/30 (tomcat) branch main updated: Skip test on MacOS remm
• 2026/09/30 (tomcat) branch 10.1.x updated: Remove unnecessary cast markt
• 2026/09/30 (tomcat) branch 10.1.x updated: Follow-up to ba91d79a markt
• 2026/09/30 (tomcat) branch 9.0.x updated: Follow-up to ba91d79a markt
• 2026/09/30 (tomcat) branch 11.0.x updated: Follow-up to ba91d79a markt
• 2026/09/30 (tomcat) branch main updated: Follow-up to ba91d79a markt
• 2026/09/30 (tomcat) 03/10: Delegate awaitTermination() in StandardThreadExecutor and StandardVirtualThreadExecutor to the wrapped executor rather than unconditionally returning false which violates the ExecutorService contract remm
• 2026/09/30 (tomcat) branch 11.0.x updated: Follow-up to 34315ac0 markt
• 2026/09/30 (tomcat) 01/08: Delegate awaitTermination() in StandardThreadExecutor and StandardVirtualThreadExecutor to the wrapped executor rather than unconditionally returning false which violates the ExecutorService contract remm
• 2026/09/30 (tomcat) 03/08: Validate the incoming entry at the start of NamingResourcesImpl.addEnvironment() so that an entry which is ignored or rejected cannot first destroy the existing environment entry or resource link with the same name remm
• 2026/09/30 (tomcat) 08/08: Fix return statement remm
• 2026/09/30 (tomcat) 06/08: Only release the shared naming entry name in NamingResourcesImpl remove*() methods when the type-specific map actually held the entry, preventing the removal of the JNDI name reservation of a differently typed descriptor with the same name remm
• 2026/09/30 (tomcat) 04/08: Retain an existing resource link in NamingResourcesImpl.addEnvironment() when the link's global target is not an overridable global environment rather than adding an environment entry with the same name which would create a duplicate JNDI binding remm
• 2026/09/30 (tomcat) branch 9.0.x updated (1e8b11fd73 -> 6080ad30f1) remm
• 2026/09/30 (tomcat) 05/08: Merge branch '10.1.x' of [email protected]:apache/tomcat.git into 10.1.x remm
• 2026/09/30 (tomcat) 02/08: Synchronise the check and assignment of the servlet instance in getServletMethods() to prevent a race which could result in a second, never initialised instance being retained by the wrapper remm
• 2026/09/30 (tomcat) branch 11.0.x updated: Partial revert of 99d1d567 markt
• 2026/09/30 (tomcat) branch main updated: Partial revert of 99d1d567 markt
• 2026/09/30 (tomcat) 04/08: Retain an existing resource link in NamingResourcesImpl.addEnvironment() when the link's global target is not an overridable global environment rather than adding an environment entry with the same name which would create a duplicate JNDI binding remm
• 2026/09/30 (tomcat) 02/08: Synchronise the check and assignment of the servlet instance in getServletMethods() to prevent a race which could result in a second, never initialised instance being retained by the wrapper remm
• 2026/09/30 (tomcat) 03/08: Validate the incoming entry at the start of NamingResourcesImpl.addEnvironment() so that an entry which is ignored or rejected cannot first destroy the existing environment entry or resource link with the same name remm
• 2026/09/30 (tomcat) 05/08: Merge branch '10.1.x' of [email protected]:apache/tomcat.git into 10.1.x remm
• 2026/09/30 (tomcat) 01/08: Delegate awaitTermination() in StandardThreadExecutor and StandardVirtualThreadExecutor to the wrapped executor rather than unconditionally returning false which violates the ExecutorService contract remm
• 2026/09/30 (tomcat) 08/08: Fix return statement remm
• 2026/09/30 (tomcat) 06/08: Only release the shared naming entry name in NamingResourcesImpl remove*() methods when the type-specific map actually held the entry, preventing the removal of the JNDI name reservation of a differently typed descriptor with the same name remm
• 2026/09/30 (tomcat) 01/04: Add the missing standardService.connector.startFailed and standardService.connector.stopFailed localization keys so connector start and stop failures produce readable messages rather than the raw key remm
• 2026/09/30 (tomcat) branch 10.1.x updated (f1dca9e463 -> 792859bdb8) remm
