Catalina
55559: Add a new attribute,
localJndiResource
, that allows a UserDatabaseRealm to obtain a UserDatabase instance from the local (web application) JNDI context rather than the global JNDI context. This option is only useful when the Realm is defined on the Context. (markt)64805: Correct imports used by
JMXProxyServlet
. (markt)Fix JNDIRealm pooling problems retrying on another bad connection. Any retries are made on a new connection, just like with the single connection scenario. Also remove all connections from the pool after an error. (remm)
Remove the entry for
org.apache.tomcat.util.descriptor.tld.LocalStrings
from tomcat-embed-core's GraalVM tomcat-resource.json. It no more part of the jar since Fix unwanted JPMS dependency of embed-core on embed-jasper. (mgrigorov)Add
org.apache.coyote.http11.Http11Nio2Protocol
to the list of classes which could be instantiated via reflection in GraalVM. (mgrigorov)Add
JsonErrorReportValve
that extends theErrorReportValve
that returns response as JSON instead of HTML. (kfujino)Add GraalVM config for Tomcat JNI related classes. This makes it possible to use the APR protocol in GraalVM native images. To use it add the following to the native-image arguments:
-H:JNIConfigurationResources=META-INF/native-image/org.apache.tomcat.embed/tomcat-embed-core/tomcat-jni.json
(mgrigorov)JNDIRealm connections should only be created with the container classloader as the thread context classloader, just like for the JAAS realm. (remm)
64871: Log a warning if Tomcat blocks access to a file because it uses symlinks. (markt)
Rename
JDBCStore
toDataSourceStore
and remove bottlenecks for database backed session store. Legacy JDBC driver configuration is no longer supported. Patch submitted by Philippe Mouawad. (remm)
Coyote
Refactor the HTTP/2 window update handling for padding in data frames to ensure that the connection window is correctly updated after a data frame with zero length padding is received. (markt)
Fix processing of URIs with %nn encoded solidus characters when
encodedSolidusHandling
was set topassthrough
and the encoded solidus was preceeded by other %nn encoded characters. Based on a pull request by willmeck. (markt)63362: Add collection of statistics for HTTP/2, WebSocket and connections upgraded via the HTTP upgrade mechanism. (markt)
Restore exception catch around Poller.events, as it would cause the NIO poller thread to exit. This is a regression caused when the Poller.events method was refactored. (remm)
Provide messages for some
SocketTimeoutException
instances that did not have one. (markt)Avoid most of the thread pool use during NIO2 socket accept. Patch submitted by Anil Gursel. (remm)
Add additional debug logging for I/O issues when communicating with the user agent. (markt)
64830: Fix concurrency issue in HPACK decoder. (markt)
Fix a concurrency issue in the NIO connector that could cause newly created connections to be removed from the poller. (markt)
Jasper
64784: Don't include the time the Java file was generated as a comment when generating Java files for JSPs and/or tags if the Java file was created during pre-compilation. This is to aid repeatable builds. (markt)
64794: Security exception reading system property on JspRuntimeLibrary use. (remm)
Add support for specifying Java 16 (with the value
16
) as the compiler source and/or compiler target for JSP compilation. If used with an ECJ version that does not support these values, a warning will be logged and the latest supported version will used. (markt)Update to the Eclipse JDT compiler 4.17. (markt)
64849: Correct JPMS metadata for the Jakarta Expression Langauge JARs to provide missing ServiceLoader information. (markt)
WebSocket
-
64848: Fix a variation of this memory leak when a write I/O
error occurs on a non-container thread. (markt)
Web applications
64799: Added missing resources to host-manager web app. (isapir)
64797: Align manager.xml template file in Host-Manager with context.xml of real Manager web application. (isapir)
Configure the examples web applications to set
SameSite=strict
for all cookies, including session cookies, created by the application. (markt)Configure the examples, Manager and Host Manager to use the HTTP header security filter with default settings apart from no HSTS header. Based on a suggestion by Debangshu Kundu. (markt)