+1 (binding), with one remark. Checked: sha256/sha512, SHA3-256 against the ATR manifest, GPG signatures against KEYS (8D339D37), ATR/dist.dev/Nexus staging artifacts identical, git tag 72f98dd2, LICENSE/NOTICE, zip == tar.gz, plus distribution starts/stops cleanly on Java 25.
Remark: the source release still contains examples/jpa-hibernate-arquillian/temp/hibernate-core-jakarta-5.6.8.Final.jar (LGPL, unreferenced). Mark removed it on main in 025ea74a99 but the removal was not backported to tomee-10.x, so it has shipped in every 10.x source release. Please cherry-pick that commit to tomee-10.x; if we don't re-roll, it must be gone for 10.3.1. Non-blocking: 10.3.0-SNAPSHOT leftovers in tomee-deb and ~20 example poms. Thanks Richard > Am 04.11.2026 um 13:51 schrieb jungm.apache.org via dev > <[email protected]>: > > Hello TomEE, > > I'd like to call a vote on releasing the following artifacts as > Apache TomEE 10.3.0. This vote is being conducted using a > Beta version of the Apache Trusted Releases (ATR) platform. > Please report any bugs or issues to the ASF Tooling team. > > The page of the release candidate from ATR revision 00002, > which includes downloads, can be found at: > > https://releases.apache.org/vote/tomee/10.3.0 > > The file manifest for ATR revision 00002, including file digests, > can be found at: > > https://releases.apache.org/manifest/tomee/10.3.0/00002 > > The release artifacts are signed with one or more OpenPGP keys from: > > https://downloads.apache.org/tomee/KEYS > > Please review the release candidate and vote accordingly. > > The artifacts are also available traditionally via dist: > https://dist.apache.org/repos/dist/dev/tomee/staging-1255/tomee-10.3.0/ > Git tag: https://github.com/apache/tomee/tree/tomee-project-10.3.0 > (72f98dd23572a5064e238fc31bf6c9c7aa45eb73) > Maven staging repo: > https://repository.apache.org/content/repositories/orgapachetomee-1255/ > > Jira changelog: > > Bug > [TOMEE-2044] - threadPool-queue (in ServicePool) from ejbd-Service is > never processed > [TOMEE-3726] - Queue is visible in JNDI Tree (java://id-resource) > [TOMEE-4011] - Multi-threaded Deployment of multiple war-files runs in > TomEERuntimeException > [TOMEE-4029] - Use of JWKS forces kid to be present in JWTs > [TOMEE-4240] - The implementation for mail.mime.parameters.strict > parameter is missing in jakarta\mail\internet\ParameterList.java class of > geronimo-mail_2.1_spec-1.0.0-M1.jar in TomEE 9.1.0 > [TOMEE-4438] - Disable releases for apache-snapshot repo > [TOMEE-4547] - MultipartMessage not build correctly with Jakarta.mail / > Interferes with Geronimo-mail > [TOMEE-4682] - SecurityContext.authenticate() does not persist the session > (bypasses HttpServletRequest.authenticate()) > [TOMEE-4699] - ThreadContext constructor is not thread-safe, causing loss > of submitted tasks. > [TOMEE-4703] - ApplicationThreadContextProvider stores a live > ThreadContext reference instead of an immutable snapshot > [TOMEE-4704] - CUTask.invoke() does not safely propagate errors to > ManagedTask > [TOMEE-4712] - MDB endpoints are activated before the application's other > EJBs are started > [TOMEE-4714] - TomEEEmbeddedExtension (JUnit 5) can not start the > container again after it was closed > [TOMEE-4715] - TomEE embedded application runner does not inject @Resource > into the @Application descriptor > [TOMEE-4716] - MicroProfile Health endpoints are not deployed when the > webapp declares a JAX-RS Application subclass > [TOMEE-4729] - MP-JWT security state is not restored for asynchronous > requests > [TOMEE-4730] - MP-JWT ignores class-level security annotations of a > resource superclass > [TOMEE-4731] - TxThreadContextRestorer fails with NPE when managed threads > end after the container shut down > > Improvement > [TOMEE-1619] - Add exception message to Alerts > [TOMEE-4679] - Prepare for next development iteration (10.3.x) > [TOMEE-4709] - Track git revision in version info > [TOMEE-4710] - Don't patch catalina.jar just to print TomEE Version > > Task > [TOMEE-4700] - Drop openejb-hessian > [TOMEE-4701] - Drop openejb-ssh > [TOMEE-4702] - Drop openejb-common-cli > [TOMEE-4705] - Migrate the Maven plugins off the Maven 2 API > [TOMEE-4706] - Migrate the Gradle plugin to a current Gradle version > [TOMEE-4707] - Drop the standalone HTTP server from openejb-http > [TOMEE-4733] - Pin Surefire to 3.5.x in TCK modules > > Dependency upgrade > [TOMEE-4663] - Geronimo Mail 1.1.1 > [TOMEE-4664] - Apache Neethi 3.2.3 > [TOMEE-4666] - Mojarra 4.0.20 > [TOMEE-4668] - SmallRye Config 3.18.1 > [TOMEE-4669] - commons-codec 1.23.0 > [TOMEE-4671] - Apache ActiveMQ 6.2.8 > [TOMEE-4672] - Bouncycastle 1.86 > [TOMEE-4676] - CXF 4.1.9 > [TOMEE-4677] - Tomcat 10.1.61 > [TOMEE-4678] - Upgrade micrometer-core jar > [TOMEE-4680] - Apache CXF - CVE-2026-54225 in TomEE 10.2.0 > [TOMEE-4683] - Jackson 2.22.2 > [TOMEE-4684] - Johnzon 2.2.0 > [TOMEE-4685] - JUnit 6.1.3 > [TOMEE-4686] - SmallRye Config 3.18.2 > [TOMEE-4687] - actions/setup-java 6.0.0 > [TOMEE-4694] - Apache ActiveMQ 6.2.10 > [TOMEE-4695] - Mojarra 4.0.28 > [TOMEE-4696] - Hibernate ORM 6.6.56.Final > [TOMEE-4697] - XBean 5.0.0 > [TOMEE-4698] - Plexus Archiver 4.14.0 > [TOMEE-4718] - MyFaces 4.0.4 > [TOMEE-4719] - Jose4j 0.9.7 > [TOMEE-4720] - Snakeyaml 2.7 > [TOMEE-4721] - Apache ActiveMQ 6.3.3 > [TOMEE-4722] - SLF4J 2.0.20 > [TOMEE-4723] - Jackson 2.22.4 > [TOMEE-4724] - Apache Neethi 3.2.4 > [TOMEE-4725] - WSS4J 4.0.2 > [TOMEE-4726] - commons-lang3 3.21.0 > > Documentation > [TOMEE-4673] - Remove "About the 'tomee' webapp" since Tomee drop-in > webapp was removed in TOMEE-3724 > > > [ ] +1 Release this package > [ ] +0 Abstain > [ ] -1 Do not release this package (please provide specific comments) > > You can vote on ATR at the URL above, or manually by replying to this email. > > The vote is open for 72 hours. > > > Thanks, > Markus Jung (jungm) > > This email was sent by [email protected] on the Apache Trusted Releases > platform