• 2026/09/30 (tomcat) 02/04: Synchronize access to the StandardHost childClassLoaders map which is written by context start threads and read by findReloadedContextMemoryLeaks() from Manager/JMX threads, preventing concurrent modification of the underlying WeakHashMap during iteration remm
• 2026/09/30 (tomcat) branch 10.1.x updated: Partial revert of 6fd26942 markt
• 2026/09/30 (tomcat) branch 11.0.x updated: Partial revert of 6fd26942 markt
• 2026/09/30 (tomcat) branch main updated: Partial revert of 6fd26942 markt
• 2026/09/30 (tomcat) 04/10: Synchronise the check and assignment of the servlet instance in getServletMethods() to prevent a race which could result in a second, never initialised instance being retained by the wrapper remm
• 2026/09/30 (tomcat) 08/10: Only release the shared naming entry name in NamingResourcesImpl remove*() methods when the type-specific map actually held the entry, preventing the removal of the JNDI name reservation of a differently typed descriptor with the same name remm
• 2026/09/30 (tomcat) branch 11.0.x updated (a0733659dc -> 8119db0676) remm
• 2026/09/30 (tomcat) 03/10: Delegate awaitTermination() in StandardThreadExecutor and StandardVirtualThreadExecutor to the wrapped executor rather than unconditionally returning false which violates the ExecutorService contract remm
• 2026/09/30 (tomcat) branch 9.0.x updated: Remove unnecessary cast markt
• 2026/09/30 (tomcat) branch main updated: Remove unnecessary cast markt
• 2026/09/30 (tomcat) 01/10: Add the missing standardService.connector.startFailed and standardService.connector.stopFailed localization keys so connector start and stop failures produce readable messages rather than the raw key remm
• 2026/09/30 (tomcat) 06/10: Retain an existing resource link in NamingResourcesImpl.addEnvironment() when the link's global target is not an overridable global environment rather than adding an environment entry with the same name which would create a duplicate JNDI binding remm
• 2026/09/30 (tomcat) 09/10: Use the atomic add() of the shared entries set as the name claim in all NamingResourcesImpl add*() methods to close the check-then-act race which could allow two descriptors with the same JNDI name to both be registered remm
• 2026/09/30 (tomcat) 02/10: Synchronise access to the StandardHost childClassLoaders map which is written by context start threads and read by findReloadedContextMemoryLeaks() from Manager/JMX threads, preventing concurrent modification of the underlying WeakHashMap during iteration remm
• 2026/09/30 (tomcat) 07/10: Walk the class hierarchy in NamingResourcesImpl getSetterType() and getFieldType() so that injection targets resolving to inherited fields or setters are no longer rejected at deployment, matching the behaviour of the runtime injection engine remm
• 2026/09/30 (tomcat) 05/10: Validate the incoming entry at the start of NamingResourcesImpl.addEnvironment() so that an entry which is ignored or rejected cannot first destroy the existing environment entry or resource link with the same name remm
• 2026/09/30 (tomcat) branch 11.0.x updated: Remove unnecessary cast markt
• 2026/09/30 Re: (tomcat) branch 9.0.x updated: Partial revert of c817143f and a further correction Rémy Maucherat
• 2026/09/30 October release timeline Mark Thomas
• 2026/09/30 (tomcat) branch 10.1.x updated: Partial revert of c817143f and a further correction markt
• 2026/09/30 (tomcat) branch main updated: Partial revert of c817143f and a further correction markt
• 2026/09/30 (tomcat) branch 11.0.x updated: Partial revert of c817143f and a further correction markt
• 2026/09/30 (tomcat) 02/10: Synchronise access to the StandardHost childClassLoaders map which is written by context start threads and read by findReloadedContextMemoryLeaks() from Manager/JMX threads, preventing concurrent modification of the underlying WeakHashMap during iteration remm
• 2026/09/30 (tomcat) branch 9.0.x updated: Partial revert of c817143f and a further correction markt
• 2026/09/30 (tomcat) 08/10: Only release the shared naming entry name in NamingResourcesImpl remove*() methods when the type-specific map actually held the entry, preventing the removal of the JNDI name reservation of a differently typed descriptor with the same name remm
