[tomcat] branch main updated: Add the ability to use foreign from java.base
This is an automated email from the ASF dual-hosted git repository. remm pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/main by this push: new 46932f0 Add the ability to use foreign from java.base 46932f0 is described below commit 46932f0e928f7ba8acba9fa6c07d17e18bebdb7b Author: remm AuthorDate: Mon Jan 31 15:48:16 2022 +0100 Add the ability to use foreign from java.base Simple package rename to java.lang.foreign, and the package name may still change. Java 18 JEP 419 is not supported. --- build.xml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/build.xml b/build.xml index 6e1e83e..f7fca71 100644 --- a/build.xml +++ b/build.xml @@ -1934,15 +1934,16 @@ - + + - + - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
Re: JDK 18 Rampdown Phase 2 & JDK 19 Early-Access Builds
Hi David, Apache Tomcat's build and tests pass successfully with JDK 18-ea+33-2077 and 19-ea+7-366 on both Linux x86_64 and aarch64! Regards, Martin On Mon, Jan 31, 2022 at 11:33 AM David Delabassee < david.delabas...@oracle.com> wrote: > Greetings! > > First off, on behalf of Oracle’s Java Team, I’d like to wish you a happy > and prosperous new year! > > In 2022, two Java releases will be made available: > - JDK 18 (March 2022) > - JDK 19 (September 2022) > > JDK 18[1] has entered Rampdown Phase Two (RDP2)[2]. Given that and to be > better prepared for the future, it makes sense to begin testing your > project(s) using early access (EA) builds of JDK 19[3]. Your feedback > allows us to evaluate and address issues you find while testing EA builds. > > This time, we have two heads-up to share: > > ## Heads-Up: JDK 18 - JEP 421 Deprecate Finalization for Removal > > Finalization is an outdated and brittle resource cleaning mechanism > present in the platform since, well, forever. Its use has been > discouraged for quite some time in favor of better alternatives (i.e., > 'try with resources' and Cleaners). JEP 421 is another step towards the > removal of finalizers as it offers tools to investigate if a codebase is > still using finalization. To learn more, you should read JEP 421[4]. You > should also listen to the latest episode of the Inside Java Podcast[5] > dedicated to this topic. We encourage you to check if your project is > still using finalizers. If so, you should start to think about removing > them and rely instead on either 'try with resources' or Cleaners. > > ## Heads-Up: JVM does not flag constant class entries ending in '/' > > Prior to JDK 19, the JVM is loading classes (1) whose class file major > version is <49, i.e., before JDK 1.5, and (2) the class's name ends with > a '/'. This violates section 4.2.1 of the JVM specification [6] and is > addressed in JDK 19. In JDK 19, the JVM is throwing, for such classes, a > ClassFormatError exception as it already does with newer classes (JDK > 1.5+). Given that this issue affects only pre-JDK 1.5 classes, we expect > the compatibility risk to be very low. > > For more details, see JDK-8278448[7]. > > [1] https://jdk.java.net/18/ > [2] > https://mail.openjdk.java.net/pipermail/jdk-dev/2022-January/006361.html > [3] https://jdk.java.net/19/ > [4] https://openjdk.java.net/jeps/421 > [5] https://inside.java/podcast/21 > [6] > https://docs.oracle.com/javase/specs/jvms/se17/html/jvms-4.html#jvms-4.2.1 > [7] https://bugs.openjdk.java.net/browse/JDK-8278448 > > > ## JDK 18 > > JDK 18 is now in RDP2 (Rampdown Phase Two) with its feature set frozen a > few weeks back when it entered RDP1. > > ### JEPs integrated to JDK 18: > > - JEP 400: UTF-8 by Default > - JEP 408: Simple Web Server > - JEP 413: Code Snippets in Java API Documentation > - JEP 416: Reimplement Core Reflection with Method Handles > - JEP 417: Vector API (Third Incubator) > - JEP 418: Internet-Address Resolution SPI > - JEP 419: Foreign Function & Memory API (Second Incubator) > - JEP 420: Pattern Matching for switch (Second Preview) > - JEP 421: Deprecate Finalization for Removal > > JDK 18 Early-Access