Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package tomcat10 for openSUSE:Factory checked in at 2026-07-28 18:07:06 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/tomcat10 (Old) and /work/SRC/openSUSE:Factory/.tomcat10.new.2004 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "tomcat10" Tue Jul 28 18:07:06 2026 rev:32 rq:1368031 version:10.1.57 Changes: -------- --- /work/SRC/openSUSE:Factory/tomcat10/tomcat10.changes 2026-07-07 21:08:40.405647293 +0200 +++ /work/SRC/openSUSE:Factory/.tomcat10.new.2004/tomcat10.changes 2026-07-28 18:08:46.131352665 +0200 @@ -1,0 +2,61 @@ +Thu Jul 23 15:22:44 UTC 2026 - mbussolotto <[email protected]> + +- Update to Tomcat 10.1.57 + * Fixed CVEs: + + CVE-2026-59084: The requirements to secuely configure the + EncryptInterceptor were not clearly documented. (bsc#1271398) + + CVE-2026-59083: Incorrect decoding of + in rewritten URIs to a single + space could allow security control bypass for some configurations. + (bsc#1271397) + * Catalina + + Fix: Avoid a race condition with concurrent lookups for a singleton JNDI + resource. (markt) + + Fix: Improve the performance of range validation for the default + servlet. (markt) + + Fix: Avoid NPE in RewriteValve. (markt) + + Fix: 70127: Fix use of Bootstrap through reflection by restoring the + public constructor. Use through scripts was not affected. (remm) + + Fix: Restore ability to extend many element classes from + AbstractAccessLogValve. (remm) + + Fix: Align DIGEST authentication with RFC 7616 and require clients to + provide a valid qop parameter. (markt) + + Fix: Use Files API to create temporary docBase when antiLockingDocBase + is enabled. (markt) + + Fix: Improve validation of configuration when DataSourceRealm starts. + (remm) + + Fix: JAASRealm should do a logout if login does not fail outright but + does not produce a Principal. (remm) + + Fix: Various edge cases for SSI substitutions, quoting and escaping. + (remm) + + Fix: unintentional conversion of literal + to a space during rule + processing in the RewriteValve. (markt) + * Coyote + + Fix: Avoid a potential JVM crash if a suitable version of Tomcat Native + is not available when the connector is explicitly configured to use + Tomcat Native with OpenSSL for TLS. (markt) + * Jasper + + Fix: 70120: The fix for 69399 (itself a fix for a regression in the fix + for 69333) was incomplete and tags that threw exceptions in doStartTag() + and doEndTag() were incorrectly re-used. This fix prevents tags from + being re-used if such an exception occurs. (markt) + + Fix: 70135: Fix security classload regression. (remm) + + Add: support for specifying Java 28 (with the value 28) as the compiler + source and/or compiler target for JSP compilation. If used with an + Eclipse JDT compiler version that does not support these values, a + warning will be logged and the default will be used. (markt) + * WebSocket + + Fix: 70126: Fix WebSocket extension permessage-deflate so that it does + not drop bytes if a compressed message inflates to more than the + available buffer. Fix written by GPT-5.5. Test case written by Hironori + Ichimiya. (markt) + + Fix: Optimise WebSocket client processing of server responses during + WebSocket HTTP upgrade process. (markt) + * Other + + Update: Byte Buddy to 1.18.9. (markt) + + Update: UnboundID to 7.0.5. (markt) + + Update: JaCoCo to 0.8.15. (markt) + + Update: BND to 7.3.0. (markt) + + Add: Improvements to French translations. (remm) + + Add: Improvements to Japanese translations provided by tak7iji. (markt) + +------------------------------------------------------------------- Old: ---- apache-tomcat-10.1.56-src.tar.gz apache-tomcat-10.1.56-src.tar.gz.asc New: ---- apache-tomcat-10.1.57-src.tar.gz apache-tomcat-10.1.57-src.tar.gz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ tomcat10.spec ++++++ --- /var/tmp/diff_new_pack.tcW4qy/_old 2026-07-28 18:08:48.207425403 +0200 +++ /var/tmp/diff_new_pack.tcW4qy/_new 2026-07-28 18:08:48.211425542 +0200 @@ -29,7 +29,7 @@ %define elspec %{elspec_major}.%{elspec_minor} %define major_version 10 %define minor_version 1 -%define micro_version 56 +%define micro_version 57 %define java_major 1 %define java_minor 11 %define java_version %{java_major}.%{java_minor} ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.tcW4qy/_old 2026-07-28 18:08:48.263427364 +0200 +++ /var/tmp/diff_new_pack.tcW4qy/_new 2026-07-28 18:08:48.267427504 +0200 @@ -1,6 +1,6 @@ -mtime: 1782910201 -commit: 0cf27d690d75706a75f4fa8214983fa5f5ab81054b50eb585156aa95b11203bc +mtime: 1784820165 +commit: d2e35f877d02e7e44b8be7e6095a9a14d4867923cec2fd0b6ce8c16dd4b08fb7 url: https://src.opensuse.org/java-packages/tomcat10 -revision: 0cf27d690d75706a75f4fa8214983fa5f5ab81054b50eb585156aa95b11203bc +revision: d2e35f877d02e7e44b8be7e6095a9a14d4867923cec2fd0b6ce8c16dd4b08fb7 projectscmsync: https://src.opensuse.org/java-packages/_ObsPrj ++++++ apache-tomcat-10.1.56-src.tar.gz -> apache-tomcat-10.1.57-src.tar.gz ++++++ /work/SRC/openSUSE:Factory/tomcat10/apache-tomcat-10.1.56-src.tar.gz /work/SRC/openSUSE:Factory/.tomcat10.new.2004/apache-tomcat-10.1.57-src.tar.gz differ: char 13, line 1 ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-07-23 17:22:45.000000000 +0200 @@ -0,0 +1 @@ +.osc