• 2026/09/30 (tomcat) branch main updated (1c6560001f -> 4f1ec70d54) remm
• 2026/09/30 (tomcat) 09/10: Use the atomic add() of the shared entries set as the name claim in all NamingResourcesImpl add*() methods to close the check-then-act race which could allow two descriptors with the same JNDI name to both be registered remm
• 2026/09/30 (tomcat) 05/10: Validate the incoming entry at the start of NamingResourcesImpl.addEnvironment() so that an entry which is ignored or rejected cannot first destroy the existing environment entry or resource link with the same name remm
• 2026/09/30 (tomcat) 04/10: Synchronise the check and assignment of the servlet instance in getServletMethods() to prevent a race which could result in a second, never initialised instance being retained by the wrapper remm
• 2026/09/30 (tomcat) branch 10.1.x updated: Follow-up to 87ed9d47 markt
• 2026/09/30 (tomcat) branch 11.0.x updated: Follow-up to 87ed9d47 markt
• 2026/09/30 (tomcat) 07/07: Store the JASPIC isMandatory MessageInfo property as a Boolean as the specification requires rather than a String, and throw IllegalArgumentException rather than NullPointerException when null is passed to the MessageInfoImpl request/response message setters remm
• 2026/09/30 (tomcat) branch 10.1.x updated: Follow-up to 34315ac0 markt
• 2026/09/30 (tomcat) branch 9.0.x updated: Follow-up to 34315ac0 markt
• 2026/09/30 (tomcat) branch main updated: Follow-up to 4127ca5f markt
• 2026/09/30 (tomcat) branch main updated (85daf45655 -> 4d142cc729) remm
• 2026/09/30 (tomcat) branch 11.0.x updated: Follow-up to 4127ca5f markt
• 2026/09/30 (tomcat) 01/02: Follow-on to 1141d547 markt
• 2026/09/30 (tomcat) 02/02: Follow-up to 4127ca5f markt
• 2026/09/30 (tomcat) branch 10.1.x updated: Follow-up to 4127ca5f markt
• 2026/09/30 (tomcat) 01/07: Fix InputBuffer.skip() consuming and returning more characters than requested by comparing and advancing by the remaining count (n - nRead) rather than the original count, and add a regression test remm
• 2026/09/30 (tomcat) 08/08: jakarta -> javax and fix test remm
• 2026/09/30 (tomcat) 03/08: Return 0 rather than -1 for zero-length reads from InputBuffer at end of stream, as required by the InputStream/Reader contract, and avoid the unnecessary blocking fill these requests previously triggered remm
• 2026/09/30 (tomcat) 04/08: Return a snapshot enumeration from Request.getLocales() to prevent ConcurrentModificationExceptions when the locales list is modified while a previously returned enumeration is being iterated remm
• 2026/09/30 (tomcat) branch 10.1.x updated: Fix registration test remm
• 2026/09/30 (tomcat) 07/08: Make FrameworkListener registration idempotent so repeated Server start events do not add duplicate container listeners or orphan previous per-context lifecycle listeners that can no longer be removed remm
• 2026/09/30 (tomcat) 06/08: Fall back to the raw trimmed filename value in ApplicationPart.getSubmittedFileName() when HttpParser.unquote() rejects an invalid quoted-string, keeping the result consistent with the file-vs-field classification performed by FileUploadBase.getFileName() for malformed Content-Disposition headers remm
• 2026/09/30 (tomcat) branch 9.0.x updated (6da20f64db -> 2fb3864f0e) remm
• 2026/09/30 (tomcat) 05/08: Add spec-mandated validation to ApplicationServletRegistration: throw IllegalStateException when the registration is modified after the context has been initialised (using a deliberately lenient availability test to avoid breaking existing applications that configure registrations before start) and IllegalArgumentException from addMapping for null or empty URL patterns remm
• 2026/09/30 (tomcat) 02/08: Record an error in CoyoteWriter.close() when the underlying OutputBuffer close fails, rather than swallowing the IOException silently, so checkError() reflects the failure remm
• 2026/09/30 (tomcat) 01/08: Fix InputBuffer.skip() consuming and returning more characters than requested by comparing and advancing by the remaining count (n - nRead) rather than the original count, and add a regression test remm
• 2026/09/30 (tomcat) branch 11.0.x updated: Fix registration test remm