builds 33 are now available[8], and are provided > under the GNU General Public License v2, with the Classpath Exception. > Also available are the Release Notes[9]. > > [8] https://jdk.java.net/18/ > [9] https://jdk.java.net/18/release-notes > > ### Changes in JDK 18 since Rampdown Phase One that are of interest: > > - JDK-8278373: Correcting References to Overloaded Methods in Javadoc > Documentation > - JDK-8279065: Deserialization filter and filter factory property error > reporting under specified > - JDK-8255409: SunPKCS11 Provider Now Supports Some PKCS#11 v3.0 APIs > - JDK-8275610: C2: Object field load floats above its null check > resulting in a segfault [Reported by Apache POI] > > > ## JDK 19 > > JDK 19 Early-Access builds 7 are now available[10], and are provided > under the GNU General Public License v2, with the Classpath Exception. > Also available are the Release Notes[11]. > > [10] https://jdk.java.net/19/ > [11] https://jdk.java.net/19/release-notes > > ### Changes in recent JDK 19 EA builds that maybe of interest: > > - JDK-8279258: Auto-vectorization enhancement for two-dimensional array > operations > - JDK-8273914: Indy string concat changes order of operations > - JDK-8268081: Upgrade Unicode Data Files to 14.0.0 > - JDK-8278087: Deserialization filter and filter factory property error > reporting under specified > - JDK-8276766: Enable jar and jmod to produce deterministic timestamped > content > - JDK-8274679: Remove unnecessary conversion to String in security code > in java.base > - JDK-8279833: Loop optimization issue in String.encodeUTF8_UTF16 > - JDK-8279064: New options for ktab to provide non-default salt > - JDK-8280055: JFR: Improve ObjectContext implementation > - JDK-8268831: Improve javadoc tool handling of streams > > > ## Topics of Interest: > > -
svn commit: r1897623 [2/2] - in /tomcat/site/trunk: docs/ xdocs/
Modified: tomcat/site/trunk/docs/security-7.html URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/security-7.html?rev=1897623=1897622=1897623=diff == --- tomcat/site/trunk/docs/security-7.html (original) +++ tomcat/site/trunk/docs/security-7.html Mon Jan 31 11:14:09 2022 @@ -1,7 +1,5 @@ -Apache Tomcat - Apache Tomcat 7 vulnerabilitieshttp://tomcat.apache.org/;>Apache Tomcathttps://www.apache.org/foundation/contributing.html; target="_blank" class="pull-left">https://www.apache.org/images/SupportApache-small.png; class="support-asf" alt="Support Apache">http://www.apache.org/; target="_blank" class="pull-left">https://www.google.com/search; method="get">GOApache TomcatHomeTaglibsMaven PluginDownloadWhich version?https://tomcat.apache.org/download-10.cgi;>Tomcat 10https://tomcat.apache.org/download-90.cgi;>Tomcat 9https://tomcat.apache.org/downloa d-80.cgi">Tomcat 8https://tomcat.apache.org/download-migration.cgi;>Tomcat Migration Tool for Jakarta EEhttps://tomcat.apache.org/download-connectors.cgi;>Tomcat Connectorshttps://tomcat.apache.org/download-native.cgi;>Tomcat Nativehttps://tomcat.apache.org/download-taglibs.cgi;>Taglibshttps://archive.apache.org/dist/tomcat/;>ArchivesDocumentationTomcat 10.1 (alpha)Tomcat 10.0Tomcat 9.0Tomcat 8.5Tomcat ConnectorsTomcat Nativehttps://cwiki.apache.org/confluence/display/TOMCAT;>WikiMigration GuidePresentationshref="https://cwiki.apache.org/confluence/x/Bi8lBg;>SpecificationsProblems? href="./security.html">Security Reportshref="./findhelp.html">Find helphref="https://cwiki.apache.org/confluence/display/TOMCAT/FAQ;>FAQ href="./lists.html">Mailing ListsBug >DatabaseIRCGet >InvolvedOverviewhref="./source.html">Source codehref="./ci.html">Buildbothref="https://cwiki.apache.org/confluence/x/vIPzBQ;>Translations href="./tools.html">ToolsMediahref="https://twitter.com/theapachetomcat;>Twitterhref="https://www.youtube.com/c/ApacheTomcatOfficial;>YouTubehref="https://bl ogs.apache.org/tomcat/">BlogMiscWho We Arehttps://www.redbubble.com/people/comdev/works/30885254-apache-tomcat;>SwagHeritagehttp://www.apache.org;>Apache HomeResourcesContactLegalhttps://www.apache.org/foundation/contributing.html;>Support