Hi Mark, Greatly appreciate the timely response and the details. Fortunately, our applications do not utilize APR/Native, and we anticipated as you stated that we can drop in Tomcat 9.1, run our automation tests and provide a package to our customers rather quickly.
The only other problem we may have as software application vendors is the messaging of when Apache Tomcat 9.0.x is EOL. Our customers, many of which are major financial institutions, also do not allow software components that are announced EOL to run in their production environments. So, if the last 9.0.x release is announced in March of 2027, and the Apache website states that 9.0.x is EOL in March of 2027, and the 9.1.x release is announced in April of 2027, we still have an issue with EOL software being in production and the security teams will also demand the application be shut down. Therefore, based on your guidance with the 9.0.x release most likely being announced in March of 2027, and 9.1.x being announced in April of 2027, and no security fixes announced for the "final" 9.0.x release until after 9.1.x is released, is it safe to assume that the EOL for 9.0.x would be adjusted to reflect a release lifecycle that does not indicate 9.0 is EOL before 9.1 is released? I started in this industry back in the late 80s and I marvel at how it has evolved to what it is today. There are times I yearn to go back to the simplicity of application development in the 90s, but I guess there were challenges back then as well. Thank you, Lisa Lisa Sayre VP R&D DDI +1 (610) 822-2396 cygnalabs.com This electronic message contains information from Cygna Labs Corp., which may be privileged or confidential. The information is intended for use only by the individual(s) or entity named above. If you are not the intended recipient, please notify the sender immediately by e-mail and be aware that any disclosure, copying, distribution or use of the contents of this e-mail is strictly prohibited. Cygna Labs monitors its e-mail system and may record your e-mails. Cygna Labs Corp, 1111 Lincoln Rd., Suite 760, Miami Beach, FL 33139 -----Original Message----- From: Mark Thomas <[email protected]> Sent: Thursday, July 16, 2026 5:45 PM To: Tomcat Users List <[email protected]> Subject: Re: Apache Tomcat 9.1.x release timeframe 16 Jul 2026 18:27:57 Lisa Sayre <[email protected]>: > Hi, > My application is currently using Apache Tomcat 9.0.120 on a RHEL 9.2. > We plan to utilize Apache Tomcat 9.1.x once it is released. > > We are concerned about the timing of the 9.1.x release and if we will > have enough time to migrate/upgrade our application to using 9.1 > before 9.0.x is officially EOL - which we see on Apache's website > states that > 9.0 EOL is no earlier than March 31st 2027. > > I understand that no release date has been provided for 9.1, but can > you provide guidance as to how long of a window or timeline software > vendors like us will have to migrate our applications before 9.0 is > EOL? The issue is security vulnerabilities. 12 months. We have stated multiple times, on this mailing list, starting in March / April this year that the first 9.1.x release will follow the final 9.0.x release and that you will be able to treat it exactly like a 9.0.x to 9.0.x+1 update providing: - you aren't using the APR connector - if you are using Tomcat Native, you are using 2.0.x You have from now (actually since ~April this year) to migrate off the APR connector if you are using APR and to Native 2.0 x if you are using Native 1.x. The only reason there is a minor version bump is dropping APR support and dropping Native 1.x support. > For example, we get notification from Apache on March 20th 2027 for a > 9.0.x release - which is presumably the last 9.0 release before it is > EOL on March 31st 2027. We then get a notification from Apache on > March 27th for the 9.1.x release. This gives us three days to > migrate, test, and deliver our software to our customer base, and it > gives them very little time to upgrade so that they are covered in > terms of security vulnerabilities. Our customer's security teams are > stating that at midnight, March 31st, if Apache Tomcat is not upgraded > to 9.1, then the company will have to shut the application/system down > to avoid being vulnerable. Then those security teams need to rethink their plans based on what is actually happening rather than their misunderstanding of what is happening. All they need to do is treat it like just another point release. There won't be any security vulnerabilities announced for the final 9.0.x release until the first 9.1.x release is available with fixes for those issues (unless the issue is in APR or Native 1.3.x in which case it won't get fixed). Better yet, tell them to buy some tickets to CoC Glasgow and they can listen to me talking about the migration process and, if they still have questions, I can answer them in person. > Any guidance on how much time will be given from the time Tomcat 9.1 > is released to the time 9.0 is EOL would be appreciated. > Thank you, > Lisa Sayre I expect that last 9.0.x release will be in March 2027 and the first 9.1.x release will be in April 2027. Mark --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