• 2026/09/30 (tomcat) 05/07: Add spec-mandated validation to ApplicationServletRegistration: throw IllegalStateException when the registration is modified after the context has been initialised (using a deliberately lenient availability test to avoid breaking existing applications that configure registrations before start) and IllegalArgumentException from addMapping for null or empty URL patterns remm
• 2026/09/30 (tomcat) branch 11.0.x updated (9b0f7e4cfe -> 731e38b9c8) remm
• 2026/09/30 (tomcat) 04/07: Document that a failure to create a persistent JASPIC provider registration is deliberately fatal rather than silently skipped, since skipping an authentication provider would fail open remm
• 2026/09/30 (tomcat) branch main updated: Follow-on to 1141d547 markt
• 2026/09/30 (tomcat) branch 10.1.x updated: Follow-on to 1141d547 markt
• 2026/09/30 (tomcat) branch 11.0.x updated: Follow-on to 1141d547 markt
• 2026/09/30 (tomcat) 06/07: Fall back to the raw trimmed filename value in ApplicationPart.getSubmittedFileName() when HttpParser.unquote() rejects an invalid quoted-string, keeping the result consistent with the file-vs-field classification performed by FileUploadBase.getFileName() for malformed Content-Disposition headers remm
• 2026/09/30 (tomcat) 04/07: Return a snapshot enumeration from Request.getLocales() to prevent ConcurrentModificationExceptions when the locales list is modified while a previously returned enumeration is being iterated remm
• 2026/09/30 (tomcat) 07/07: Make FrameworkListener registration idempotent so repeated Server start events do not add duplicate container listeners or orphan previous per-context lifecycle listeners that can no longer be removed remm
• 2026/09/30 (tomcat) 02/07: Record an error in CoyoteWriter.close() when the underlying OutputBuffer close fails, rather than swallowing the IOException silently, so checkError() reflects the failure remm
• 2026/09/30 (tomcat) 06/08: Fall back to the raw trimmed filename value in ApplicationPart.getSubmittedFileName() when HttpParser.unquote() rejects an invalid quoted-string, keeping the result consistent with the file-vs-field classification performed by FileUploadBase.getFileName() for malformed Content-Disposition headers remm
• 2026/09/30 (tomcat) branch 9.0.x updated: Follow-up to 0dd86e53 markt
• 2026/09/30 (tomcat) 08/08: Merge branch '11.0.x' of [email protected]:apache/tomcat.git into 11.0.x remm
• 2026/09/30 (tomcat) 05/08: Add spec-mandated validation to ApplicationServletRegistration: throw IllegalStateException when the registration is modified after the context has been initialised (using a deliberately lenient availability test to avoid breaking existing applications that configure registrations before start) and IllegalArgumentException from addMapping for null or empty URL patterns remm
• 2026/09/30 (tomcat) branch 11.0.x updated: Follow-up to 0dd86e53 markt
• 2026/09/30 (tomcat) 01/08: Fix InputBuffer.skip() consuming and returning more characters than requested by comparing and advancing by the remaining count (n - nRead) rather than the original count, and add a regression test remm
• 2026/09/30 (tomcat) 04/08: Return a snapshot enumeration from Request.getLocales() to prevent ConcurrentModificationExceptions when the locales list is modified while a previously returned enumeration is being iterated remm
• 2026/09/30 (tomcat) 02/08: Record an error in CoyoteWriter.close() when the underlying OutputBuffer close fails, rather than swallowing the IOException silently, so checkError() reflects the failure remm
• 2026/09/30 (tomcat) 03/08: Return 0 rather than -1 for zero-length reads from InputBuffer at end of stream, as required by the InputStream/Reader contract, and avoid the unnecessary blocking fill these requests previously triggered remm
• 2026/09/30 (tomcat) branch 10.1.x updated: Follow-up to 0dd86e53 markt
• 2026/09/30 (tomcat) branch main updated: Follow-up to 0dd86e53 markt
• 2026/09/30 (tomcat) 07/08: Make FrameworkListener registration idempotent so repeated Server start events do not add duplicate container listeners or orphan previous per-context lifecycle listeners that can no longer be removed remm