Apachehttps://www.apache.org/foundation/sponsorship.html;>Sponsorshiphttp://www.apache.org/foundation/thanks.html;>Thankshttp://www.apache.org/licenses/;>LicenseContentTable of Contents -Apache Tomcat 7.x vulnerabilitiesFixed in Apache Tomcat 7.0.109Fixed in Apache Tomcat 7.0.108Fixed in Apache Tomcat 7.0.107Fixed in Apache Tomcat 7.0.105Fixed in Apache Tomcat 7.0.104Fixed in Apache Tomcat 7.0.100Fixed in Apache Tomcat 7.0.99Fixed in Apache Tomcat 7.0.94Fixed in Apache Tomcat 7.0.91Fixed in Apache Tomcat 7.0.90Fixed in Apache Tomcat 7.0.89Fixed in Apache Tomcat 7.0.88Fixed in Apache Tomcat 7.0.85Fixed in Apache Tomcat 7.0.84Fixed in Apache Tomcat 7.0.82Fixed in Apache Tomcat 7.0.81Fixed in Apache Tomcat 7.0.79Fixed in Apache Tomcat 7.0.78Fixed in Apache Tomcat 7.0.77Fixed in Apache Tomcat 7.0.76Fixed in Apache Tomcat 7.0.75Fixed in Apache Tomcat 7.0.73Fixed in Apache Tomcat 7.0.72Fixed in Apache Tomcat 7.0.70Fixed in Apache Tomcat 7.0.68Fixed in Apache Tomcat 7.0.67Fixed in Apache Tomcat 7.0.65Fixed in Apache Tomcat 7.0.59Fixed in Apache Tomcat 7.0.55Fixed in Apache Tomcat 7.0.54Fixed in Apache Tomcat 7.0.53Fixed in Apache Tomcat 7.0.52Fixed in Apache Tomcat 7.0.50Fixed in Apache Tomcat 7.0.47Fixed in Apache T omcat 7.0.40Fixed in Apache Tomcat 7.0.33Fixed in Apache Tomcat 7.0.32Fixed in Apache Tomcat 7.0.30Fixed in Apache Tomcat 7.0.28Fixed in Apache Tomcat 7.0.23Fixed in Apache Tomcat 7.0.22Fixed in Apache Tomcat 7.0.21Fixed in Apache Tomcat 7.0.20Fixed in Apache Tomcat 7.0.19Fixed in Apache Tomcat 7.0.14Fixed in Apache Tomcat 7.0.12Fixed in Apache To mcat 7.0.11Fixed in Apache Tomcat 7.0.8Fixed in Apache Tomcat 7.0.6Fixed in Apache Tomcat 7.0.5Fixed in Apache Tomcat 7.0.4Fixed in Apache Tomcat 7.0.2Not a vulnerability in Tomcat -Apache Tomcat 7.x vulnerabilities +Apache Tomcat - Apache Tomcat 7 vulnerabilitieshttp://tomcat.apache.org/;>Apache Tomcathttps://www.apache.org/foundation/contributing.html; target="_blank" class="pull-left">https://www.apache.org/images/SupportApache-small.png; class="support-asf" alt="Support Apache">http://www.apache.org/; target="_blank" class="pull-left">https://www.google.com/search; method="get">GOApache TomcatHomeTaglibsMaven PluginDownloadWhich version?https://tomcat.apache.org/download-10.cgi;>Tomcat 10https://tomcat.apache.org/download-90.cgi;>Tomcat 9https://tomcat.apache.org/downloa d-80.cgi">Tomcat 8https://tomcat.apache.org/download-migration.cgi;>Tomcat Migration Tool for Jakarta EEhttps://tomcat.apache.org/download-connectors.cgi;>Tomcat Connectorshttps://tomcat.apache.org/download-native.cgi;>Tomcat
svn commit: r1897623 [1/2] - in /tomcat/site/trunk: docs/ xdocs/
Author: markt Date: Mon Jan 31 11:14:09 2022 New Revision: 1897623 URL: http://svn.apache.org/viewvc?rev=1897623=rev Log: Improvements to the security pages. Move the ToC to after the intro so the intro is always visible. Make EOL statements bold so they stand out. Post CVE-2021-44228 we are getting a lot of questions about out of date Tomcat versions so make the security status of these versions clearer. Modified: tomcat/site/trunk/docs/security-10.html tomcat/site/trunk/docs/security-3.html tomcat/site/trunk/docs/security-4.html tomcat/site/trunk/docs/security-5.html tomcat/site/trunk/docs/security-6.html tomcat/site/trunk/docs/security-7.html tomcat/site/trunk/docs/security-8.html tomcat/site/trunk/docs/security-9.html tomcat/site/trunk/xdocs/security-10.xml tomcat/site/trunk/xdocs/security-3.xml tomcat/site/trunk/xdocs/security-4.xml tomcat/site/trunk/xdocs/security-5.xml tomcat/site/trunk/xdocs/security-6.xml tomcat/site/trunk/xdocs/security-7.xml tomcat/site/trunk/xdocs/security-8.xml tomcat/site/trunk/xdocs/security-9.xml Modified: tomcat/site/trunk/docs/security-10.html URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/security-10.html?rev=1897623=1897622=1897623=diff == --- tomcat/site/trunk/docs/security-10.html (original) +++ tomcat/site/trunk/docs/security-10.html Mon Jan 31 11:14:09 2022 @@ -1,7 +1,5 @@ -Apache Tomcat - Apache