I am not sure that I am a voting member and probably does not apply to this release, but moving to Tomcat .31 and .51 mayb be bumpy if using the AJP protocol.
Tomcat changed the default secretRequired to be true. However, what they do not tell you is you need to add a secret to the server xml AND the httpd config. One note I learned the hard way on syntax: Tomcat server.xml looks like: secret="some_string" http config looks like: secret=some_string. One requires quotes, the other does not. As far as I know there is not any good examples/sample I could find in google. Thanks, Rod. On 2/25/20, 2:10 PM, "Jonathan Gallimore" <jonathan.gallim...@gmail.com> wrote: Nationwide Information Security Warning: This is an external email. Do not click on links or open attachments unless you trust the sender. ------------------------------------------------------------------------------ Hi This is a vote for an updated Java EE spec jar, with one single change over javaee-api:8.0-3, which is to use the Tomcat API libraries from 9.0.31 as opposed to 9.0.22. This is required to fix an issue in the TomEE builds where javax.el.ExpressionFactory#getClassNameServices was returning the first line of the ASF license header as opposed to a class name, and this being released is a pre-requisite for any further TomEE releases. *SVN TAG* https://svn.apache.org/repos/asf/tomee/javaee-api/tags/javaee-api-8.0-4/ *Sources* https://repository.apache.org/service/local/repositories/orgapachetomee-1162/content/org/apache/tomee/javaee-api/8.0-4/javaee-api-8.0-4-source-release.zip *Binaries* https://repository.apache.org/service/local/repositories/orgapachetomee-1162/content/org/apache/tomee/javaee-api/8.0-4/javaee-api-8.0-4.zip please VOTE [+1] all fine, ship it [+0] don't care [-1] stop, because ${reason} The VOTE is open for 72h. Here's my +1. Many thanks Jon