• 2026/09/30 (tomcat) 03/08: Return 0 rather than -1 for zero-length reads from InputBuffer at end of stream, as required by the InputStream/Reader contract, and avoid the unnecessary blocking fill these requests previously triggered remm
• 2026/09/30 (tomcat) 08/08: Merge branch 'main' of [email protected]:apache/tomcat.git into main remm
• 2026/09/30 (tomcat) 05/08: Add spec-mandated validation to ApplicationServletRegistration: throw IllegalStateException when the registration is modified after the context has been initialised (using a deliberately lenient availability test to avoid breaking existing applications that configure registrations before start) and IllegalArgumentException from addMapping for null or empty URL patterns remm
• 2026/09/30 (tomcat) 06/08: Fall back to the raw trimmed filename value in ApplicationPart.getSubmittedFileName() when HttpParser.unquote() rejects an invalid quoted-string, keeping the result consistent with the file-vs-field classification performed by FileUploadBase.getFileName() for malformed Content-Disposition headers remm
• 2026/09/30 (tomcat) 04/08: Return a snapshot enumeration from Request.getLocales() to prevent ConcurrentModificationExceptions when the locales list is modified while a previously returned enumeration is being iterated remm
• 2026/09/30 (tomcat) 01/08: Fix InputBuffer.skip() consuming and returning more characters than requested by comparing and advancing by the remaining count (n - nRead) rather than the original count, and add a regression test remm
• 2026/09/30 (tomcat) 02/08: Record an error in CoyoteWriter.close() when the underlying OutputBuffer close fails, rather than swallowing the IOException silently, so checkError() reflects the failure remm
• 2026/09/30 (tomcat) branch 9.0.x updated: Follow-up to 09c0caced9 markt
• 2026/09/30 (tomcat) branch 10.1.x updated: Follow-up to 09c0caced9 markt
• 2026/09/30 (tomcat) branch 11.0.x updated: Follow-up to 09c0caced9 markt
• 2026/09/30 (tomcat) branch main updated: Follow-up to 09c0caced9 markt
• 2026/09/30 (tomcat) 06/07: Update the JASPIC client Subject only when password validation succeeded (or was not requested), failing closed rather than adding a principal derived from untrusted caller-supplied data when validation failed remm
• 2026/09/30 (tomcat) 01/06: Stop SSO session listeners accumulating on sessions by re-keying the SSO entry on session ID change without registering an additional listener remm
• 2026/09/30 (tomcat) 02/06: Guard SpnegoAuthenticator against missing JAAS/Kerberos config files, handle the unchecked SecurityException they would cause and log GSS ticket failures with the correct message remm
• 2026/09/30 (tomcat) 03/06: Load statically configured ServerAuthModule classes via the thread context (web application) class loader first, matching the pattern used for AuthConfigProvider classes, so modules packaged in WEB-INF/lib are found remm
• 2026/09/30 (tomcat) 06/06: Store the JASPIC isMandatory MessageInfo property as a Boolean as the specification requires rather than a String, and throw IllegalArgumentException rather than NullPointerException when null is passed to the MessageInfoImpl request/response message setters remm
• 2026/09/30 (tomcat) branch 9.0.x updated (fee51e710c -> 99f7d442ac) remm
• 2026/09/30 (tomcat) 04/06: Document that a failure to create a persistent JASPIC provider registration is deliberately fatal rather than silently skipped, since skipping an authentication provider would fail open remm
• 2026/09/30 (tomcat) branch 10.1.x updated (4cb3350640 -> d852152140) remm
• 2026/09/30 (tomcat) 02/07: Guard SpnegoAuthenticator against missing JAAS/Kerberos config files, handle the unchecked SecurityException they would cause and log GSS ticket failures with the correct message remm
• 2026/09/30 (tomcat) 06/07: Update the JASPIC client Subject only when password validation succeeded (or was not requested), failing closed rather than adding a principal derived from untrusted caller-supplied data when validation failed remm
• 2026/09/30 (tomcat) 03/07: Load statically configured ServerAuthModule classes via the thread context (web application) class loader first, matching the pattern used for AuthConfigProvider classes, so modules packaged in WEB-INF/lib are found remm