Tomcat 10 vulnerabilitieshttp://tomcat.apache.org/;>Apache Tomcathttps://www.apache.org/foundation/contributing.html; target="_blank" class="pull-left">https://www.apache.org/images/SupportApache-small.png; class="support-asf" alt="Support Apache">http://www.apache.org/; target="_blank" class="pull-left">https://www.google.com/search; method="get">GOApache TomcatHomeTaglibsMaven PluginDownloadWhich version?https://tomcat.apache.org/download-10.cgi;>Tomcat 10https://tomcat.apache.org/download-90.cgi;>Tomcat 9https://tomcat.apache.org/downlo ad-80.cgi">Tomcat 8https://tomcat.apache.org/download-migration.cgi;>Tomcat Migration Tool for Jakarta EEhttps://tomcat.apache.org/download-connectors.cgi;>Tomcat Connectorshttps://tomcat.apache.org/download-native.cgi;>Tomcat Nativehttps://tomcat.apache.org/download-taglibs.cgi;>Taglibshttps://archive.apache.org/dist/tomcat/;>ArchivesDocumentationTomcat 10.1 (alpha)Tomcat 10.0Tomcat 9.0Tomcat 8.5Tomcat ConnectorsTomcat Nativehttps://cwiki.apache.org/confluence/display/TOMCAT;>WikiMigration GuidePresentationshttps://cwiki.apache.org/confluence/x/Bi8lBg;>SpecificationsProblems?Security ReportsFind helphttps://cwiki.apache.org/confluence/display/TOMCAT/FAQ;>FAQMailing ListsBug DatabaseIRCGet InvolvedOverviewSource codeBuildbothttps://cwiki.apache.org/confluence/x/vIPzBQ;>TranslationsToolsMediahttps://twitter.com/theapachetomcat;>Twitterhttps://www.youtube.com/c/ApacheTomcatOfficial;>YouTubeBlogMiscWho We Arehttps://www.redbubble.com/people/comdev/works/30885254-apache-tomcat;>SwagHeritagehttp://www.apache.org;>Apache HomeResourcesContactLegalhttps://www.apache.org/foundation/contributing.html;>Support Apachehttps://www.apache.org/foundation/sponsorship.html;>Sponsorshiphttp://www.apache.org/foundation/thanks.html;>Thankshttp://www.apache.org/licenses/;>LicenseContentTable of Contents -Apache Tomcat 10.x vulnerabilitiesFixed in Apache Tomcat 10.0.16Fixed in Apache Tomcat 10.1.0-M10Fixed in Apache Tomcat 10.0.12Fixed in Apache Tomcat 10.1.0-M6Fixed in Apache Tomcat 10.0.7Fixed in Apache Tomcat 10.0.6Fixed in Apache Tomcat 10.0.5Fixed in Apache Tomcat 10.0.4Fixed in Apache Tomcat 10.0.2Fixed in Apache Tomcat 10.0.0-M10Fixed in Apache Tomcat 10.0.0-M8Fixed in Apache Tomcat 10.0.0-M7Fixed in Apache Tomcat 10.0.0-M6Fixed in Apache Tomcat 10.0.0-M5Not a vulnerability in Tomcat -Apache Tomcat 10.x vulnerabilities +Apache Tomcat - Apache Tomcat 10 vulnerabilitieshttp://tomcat.apache.org/;>Apache Tomcathttps://www.apache.org/foundation/contributing.html; target="_blank" class="pull-left">https://www.apache.org/images/SupportApache-small.png; class="support-asf" alt="Support Apache">http://www.apache.org/; target="_blank" class="pull-left">https://www.google.com/search; method="get">GOApache TomcatHomeTaglibsMaven PluginDownloadWhich version?https://tomcat.apache.org/download-10.cgi;>Tomcat 10https://tomcat.apache.org/download-90.cgi;>Tomcat 9https://tomcat.apache.org/downlo ad-80.cgi">Tomcat 8https://tomcat.apache.org/download-migration.cgi;>Tomcat Migration Tool for Jakarta EEhttps://tomcat.apache.org/download-connectors.cgi;>Tomcat Connectorshttps://tomcat.apache.org/download-native.cgi;>Tomcat Nativehttps://tomcat.apache.org/download-taglibs.cgi;>Taglibshttps://archive.apache.org/dist/tomcat/;>ArchivesDocumentationTomcat 10.1 (alpha)Tomcat 10.0Tomcat 9.0Tomcat 8.5Tomcat ConnectorsTomcat
Re: JDK 18 Rampdown Phase 2 & JDK 19 Early-Access Builds
On Mon, Jan 31, 2022 at 10:33 AM David Delabassee wrote: > > Greetings! > > First off, on behalf of Oracle’s Java Team, I’d like to wish you a happy > and prosperous new year! > > In 2022, two Java releases will be made available: > - JDK 18 (March 2022) > - JDK 19 (September 2022) > > JDK 18[1] has entered Rampdown Phase Two (RDP2)[2]. Given that and to be > better prepared for the future, it makes sense to begin testing your > project(s) using early access (EA) builds of JDK 19[3]. Your feedback > allows us to evaluate and address issues you find while testing EA builds. > > This time, we have two heads-up