Changelog

Tomcat 10.1.0-M1 (markt)

General

  • Code: This release contains all of the changes up to and including those in Apache Tomcat 10.0.6 plus the additional changes listed below. (markt)
  • Code: Remove code previously marked for removal in Tomcat 10.1.x. (markt)

Catalina

  • Code: Incremented the supported Jakarta Servlet version to 5.1 to align with the current development branch of the Jakarta Servlet specification. (markt)
  • Fix: 65301: RemoteIpValve will now avoid getting the local host name when it is not needed. (remm)
  • Fix: 65308: NPE in JNDIRealm when no userRoleAttribute is given. (fschumacher)
  • Add: #412: Add commented out, sample users for the Tomcat Manager app to the default tomcat-users.xml file. Based on a PR by Arnaud Dagnelies. (markt)
  • Add: #418: Add a new option, pass-through, to the default servlet's useBomIfPresent initialization parameter that causes the default servlet to leave any BOM in place when processing a static file and not to use the BOM to determine the encoding of the file. Based on a pull request by Jean-Louis Monteiro. (markt)
  • Fix: #419: When processing POST requests of type multipart/form-data for parts without a filename that are added to the parameter map in String form, check the size of the part before attempting conversion to String. Pull request provided by tianshuang. (markt)
  • Add: Implement the new Cookie methods setAttribute(), getAttribute() and getAttributes() introduced in Servlet 5.1. (markt)
  • Fix: AprLifecycleListener does not show dev version suffix for libtcnative and libapr. (michaelo)
  • Update: Refactor principal handling in UserDatabaseRealm using an inner class that extends GenericPrincipal. (remm)
  • Fix: Enable the default doHead()) implementation in HttpServlet to correctly handle responses where the content length needs to be represented as a long since it is larger than the maximum value that can be represented by an int. (markt)
  • Fix: Avoid synchronization on roles verification for the memory UserDatabase. (remm)
  • Fix: Fix the default doHead()) implementation in HttpServlet to correctly handle responses where the Servlet calls ServletResponse.reset() and/or ServletResponse.resetBuffer(). (markt)
  • Fix: Fix the default doHead()) implementation in HttpServlet to correctly handle responses generated using the Servlet non-blocking API. (markt)

Coyote

  • Fix: 65303: Fix a possible NullPointerException if an error occurs on an HTTP/1.1 connection being upgraded to HTTP/2 or on a pushed HTTP/2 stream. (markt)
  • Update: Simplify AprEndpoint socket bind for all platforms. (michaelo)
  • Fix: 65340: Add missing check for a negative return value for Hpack.decodeInteger in the HpackDecoder, which could cause a NegativeArraySizeException exception. Submitted by Thomas, and verified the fix is present in the donated hpack code in a further update. (remm)
  • Add: Add debug logging for HTTP/2 HPACK header decoding. (markt)
  • Fix: Correct parsing of HTTP headers consisting of a list of tokens so that a header with an empty token is treated consistently regardless of whether the empty token is at the start, middle or end of the list of tokens. (markt)
  • Fix: Remove support for the identity transfer encoding. The inclusion of this encoding in RFC 2616 was an error that was corrected in 2001. Requests using this transfer encoding will now receive a 501 response. (markt)
  • Fix: Process transfer encoding headers from both HTTP 1.0 and HTTP 1.1 clients. (markt)
  • Fix: Ensure that if the transfer encoding header contains the chunked, that the chunked encoding is the final encoding listed. (markt)

Jasper

  • Code: Incremented the supported Jakarta Expression Language version to 5.0 to align with the current development branch of the Jakarta Expression Language specification. (markt)
  • Code: Review code used to generate Java source from JSPs and tags and remove code found to be unnecessary. (markt)
  • Code: Refactor use of internal ChildInfo class to use compile time type checking rather than run time type checking. (markt)
  • Fix: 65124: Partial fix. When generating Java source code to call a tag handler, only define the local variable JspWriter out when it is going to be used. (markt)
  • Code: Add generics to the EL 5.0 API to align with the current EL 5.0 development branch. (markt)
  • Update: Update the web-fragment.xml included in jasper.jar and jasper-el.jar to use the Servlet 5.0 schema. (markt)
  • Fix: Update JspC to generate web.xml and web-fragment.xml files using Servlet 5.0 schemas. (markt)
  • Code: Remove the deprecated method MethodExpression.getParmetersProvided() from the EL API to align with the current EL 5.0 development branch. (markt)
  • Fix: 65358: Improve expression language method matching for methods with varargs. Where multiple methods may match the provided parameters, the method that requires the fewest varargs is preferred. (markt)
  • Add: 65332: Add a commented out section in catalina.policy that provides the necessary permissions to compile JSPs with javac when running on Java 9 onwards with a security manager. It is commented out as it will cause errors if used with earlier Java versions. (markt)

WebSocket

  • Fix: 65317: When using permessage-deflate, the WebSocket connection was incorrectly closed if the uncompressed payload size was an exact multiple of 8192. Based on a patch provided by Saksham Verma. (markt)
  • Update: Update the web-fragment.xml included in tomcat-websocket.jarto use the Servlet 5.0 schema. (markt)
  • Fix: 65342: Correct a regression introduced with the fix for 65262 that meant Tomcat's WebSocket implementation would only work with Tomcat's implementation of the Jakarta WebSocket API. (markt)

Web applications

  • Fix: Improve the description of the maxConnections and acceptCount attributes in the Connector section of the documentation web application. (markt)

Other

  • Add: Improvements to French translations. (remm)
  • Add: Improvements to Korean translations. (woonsan)
  • Fix: 65362: Correct a regression in the previous release. The change to create OSGi Require-Capability sections in manifests for Jakarta API JARs manually rather bnd annotations did not add the necessary manual entries to the embedded JARs. (markt)
  • Update: Update the packaged version of the Tomcat Native Library to 1.2.30. Also update the minimum recommended version to 1.2.30. (markt)