Rainer,
On 11/11/26 12:53 PM, Rainer Jung wrote:
Am 09.11.26 um 20:51 schrieb Mark Thomas via dev:
The proposed Apache Tomcat 11.0.29 release is now available for voting.
(The 11.0.28 VOTE was cancelled)
The notable changes compared to 11.0.27 include:
- Large number of bugfixes to jdbc-pool
- The JAAS realm is now deprecated and will be removed in Tomcat 12
- Deprecate the EncryptInterceptor and replace it with TLS-PSK support
to encrypt cluster traffic
For full details, see the change log:
https://nightlies.apache.org/tomcat/tomcat-11.0.x/docs/changelog.html
Applications that run on Tomcat 9 and earlier will not run on Tomcat
11 without changes. Java EE applications designed for Tomcat 9 and
earlier may be placed in the $CATALINA_BASE/webapps-javaee directory
and Tomcat will automatically convert them to Jakarta EE and copy them
to the webapps directory. Applications using deprecated APIs may
require further changes.
It can be obtained from:
https://dist.apache.org/repos/dist/dev/tomcat/tomcat-11/v11.0.29/
The Maven staging repo is:
https://repository.apache.org/content/repositories/orgapachetomcat-1612
The tag is:
https://github.com/apache/tomcat/tree/11.0.29
0b6efc14f491edfd9d648d010cd5e9407edf276d
The proposed 11.0.29 release is:
[ ] -1 Broken - do not release
[ ] +1 Stable - go ahead and release as 11.0.29
+1 to release.
Reproducibility of the build checked (including the Windows installer)
using "ant verify-release" on Linux Mint 22.3. OK after setting LANG.
Original Windows installer signature verified with osslsigncode 2.15.
Unit tests ran on platforms
- RHEL 8, 9 and 10 and SLES 15
using
- recent patch versions of JDK 17, 21, 25, 27 and 28 (EA)
from
- Eclipse Adoptium, Azul Zulu, Amazon Coretto, Oracle, RedHat (27
missing) and from OpenJDK for 28
Also tested with
- tcnative 2.0.17 and panama
based on
- OpenSSL 3.5.9, 3.6.5, 4.0.3 and 4.1.0.
Each combination of platform, JVM and JSSE or tcnative or panama only
tested for NIO or NIO2 (randomized). Total number of test combinations:
45 nio2 jsse
86 nio2 panama
149 nio2 tcnative
32 nio jsse
70 nio panama
159 nio tcnative
Test observations:
- IMHO nothing critical
- a few test failures
- very few crashes with tcnative (4 in 308 runs)
Could you post these details? In security@ if you think they are
security-adjacent.
- no crash failures with panama (156 runs)
(!!)
- one non-crash failures with jsse (1 in 77 runs)
- no non-crash failures with tcnative (308 runs)
- no non-crash failures with panama (156 runs)
Do you have past stats stored anywhere for previous votes? I'm curious
to see if things are "getting better" with each release and if so, by
how much. (I know I can read the ML or get an AI to do it -- and hope
for the best -- but maybe you have these data squirreled away somewhere
more easily analyzable.)
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