to share: > > ## Heads-Up: JDK 18 - JEP 421 Deprecate Finalization for Removal > > Finalization is an outdated and brittle resource cleaning mechanism > present in the platform since, well, forever. Its use has been > discouraged for quite some time in favor of better alternatives (i.e., > 'try with resources' and Cleaners). JEP 421 is another step towards the > removal of finalizers as it offers tools to investigate if a codebase is > still using finalization. To learn more, you should read JEP 421[4]. You > should also listen to the latest episode of the Inside Java Podcast[5] > dedicated to this topic. We encourage you to check if your project is > still using finalizers. If so, you should start to think about removing > them and rely instead on either 'try with resources' or Cleaners. > > ## Heads-Up: JVM does not flag constant class entries ending in '/' > > Prior to JDK 19, the JVM is loading classes (1) whose class file major > version is <49, i.e., before JDK 1.5, and (2) the class's name ends with > a '/'. This violates section 4.2.1 of the JVM specification [6] and is > addressed in JDK 19. In JDK 19, the JVM is throwing, for such classes, a > ClassFormatError exception as it already does with newer classes (JDK > 1.5+). Given that this issue affects only pre-JDK 1.5 classes, we expect > the compatibility risk to be very low. > > For more details, see JDK-8278448[7]. > > [1] https://jdk.java.net/18/ > [2] https://mail.openjdk.java.net/pipermail/jdk-dev/2022-January/006361.html > [3] https://jdk.java.net/19/ > [4] https://openjdk.java.net/jeps/421 > [5] https://inside.java/podcast/21 > [6] > https://docs.oracle.com/javase/specs/jvms/se17/html/jvms-4.html#jvms-4.2.1 > [7] https://bugs.openjdk.java.net/browse/JDK-8278448 > > > ## JDK 18 > > JDK 18 is now in RDP2 (Rampdown Phase Two) with its feature set frozen a > few weeks back when it entered RDP1. > > ### JEPs integrated to JDK 18: > > - JEP 400: UTF-8 by Default > - JEP 408: Simple Web Server > - JEP 413: Code Snippets in Java API Documentation > - JEP 416: Reimplement Core Reflection with Method Handles > - JEP 417: Vector API (Third Incubator) > - JEP 418: Internet-Address Resolution SPI > - JEP 419: Foreign Function & Memory API (Second Incubator) This one was not super exciting, so moving on to the foreign preview instead (for now it is java.lang.foreign). > - JEP 420: Pattern Matching for switch (Second Preview) > - JEP 421: Deprecate Finalization for Removal Rémy > JDK 18 Early-Access builds 33 are now available[8], and are provided > under the GNU General Public License v2, with the Classpath Exception. > Also available are the Release Notes[9]. > > [8] https://jdk.java.net/18/ > [9] https://jdk.java.net/18/release-notes > > ### Changes in JDK 18 since Rampdown Phase One that are of interest: > > - JDK-8278373: Correcting References to Overloaded Methods in Javadoc > Documentation > - JDK-8279065: Deserialization filter and filter factory property error > reporting under specified > - JDK-8255409: SunPKCS11 Provider Now Supports Some PKCS#11 v3.0 APIs > - JDK-8275610: C2: Object field load floats above its null check > resulting in a segfault [Reported by Apache POI] > > > ## JDK 19 > > JDK 19 Early-Access builds 7 are now available[10], and are provided > under the GNU General Public License v2, with the Classpath Exception. > Also available are the Release Notes[11]. > > [10] https://jdk.java.net/19/ > [11] https://jdk.java.net/19/release-notes > > ### Changes in recent JDK 19 EA builds that maybe of interest: > > - JDK-8279258: Auto-vectorization enhancement for two-dimensional array > operations > - JDK-8273914: Indy string concat changes order of operations > - JDK-8268081: Upgrade Unicode Data Files to 14.0.0 > - JDK-8278087: Deserialization filter and filter factory property error > reporting under specified > - JDK-8276766: Enable jar and jmod to produce deterministic timestamped > content > - JDK-8274679: Remove unnecessary conversion to String in security code > in java.base > - JDK-8279833: Loop optimization issue in String.encodeUTF8_UTF16 > - JDK-8279064: New options for ktab to provide non-default salt > - JDK-8280055: JFR: Improve ObjectContext implementation > - JDK-8268831: Improve javadoc tool handling of streams > > > ## Topics of Interest: > > - "State of Valhalla" update >
