Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package tomcat for openSUSE:Factory checked in at 2026-07-28 18:06:59 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/tomcat (Old) and /work/SRC/openSUSE:Factory/.tomcat.new.2004 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "tomcat" Tue Jul 28 18:06:59 2026 rev:129 rq:1368030 version:9.0.120 Changes: -------- --- /work/SRC/openSUSE:Factory/tomcat/tomcat.changes 2026-07-07 21:08:45.425820797 +0200 +++ /work/SRC/openSUSE:Factory/.tomcat.new.2004/tomcat.changes 2026-07-28 18:08:26.494664672 +0200 @@ -1,0 +2,63 @@ +Thu Jul 23 15:21:27 UTC 2026 - mbussolotto <[email protected]> + +- Update to Tomcat 9.0.120 + * Fixed CVEs: + + CVE-2026-59084: The requirements to secuely configure the + EncryptInterceptor were not clearly documented. (bsc#1271398) + + CVE-2026-59083: Incorrect decoding of + in rewritten URIs to a single + space could allow security control bypass for some configurations. + (bsc#1271397) + * Catalina + + Fix: Avoid a race condition with concurrent lookups for a singleton JNDI + resource. (markt) + + Fix: Improve the performance of range validation for the default + servlet. (markt) + + Fix: Avoid NPE in RewriteValve. (markt) + + Fix: 70127: Fix use of Bootstrap through reflection by restoring the + public constructor. Use through scripts was not affected. (remm) + + Fix: Restore ability to extend many element classes from + AbstractAccessLogValve. (remm) + + Fix: Align DIGEST authentication with RFC 7616 and require clients to + provide a valid qop parameter. (markt) + + Fix: Use Files API to create temporary docBase when antiLockingDocBase + is enabled. (markt) + + Fix: Improve validation of configuration when DataSourceRealm starts. + (remm) + + Fix: JAASRealm should do a logout if login does not fail outright but + does not produce a Principal. (remm) + + Fix: Various edge cases for SSI substitutions, quoting and escaping. + (remm) + + Fix: unintentional conversion of literal + to a space during rule + processing in the RewriteValve. (markt) + * Coyote + + Fix: Avoid a potential JVM crash if a suitable version of Tomcat Native + is not available when the connector is explicitly configured to use + Tomcat Native with OpenSSL for TLS. (markt) + + Fix: Correct a regression introduced in 9.0.119 that broke reading of + some request bodies via a Reader. (markt) + * Jasper + + Fix: 70120: The fix for 69399 (itself a fix for a regression in the fix + for 69333) was incomplete and tags that threw exceptions in doStartTag() + and doEndTag() were incorrectly re-used. This fix prevents tags from + being re-used if such an exception occurs. (markt) + + Fix: 70135: Fix security classload regression. (remm) + + Add: support for specifying Java 28 (with the value 28) as the compiler + source and/or compiler target for JSP compilation. If used with an + Eclipse JDT compiler version that does not support these values, a + warning will be logged and the default will be used. (markt) + * WebSocket + + Fix: 70126: Fix WebSocket extension permessage-deflate so that it does + not drop bytes if a compressed message inflates to more than the + available buffer. Fix written by GPT-5.5. Test case written by Hironori + Ichimiya. (markt) + + Fix: Optimise WebSocket client processing of server responses during + WebSocket HTTP upgrade process. (markt) + * Other + + Update: Byte Buddy to 1.18.9. (markt) + + Update: UnboundID to 7.0.5. (markt) + + Update: JaCoCo to 0.8.15. (markt) + + Update: BND to 7.3.0. (markt) + + Add: Improvements to French translations. (remm) + + Add: Improvements to Japanese translations provided by tak7iji. (markt) + +------------------------------------------------------------------- Old: ---- apache-tomcat-9.0.119-src.tar.gz apache-tomcat-9.0.119-src.tar.gz.asc New: ---- apache-tomcat-9.0.120-src.tar.gz apache-tomcat-9.0.120-src.tar.gz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ tomcat.spec ++++++ --- /var/tmp/diff_new_pack.CvqTAc/_old 2026-07-28 18:08:31.454838457 +0200 +++ /var/tmp/diff_new_pack.CvqTAc/_new 2026-07-28 18:08:31.466838877 +0200 @@ -22,7 +22,7 @@ %define elspec 3.0 %define major_version 9 %define minor_version 0 -%define micro_version 119 +%define micro_version 120 %define packdname apache-tomcat-%{version}-src # FHS 2.3 compliant tree structure - http://www.pathname.com/fhs/2.3/ %global basedir /srv/%{name} ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.CvqTAc/_old 2026-07-28 18:08:31.766849388 +0200 +++ /var/tmp/diff_new_pack.CvqTAc/_new 2026-07-28 18:08:31.810850930 +0200 @@ -1,6 +1,6 @@ -mtime: 1782910289 -commit: f408b0f075b333222e7987cd44dd21dc5b5e3ed097d81e690217d2a762d45fd4 +mtime: 1784820089 +commit: c156d7fd48748b217855ea05c73cadc4e20bff89f70fc16ab39cc5c6d4d1d126 url: https://src.opensuse.org/java-packages/tomcat -revision: f408b0f075b333222e7987cd44dd21dc5b5e3ed097d81e690217d2a762d45fd4 +revision: c156d7fd48748b217855ea05c73cadc4e20bff89f70fc16ab39cc5c6d4d1d126 projectscmsync: https://src.opensuse.org/java-packages/_ObsPrj ++++++ apache-tomcat-9.0.119-src.tar.gz -> apache-tomcat-9.0.120-src.tar.gz ++++++ /work/SRC/openSUSE:Factory/tomcat/apache-tomcat-9.0.119-src.tar.gz /work/SRC/openSUSE:Factory/.tomcat.new.2004/apache-tomcat-9.0.120-src.tar.gz differ: char 13, line 1 ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-07-23 17:21:29.000000000 +0200 @@ -0,0 +1,5 @@ +.osc +*.obscpio +*.osc +_build.* +.pbuild
