Hi Mark,
Greatly appreciate the timely response and the details.

Fortunately, our applications do not utilize APR/Native, and we anticipated as 
you stated that we can drop in Tomcat 9.1, run our automation tests and provide 
a package to our customers rather quickly.

The only other problem we may have as software application vendors is the 
messaging of when Apache Tomcat 9.0.x is EOL.
Our customers, many of which are major financial institutions,  also do not 
allow software components that are announced EOL to run in their production 
environments.
So, if the last 9.0.x release is announced in March of 2027, and the Apache 
website states that 9.0.x is EOL in March of 2027, and the 9.1.x release is 
announced in April of 2027, we still have an issue with EOL software being in 
production and the security teams will also demand the application be shut 
down. 

Therefore, based on your guidance with the 9.0.x release most likely being 
announced in March of 2027, and 9.1.x being announced in April of 2027, and no 
security fixes announced for the "final" 9.0.x release until after 9.1.x is 
released, is it safe to assume that the EOL for 9.0.x would be adjusted to 
reflect a release lifecycle that does not indicate 9.0 is EOL before 9.1 is 
released?

I started in this industry back in the late 80s and I marvel at how it has 
evolved to what it is today.
There are times I yearn to go back to the simplicity of application development 
in the 90s, but I guess there were challenges back then as well.

Thank you,
Lisa

Lisa Sayre
VP R&D DDI 
  +1 (610) 822-2396
  cygnalabs.com

          
This electronic message contains information from Cygna Labs Corp., which may 
be privileged or confidential. The information is intended for use only by the 
individual(s) or entity named above. If you are not the intended recipient, 
please notify the sender immediately by e-mail and be aware that any 
disclosure, copying, distribution or use of the contents of this e-mail is 
strictly prohibited. Cygna Labs monitors its e-mail system and may record your 
e-mails. Cygna Labs Corp, 1111 Lincoln Rd., Suite 760, Miami Beach, FL 33139
 

-----Original Message-----
From: Mark Thomas <[email protected]> 
Sent: Thursday, July 16, 2026 5:45 PM
To: Tomcat Users List <[email protected]>
Subject: Re: Apache Tomcat 9.1.x release timeframe

16 Jul 2026 18:27:57 Lisa Sayre <[email protected]>:

> Hi,
> My application is currently using Apache Tomcat 9.0.120 on a RHEL 9.2.
> We plan to utilize Apache Tomcat 9.1.x once it is released.
>
> We are concerned about the timing of the 9.1.x release and if we will 
> have enough time to migrate/upgrade our application to using 9.1 
> before 9.0.x is officially EOL - which we see on Apache's website 
> states that
> 9.0 EOL is no earlier than March 31st 2027.
>
> I understand that no release date has been provided for 9.1, but can 
> you provide guidance as to how long of a window or timeline software 
> vendors like us will have to migrate our applications before 9.0 is 
> EOL?  The issue is security vulnerabilities.

12 months.

We have stated multiple times, on this mailing list, starting in March / April 
this year that the first 9.1.x release will follow the final 9.0.x release and 
that you will be able to treat it exactly like a 9.0.x to
9.0.x+1 update providing:
- you aren't using the APR connector
- if you are using Tomcat Native, you are using 2.0.x

You have from now (actually since ~April this year) to migrate off the APR 
connector if you are using APR and to Native 2.0 x if you are using Native 1.x.

The only reason there is a minor version bump is dropping APR support and 
dropping Native 1.x support.

> For example, we get notification from Apache on March 20th 2027 for a 
> 9.0.x release - which is presumably the last 9.0 release before it is 
> EOL on March 31st 2027.  We then get a notification from Apache on 
> March 27th for the 9.1.x release.  This gives us three days to 
> migrate, test, and deliver our software to our customer base, and it 
> gives them very little time to upgrade so that they are covered in 
> terms of security vulnerabilities.  Our customer's security teams are 
> stating that at midnight, March 31st, if Apache Tomcat is not upgraded 
> to 9.1, then the company will have to shut the application/system down 
> to avoid being vulnerable.

Then those security teams need to rethink their plans based on what is actually 
happening rather than their misunderstanding of what is happening.

All they need to do is treat it like just another point release. There won't be 
any security vulnerabilities announced for the final 9.0.x release until the 
first 9.1.x release is available with fixes for those issues (unless the issue 
is in APR or Native 1.3.x in which case it won't get fixed).

Better yet, tell them to buy some tickets to CoC Glasgow and they can listen to 
me talking about the migration process and, if they still have questions, I can 
answer them in person.

> Any guidance on how much time will be given from the time Tomcat 9.1 
> is released to the time 9.0 is EOL would be appreciated.
> Thank you,
> Lisa Sayre

I expect that last 9.0.x release will be in March 2027 and the first 9.1.x 
release will be in April 2027.

Mark

---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to