[tomcat] branch 8.5.x updated: Improve docs for the protocol attribute of the JNDIRealm
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch 8.5.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/8.5.x by this push: new bf13482 Improve docs for the protocol attribute of the JNDIRealm bf13482 is described below commit bf1348232d47c6da9612363fceefeb384bf097d5 Author: Mark Thomas AuthorDate: Mon Jan 31 10:35:35 2022 + Improve docs for the protocol attribute of the JNDIRealm --- webapps/docs/changelog.xml| 4 webapps/docs/config/realm.xml | 4 ++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml index 6d146f6..36af447 100644 --- a/webapps/docs/changelog.xml +++ b/webapps/docs/changelog.xml @@ -130,6 +130,10 @@ avoid an issue with reproducible builds due to differences in file ordering across different operating systems with Ant's zip task. (markt) + +Better documentation for the protocol attribute of the +JNDIRealm. (markt) + diff --git a/webapps/docs/config/realm.xml b/webapps/docs/config/realm.xml index 4f515fb..554a99c 100644 --- a/webapps/docs/config/realm.xml +++ b/webapps/docs/config/realm.xml @@ -361,8 +361,8 @@ - A string specifying the security protocol to use. If not given - the providers default is used. + A string specifying the TLS protocol to use. If not given, the + Java runtime's default is used. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
[tomcat] branch 9.0.x updated: Improve docs for the protocol attribute of the JNDIRealm
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/9.0.x by this push: new 7a04bdf Improve docs for the protocol attribute of the JNDIRealm 7a04bdf is described below commit 7a04bdf527cd68535e5757eda10501f96f0f8602 Author: Mark Thomas AuthorDate: Mon Jan 31 10:35:35 2022 + Improve docs for the protocol attribute of the JNDIRealm --- webapps/docs/changelog.xml| 4 webapps/docs/config/realm.xml | 4 ++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml index a40544d..1860389 100644 --- a/webapps/docs/changelog.xml +++ b/webapps/docs/changelog.xml @@ -130,6 +130,10 @@ avoid an issue with reproducible builds due to differences in file ordering across different operating systems with Ant's zip task. (markt) + +Better documentation for the protocol attribute of the +JNDIRealm. (markt) + diff --git a/webapps/docs/config/realm.xml b/webapps/docs/config/realm.xml index 51f586d..6a84fa1 100644 --- a/webapps/docs/config/realm.xml +++ b/webapps/docs/config/realm.xml @@ -361,8 +361,8 @@ - A string specifying the security protocol to use. If not given - the providers default is used. + A string specifying the TLS protocol to use. If not given, the + Java runtime's default is used. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
[tomcat] branch 10.0.x updated: Improve docs for the protocol attribute of the JNDIRealm
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch 10.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/10.0.x by this push: new c37eecb Improve docs for the protocol attribute of the JNDIRealm c37eecb is described below commit c37eecbe444cc8be4385481e20b3b8e3ac249f2a Author: Mark Thomas AuthorDate: Mon Jan 31 10:35:35 2022 + Improve docs for the protocol attribute of the JNDIRealm --- webapps/docs/changelog.xml| 4 webapps/docs/config/realm.xml | 4 ++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml index 2afd5bc..46f938a 100644 --- a/webapps/docs/changelog.xml +++ b/webapps/docs/changelog.xml @@ -130,6 +130,10 @@ avoid an issue with reproducible builds due to differences in file ordering across different operating systems with Ant's zip task. (markt) + +Better documentation for the protocol attribute of the +JNDIRealm. (markt) + diff --git a/webapps/docs/config/realm.xml b/webapps/docs/config/realm.xml index 76e00ef..78b4c20 100644 --- a/webapps/docs/config/realm.xml +++ b/webapps/docs/config/realm.xml @@ -361,8 +361,8 @@ - A string specifying the security protocol to use. If not given - the providers default is used. + A string specifying the TLS protocol to use. If not given, the + Java runtime's default is used. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
