Hi folks, +1 (non-binding)
Verified sha256/sh512 hashes and signatures: => VALID I've tested on three applications: JAX-WS, JAX-RS, JPA, CDI, Servlets, and EARs. From what I can tell: everything looks fine. Java version: 25.0.5, vendor: Eclipse Adoptium, runtime: /Library/Java/JavaVirtualMachines/temurin-25.0.5.jdk/Contents/Home Default locale: de_DE, platform encoding: UTF-8 OS name: "mac os x", version: "27.2", arch: "aarch64", family: "mac" In addition, I ran (runtime) checks on a Linux/Ubuntu env. Thanks to all contributors and for prepping this release candidate. Gruß Martin > Am 04.11.2026 um 21:43 schrieb Richard Zowalla via dev <[email protected]>: > > +1 (binding), with one remark. > > Checked: sha256/sha512, SHA3-256 against the ATR manifest, GPG signatures > against KEYS (8D339D37), ATR/dist.dev/Nexus staging artifacts identical, git > tag 72f98dd2, LICENSE/NOTICE, zip == tar.gz, plus distribution starts/stops > cleanly on Java 25. > > Remark: the source release still contains > examples/jpa-hibernate-arquillian/temp/hibernate-core-jakarta-5.6.8.Final.jar > (LGPL, unreferenced). Mark removed it on main in 025ea74a99 but the removal > was not backported to tomee-10.x, so it has shipped in every 10.x source > release. Please cherry-pick that commit to tomee-10.x; if we don't re-roll, > it must be gone for 10.3.1. > > Non-blocking: 10.3.0-SNAPSHOT leftovers in tomee-deb and ~20 example poms. > > Thanks > Richard > >> Am 04.11.2026 um 13:51 schrieb jungm.apache.org via dev >> <[email protected]>: >> >> Hello TomEE, >> >> I'd like to call a vote on releasing the following artifacts as >> Apache TomEE 10.3.0. This vote is being conducted using a >> Beta version of the Apache Trusted Releases (ATR) platform. >> Please report any bugs or issues to the ASF Tooling team. >> >> The page of the release candidate from ATR revision 00002, >> which includes downloads, can be found at: >> >> https://releases.apache.org/vote/tomee/10.3.0 >> >> The file manifest for ATR revision 00002, including file digests, >> can be found at: >> >> https://releases.apache.org/manifest/tomee/10.3.0/00002 >> >> The release artifacts are signed with one or more OpenPGP keys from: >> >> https://downloads.apache.org/tomee/KEYS >> >> Please review the release candidate and vote accordingly. >> >> The artifacts are also available traditionally via dist: >> https://dist.apache.org/repos/dist/dev/tomee/staging-1255/tomee-10.3.0/ >> Git tag: https://github.com/apache/tomee/tree/tomee-project-10.3.0 >> (72f98dd23572a5064e238fc31bf6c9c7aa45eb73) >> Maven staging repo: >> https://repository.apache.org/content/repositories/orgapachetomee-1255/ >> >> Jira changelog: >> >> Bug >> [TOMEE-2044] - threadPool-queue (in ServicePool) from ejbd-Service is >> never processed >> [TOMEE-3726] - Queue is visible in JNDI Tree (java://id-resource) >> [TOMEE-4011] - Multi-threaded Deployment of multiple war-files runs in >> TomEERuntimeException >> [TOMEE-4029] - Use of JWKS forces kid to be present in JWTs >> [TOMEE-4240] - The implementation for mail.mime.parameters.strict >> parameter is missing in jakarta\mail\internet\ParameterList.java class of >> geronimo-mail_2.1_spec-1.0.0-M1.jar in TomEE 9.1.0 >> [TOMEE-4438] - Disable releases for apache-snapshot repo >> [TOMEE-4547] - MultipartMessage not build correctly with Jakarta.mail / >> Interferes with Geronimo-mail >> [TOMEE-4682] - SecurityContext.authenticate() does