This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit be0ae002152a0299c5acf5b3cf7d1e2acea4320c Author: opencode <[email protected]> AuthorDate: Sun Oct 18 13:00:33 2026 +0200 Pin serialVersionUID in EL expression classes MethodExpressionImpl, ValueExpressionImpl and MethodExpressionLiteral are Externalizable classes that, per the jakarta.el Expression contract, are intended to be serialized to preserve expression state across the application lifetime. Unlike their sibling classes (ValueExpressionLiteral, FunctionMapperImpl, VariableMapperImpl, all of which are reachable in the same serialized streams and all of which have long pinned a serialVersionUID), these three relied on the JVM-computed default UID, which changes whenever the class structure changes, making cross-version deserialization fragile. Add @Serial private static final long serialVersionUID = 1L to each class, aligning them with the existing package convention. Verified that same-version serialization round-trips of all four expression classes continue to work and that the EL testsuite passes unchanged. --- java/org/apache/el/MethodExpressionImpl.java | 4 ++++ java/org/apache/el/MethodExpressionLiteral.java | 4 ++++ java/org/apache/el/ValueExpressionImpl.java | 4 ++++ 3 files changed, 12 insertions(+) diff --git a/java/org/apache/el/MethodExpressionImpl.java b/java/org/apache/el/MethodExpressionImpl.java index 83a0a9ae68..3571e162c8 100644 --- a/java/org/apache/el/MethodExpressionImpl.java +++ b/java/org/apache/el/MethodExpressionImpl.java @@ -20,6 +20,7 @@ import java.io.Externalizable; import java.io.IOException; import java.io.ObjectInput; import java.io.ObjectOutput; +import java.io.Serial; import javax.el.ELContext; import javax.el.ELException; @@ -66,6 +67,9 @@ import org.apache.el.util.ReflectionUtil; */ public final class MethodExpressionImpl extends MethodExpression implements Externalizable { + @Serial + private static final long serialVersionUID = 1L; + private Class<?> expectedType; private String expr; diff --git a/java/org/apache/el/MethodExpressionLiteral.java b/java/org/apache/el/MethodExpressionLiteral.java index 497ab083dd..540ac1ee97 100644 --- a/java/org/apache/el/MethodExpressionLiteral.java +++ b/java/org/apache/el/MethodExpressionLiteral.java @@ -20,6 +20,7 @@ import java.io.Externalizable; import java.io.IOException; import java.io.ObjectInput; import java.io.ObjectOutput; +import java.io.Serial; import javax.el.ELContext; import javax.el.ELException; @@ -34,6 +35,9 @@ import org.apache.el.util.ReflectionUtil; */ public class MethodExpressionLiteral extends MethodExpression implements Externalizable { + @Serial + private static final long serialVersionUID = 1L; + private Class<?> expectedType; private String expr; diff --git a/java/org/apache/el/ValueExpressionImpl.java b/java/org/apache/el/ValueExpressionImpl.java index a0c289212b..708681370a 100644 --- a/java/org/apache/el/ValueExpressionImpl.java +++ b/java/org/apache/el/ValueExpressionImpl.java @@ -20,6 +20,7 @@ import java.io.Externalizable; import java.io.IOException; import java.io.ObjectInput; import java.io.ObjectOutput; +import java.io.Serial; import javax.el.ELContext; import javax.el.ELException; @@ -74,6 +75,9 @@ import org.apache.el.util.ReflectionUtil; */ public final class ValueExpressionImpl extends ValueExpression implements Externalizable { + @Serial + private static final long serialVersionUID = 1L; + private Class<?> expectedType; private String expr; --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