[tomcat] branch main updated: Improve docs for the protocol attribute of the JNDIRealm
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/main by this push: new da7d3b1 Improve docs for the protocol attribute of the JNDIRealm da7d3b1 is described below commit da7d3b12be19df0408bc22dd0f2b7d507f432921 Author: Mark Thomas AuthorDate: Mon Jan 31 10:35:35 2022 + Improve docs for the protocol attribute of the JNDIRealm --- webapps/docs/changelog.xml| 4 webapps/docs/config/realm.xml | 4 ++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml index 6684bf9..c410c98 100644 --- a/webapps/docs/changelog.xml +++ b/webapps/docs/changelog.xml @@ -130,6 +130,10 @@ avoid an issue with reproducible builds due to differences in file ordering across different operating systems with Ant's zip task. (markt) + +Better documentation for the protocol attribute of the +JNDIRealm. (markt) + diff --git a/webapps/docs/config/realm.xml b/webapps/docs/config/realm.xml index 76e00ef..78b4c20 100644 --- a/webapps/docs/config/realm.xml +++ b/webapps/docs/config/realm.xml @@ -361,8 +361,8 @@ - A string specifying the security protocol to use. If not given - the providers default is used. + A string specifying the TLS protocol to use. If not given, the + Java runtime's default is used. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
JDK 18 Rampdown Phase 2 & JDK 19 Early-Access Builds
Greetings! First off, on behalf of Oracle’s Java Team, I’d like to wish you a happy and prosperous new year! In 2022, two Java releases will be made available: - JDK 18 (March 2022) - JDK 19 (September 2022) JDK 18[1] has entered Rampdown Phase Two (RDP2)[2]. Given that and to be better prepared for the future, it makes sense to begin testing your project(s) using early access (EA) builds of JDK 19[3]. Your feedback allows us to evaluate and address issues you find while testing EA builds. This time, we have two heads-up to share: ## Heads-Up: JDK 18 - JEP 421 Deprecate Finalization for Removal Finalization is an outdated and brittle resource cleaning mechanism present in the platform since, well, forever. Its use has been discouraged for quite some time in favor of better alternatives (i.e., 'try with resources' and Cleaners). JEP 421 is another step towards the removal of finalizers as it offers tools to investigate if a codebase is still using finalization. To learn more, you should read JEP 421[4]. You should also listen to the latest episode of the Inside Java Podcast[5] dedicated to this topic. We encourage you to check if your project is still using finalizers. If so, you should start to think about removing them and rely instead on either 'try with resources' or Cleaners. ## Heads-Up: JVM does not flag constant class entries ending in '/' Prior to JDK 19, the JVM is loading classes (1) whose class file major version is <49, i.e., before JDK 1.5, and (2) the class's name ends with a '/'. This violates section 4.2.1 of the JVM specification [6] and is addressed in JDK 19. In JDK 19, the JVM is throwing, for such classes, a ClassFormatError exception as it already does with newer classes (JDK 1.5+). Given that this issue affects only pre-JDK 1.5 classes, we expect the compatibility risk to be very low. For more details, see JDK-8278448[7]. [1] https://jdk.java.net/18/ [2] https://mail.openjdk.java.net/pipermail/jdk-dev/2022-January/006361.html [3] https://jdk.java.net/19/ [4] https://openjdk.java.net/jeps/421 [5] https://inside.java/podcast/21 [6] https://docs.oracle.com/javase/specs/jvms/se17/html/jvms-4.html#jvms-4.2.1 [7] https://bugs.openjdk.java.net/browse/JDK-8278448 ## JDK 18 JDK 18 is now in RDP2 (Rampdown Phase Two) with its feature set frozen