not persist the session >> (bypasses HttpServletRequest.authenticate()) >> [TOMEE-4699] - ThreadContext constructor is not thread-safe, causing loss >> of submitted tasks. >> [TOMEE-4703] - ApplicationThreadContextProvider stores a live >> ThreadContext reference instead of an immutable snapshot >> [TOMEE-4704] - CUTask.invoke() does not safely propagate errors to >> ManagedTask >> [TOMEE-4712] - MDB endpoints are activated before the application's other >> EJBs are started >> [TOMEE-4714] - TomEEEmbeddedExtension (JUnit 5) can not start the >> container again after it was closed >> [TOMEE-4715] - TomEE embedded application runner does not inject @Resource >> into the @Application descriptor >> [TOMEE-4716] - MicroProfile Health endpoints are not deployed when the >> webapp declares a JAX-RS Application subclass >> [TOMEE-4729] - MP-JWT security state is not restored for asynchronous >> requests >> [TOMEE-4730] - MP-JWT ignores class-level security annotations of a >> resource superclass >> [TOMEE-4731] - TxThreadContextRestorer fails with NPE when managed threads >> end after the container shut down >> >> Improvement >> [TOMEE-1619] - Add exception message to Alerts >> [TOMEE-4679] - Prepare for next development iteration (10.3.x) >> [TOMEE-4709] - Track git revision in version info >> [TOMEE-4710] - Don't patch catalina.jar just to print TomEE Version >> >> Task >> [TOMEE-4700] - Drop openejb-hessian >> [TOMEE-4701] - Drop openejb-ssh >> [TOMEE-4702] - Drop openejb-common-cli >> [TOMEE-4705] - Migrate the Maven plugins off the Maven 2 API >> [TOMEE-4706] - Migrate the Gradle plugin to a current Gradle version >> [TOMEE-4707] - Drop the standalone HTTP server from openejb-http >> [TOMEE-4733] - Pin Surefire to 3.5.x in TCK modules >> >> Dependency upgrade >> [TOMEE-4663] - Geronimo Mail 1.1.1 >> [TOMEE-4664] - Apache Neethi 3.2.3 >> [TOMEE-4666] - Mojarra 4.0.20 >> [TOMEE-4668] - SmallRye Config 3.18.1 >> [TOMEE-4669] - commons-codec 1.23.0 >> [TOMEE-4671] - Apache ActiveMQ 6.2.8 >> [TOMEE-4672] - Bouncycastle 1.86 >> [TOMEE-4676] - CXF 4.1.9 >> [TOMEE-4677] - Tomcat 10.1.61 >> [TOMEE-4678] - Upgrade micrometer-core jar >> [TOMEE-4680] - Apache CXF - CVE-2026-54225 in TomEE 10.2.0 >> [TOMEE-4683] - Jackson 2.22.2 >> [TOMEE-4684] - Johnzon 2.2.0 >> [TOMEE-4685] - JUnit 6.1.3 >> [TOMEE-4686] - SmallRye Config 3.18.2 >> [TOMEE-4687] - actions/setup-java 6.0.0 >> [TOMEE-4694] - Apache ActiveMQ 6.2.10 >> [TOMEE-4695] - Mojarra 4.0.28 >> [TOMEE-4696] - Hibernate ORM 6.6.56.Final >> [TOMEE-4697] - XBean 5.0.0 >> [TOMEE-4698] - Plexus Archiver 4.14.0 >> [TOMEE-4718] - MyFaces 4.0.4 >> [TOMEE-4719] - Jose4j 0.9.7 >> [TOMEE-4720] - Snakeyaml 2.7 >> [TOMEE-4721] - Apache ActiveMQ 6.3.3 >> [TOMEE-4722] - SLF4J 2.0.20 >> [TOMEE-4723] - Jackson 2.22.4 >> [TOMEE-4724] - Apache Neethi 3.2.4 >> [TOMEE-4725] - WSS4J 4.0.2 >> [TOMEE-4726] - commons-lang3 3.21.0 >> >> Documentation >> [TOMEE-4673] - Remove "About the 'tomee' webapp" since Tomee drop-in >> webapp was removed in TOMEE-3724 >> >> >> [ ] +1 Release this package >> [ ] +0 Abstain >> [ ] -1 Do not release this package (please provide specific comments) >> >> You can vote on ATR at the URL above, or manually by replying to this email. >> >> The vote is open for 72 hours. >> >> >> Thanks, >> Markus Jung (jungm) >> >> This email was sent by [email protected] on the Apache Trusted Releases >> platform >