• 2026/09/30 (tomcat) 04/07: Document that a failure to create a persistent JASPIC provider registration is deliberately fatal rather than silently skipped, since skipping an authentication provider would fail open remm
• 2026/09/30 (tomcat) 01/07: Stop SSO session listeners accumulating on sessions by re-keying the SSO entry on session ID change without registering an additional listener remm
• 2026/09/30 (tomcat) 05/07: Initialize the ServerAuthModule before caching the SingleModuleServerAuthContext so a failed initialization is not cached permanently and can be re-attempted on next use remm
• 2026/09/30 (tomcat) branch 11.0.x updated (5e9a552f97 -> 4c55e09d78) remm
• 2026/09/30 (tomcat) 04/07: Document that a failure to create a persistent JASPIC provider registration is deliberately fatal rather than silently skipped, since skipping an authentication provider would fail open remm
• 2026/09/30 (tomcat) 01/07: Stop SSO session listeners accumulating on sessions by re-keying the SSO entry on session ID change without registering an additional listener remm
• 2026/09/30 (tomcat) 03/07: Load statically configured ServerAuthModule classes via the thread context (web application) class loader first, matching the pattern used for AuthConfigProvider classes, so modules packaged in WEB-INF/lib are found remm
• 2026/09/30 (tomcat) 07/07: Store the JASPIC isMandatory MessageInfo property as a Boolean as the specification requires rather than a String, and throw IllegalArgumentException rather than NullPointerException when null is passed to the MessageInfoImpl request/response message setters remm
• 2026/09/30 (tomcat) 02/07: Guard SpnegoAuthenticator against missing JAAS/Kerberos config files, handle the unchecked SecurityException they would cause and log GSS ticket failures with the correct message remm
• 2026/09/30 (tomcat) 03/07: Load statically configured ServerAuthModule classes via the thread context (web application) class loader first, matching the pattern used for AuthConfigProvider classes, so modules packaged in WEB-INF/lib are found remm
• 2026/09/30 (tomcat) branch main updated (c2b1c9dab0 -> c817143f15) remm
• 2026/09/30 (tomcat) 07/07: Store the JASPIC isMandatory MessageInfo property as a Boolean as the specification requires rather than a String, and throw IllegalArgumentException rather than NullPointerException when null is passed to the MessageInfoImpl request/response message setters remm
• 2026/09/30 (tomcat) 01/07: Stop SSO session listeners accumulating on sessions by re-keying the SSO entry on session ID change without registering an additional listener remm
• 2026/09/30 (tomcat) 02/07: Guard SpnegoAuthenticator against missing JAAS/Kerberos config files, handle the unchecked SecurityException they would cause and log GSS ticket failures with the correct message remm
• 2026/09/30 (tomcat) 06/07: Update the JASPIC client Subject only when password validation succeeded (or was not requested), failing closed rather than adding a principal derived from untrusted caller-supplied data when validation failed remm
• 2026/09/30 (tomcat) branch 10.1.x updated: Explicitly state virtual host and SNI matching are separate markt
• 2026/09/30 (tomcat) branch main updated: Explicitly state virtual host and SNI matching are separate markt
• 2026/09/29 [PR] Fix CharChunk.indexOf(char) for chunks with a non-zero start [tomcat] via GitHub
• 2026/09/29 [PR] Fix Map.Entry contract for CaseInsensitiveKeyMap entries [tomcat] via GitHub
• 2026/09/29 Buildbot failure in on tomcat-11.0.x buildbot
• 2026/09/29 Buildbot failure in on tomcat-12.0.x buildbot
• 2026/09/29 Buildbot failure in on tomcat-9.0.x buildbot
• 2026/09/29 (tomcat) 06/13: Include the HTTP error response body in the error messages of the Manager Ant tasks remm
• 2026/09/29 Buildbot retry in on tomcat-10.1.x buildbot
• 2026/09/29 (tomcat) 13/14: Raise a BuildException when a JMX task or condition explicitly specifies a target that conflicts with an existing connection reference instead of silently ignoring it remm

• Earlier messages
• Later messages