a few weeks back when it entered RDP1. ### JEPs integrated to JDK 18: - JEP 400: UTF-8 by Default - JEP 408: Simple Web Server - JEP 413: Code Snippets in Java API Documentation - JEP 416: Reimplement Core Reflection with Method Handles - JEP 417: Vector API (Third Incubator) - JEP 418: Internet-Address Resolution SPI - JEP 419: Foreign Function & Memory API (Second Incubator) - JEP 420: Pattern Matching for switch (Second Preview) - JEP 421: Deprecate Finalization for Removal JDK 18 Early-Access builds 33 are now available[8], and are provided under the GNU General Public License v2, with the Classpath Exception. Also available are the Release Notes[9]. [8] https://jdk.java.net/18/ [9] https://jdk.java.net/18/release-notes ### Changes in JDK 18 since Rampdown Phase One that are of interest: - JDK-8278373: Correcting References to Overloaded Methods in Javadoc Documentation - JDK-8279065: Deserialization filter and filter factory property error reporting under specified - JDK-8255409: SunPKCS11 Provider Now Supports Some PKCS#11 v3.0 APIs - JDK-8275610: C2: Object field load floats above its null check resulting in a segfault [Reported by Apache POI] ## JDK 19 JDK 19 Early-Access builds 7 are now available[10], and are provided under the GNU General Public License v2, with the Classpath Exception. Also available are the Release Notes[11]. [10] https://jdk.java.net/19/ [11] https://jdk.java.net/19/release-notes ### Changes in recent JDK 19 EA builds that maybe of interest: - JDK-8279258: Auto-vectorization enhancement for two-dimensional array operations - JDK-8273914: Indy string concat changes order of operations - JDK-8268081: Upgrade Unicode Data Files to 14.0.0 - JDK-8278087: Deserialization filter and filter factory property error reporting under specified - JDK-8276766: Enable jar and jmod to produce deterministic timestamped content - JDK-8274679: Remove unnecessary conversion to String in security code in java.base - JDK-8279833: Loop optimization issue in String.encodeUTF8_UTF16 - JDK-8279064: New options for ktab to provide non-default salt - JDK-8280055: JFR: Improve ObjectContext implementation - JDK-8268831: Improve javadoc tool handling of streams ## Topics of Interest: - "State of Valhalla" update https://mail.openjdk.java.net/pipermail/valhalla-spec-experts/2021-December/001747.html - Java's Plans for 2022 - Inside Java Newscast https://inside.java/2022/01/13/insidejava-newscast-018/ - New Loom Early Access builds based on JDK 19 EAb2 https://mail.openjdk.java.net/pipermail/loom-dev/2021-December/003394.html - New Panama Foreign Early-Access builds (including
[Bug 65853] [CsrfPreventionFilter] Extract evaluation of skipNonceCheck into overridable method
https://bz.apache.org/bugzilla/show_bug.cgi?id=65853 --- Comment #3 from Marvin Fröhlich --- Sorry, of course like this. String newNonce = generateNonce(req); ... -- You are receiving this mail because: You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
[Bug 65853] [CsrfPreventionFilter] Extract evaluation of skipNonceCheck into overridable method
https://bz.apache.org/bugzilla/show_bug.cgi?id=65853
--- Comment #2 from Marvin Fröhlich ---
I further suggest to either add HttpServletRequest argument to the
generateNonce() method or add another method like
getSkipNonceGeneration(HttpServletRequest request) or
getGenerateNonce(HttpServletRequest request), what ever you prefer.
Background is, that you may need to override behavior, when to actually
generate a nonce for a given request.
The call would look like this.
###
String newNonce = generateNonce();
if (newNonce != null) {
nonceCache.add(newNonce);
// Take this request's nonce and put it into the request
// attributes so pages can make direct use of it, rather than
// requiring the use of response.encodeURL.
request.setAttribute(Constants.CSRF_NONCE_REQUEST_ATTR_NAME, newNonce);
wResponse = new CsrfResponseWrapper(res, nonceRequestParameterName,
newNonce);
} else {
wResponse = response;
}
###
--
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org
